chef 18.8.11 → 18.8.54

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9134da925c12e6c628dedfe24b287e1a6fb7b40adffc919099befcf40ae9775
-  data.tar.gz: 38eb35ac0c39650ce752e5f50a5c02cb6b663d68b4631c5f029b8de88874a0b6
+  metadata.gz: 7b200565a19bca36e21bba522b339ae53aedc340acbe2d1f66b187d2b0c2bbed
+  data.tar.gz: 57a4a650d762784ffa533cffbd6a49af21f296b58b9b50b23e99f125a008b449
 SHA512:
-  metadata.gz: 545ec3bbe5e85ecf94082d06fde179e1a0c0645e1437ee40425da904132027ac4750b2b3b0dacc482686b77142fe86a95154181196348c6ff180627b6bb4e6c0
-  data.tar.gz: ebb942abcf7e954e36674ca6ff152745e1e80490b7ad26fabaf3314dea008822ea65a660e05166c1af8f1cf968ab0df3dffa70f032082ddda634fadec3847efe
+  metadata.gz: ffd6ad0207a74bc4a3cc137d5122f07313b5786f35d79c56c7a375764aaab81c58b949694969bcdc012144557eb16d86c75f9e14b962b08acd4e00b41af5a92c
+  data.tar.gz: 1bb9911b3f2e96b5985dad10677e741c6cb4ab6eb65a5f35a1397f2e935f74d6a777a53e88e6df7f19e95ec1ec1c3f7d9394db6b465463e62844f1176c40e191

data/Gemfile

@@ -75,22 +75,3 @@ instance_eval(ENV["GEMFILE_MOD"]) if ENV["GEMFILE_MOD"]
 # If you want to load debugging tools into the bundle exec sandbox,
 # add these additional dependencies into Gemfile.local
 eval_gemfile("./Gemfile.local") if File.exist?("./Gemfile.local")
-
-# These lines added for Windows development only.
-# For FFI to call into PowerShell we need the binaries and assemblies located
-# in the Ruby bindir.
-# The Powershell DLL source lives here: https://github.com/chef/chef-powershell-shim
-# Every merge into that repo triggers a Habitat build and promotion. Running
-# the rake :update_chef_exec_dll task in this (chef/chef) repo will pull down
-# the built packages and copy the binaries to distro/ruby_bin_folder.
-#
-# We copy (and overwrite) these files every time "bundle <exec|install>" is
-# executed, just in case they have changed.
-if RUBY_PLATFORM.match?(/mswin|mingw|windows/)
-  instance_eval do
-    ruby_exe_dir = RbConfig::CONFIG["bindir"]
-    assemblies = Dir.glob(File.expand_path("distro/ruby_bin_folder/#{ENV["PROCESSOR_ARCHITECTURE"]}", __dir__) + "**/*")
-    FileUtils.cp_r assemblies, ruby_exe_dir, verbose: false unless ENV["_BUNDLER_WINDOWS_DLLS_COPIED"]
-    ENV["_BUNDLER_WINDOWS_DLLS_COPIED"] = "1"
-  end
-end

data/chef-universal-mingw-ucrt.gemspec

@@ -15,7 +15,7 @@ gemspec.add_dependency "wmi-lite", "~> 1.0"
 gemspec.add_dependency "win32-taskscheduler", "~> 2.0"
 gemspec.add_dependency "iso8601", ">= 0.12.1", "< 0.14" # validate 0.14 when it comes out
 gemspec.add_dependency "win32-certstore", "~> 0.6.15" # 0.5+ required for specifying user vs. system store
-gemspec.add_dependency "chef-powershell", "~> 18.1.0" # The guts of the powershell_exec code have been moved to its own gem, chef-powershell. It's part of the chef-powershell-shim repo.
+gemspec.add_dependency "chef-powershell", "~> 18.6.0" # The guts of the powershell_exec code have been moved to its own gem, chef-powershell. It's part of the chef-powershell-shim repo.
 
 gemspec.extensions << "ext/win32-eventlog/Rakefile"
 gemspec.files += Dir.glob("{distro,ext}/**/*")

data/chef.gemspec

@@ -31,10 +31,10 @@ Gem::Specification.new do |s|
     s.required_ruby_version = ">= 3.1.0"
   end
 
-  s.add_dependency "activesupport", ">= 4.2.7.1", "<= 7.1.3.2"
+  s.add_dependency "activesupport", ">= 4.2.7.1", "<= 7.1.5.2"
   s.add_dependency "chef-config", "= #{Chef::VERSION}"
   s.add_dependency "chef-utils", "= #{Chef::VERSION}"
-  s.add_dependency "train-core", "~> 3.10", "<= 3.12.13"
+  s.add_dependency "train-core", "~> 3.13", ">= 3.13.4"
   s.add_dependency "train-winrm", "~> 0.2.17"
   s.add_dependency "train-rest", ">= 0.4.1" # target mode with rest APIs
 
@@ -83,9 +83,8 @@ Gem::Specification.new do |s|
 
   s.require_paths = %w{ lib }
   s.files = %w{Gemfile Rakefile LICENSE README.md} +
-    Dir.glob("{lib,spec}/**/*", File::FNM_DOTMATCH).reject { |f| File.directory?(f) } +
-    Dir.glob("*.gemspec") +
-    Dir.glob("tasks/rspec.rb")
+    Dir.glob("{lib}/**/*", File::FNM_DOTMATCH).reject { |f| File.directory?(f) } +
+    Dir.glob("*.gemspec")
 
   s.metadata = {
     "bug_tracker_uri" => "https://github.com/chef/chef/issues",

data/lib/chef/chef_fs/file_system/chef_server/cookbook_dir.rb

@@ -204,6 +204,10 @@ class Chef
               end
             end
           end
+
+          def cookbook_frozen?
+            @frozen ||= (chef_object&.frozen_version? || false)
+          end
         end
       end
     end

data/lib/chef/chef_fs/file_system/repository/chef_repository_file_system_cookbook_dir.rb

@@ -100,10 +100,6 @@ class Chef
             raise
           end
 
-          def children
-            super.select { |entry| !(entry.dir? && entry.children.size == 0 ) }
-          end
-
           def can_have_child?(name, is_dir)
             if is_dir && !%w{ root_files .. . }.include?(name)
               # Only the given directories will be uploaded.
@@ -132,7 +128,7 @@ class Chef
           end
 
           def can_upload?
-            File.exist?(uploaded_cookbook_version_path) || children.size > 0
+            File.exist?(uploaded_cookbook_version_path) || any_children?
           end
 
           protected

data/lib/chef/chef_fs/file_system/repository/chef_repository_file_system_cookbook_entry.rb

@@ -89,6 +89,18 @@ class Chef
             true
           end
 
+          # This is a lighter (than `#children.size == 0`) existence check.
+          # return earlier where we only care if 1 or more children exist
+          def any_children?
+            Dir.entries(file_path).any? { |child_name|
+              (child = make_child_entry(child_name)) &&
+                can_have_child?(child.name, child.dir?) &&
+                !(child.dir? && !child.any_children? )
+            }
+          rescue Errno::ENOENT
+            raise Chef::ChefFS::FileSystem::NotFoundError.new(self, $!)
+          end
+
           def write_pretty_json
             false
           end

data/lib/chef/chef_fs/file_system.rb

@@ -129,6 +129,10 @@ class Chef
       #     actually different (which will take time to determine).
       #   - +dry_run+ - if +true+, action will not actually be taken;
       #     things will be printed out instead.
+      #   - +skip_frozen_cookbook_status+ - if +true+ (default), status.json files will
+      #     NOT be created for cookbook directories. If +false+, status.json files
+      #     containing frozen cookbook information will be created.
+      #     Used primarily by knife-ec-backup.
       #
       # ==== Examples
       #
@@ -312,6 +316,7 @@ class Chef
                     new_dest_parent.create_child_from(src_entry)
                     ui.output "Created #{dest_path}" if ui
                   end
+                  create_cookbook_status_file(src_entry, dest_entry, options, ui)
                   return
                 end
 
@@ -331,6 +336,7 @@ class Chef
                       error ||= child_error
                     end
                   end
+                  create_cookbook_status_file(src_entry, new_dest_dir, options, ui)
                 else
                   if options[:dry_run]
                     ui.output "Would create #{dest_path}" if ui
@@ -355,6 +361,7 @@ class Chef
                     ui.output "Updated #{dest_path}" if ui
                   end
                 end
+                create_cookbook_status_file(src_entry, dest_entry, options, ui)
                 return
               end
 
@@ -368,6 +375,7 @@ class Chef
                       error ||= child_error
                     end
                   end
+                  create_cookbook_status_file(src_entry, dest_entry, options, ui)
                 else
                   # If they are different types.
                   ui.error("File #{src_path} is a directory while file #{dest_path} is a regular file\n") if ui
@@ -439,6 +447,16 @@ class Chef
           parent
         end
 
+        def create_cookbook_status_file(src_entry, dest_entry, options, ui = nil)
+          # Skip status.json creation by default, unless explicitly disabled
+          skip_creation = options.key?(:skip_frozen_cookbook_status) ? options[:skip_frozen_cookbook_status] : true
+          return if skip_creation || !src_entry.is_a?(Chef::ChefFS::FileSystem::ChefServer::CookbookDir)
+
+          status_file = dest_entry.child("status.json")
+          frozen_status = src_entry.cookbook_frozen? || false
+          status_file.write({ "frozen": frozen_status }.to_json)
+          ui.output "Created status.json with frozen: #{frozen_status} for #{src_entry.name}" if ui
+        end
       end
     end
   end

data/lib/chef/property.rb

@@ -655,8 +655,8 @@ class Chef
 
     # @api private
     def get_value(resource)
-      if instance_variable_name
-        resource.instance_variable_get(instance_variable_name)
+      if (i = instance_variable_name)
+        resource.instance_variable_get(i)
       else
         resource.send(name)
       end
@@ -664,8 +664,8 @@ class Chef
 
     # @api private
     def set_value(resource, value)
-      if instance_variable_name
-        resource.instance_variable_set(instance_variable_name, value)
+      if (i = instance_variable_name)
+        resource.instance_variable_set(i, value)
       else
         resource.send(name, value)
       end
@@ -673,8 +673,8 @@ class Chef
 
     # @api private
     def value_is_set?(resource)
-      if instance_variable_name
-        resource.instance_variable_defined?(instance_variable_name)
+      if (i = instance_variable_name)
+        resource.instance_variable_defined?(i)
       else
         true
       end

data/lib/chef/provider/package/rubygems.rb

@@ -371,6 +371,27 @@ class Chef
           end
 
           def candidate_version_from_remote(gem_dependency, *sources)
+            source_args = sources.compact.map { |s| "--source=#{s}" }.join(" ")
+            cmd = "#{@gem_binary_location} list #{gem_dependency.name} --remote --all #{source_args}"
+            result = shell_out!(cmd)
+
+            versions = []
+            result.stdout.each_line do |line|
+              next unless line.start_with?("#{gem_dependency.name} (")
+
+              version_string = line[/\((.*)\)/, 1]
+              next unless version_string
+
+              version_string.split(/,\s*/).each do |v|
+                version = Gem::Version.new(v.strip)
+                versions << version if gem_dependency.requirement.satisfied_by?(version)
+              rescue ArgumentError
+                # Skip invalid versions
+              end
+            end
+
+            versions.max
+          rescue Mixlib::ShellOut::ShellCommandFailed
             with_gem_sources(*sources) do
               with_gem_platforms(*gem_platforms) do
                 find_newest_remote_version(gem_dependency, *sources)

data/lib/chef/pwsh.rb

@@ -60,13 +60,10 @@ class Chef
 
     def self.dll
       # This Powershell DLL source lives here: https://github.com/chef/chef-powershell-shim
-      # Every merge into that repo triggers a Habitat build and promotion. Running
-      # the rake :update_chef_exec_dll task in this (chef/chef) repo will pull down
-      # the built packages and copy the binaries to distro/ruby_bin_folder. Bundle install
-      # ensures that the correct architecture binaries are installed into the path.
+      # Every merge into that repo triggers a Habitat build and promotion.
       # Also note that the version of pwsh is determined by which assemblies the dll was
       # built with. To update powershell, those dependencies must be bumped.
-      @dll ||= Dir.glob("#{RbConfig::CONFIG["bindir"]}/**/Chef.PowerShell.Wrapper.Core.dll").last
+      @dll ||= Dir.glob("#{RbConfig::CONFIG["bindir"]}/../**/Chef.PowerShell.Wrapper.dll").last
     end
   end
 end

data/lib/chef/resource/apt_repository.rb

@@ -309,6 +309,15 @@ class Chef
           "/etc/apt/keyrings/#{new_resource.repo_name}.gpg"
         end
 
+        # Get the current APT version, this is important for creating keyring files,
+        # on newer APT versions these need to be an _older_ GnuPG format due to "sqv"
+        # being used to verify
+        #
+        # @return [Integer]
+        def apt_version
+          @apt_version ||= shell_out("apt -v").stdout.strip[/([0-9]\.?){3}/, 0].to_i
+        end
+
         # Fetch the key using either cookbook_file or remote_file, validate it,
         # and install it with apt-key add
         # @param [String] key the key to install
@@ -320,6 +329,7 @@ class Chef
           key_name = key.gsub(/[^0-9A-Za-z\-]/, "_")
           keyfile_tmp_path = ::File.join(Chef::Config[:file_cache_path], key_name)
           keyfile_path = keyring_path
+          gpg_keyring_prefix = apt_version > 2 ? "gnupg-ring:" : ""
           tmp_dir = Dir.mktmpdir(".gpg")
           at_exit { FileUtils.remove_entry(tmp_dir) }
 
@@ -334,20 +344,19 @@ class Chef
               sensitive new_resource.sensitive
               action :create
               verify "gpg --homedir #{tmp_dir} %{path}"
-              notifies :delete, "file[#{keyfile_path}]", :immediately
-              notifies :run, "execute[dearmor #{keyfile_path}]", :immediately
+              notifies :run, "execute[import #{keyfile_path}]", :immediately
             end
 
-            execute "dearmor #{keyfile_path}" do
-              command [ "gpg", "--batch", "--yes", "--dearmor", "-o", keyfile_path, keyfile_tmp_path ]
+            execute "import #{keyfile_path}" do
+              command [ "gpg", "--import", "--batch", "--yes", "--no-default-keyring", "--keyring", "#{gpg_keyring_prefix}#{keyfile_path}", keyfile_tmp_path ]
               default_env true
               sensitive new_resource.sensitive
               action :nothing
-              only_if { !::File.exist?(keyfile_path) || ::File.read(keyfile_path).include?("-----BEGIN PGP PUBLIC KEY BLOCK-----") }
             end
 
             file keyfile_path do
               mode "0644"
+              notifies :run, "execute[import #{keyfile_path}]", :before unless ::File.exist?(keyfile_path)
             end
           else
             declare_resource(key_resource_type(key), keyfile_path) do

data/lib/chef/resource/chocolatey_installer.rb

@@ -53,7 +53,7 @@ class Chef
       allowed_actions :install, :uninstall, :upgrade
 
       property :download_url, String,
-        description: "The URL to download Chocolatey from. This sets the value of $env:ChocolateyDownloadUrl and causes the installer to choose an alternate download location. If this is not set, Chocolatey installs fall back to the official Chocolatey community repository to download Chocolatey from. It can also be used for offline installation by providing a path to a Chocolatey.nupkg."
+        description: "The URL to download Chocolatey from. This sets the value of $env:ChocolateyDownloadUrl and causes the installer to choose an alternate download location. If this is not set, Chocolatey installs fall back to the official Chocolatey community repository to download Chocolatey from. It can also be used for offline installation by providing a path to a Chocolatey.nupkg. If the provided URL is a PowerShell script (ending in .ps1), that script will be downloaded and executed directly. If it is any other file type, it will be downloaded to the Chef client directory. ChefConfig::Config.etc_chef_dir(windows: true) is used to find that location."
 
       property :chocolatey_version, String,
         description: "Specifies a target version of Chocolatey to install. By default, the latest stable version is installed. This will use the value in $env:ChocolateyVersion by default, if that environment variable is present. This parameter is ignored if download_url is set."
@@ -128,10 +128,25 @@ class Chef
           powershell_exec("Set-Item -path env:ChocolateyProxyUser -Value #{new_resource.proxy_user}; Set-Item -path env:ChocolateyProxyPassword -Value #{new_resource.proxy_password}")
         end
 
-        # note that Invoke-Expression is being called on the downloaded script (outer parens),
-        # not triggering the script download (inner parens)
+        # Handle custom download URLs appropriately based on file type
         converge_if_changed do
-          powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))").error!
+          if new_resource.download_url
+            Chef::Log.info("Using custom download URL for Chocolatey installation: #{new_resource.download_url}")
+            # If it's a PowerShell script, execute it directly (original behavior)
+            if new_resource.download_url.downcase.end_with?(".ps1")
+              powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('#{new_resource.download_url}'))").error!
+            else
+              # Assume it's a direct link to a nupkg or other file and handle accordingly
+              chef_dir = ChefConfig::Config.etc_chef_dir(windows: true)
+
+              # Let PowerShell handle the filename - it will use the server's suggested filename
+              # from Content-Disposition header, or fall back to the URL path
+              powershell_exec("Invoke-WebRequest '#{new_resource.download_url}' -OutFile '#{chef_dir}'").error!
+              Chef::Log.info("Downloaded file from #{new_resource.download_url} to #{chef_dir}")
+            end
+          else
+            powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))").error!
+          end
         end
       end
 

data/lib/chef/resource/ohai.rb

@@ -90,6 +90,7 @@ class Chef
           ohai_plugin_path = Chef::Config[:ohai_segment_plugin_path]
           if ohai_plugin_path && Dir.exist?(ohai_plugin_path) && !Dir.empty?(ohai_plugin_path)
             # Configure Ohai to load plugins from the cookbook segment path
+            ohai.config[:plugin_path] ||= ::Ohai.config[:plugin_path]
             ohai.config[:plugin_path] << ohai_plugin_path
             logger.trace("Added cookbook plugin path to ohai: #{ohai_plugin_path}")
           end

data/lib/chef/resource_reporter.rb

@@ -35,7 +35,7 @@ class Chef
       as_hash["before"]   = current_resource ? current_resource.state_for_resource_reporter : {}
       # if the "before" hash is too large, we need to truncate it to avoid 413 errors
       # 640K ought be enough for every Windows registry entry
-      as_hash["before"]   = {} if as_hash["before"].to_json.length > 657920
+      as_hash["before"]   = {} if as_hash["before"].to_s.bytesize > 657920
       as_hash["duration"] = ( action_record.elapsed_time * 1000 ).to_i.to_s
       as_hash["delta"]    = new_resource.diff if new_resource.respond_to?(:diff)
       as_hash["delta"]    = "" if as_hash["delta"].nil?

data/lib/chef/shell.rb

@@ -56,9 +56,14 @@ module Shell
   # Start the irb REPL with chef-shell's customizations
   def self.start
     setup_logger
-    # FUGLY HACK: irb gives us no other choice.
-    irb_help = [:help, :irb_help, IRB::ExtendCommandBundle::NO_OVERRIDE]
-    IRB::ExtendCommandBundle.instance_variable_get(:@ALIASES).delete(irb_help)
+
+    # @ALIASES was removed from irb in v1.13.0, but chef-shell can still be run in contexts that
+    # use the Ruby 3.1.x default of irb v1.4.1
+    if IRB::ExtendCommandBundle.instance_variables.include? :@ALIASES
+      # FUGLY HACK: irb gives us no other choice.
+      irb_help = [:help, :irb_help, IRB::ExtendCommandBundle::NO_OVERRIDE]
+      IRB::ExtendCommandBundle.instance_variable_get(:@ALIASES).delete(irb_help)
+    end
 
     parse_opts
     Chef::Config[:shell_config] = options.config

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("..", __dir__)
-  VERSION = Chef::VersionString.new("18.8.11")
+  VERSION = Chef::VersionString.new("18.8.54")
 end
 
 #