chef 18.9.4 → 18.11.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a1de7dd02696d84d680c3851565ec4837ca0275cc4cc153d39bde72eea4f2be
-  data.tar.gz: 5e8ac13c389d7e024108b626f935d11c092a120fd857ac5200fc13fafcc1a5d2
+  metadata.gz: bf0beb126b5eeb735670c67b48e79aae54a6ba25760f99babf2468fe6ff78437
+  data.tar.gz: 99033f783a17e8870ccfc0f20ef3489cfed936f2882d7030beaf0d78971e8a85
 SHA512:
-  metadata.gz: cc96321c5e4d51febea1aec696accb358d3219a31e142c00b5c7255501682f98f098de20ae2e720ac9fbb4c13991a3692614262585ed4dde34ce2b2eb7830bb7
-  data.tar.gz: 8d35f965f1f382983b098dce2a7302684cd2273523ea03b07a1a66c5183f70bda24bcabfd4056c8c9bc7ca5eeb7c698ed92e70826703e760b5927b4a06af1055
+  metadata.gz: c3e593233b5da46f034602581455a9ee6d32eaf77a1bbcedc91fb17d5826081c139480192887fdb3804cda29862383fe46fa74bae56af7947096d0adc42493e8
+  data.tar.gz: d80743280c5469a1c869fe02cce993d0649fdfecf6a3ca8a66892465b5b3239aba64378579c659800122aeb408745efd11712ff6dddb46b75d92ac000a36dc30

data/Gemfile

@@ -7,7 +7,7 @@ gem "ohai", git: "https://github.com/chef/ohai.git", branch: "18-stable"
 # Nwed to file a bug with rest-client. In the meantime, we can use this until they accept the update.
 gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1"
 
-gem "ffi", ">= 1.15.5", "<= 1.17.0"
+gem "ffi", ">= 1.15.5", "<= 1.18.0"
 gem "chef-utils", path: File.expand_path("chef-utils", __dir__) if File.exist?(File.expand_path("chef-utils", __dir__))
 gem "chef-config", path: File.expand_path("chef-config", __dir__) if File.exist?(File.expand_path("chef-config", __dir__))
 
@@ -31,15 +31,19 @@ group(:omnibus_package) do
   gem "rb-readline"
   gem "chef-vault"
 
-  gem "inspec-core-bin", ">= 5", "< 6"
+  gem "inspec-core-bin", "~> 5.24", "< 6"
 end
 
 group(:omnibus_package, :pry) do
   # Locked because pry-byebug is broken with 13+.
   # some work is ongoing? https://github.com/deivid-rodriguez/pry-byebug/issues/343
-  gem "pry", "= 0.13.0"
-  # byebug does not install on freebsd on ruby 3.0
-  gem "pry-byebug" unless RUBY_PLATFORM.match?(/freebsd/i)
+  gem "pry", "0.15.2"
+  # byebug does not install on freebsd on ruby 3.0; byebug >= 12 requires ruby >= 3.1
+  # which is incompatible with the AIX omnibus toolchain (ruby 3.0.3)
+  unless RUBY_PLATFORM.match?(/freebsd|aix/i)
+    gem "byebug", "< 13"
+    gem "pry-byebug", "< 3.12"
+  end
   gem "pry-stack_explorer"
 end
 
@@ -60,18 +64,18 @@ group(:development, :test) do
   gem "rake", ">= 12.3.3"
   gem "rspec"
   gem "webmock"
-  gem "crack", "< 0.4.6" # due to https://github.com/jnunemaker/crack/pull/75
+  gem "crack", "< 1.0.2" # due to https://github.com/jnunemaker/crack/pull/75
   gem "fauxhai-ng" # for chef-utils gem
 end
 
-gem "chefstyle"
-# group(:chefstyle) do
-#   # for testing new chefstyle rules
-#   gem "chefstyle", git: "https://github.com/chef/chefstyle.git", branch: "main"
-# end
+gem "cookstyle", "~> 8.6"
 
 instance_eval(ENV["GEMFILE_MOD"]) if ENV["GEMFILE_MOD"]
 
 # If you want to load debugging tools into the bundle exec sandbox,
 # add these additional dependencies into Gemfile.local
-eval_gemfile("./Gemfile.local") if File.exist?("./Gemfile.local")
+#
+# But doing eval_gemfile("./Gemfile.local") breaks dependabot, so a
+# bit of indirection here
+local_gemfile = File.join(__dir__, "Gemfile.local")
+eval(File.read(local_gemfile)) if File.exist?(local_gemfile)

data/README.md

@@ -1,5 +1,4 @@
 # Chef Infra
-[![Code Climate](https://codeclimate.com/github/chef/chef.svg)](https://codeclimate.com/github/chef/chef)
 [![Build Status](https://badge.buildkite.com/c82093430ceec7d27af05febb9dcafe3aa331fff9d74c0ab9d.svg?branch=main)](https://buildkite.com/chef-oss/chef-chef-main-verify)
 [![Gem Version](https://badge.fury.io/rb/chef.svg)](https://badge.fury.io/rb/chef)
 [![](https://img.shields.io/badge/Release%20Policy-Cadence%20Release-brightgreen.svg)](https://github.com/chef/chef/blob/main/docs/dev/design_documents/client_release_cadence.md)

data/Rakefile

@@ -100,12 +100,28 @@ task :register_eventlog do
   end
 end
 
-begin
-  require "chefstyle"
+desc "Check Linting and code style."
+task :style do
   require "rubocop/rake_task"
-  RuboCop::RakeTask.new(:style) do |task|
-    task.options += ["--display-cop-names", "--no-color"]
+  require "cookstyle/chefstyle"
+
+  if RbConfig::CONFIG["host_os"] =~ /mswin|mingw|cygwin/
+    # Windows-specific command, rubocop erroneously reports the CRLF in each file which is removed when your PR is uploaded to GitHub.
+    # This is a workaround to ignore the CRLF from the files before running cookstyle.
+    sh "cookstyle --chefstyle -c .rubocop.yml --except Layout/EndOfLine"
+  else
+    sh "cookstyle --chefstyle -c .rubocop.yml"
   end
 rescue LoadError
-  puts "chefstyle/rubocop is not available. bundle install first to make sure all dependencies are installed."
+  puts "Rubocop or Cookstyle gems are not installed. bundle install first to make sure all dependencies are installed."
 end
+
+# begin
+#   require "chefstyle"
+#   require "rubocop/rake_task"
+#   RuboCop::RakeTask.new(:style) do |task|
+#     task.options += ["--display-cop-names", "--no-color"]
+#   end
+# rescue LoadError
+#   puts "chefstyle/rubocop is not available. bundle install first to make sure all dependencies are installed."
+# end

data/chef-universal-mingw-ucrt.gemspec

@@ -1,4 +1,6 @@
-gemspec = instance_eval(File.read(File.expand_path("chef.gemspec", __dir__)))
+# rubocop:disable Chef/Ruby/GemspecLicense
+# License is in the included gemspec.
+gemspec = Gem::Specification.load(File.expand_path("chef.gemspec", __dir__))
 
 gemspec.platform = Gem::Platform.new(%w{universal mingw-ucrt})
 
@@ -6,7 +8,7 @@ gemspec.add_dependency "win32-api", "~> 1.10.0"
 gemspec.add_dependency "win32-event", "~> 0.6.1"
 # TODO: Relax this pin and make the necessary updaets. The issue originally
 # leading to this pin has been fixed in 0.6.5.
-gemspec.add_dependency "win32-eventlog", "0.6.3"
+gemspec.add_dependency "win32-eventlog", "0.6.7"
 gemspec.add_dependency "win32-mmap", "~> 0.4.1"
 gemspec.add_dependency "win32-mutex", "~> 0.4.2"
 gemspec.add_dependency "win32-process", "~> 0.9"

data/chef.gemspec

@@ -1,6 +1,6 @@
 # on Windows, the directory location starts with "(eval at " because it's
 # being evaled in
-file_directory = File.dirname(__FILE__).gsub(/\(eval at /, "")
+file_directory = File.dirname(__FILE__).gsub("(eval at ", "")
 $:.unshift(File.join(file_directory, "lib"))
 vs_path = File.expand_path("chef-utils/lib/chef-utils/version_string.rb", __dir__)
 
@@ -25,16 +25,17 @@ Gem::Specification.new do |s|
   s.email = "adam@chef.io"
   s.homepage = "https://www.chef.io"
 
+  # help dependabot by specifying a default. If the default is in
+  # the 'else', dependabot misses it and falls back to a very old ruby
+  s.required_ruby_version = ">= 3.1.0"
   if RUBY_PLATFORM =~ /aix/
     s.required_ruby_version = ">= 3.0.3"
-  else
-    s.required_ruby_version = ">= 3.1.0"
   end
 
   s.add_dependency "chef-config", "= #{Chef::VERSION}"
   s.add_dependency "chef-utils", "= #{Chef::VERSION}"
   s.add_dependency "train-core", "~> 3.13", ">= 3.13.4"
-  s.add_dependency "train-winrm", "~> 0.2.17"
+  s.add_dependency "train-winrm", "~> 0.4.0"
   s.add_dependency "train-rest", ">= 0.4.1" # target mode with rest APIs
 
   s.add_dependency "license-acceptance", ">= 1.0.5", "< 3"
@@ -47,35 +48,37 @@ Gem::Specification.new do |s|
 
   # AIX Gemfile.aix.lock uses this, but currently a manual process
   if RUBY_PLATFORM.include?("aix") || ENV["GENERATE_AIX"] == "true"
-    s.add_dependency "inspec-core", ">= 5", "<= 5.22.80"
+    s.add_dependency "inspec-core", ">= 5", "< 8"
   else
-    s.add_dependency "inspec-core", ">= 5", "< 6"
+    s.add_dependency "inspec-core", ">= 5", "< 8"
   end
 
   s.add_dependency "ffi", ">= 1.15.5", "<= 1.16.3"
-  s.add_dependency "ffi-yajl", "~> 2.2"
+  s.add_dependency "ffi-yajl", ">= 2.2", "< 4.0"
   s.add_dependency "net-sftp", ">= 2.1.2", "< 5.0" # remote_file resource
   s.add_dependency "net-ftp" # remote_file resource
   s.add_dependency "erubis", "~> 2.7" # template resource / cookbook syntax check
-  s.add_dependency "diff-lcs", ">= 1.2.4", "!= 1.4.0", "< 1.6.0" # 1.4 breaks output. Used in lib/chef/util/diff
+  s.add_dependency "diff-lcs", ">= 1.2.4", "!= 1.4.0", "< 2.1.0" # 1.4 breaks output. Used in lib/chef/util/diff
   s.add_dependency "ffi-libarchive", "~> 1.0", ">= 1.0.3" # archive_file resource
-  s.add_dependency "chef-zero", ">= 15.0.21", "< 15.2"
+  s.add_dependency "chef-zero", "~> 15.1.11"
   s.add_dependency "chef-vault" # chef-vault resources and helpers
 
   s.add_dependency "plist", "~> 3.2" # launchd, dscl/mac user, macos_userdefaults, osx_profile and plist resources
   s.add_dependency "iniparse", "~> 1.4" # systemd_unit resource
   s.add_dependency "addressable"
   s.add_dependency "syslog-logger", "~> 1.6"
-  s.add_dependency "uuidtools", ">= 2.1.5", "< 3.0" # osx_profile resource
-  s.add_dependency "unf_ext", "~> 0.0.8.2" # older platforms
-  s.add_dependency "uri", "~> 1.0.3" # This is used by net-http. We are forcing a version to get past a CVE in 1.0.2
+  s.add_dependency "uuidtools", ">= 2.1.5", "< 4.0" # osx_profile resource
+  s.add_dependency "unf_ext", ">= 0.0.8.2", "< 0.0.10.0" # older platforms
+  s.add_dependency "uri", ">= 1.0.4", "< 1.2.0" # This is used by net-http. We are forcing a version to get past a CVE in 1.0.2
   s.add_dependency "corefoundation", "~> 0.3.4" # macos_userdefaults resource
 
   s.add_dependency "proxifier2", "~> 1.1"
 
-  s.add_dependency "aws-sdk-s3", "~> 1.91" # s3 recipe-url support
+  # 1.219 depends (transitively) on bigdecimal 4.1.2 which dodesn't compile
+  # on CentOS7
+  s.add_dependency "aws-sdk-s3", ">= 1.218.0", "< 1.219.0"
   s.add_dependency "aws-sdk-secretsmanager", "~> 1.46"
-  s.add_dependency "vault", "~> 0.18.2" # hashi vault official client gem
+  s.add_dependency "vault", ">= 0.18.2", "< 0.21.0" # hashi vault official client gem
 
   s.bindir = "bin"
   s.executables = %w{ }

data/lib/chef/application/apply.rb

@@ -75,7 +75,7 @@ class Chef::Application::Apply < Chef::Application
     short: "-l LEVEL",
     long: "--log_level LEVEL",
     description: "Set the log level (trace, debug, info, warn, error, fatal).",
-    proc: lambda { |l| l.to_sym }
+    proc: lambda(&:to_sym)
 
   option :log_location_cli,
     short: "-L LOGLOCATION",

data/lib/chef/application/base.rb

@@ -96,7 +96,7 @@ class Chef::Application::Base < Chef::Application
     short: "-l LEVEL",
     long: "--log_level LEVEL",
     description: "Set the log level (auto, trace, debug, info, warn, error, fatal).",
-    proc: lambda { |l| l.to_sym }
+    proc: lambda(&:to_sym)
 
   option :log_location_cli,
     short: "-L LOGLOCATION",
@@ -139,7 +139,7 @@ class Chef::Application::Base < Chef::Application
     short: "-i SECONDS",
     long: "--interval SECONDS",
     description: "Run #{ChefUtils::Dist::Infra::PRODUCT} periodically, in seconds.",
-    proc: lambda { |s| s.to_i }
+    proc: lambda(&:to_i)
 
   option :json_attribs,
     short: "-j JSON_ATTRIBS",
@@ -157,7 +157,7 @@ class Chef::Application::Base < Chef::Application
     short: "-s SECONDS",
     long: "--splay SECONDS",
     description: "The splay time for running at intervals, in seconds.",
-    proc: lambda { |s| s.to_i }
+    proc: lambda(&:to_i)
 
   option :environment,
     short: "-E ENVIRONMENT",
@@ -189,7 +189,7 @@ class Chef::Application::Base < Chef::Application
   option :run_lock_timeout,
     long: "--run-lock-timeout SECONDS",
     description: "Set maximum duration to wait for another client run to finish, default is indefinitely.",
-    proc: lambda { |s| s.to_i }
+    proc: lambda(&:to_i)
 
   option :version,
     short: "-v",

data/lib/chef/application/exit_code.rb

@@ -141,7 +141,7 @@ class Chef
         def non_standard_exit_code_warning(exit_code)
           "#{ChefUtils::Dist::Infra::CLIENT} attempted to exit with a non-standard exit code of #{exit_code}." \
           " The #{ChefUtils::Dist::Infra::PRODUCT} Exit Codes design document (https://github.com/chef/chef/blob/main/docs/dev/design_documents/client_exit_codes.md)" \
-          " defines the exit codes that should be used with #{ChefUtils::Dist::Infra::CLIENT}. Chef::Application::ExitCode defines"  \
+          " defines the exit codes that should be used with #{ChefUtils::Dist::Infra::CLIENT}. Chef::Application::ExitCode defines" \
           " valid exit codes Non-standard exit codes are redefined as GENERIC_FAILURE."
         end
 

data/lib/chef/chef_fs/command_line.rb

@@ -29,7 +29,7 @@ class Chef
 
       def self.diff_print(pattern, a_root, b_root, recurse_depth, output_mode, format_path = nil, diff_filter = nil, ui = nil)
         if format_path.nil?
-          format_path = proc { |entry| entry.path_for_printing }
+          format_path = proc(&:path_for_printing)
         end
 
         get_content = (output_mode != :name_only && output_mode != :name_status)
@@ -119,9 +119,9 @@ class Chef
               yield result
             end
 
-          when :both_nonexistent
-          when :added_cannot_upload
-          when :deleted_cannot_download
+          when :both_nonexistent # rubocop:disable Lint/EmptyWhen
+          when :added_cannot_upload # rubocop:disable Lint/EmptyWhen
+          when :deleted_cannot_download # rubocop:disable Lint/EmptyWhen
           when :same
             # Skip these silently
           when :error

data/lib/chef/chef_fs/file_system/chef_server/cookbook_dir.rb

@@ -91,7 +91,7 @@ class Chef
                     end
                   end
                   # Create the file itself
-                  container.add_child(CookbookFile.new(parts[parts.length - 1], container, file))
+                  container.add_child(CookbookFile.new(parts[-1], container, file))
                 end
               end
               @children = @children.sort_by(&:name)

data/lib/chef/chef_fs/file_system/chef_server/cookbooks_dir.rb

@@ -80,9 +80,8 @@ class Chef
                 tmp_cl.load_cookbooks
                 tmp_cl.compile_metadata
                 tmp_cl.freeze_versions if options[:freeze]
-                cookbook_for_upload = []
-                tmp_cl.each do |cookbook_name, cookbook|
-                  cookbook_for_upload << cookbook
+                cookbook_for_upload = tmp_cl.map do |cookbook_name, cookbook|
+                  cookbook
                 end
 
                 uploader = Chef::CookbookUploader.new(cookbook_for_upload, force: options[:force], rest: chef_rest)

data/lib/chef/client.rb

@@ -385,7 +385,7 @@ class Chef
     # @api private
     def rest
       @rest ||= Chef::ServerAPI.new(Chef::Config[:chef_server_url], client_name: node_name,
-                                    signing_key_filename: Chef::Config[:client_key])
+        signing_key_filename: Chef::Config[:client_key])
     end
 
     # A rest object with validate_utf8 set to false.  This will not throw exceptions
@@ -397,7 +397,7 @@ class Chef
     def rest_clean
       @rest_clean ||=
         Chef::ServerAPI.new(Chef::Config[:chef_server_url], client_name: node_name,
-                            signing_key_filename: Chef::Config[:client_key], validate_utf8: false)
+          signing_key_filename: Chef::Config[:client_key], validate_utf8: false)
     end
 
     #
@@ -1090,4 +1090,3 @@ end
 require_relative "cookbook_loader"
 require_relative "cookbook_version"
 require_relative "cookbook/synchronizer"
-

data/lib/chef/compliance/fetcher/chef_server.rb

@@ -125,7 +125,7 @@ class Chef
         private
 
         def chef_server_url
-          m = %r{^#{@config['server']}/owners/(?<owner>[^/]+)/compliance/(?<id>[^/]+)/tar$}.match(@target)
+          m = %r{^#{@config["server"]}/owners/(?<owner>[^/]+)/compliance/(?<id>[^/]+)/tar$}.match(@target)
           "#{m[:owner]}/#{m[:id]}"
         end
       end

data/lib/chef/compliance/reporter/cli.rb

@@ -46,11 +46,11 @@ class Chef
             end
             if result[:message]
               if found
-                result[:message].split(/\n/).reject(&:empty?).each do |m|
+                result[:message].split("\n").reject(&:empty?).each do |m|
                   output << pastel.red("#{" " * 12}#{m}")
                 end
               else
-                result[:message].split(/\n/).reject(&:empty?).each do |m|
+                result[:message].split("\n").reject(&:empty?).each do |m|
                   output << pastel.red("#{" " * 9}#{m}")
                 end
               end

data/lib/chef/compliance/runner.rb

@@ -72,14 +72,32 @@ class Chef
         logger.debug("#{self.class}##{__method__}: enabling Compliance Phase")
 
         report_with_interval
+        @compliance_phase_completed = true
       end
 
-      def run_failed(_exception, _run_status)
+      def run_failed(exception, _run_status)
         # If the run has failed because our own validation of compliance
         # phase configuration has failed, we don't want to submit a report
         # because we're still not configured correctly.
         return unless enabled? && @validation_passed
 
+        # A reboot exception is not a real failure — it is an expected outcome
+        # when a reboot resource fires :reboot_now.  In that case run_completed
+        # has already executed the Compliance Phase, so running it again here
+        # would produce a duplicate scan (and the second scan may be killed by
+        # the pending reboot).
+        if exception.is_a?(Chef::Exceptions::Reboot)
+          logger.debug("#{self.class}##{__method__}: skipping Compliance Phase because a reboot was requested")
+          return
+        end
+
+        # Guard against any other code path that might trigger both run_completed
+        # and run_failed in the same client run.
+        if @compliance_phase_completed
+          logger.debug("#{self.class}##{__method__}: skipping Compliance Phase because it has already run in this client run")
+          return
+        end
+
         logger.debug("#{self.class}##{__method__}: enabling Compliance Phase")
 
         report_with_interval

data/lib/chef/dsl/chef_vault.rb

@@ -81,4 +81,4 @@ class Chef
       end
     end
   end
-end
+end