chef 18.7.10 → 18.8.46

data/spec/integration/client/exit_code_spec.rb

@@ -1,116 +0,0 @@
-
-require "spec_helper"
-require "support/shared/integration/integration_helper"
-require "chef/mixin/shell_out"
-require "tiny_server"
-require "tmpdir"
-require "chef/platform"
-require "chef-utils/dist"
-
-describe "chef-client" do
-
-  include IntegrationSupport
-  include Chef::Mixin::ShellOut
-
-  let(:chef_dir) { File.join(__dir__, "..", "..", "..") }
-
-  # Invoke `chef-client` as `ruby PATH/TO/chef-client`. This ensures the
-  # following constraints are satisfied:
-  # * Windows: windows can only run batch scripts as bare executables. Rubygems
-  # creates batch wrappers for installed gems, but we don't have batch wrappers
-  # in the source tree.
-  # * Other `chef-client` in PATH: A common case is running the tests on a
-  # machine that has omnibus chef installed. In that case we need to ensure
-  # we're running `chef-client` from the source tree and not the external one.
-  # cf. CHEF-4914
-  let(:chef_client) { "bundle exec #{ChefUtils::Dist::Infra::CLIENT} --no-fork --minimal-ohai --always-dump-stacktrace" }
-
-  let(:critical_env_vars) { %w{PATH RUBYOPT BUNDLE_GEMFILE GEM_PATH}.map { |o| "#{o}=#{ENV[o]}" } .join(" ") }
-
-  when_the_repository "uses RFC 062 defined exit codes" do
-
-    def setup_client_rb
-      file "config/client.rb", <<~EOM
-        local_mode true
-        cookbook_path "#{path_to("cookbooks")}"
-      EOM
-    end
-
-    def run_chef_client_and_expect_exit_code(exit_code)
-      shell_out!("#{chef_client} -c \"#{path_to("config/client.rb")}\" -o 'x::default'",
-        cwd: chef_dir,
-        returns: [exit_code])
-    end
-
-    context "has a cookbook" do
-      context "with a library" do
-        context "which cannot be loaded" do
-          before do
-            file "cookbooks/x/recipes/default.rb", ""
-            file "cookbooks/x/libraries/error.rb", "require 'does/not/exist'"
-          end
-
-          it "exits with GENERIC_FAILURE, 1" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 1
-          end
-        end
-      end
-
-      context "with a recipe" do
-        context "which throws an error" do
-          before { file "cookbooks/x/recipes/default.rb", "raise 'BOOM'" }
-
-          it "exits with GENERIC_FAILURE, 1" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 1
-          end
-        end
-
-        context "with a recipe which calls Chef::Application.fatal with a non-RFC exit code" do
-          before { file "cookbooks/x/recipes/default.rb", "Chef::Application.fatal!('BOOM', 123)" }
-
-          it "exits with the GENERIC_FAILURE exit code, 1" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 1
-          end
-        end
-
-        context "with a recipe which calls Chef::Application.exit with a non-RFC exit code" do
-          before { file "cookbooks/x/recipes/default.rb", "Chef::Application.exit!('BOOM', 231)" }
-
-          it "exits with the GENERIC_FAILURE exit code, 1" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 1
-          end
-        end
-
-        context "when a reboot exception is raised (like from the reboot resource)" do
-          before do
-            file "cookbooks/x/recipes/default.rb", <<~EOM
-              raise Chef::Exceptions::Reboot.new
-            EOM
-          end
-
-          it "exits with REBOOT_SCHEDULED, 35" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 35
-          end
-        end
-
-        context "when an attempt to reboot fails (like from the reboot resource)" do
-          before do
-            file "cookbooks/x/recipes/default.rb", <<~EOM
-              raise Chef::Exceptions::RebootFailed.new
-            EOM
-          end
-
-          it "exits with REBOOT_FAILED, 41" do
-            setup_client_rb
-            run_chef_client_and_expect_exit_code 41
-          end
-        end
-      end
-    end
-  end
-end

data/spec/integration/client/fips_spec.rb

@@ -1,29 +0,0 @@
-require "spec_helper"
-
-describe "chef-client fips" do
-  def enable_fips
-    OpenSSL.fips_mode = true
-  end
-
-  # All tests assume fips mode is off at present
-  after { OpenSSL.fips_mode = false }
-
-  # For non-FIPS OSes/builds of Ruby, enabling FIPS should error
-  example "Error enabling fips_mode if FIPS not linked", :fips_mode_negative_test do
-    expect { enable_fips }.to raise_error(OpenSSL::OpenSSLError)
-  end
-
-  example "Do not error on MD5 if not fips_mode", :fips_mode_negative_test do
-    expect { OpenSSL::Digest.new("MD5", "test string for digesting") }.not_to raise_error
-  end
-
-  # For FIPS OSes/builds of Ruby, enabling FIPS should not error
-  example "Do not error enabling fips_mode if FIPS linked", :fips_mode_test do
-    expect { enable_fips }.not_to raise_error
-  end
-
-  example "Error on MD5 if fips_mode", :fips_mode_test do
-    enable_fips
-    expect { OpenSSL::Digest.new("MD5", "test string for digesting") }.to raise_error(OpenSSL::Digest::DigestError)
-  end
-end

data/spec/integration/client/ipv6_spec.rb

@@ -1,135 +0,0 @@
-#
-# Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-require "spec_helper"
-require "support/shared/integration/integration_helper"
-require "chef/mixin/shell_out"
-
-describe "chef-client" do
-  include IntegrationSupport
-  include Chef::Mixin::ShellOut
-
-  let(:chef_zero_opts) { { host: "::1" } }
-
-  let(:validation_pem) do
-    <<~END_VALIDATION_PEM
-      -----BEGIN RSA PRIVATE KEY-----
-      MIIEogIBAAKCAQEApubutqtYYQ5UiA9QhWP7UvSmsfHsAoPKEVVPdVW/e8Svwpyf
-      0Xef6OFWVmBE+W442ZjLOe2y6p2nSnaq4y7dg99NFz6X+16mcKiCbj0RCiGqCvCk
-      NftHhTgO9/RFvCbmKZ1RKNob1YzLrFpxBHaSh9po+DGWhApcd+I+op+ZzvDgXhNn
-      0nauZu3rZmApI/r7EEAOjFedAXs7VPNXhhtZAiLSAVIrwU3ZajtSzgXOxbNzgj5O
-      AAAMmThK+71qPdffAdO4J198H6/MY04qgtFo7vumzCq0UCaGZfmeI1UNE4+xQWwP
-      HJ3pDAP61C6Ebx2snI2kAd9QMx9Y78nIedRHPwIDAQABAoIBAHssRtPM1GacWsom
-      8zfeN6ZbI4KDlbetZz0vhnqDk9NVrpijWlcOP5dwZXVNitnB/HaqCqFvyPDY9JNB
-      zI/pEFW4QH59FVDP42mVEt0keCTP/1wfiDDGh1vLqVBYl/ZphscDcNgDTzNkuxMx
-      k+LFVxKnn3w7rGc59lALSkpeGvbbIDjp3LUMlUeCF8CIFyYZh9ZvXe4OCxYdyjxb
-      i8tnMLKvJ4Psbh5jMapsu3rHQkfPdqzztQUz8vs0NYwP5vWge46FUyk+WNm/IhbJ
-      G3YM22nwUS8Eu2bmTtADSJolATbCSkOwQ1D+Fybz/4obfYeGaCdOqB05ttubhenV
-      ShsAb7ECgYEA20ecRVxw2S7qA7sqJ4NuYOg9TpfGooptYNA1IP971eB6SaGAelEL
-      awYkGNuu2URmm5ElZpwJFFTDLGA7t2zB2xI1FeySPPIVPvJGSiZoFQOVlIg9WQzK
-      7jTtFQ/tOMrF+bigEUJh5bP1/7HzqSpuOsPjEUb2aoCTp+tpiRGL7TUCgYEAwtns
-      g3ysrSEcTzpSv7fQRJRk1lkBhatgNd0oc+ikzf74DaVLhBg1jvSThDhiDCdB59mr
-      Jh41cnR1XqE8jmdQbCDRiFrI1Pq6TPaDZFcovDVE1gue9x86v3FOH2ukPG4d2/Xy
-      HevXjThtpMMsWFi0JYXuzXuV5HOvLZiP8sN3lSMCgYANpdxdGM7RRbE9ADY0dWK2
-      V14ReTLcxP7fyrWz0xLzEeCqmomzkz3BsIUoouu0DCTSw+rvAwExqcDoDylIVlWO
-      fAifz7SeZHbcDxo+3TsXK7zwnLYsx7YNs2+aIv6hzUUbMNmNmXMcZ+IEwx+mRMTN
-      lYmZdrA5mr0V83oDFPt/jQKBgC74RVE03pMlZiObFZNtheDiPKSG9Bz6wMh7NWMr
-      c37MtZLkg52mEFMTlfPLe6ceV37CM8WOhqe+dwSGrYhOU06dYqUR7VOZ1Qr0aZvo
-      fsNPu/Y0+u7rMkgv0fs1AXQnvz7kvKaF0YITVirfeXMafuKEtJoH7owRbur42cpV
-      YCAtAoGAP1rHOc+w0RUcBK3sY7aErrih0OPh9U5bvJsrw1C0FIZhCEoDVA+fNIQL
-      syHLXYFNy0OxMtH/bBAXBGNHd9gf5uOnqh0pYcbe/uRAxumC7Rl0cL509eURiA2T
-      +vFmf54y9YdnLXaqv+FhJT6B6V7WX7IpU9BMqJY1cJYXHuHG2KA=
-      -----END RSA PRIVATE KEY-----
-    END_VALIDATION_PEM
-  end
-
-  let(:cache_path) do
-    Dir.mktmpdir
-  end
-
-  let(:basic_config_file) do
-    <<~END_CLIENT_RB
-      chef_server_url "http://[::1]:8900"
-      validation_key '#{path_to("config/validator.pem")}'
-      cache_path '#{cache_path}'
-      client_key '#{cache_path}/client.pem'
-    END_CLIENT_RB
-  end
-
-  let(:client_rb_content) do
-    basic_config_file
-  end
-
-  let(:chef_dir) { File.join(__dir__, "..", "..", "..") }
-
-  let(:chef_client_cmd) { %Q{bundle exec #{ChefUtils::Dist::Infra::CLIENT} --minimal-ohai -c "#{path_to("config/client.rb")}" -lwarn --always-dump-stacktrace} }
-
-  after do
-    FileUtils.rm_rf(cache_path)
-  end
-
-  # Some Solaris test platforms are too old for IPv6. These tests should not
-  # otherwise be platform dependent, so exclude solaris
-  when_the_chef_server "is running on IPv6", :not_supported_on_solaris, :not_supported_on_gce, :not_supported_on_aix do
-
-    when_the_repository "has a cookbook with a no-op recipe" do
-      before do
-        cookbook "noop", "1.0.0", {}, "recipes" => { "default.rb" => "#raise 'foo'" }
-        file "config/client.rb", client_rb_content
-        file "config/validator.pem", validation_pem
-      end
-
-      it "should complete with success" do
-        result = shell_out("#{chef_client_cmd} -o 'noop::default'", cwd: chef_dir)
-        result.error!
-      end
-
-    end
-
-    when_the_repository "has a cookbook that hits server APIs" do
-
-      before do
-        recipe = <<-END_RECIPE
-          actual_item = data_bag_item("expect_bag", "expect_item")
-          if actual_item.key?("expect_key") and actual_item["expect_key"] == "expect_value"
-            Chef::Log.info "lookin good"
-          else
-            Chef::Log.error("!" * 80)
-            raise "unexpected data bag item content \#{actual_item.inspect}"
-            Chef::Log.error("!" * 80)
-          end
-
-        END_RECIPE
-
-        data_bag("expect_bag", { "expect_item" => { "expect_key" => "expect_value" } })
-
-        cookbook "api-smoke-test", "1.0.0", {}, "recipes" => { "default.rb" => recipe }
-      end
-
-      before do
-        file "config/client.rb", client_rb_content
-        file "config/validator.pem", validation_pem
-      end
-
-      it "should complete with success" do
-        result = shell_out("#{chef_client_cmd} -o 'api-smoke-test::default'", cwd: chef_dir)
-        result.error!
-      end
-
-    end
-  end
-end

data/spec/integration/client/open_ssl_spec.rb

@@ -1,20 +0,0 @@
-require "spec_helper"
-
-describe "openssl checks" do
-  let(:openssl_version_default) do
-    if windows?
-      "3.0.9"
-    elsif macos?
-      "1.1.1m"
-    else
-      "3.0.9"
-    end
-  end
-
-  %w{version library_version}.each do |method|
-    # macOS just picks up its own for some reason, maybe it circumvents a build step
-    example "check #{method}", not_supported_on_macos: true do
-      expect(OpenSSL.const_get("OPENSSL_#{method.upcase}")).to match(openssl_version_default), "OpenSSL doesn't match omnibus_overrides.rb"
-    end
-  end
-end

data/spec/integration/compliance/compliance_spec.rb

@@ -1,143 +0,0 @@
-require "spec_helper"
-
-require "support/shared/integration/integration_helper"
-require "chef/mixin/shell_out"
-require "chef-utils/dist"
-
-describe "chef-client with compliance phase" do
-
-  include IntegrationSupport
-  include Chef::Mixin::ShellOut
-
-  let(:chef_dir) { File.join(__dir__, "..", "..", "..") }
-
-  # Invoke `chef-client` as `ruby PATH/TO/chef-client`. This ensures the
-  # following constraints are satisfied:
-  # * Windows: windows can only run batch scripts as bare executables. Rubygems
-  # creates batch wrappers for installed gems, but we don't have batch wrappers
-  # in the source tree.
-  # * Other `chef-client` in PATH: A common case is running the tests on a
-  # machine that has omnibus chef installed. In that case we need to ensure
-  # we're running `chef-client` from the source tree and not the external one.
-  # cf. CHEF-4914
-  let(:chef_client) { "bundle exec #{ChefUtils::Dist::Infra::CLIENT} --minimal-ohai --always-dump-stacktrace" }
-
-  when_the_repository "has a custom profile" do
-    let(:report_file) { path_to("report_file.json") }
-
-    before do
-      directory "profiles/my-profile" do
-        file "inspec.yml", <<~FILE
-          ---
-          name: my-profile
-        FILE
-
-        directory "controls" do
-          file "my_control.rb", <<~FILE
-            control "my control" do
-              describe Dir.home do
-                it { should be_kind_of String }
-              end
-            end
-          FILE
-        end
-      end
-
-      file "attributes.json", <<~FILE
-        {
-          "audit": {
-            "compliance_phase": true,
-            "reporter": "json-file",
-            "json_file": {
-              "location": "#{report_file}"
-            },
-            "profiles": {
-              "my-profile": {
-                "path": "#{path_to("profiles/my-profile")}"
-              }
-            }
-          }
-        }
-      FILE
-    end
-
-    it "should complete with success" do
-      result = shell_out!("#{chef_client} --local-mode --json-attributes #{path_to("attributes.json")}", cwd: chef_dir)
-      result.error!
-
-      inspec_report = JSON.parse(File.read(report_file))
-      expect(inspec_report["profiles"].length).to eq(1)
-
-      profile = inspec_report["profiles"].first
-      expect(profile["name"]).to eq("my-profile")
-      expect(profile["controls"].length).to eq(1)
-
-      control = profile["controls"].first
-      expect(control["id"]).to eq("my control")
-      expect(control["results"].length).to eq(1)
-
-      result = control["results"].first
-      expect(result["status"]).to eq("passed")
-    end
-  end
-
-  when_the_repository "has a compliance segment" do
-    let(:report_file) { path_to("report_file.json") }
-
-    before do
-      directory "cookbooks/x" do
-        directory "compliance" do
-          directory "profiles/my_profile" do
-            file "inspec.yml", <<~FILE
-              ---
-              name: my-profile
-            FILE
-
-            directory "controls" do
-              file "my_control.rb", <<~FILE
-                control "my control" do
-                  describe Dir.home do
-                    it { should be_kind_of String }
-                  end
-                end
-              FILE
-            end
-          end
-        end
-        file "attributes/default.rb", <<~FILE
-        default['audit']['reporter'] = "json-file"
-        default['audit']['json_file'] = {
-              "location" => "#{report_file}"
-            }
-        FILE
-        file "recipes/default.rb", <<~FILE
-          include_profile ".*::.*"
-        FILE
-      end
-      file "config/client.rb", <<~EOM
-        local_mode true
-        cookbook_path "#{path_to("cookbooks")}"
-        log_level :warn
-      EOM
-    end
-
-    it "should complete with success" do
-      result = shell_out!("#{chef_client} -c \"#{path_to("config/client.rb")}\" -r 'recipe[x]'", cwd: chef_dir)
-      result.error!
-
-      inspec_report = JSON.parse(File.read(report_file))
-      expect(inspec_report["profiles"].length).to eq(1)
-
-      profile = inspec_report["profiles"].first
-      expect(profile["name"]).to eq("my-profile")
-      expect(profile["controls"].length).to eq(1)
-
-      control = profile["controls"].first
-      expect(control["id"]).to eq("my control")
-      expect(control["results"].length).to eq(1)
-
-      result = control["results"].first
-      expect(result["status"]).to eq("passed")
-    end
-  end
-end

data/spec/integration/ohai/ohai_spec.rb

@@ -1,62 +0,0 @@
-require "spec_helper"
-require "chef/mixin/shell_out"
-require "benchmark" unless defined?(Benchmark)
-
-describe "ohai" do
-  include Chef::Mixin::ShellOut
-
-  let(:ohai) { "bundle exec ohai" }
-
-  describe "testing ohai performance" do
-    # The purpose of this test is to generally find misconfigured DNS on
-    # CI testers.  If this fails, it is probably because the forward+reverse
-    # DNS lookup that node[:hostname] needs is timing out and failing.
-    #
-    # If it is failing spuriously, it may mean DNS is failing spuriously, the
-    # best solution will be to make sure that `hostname -f`-like behavior hits
-    # /etc/hosts and not DNS.
-    #
-    # If it still fails supriously, it is possible that the server has high
-    # CPU load (e.g. due to background processes) which are contending with the
-    # running tests (disable the screensaver on servers, stop playing Fortnite
-    # while you're running tests, etc).
-    #
-    # If this just fails due to I/O being very slow and ruby being very slow to
-    # startup then that still indicates that the tester configuration needs
-    # fixing.  The fact that this will fail on a windows box on a virt that doesn't
-    # use an SSD is because we have a higher bar for the tests to run successfully
-    # and that configuration is broken, so this test is red for a reason.
-    #
-    # This will probably fail on raspberry pi's or something like that as well.  That
-    # is not a bug.  We will never accept a raspberry pi as a CI tester for our
-    # software.  Feel free to manually delete and thereby skip this file in your
-    # own testing harness, but that is not our concern, we are testing behavior
-    # that is critical to our infrastructure and must run in our tests.
-    #
-    # XXX: unfortunately this is so slow on our windows testers (~9 seconds on one
-    # tester) that we can't enable it for windows unless we get some better perf there.
-    #
-    it "the hostname plugin must return in under 4 seconds (see comments in code)" do
-      # unfortunately this doesn't look stable enough to enable
-      skip "we need to do more performance work on windows and s390x testers before this can be enabled"
-      delta = Benchmark.realtime do
-        shell_out!("#{ohai} hostname")
-      end
-      expect(delta).to be < 4
-    end
-
-    # The purpose of this is to give some indication of if shell_out is slow or
-    # if the hostname plugin itself is slow.  If this test is also failing that we
-    # almost certainly have some kind of issue with DNS timeouts, etc.  If this
-    # test succeeds and the other one fails, then it can be some kind of shelling-out
-    # issue or poor performance due to I/O on starting up ruby to run ohai, etc.
-    #
-    # @todo: This is disbled 4.26.2021 so we can ship 17.0
-    # it "the hostname plugin must return in under 2 seconds when called from pure ruby" do
-    #   delta = Benchmark.realtime do
-    #     Ohai::System.new.all_plugins(["hostname"])
-    #   end
-    #   expect(delta).to be < 2
-    # end
-  end
-end