chef 18.9.4 → 18.11.11

data/lib/chef/dsl/rest_resource.rb

@@ -20,56 +20,263 @@ require "chef/constants" unless defined?(NOT_PASSED)
 class Chef
   module DSL
     module RestResource
+      private
+
+      def inherited_accessor(name)
+        superclass.public_send(name) if superclass.respond_to?(name)
+      end
+
+      public
+
+      # Define property mapping between resource properties and JSON API fields
+      #
+      # Maps resource properties to their corresponding locations in the JSON
+      # API payload. Supports both simple 1:1 mappings and complex transformations.
+      #
+      # @param rest_property_map [Hash, Array, NOT_PASSED] The property mapping configuration
+      #   - Hash: Keys are property symbols, values are JMESPath strings or symbol references
+      #   - Array: Simple 1:1 mapping (property name matches JSON field name)
+      #   - NOT_PASSED: Acts as getter, returns current mapping
+      #
+      # @return [Hash] The current property mapping
+      #
+      # @example Simple 1:1 mapping
+      #   rest_property_map [:username, :email, :role]
+      #   # Equivalent to: { username: 'username', email: 'email', role: 'role' }
+      #
+      # @example Nested JSON paths
+      #   rest_property_map({
+      #     username: 'user.name',
+      #     email: 'user.contact.email',
+      #     role: 'permissions.role'
+      #   })
+      #
+      # @example Custom mapping functions
+      #   rest_property_map({
+      #     username: 'username',
+      #     tags: :tags_mapping  # Calls tags_from_json and tags_to_json methods
+      #   })
+      #
+      # @see #json_to_property Method that uses this mapping to extract values
+      # @see #property_to_json Method that uses this mapping to create JSON
       def rest_property_map(rest_property_map = NOT_PASSED)
-        if rest_property_map != NOT_PASSED
+        unless rest_property_map.equal?(NOT_PASSED)
           rest_property_map = rest_property_map.to_h { |k| [k.to_sym, k] } if rest_property_map.is_a? Array
 
           @rest_property_map = rest_property_map
         end
-        @rest_property_map
+        @rest_property_map || inherited_accessor(:rest_property_map)
       end
 
-      # URL to collection
+      # Define the REST API collection URL
+      #
+      # Sets the base URL for the collection of resources. This URL is used for:
+      # - GET requests to list all resources
+      # - POST requests to create new resources
+      #
+      # @param rest_api_collection [String, NOT_PASSED] The collection URL path
+      #   - String: Must be an absolute path starting with '/'
+      #   - NOT_PASSED: Acts as getter, returns current collection URL
+      #
+      # @return [String] The current collection URL
+      #
+      # @raise [ArgumentError] If the path doesn't start with '/'
+      #
+      # @example
+      #   rest_api_collection '/api/v1/users'
+      #   # GET  /api/v1/users      # List all users
+      #   # POST /api/v1/users      # Create new user
       def rest_api_collection(rest_api_collection = NOT_PASSED)
-        if rest_api_collection != NOT_PASSED
+        unless rest_api_collection.equal?(NOT_PASSED)
           raise ArgumentError, "You must pass an absolute path to rest_api_collection" unless rest_api_collection.start_with? "/"
 
           @rest_api_collection = rest_api_collection
         end
 
-        @rest_api_collection
+        @rest_api_collection || inherited_accessor(:rest_api_collection)
       end
 
-      # RFC6570-Templated URL to document
+      # Define the REST API document URL with RFC 6570 template support
+      #
+      # Sets the URL pattern for individual resource documents. The URL can include
+      # RFC 6570 URI templates that will be expanded using property values. This URL
+      # is used for:
+      # - GET requests to retrieve a specific resource
+      # - PATCH/PUT requests to update a resource
+      # - DELETE requests to remove a resource
+      #
+      # @param rest_api_document [String, NOT_PASSED] The document URL pattern
+      #   - String: Must be an absolute path starting with '/'
+      #   - Can include RFC 6570 templates like {property_name}
+      #   - NOT_PASSED: Acts as getter, returns current document URL
+      #
+      # @param first_element_only [Boolean] If true and API returns array, extract first element only
+      #
+      # @return [String] The current document URL pattern
+      #
+      # @raise [ArgumentError] If the path doesn't start with '/'
+      #
+      # @example Path-based URL
+      #   rest_api_document '/api/v1/users/{username}'
+      #   # With username='john':
+      #   # GET    /api/v1/users/john
+      #   # PATCH  /api/v1/users/john
+      #   # DELETE /api/v1/users/john
+      #
+      # @example Query-based URL
+      #   rest_api_document '/api/v1/users?name={username}&email={email}'
+      #   # With username='john', email='john@example.com':
+      #   # GET /api/v1/users?name=john&email=john@example.com
+      #
+      # @example With first_element_only
+      #   rest_api_document '/api/v1/users?name={username}', first_element_only: true
+      #   # API returns: [{"name": "john", ...}]
+      #   # Resource sees: {"name": "john", ...}
+      #
+      # @see https://tools.ietf.org/html/rfc6570 RFC 6570 URI Template specification
       def rest_api_document(rest_api_document = NOT_PASSED, first_element_only: false)
-        if rest_api_document != NOT_PASSED
+        unless rest_api_document.equal?(NOT_PASSED)
           raise ArgumentError, "You must pass an absolute path to rest_api_document" unless rest_api_document.start_with? "/"
 
           @rest_api_document = rest_api_document
           @rest_api_document_first_element_only = first_element_only
         end
-        @rest_api_document
+        @rest_api_document ||
+          inherited_accessor(:rest_api_document) ||
+          (rest_api_collection && rest_identity_property ? "#{rest_api_collection}/{#{rest_identity_property}}" : nil)
       end
 
-      # Explicit REST document identity mapping
+      # Define explicit identity mapping for resource identification
+      #
+      # Explicitly specifies which JSON fields and resource properties uniquely
+      # identify a resource. Use this when automatic identity inference from the
+      # document URL is insufficient or when dealing with composite keys.
+      #
+      # If not specified, the identity is automatically inferred from RFC 6570
+      # templates in the document URL.
+      #
+      # @param rest_identity_map [Hash, NOT_PASSED] Mapping of JSON paths to properties
+      #   - Hash: Keys are JMESPath-like strings, values are property symbols
+      #   - NOT_PASSED: Acts as getter, returns current identity mapping
+      #
+      # @return [Hash, nil] The current identity mapping or nil if using auto-inference
+      #
+      # @example Simple identity
+      #   property :username, String, identity: true
+      #   rest_identity_map({ 'username' => :username })
+      #
+      # @example Composite identity
+      #   property :name, String
+      #   property :namespace, String
+      #
+      #   rest_identity_map({
+      #     'name' => :name,
+      #     'namespace' => :namespace
+      #   })
+      #
+      # @example Nested identity fields
+      #   property :user_id, String
+      #   property :org_id, String
+      #
+      #   rest_identity_map({
+      #     'user.id' => :user_id,
+      #     'organization.id' => :org_id
+      #   })
       def rest_identity_map(rest_identity_map = NOT_PASSED)
-        @rest_identity_map = rest_identity_map if rest_identity_map != NOT_PASSED
-        @rest_identity_map
+        @rest_identity_map = rest_identity_map unless rest_identity_map.equal?(NOT_PASSED)
+        @rest_identity_map || inherited_accessor(:rest_identity_map)
       end
 
-      # Mark up properties for POST only, not PATCH/PUT
+      # Declare properties that should only be sent during resource creation
+      #
+      # Specifies which properties should only be included in POST (create) requests
+      # and excluded from PATCH/PUT (update) requests. This is useful for properties
+      # that can only be set during initial creation or would cause errors if
+      # included in updates.
+      #
+      # @param rest_post_only_properties [Symbol, Array<Symbol>, NOT_PASSED] Properties to mark
+      #   - Symbol: Single property name
+      #   - Array<Symbol>: Multiple property names
+      #   - NOT_PASSED: Acts as getter, returns current post-only properties
+      #
+      # @return [Array<Symbol>] Current list of post-only properties (empty array if none)
+      #
+      # @example Single property
+      #   property :password, String, sensitive: true
+      #   property :username, String
+      #
+      #   rest_post_only_properties :password
+      #   # Password only sent when creating user, not when updating
+      #
+      # @example Multiple properties
+      #   property :password, String, sensitive: true
+      #   property :initial_role, String
+      #   property :username, String
+      #
+      #   rest_post_only_properties [:password, :initial_role]
+      #
+      # @example Common use cases
+      #   # Passwords that can't be updated via API
+      #   rest_post_only_properties :admin_password
+      #
+      #   # Resource size that can't be changed after creation
+      #   rest_post_only_properties :disk_size_gb
+      #
+      #   # Initialization parameters
+      #   rest_post_only_properties [:template_id, :source_snapshot]
       def rest_post_only_properties(rest_post_only_properties = NOT_PASSED)
-        if rest_post_only_properties != NOT_PASSED
+        unless rest_post_only_properties.equal?(NOT_PASSED)
           @rest_post_only_properties = Array(rest_post_only_properties).map(&:to_sym)
         end
-        @rest_post_only_properties || []
+        @rest_post_only_properties || inherited_accessor(:rest_post_only_properties) || []
       end
 
       def rest_api_document_first_element_only(rest_api_document_first_element_only = NOT_PASSED)
-        if rest_api_document_first_element_only != NOT_PASSED
+        unless rest_api_document_first_element_only.equal?(NOT_PASSED)
           @rest_api_document_first_element_only = rest_api_document_first_element_only
         end
-        @rest_api_document_first_element_only
+        @rest_api_document_first_element_only || inherited_accessor(:rest_api_document_first_element_only)
+      end
+
+      # Define the base URL for the REST API
+      #
+      # Sets the base endpoint URL that is prepended to all collection and document
+      # URLs. This allows resource definitions to be self-contained without requiring
+      # the Train transport endpoint to be pre-configured.
+      #
+      # @param rest_api_endpoint [String, NOT_PASSED] The base URL of the REST API
+      #   - NOT_PASSED: Acts as getter, returns current endpoint URL
+      #
+      # @return [String, nil] The current endpoint URL
+      #
+      # @example
+      #   rest_api_endpoint "https://api.example.com"
+      #   rest_api_collection "/api/v1/users"
+      #   # GET https://api.example.com/api/v1/users
+      def rest_api_endpoint(rest_api_endpoint = NOT_PASSED)
+        @rest_api_endpoint = rest_api_endpoint unless rest_api_endpoint.equal?(NOT_PASSED)
+        @rest_api_endpoint || inherited_accessor(:rest_api_endpoint)
+      end
+
+      # Declare the property that uniquely identifies a resource in the REST API
+      #
+      # Sets the identity property for the resource and auto-generates the document
+      # URL as "#{rest_api_collection}/{property}" when no explicit rest_api_document
+      # is provided. This is a convenience alternative to setting rest_api_document
+      # manually.
+      #
+      # @param property [Symbol, NOT_PASSED] The property name used as the resource identifier
+      #   - NOT_PASSED: Acts as getter, returns current identity property
+      #
+      # @return [Symbol, nil] The current identity property name
+      #
+      # @example
+      #   rest_api_collection "/api/v1/users"
+      #   rest_identity_property :username
+      #   # Auto-generates rest_api_document as "/api/v1/users/{username}"
+      def rest_identity_property(property = NOT_PASSED)
+        @rest_identity_property = property unless property.equal?(NOT_PASSED)
+        @rest_identity_property || inherited_accessor(:rest_identity_property)
       end
 
     end

data/lib/chef/encrypted_data_bag_item/decryptor.rb

@@ -177,11 +177,7 @@ class Chef::EncryptedDataBagItem
         digest = OpenSSL::Digest.new("sha256")
         raw_hmac = OpenSSL::HMAC.digest(digest, key, @encrypted_data["encrypted_data"])
 
-        if candidate_hmac_matches?(raw_hmac)
-          true
-        else
-          raise DecryptionFailure, "Error decrypting data bag value: invalid hmac. Most likely the provided key is incorrect"
-        end
+        candidate_hmac_matches?(raw_hmac) || raise(DecryptionFailure, "Error decrypting data bag value: invalid hmac. Most likely the provided key is incorrect")
       end
 
       private

data/lib/chef/environment.rb

@@ -35,7 +35,7 @@ class Chef
     include Chef::Mixin::ParamsValidate
     include Chef::Mixin::FromFile
 
-    COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:\s+)((?:#{Chef::VersionConstraint::OPS.join('|')})(?:\s+).+)$/.freeze
+    COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:\s+)((?:#{Chef::VersionConstraint::OPS.join("|")})(?:\s+).+)$/.freeze
 
     def initialize(chef_server_rest: nil)
       @name = ""

data/lib/chef/exceptions.rb

@@ -532,7 +532,7 @@ class Chef
         @resources_found = resources_found
         matches_info = @resources_found.each do |r|
           if r["Module"].nil?
-            "Resource #{r["Name"]} was found in #{r["Module"]["Name"]}"
+            "Resource #{r["Name"]} was found in #{r["Module"]["Name"]}" # rubocop:disable Lint/Void
           else
             "Resource #{r["Name"]} is a binary resource"
           end

data/lib/chef/file_cache.rb

@@ -201,11 +201,7 @@ class Chef
           }
         )
         full_path = create_cache_path(path, false)
-        if File.exist?(full_path)
-          true
-        else
-          false
-        end
+        File.exist?(full_path) || false
       end
 
       alias_method :has_key?, :key?

data/lib/chef/formatters/error_description.rb

@@ -59,10 +59,17 @@ class Chef
 
       private
 
+      MAX_DISPLAY_TEXT_LENGTH = 10_000
+
       def display_section(heading, text, out)
         out.puts heading
         out.puts "-" * heading.size
-        out.puts text
+        if text.is_a?(String) && text.length > MAX_DISPLAY_TEXT_LENGTH
+          out.puts text[0, MAX_DISPLAY_TEXT_LENGTH]
+          out.puts "\n... [truncated #{text.length - MAX_DISPLAY_TEXT_LENGTH} characters of output]"
+        else
+          out.puts text
+        end
         out.puts "\n"
       end
 

data/lib/chef/formatters/error_inspectors/compile_error_inspector.rb

@@ -126,7 +126,7 @@ class Chef
         end
 
         def filtered_bt
-          backtrace_lines_in_cookbooks.count > 0 ? backtrace_lines_in_cookbooks : exception.backtrace
+          backtrace_lines_in_cookbooks.any? ? backtrace_lines_in_cookbooks : exception.backtrace
         end
 
         def found_error_in_cookbooks?

data/lib/chef/formatters/error_inspectors/cookbook_resolve_error_inspector.rb

@@ -69,7 +69,7 @@ class Chef
             describe_412_error(error_description)
           when Net::HTTPBadRequest
             describe_400_error(error_description)
-          when Net::HTTPNotFound
+          when Net::HTTPNotFound # rubocop:disable Lint/EmptyWhen
           when Net::HTTPInternalServerError
             describe_500_error(error_description)
           when Net::HTTPBadGateway, Net::HTTPServiceUnavailable

data/lib/chef/formatters/error_inspectors/cookbook_sync_error_inspector.rb

@@ -64,7 +64,7 @@ class Chef
             describe_401_error(error_description)
           when Net::HTTPBadRequest
             describe_400_error(error_description)
-          when Net::HTTPNotFound
+          when Net::HTTPNotFound # rubocop:disable Lint/EmptyWhen
           when Net::HTTPInternalServerError
             describe_500_error(error_description)
           when Net::HTTPBadGateway, Net::HTTPServiceUnavailable, Net::HTTPGatewayTimeOut

data/lib/chef/group.rb

@@ -35,7 +35,7 @@ class Chef
       body_hash = {
         groupname: "#{groupname}",
         actors: {
-          "users" => group["actors"].concat([username]),
+          "users" => group["actors"].push(username),
           "groups" => group["groups"],
         },
       }

data/lib/chef/handler/slow_report.rb

@@ -54,7 +54,7 @@ class Chef
 
       def count
         num = all_resources.count
-        num > amount ? amount : num
+        [num, amount].min
       end
 
       def stripped_source_line(resource)

data/lib/chef/http/authenticator.rb

@@ -150,8 +150,9 @@ class Chef
 
         if !!results
           @raw_key = results
-        elsif key_file == nil? && raw_key == nil?
+        elsif key_file.nil? && raw_key.nil?
           puts "\nNo key detected\n"
+          return
         elsif !!key_file
           @raw_key = IO.read(key_file).strip
         elsif !!raw_key
@@ -305,14 +306,26 @@ class Chef
 
           if !!check_certstore_for_key(client_name)
             ps_blob = powershell_exec!(get_the_key_ps(client_name, password)).result
+            # ps_blob can be false when the PowerShell Catch block fires (e.g. cert export
+            # race condition or temporary store lock). Guard before calling Hash#[] to
+            # avoid NoMethodError: undefined method `[]' for false:FalseClass.
+            return false unless ps_blob.is_a?(Hash) && ps_blob["PSPath"]
+
             file_path = ps_blob["PSPath"].split("::")[1]
-            pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+
+            # Use begin/ensure to guarantee the unique temp file is deleted even if
+            # File.binread or OpenSSL::PKCS12.new raises an exception, preventing
+            # orphaned PFX files on disk.
+            begin
+              pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+            ensure
+              File.delete(file_path) if File.exist?(file_path)
+            end
 
             # We check the pfx we just extracted the private key from
             # if that cert is expiring in 7 days or less we generate a new pfx/p12 object
             # then we post the new public key from that to the client endpoint on
             # chef server.
-            File.delete(file_path)
             key_expiring = is_certificate_expiring?(pkcs)
             if key_expiring
               powershell_exec!(delete_old_key_ps(client_name))
@@ -335,15 +348,15 @@ class Chef
       def self.get_the_key_ps(client_name, password)
         store = get_cert_user
         powershell_code = <<~CODE
-            Try {
-              $my_pwd = ConvertTo-SecureString -String "#{password}" -Force -AsPlainText;
-              $cert = Get-ChildItem -path cert:\\#{store}\\My -Recurse | Where-Object { $_.Subject -match "chef-#{client_name}$" } -ErrorAction Stop;
-              $tempfile = [System.IO.Path]::GetTempPath() + "export_pfx.pfx";
-              Export-PfxCertificate -Cert $cert -Password $my_pwd -FilePath $tempfile;
-            }
-            Catch {
-              return $false
-            }
+          Try {
+            $my_pwd = ConvertTo-SecureString -String "#{password}" -Force -AsPlainText;
+            $cert = Get-ChildItem -path cert:\\#{store}\\My -Recurse | Where-Object { $_.Subject -match "chef-#{client_name}$" } -ErrorAction Stop;
+            $tempfile = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), [System.IO.Path]::GetRandomFileName() + ".pfx");
+            Export-PfxCertificate -Cert $cert -Password $my_pwd -FilePath $tempfile;
+          }
+          Catch {
+            return $false
+          }
         CODE
       end
 

data/lib/chef/mixin/api_version_request_handling.rb

@@ -42,7 +42,7 @@ class Chef
         max_server_version = Integer(header["max_version"])
 
         supported_client_versions.each do |version|
-          if version >= min_server_version && version <= max_server_version
+          if version.between?(min_server_version, max_server_version)
             server_supported_client_versions.push(version)
           end
         end

data/lib/chef/mixin/powershell_type_coercions.rb

@@ -72,8 +72,8 @@ class Chef
         # do we need to worry about binary data?
         if unsafe?(s)
           encoded_str = Base64.strict_encode64(s.encode("UTF-8"))
-          "([System.Text.Encoding]::UTF8.GetString("\
-               "[System.Convert]::FromBase64String('#{encoded_str}')"\
+          "([System.Text.Encoding]::UTF8.GetString(" \
+               "[System.Convert]::FromBase64String('#{encoded_str}')" \
           "))"
         else
           "'#{s}'"

data/lib/chef/mixin/securable.rb

@@ -50,9 +50,9 @@ class Chef
 
               # Windows does not support the sticky or setuid bits
               if ChefUtils.windows?
-                Integer(m) <= 0777 && Integer(m) >= 0
+                Integer(m).between?(0, 0777)
               else
-                Integer(m) <= 07777 && Integer(m) >= 0
+                Integer(m).between?(0, 07777)
               end
             end,
           }

data/lib/chef/mixin/template.rb

@@ -93,6 +93,12 @@ class Chef
           @_extension_modules = []
         end
 
+        # Provide a compact inspect so exception messages do not dump the full
+        # template context, including node attributes and secrets.
+        def inspect
+          "#<#{self.class} template_name=#{@template_name.inspect} cookbook_name=#{@cookbook_name.inspect}>"
+        end
+
         ###
         # USER FACING API
         ###
@@ -220,8 +226,15 @@ class Chef
           @original_exception, @template, @context, @options = original_exception, template, context, options
         end
 
+        MAX_MESSAGE_LENGTH = 10_000
+
         def message
-          @original_exception.message
+          msg = @original_exception.message
+          if msg.length > MAX_MESSAGE_LENGTH
+            msg[0, MAX_MESSAGE_LENGTH] + "\n... [truncated #{msg.length - MAX_MESSAGE_LENGTH} characters]"
+          else
+            msg
+          end
         end
 
         def line_number
@@ -238,7 +251,7 @@ class Chef
 
         def source_listing
           @source_listing ||= begin
-            lines = @template.split(/\n/)
+            lines = @template.split("\n")
             if line_number
               line_index = line_number - 1
               beginning_line = line_index <= SOURCE_CONTEXT_WINDOW ? 0 : line_index - SOURCE_CONTEXT_WINDOW
@@ -258,7 +271,16 @@ class Chef
         end
 
         def to_s
-          "\n\n#{self.class} (#{message}) #{source_location}:\n\n" +
+          location_parts = []
+          if @context.respond_to?(:cookbook_name) && @context.cookbook_name
+            location_parts << "cookbook: #{@context.cookbook_name}"
+          end
+          if @context.respond_to?(:template_name) && @context.template_name
+            location_parts << "template: #{@context.template_name}"
+          end
+          location_hint = location_parts.empty? ? "" : " (#{location_parts.join(", ")})"
+
+          "\n\n#{self.class} (#{message}) #{source_location}#{location_hint}:\n\n" +
             "#{source_listing}\n\n  #{original_exception.backtrace.join("\n  ")}\n\n"
         end
       end

data/lib/chef/mixin/versioned_api.rb

@@ -48,7 +48,7 @@ class Chef
           version = klass.send(:minimum_api_version)
           # min and max versions will be nil if we've not made a request to the server yet,
           # in which case we'll just start with the highest version and see what happens
-          ServerAPIVersions.instance.min_server_version.nil? || (version >= ServerAPIVersions.instance.min_server_version && version <= ServerAPIVersions.instance.send(type))
+          ServerAPIVersions.instance.min_server_version.nil? || (version.between?(ServerAPIVersions.instance.min_server_version, ServerAPIVersions.instance.send(type)))
         end
           .max_by { |a| a.send(:minimum_api_version) }
       end

data/lib/chef/monkey_patches/net-http.rb

@@ -37,9 +37,9 @@ if RUBY_VERSION.split(".")[0..1].join(".") == "3.1"
         if use_ssl?
           if proxy?
             plain_sock = BufferedIO.new(s, read_timeout: @read_timeout,
-                                        write_timeout: @write_timeout,
-                                        continue_timeout: @continue_timeout,
-                                        debug_output: @debug_output)
+              write_timeout: @write_timeout,
+              continue_timeout: @continue_timeout,
+              debug_output: @debug_output)
             buf = "CONNECT #{conn_address}:#{@port} HTTP/#{HTTPVersion}\r\n"
             buf << "Host: #{@address}:#{@port}\r\n"
             if proxy_user
@@ -65,8 +65,8 @@ if RUBY_VERSION.split(".")[0..1].join(".") == "3.1"
           @ssl_context.set_params(ssl_parameters)
           unless @ssl_context.session_cache_mode.nil? # a dummy method on JRuby
             @ssl_context.session_cache_mode =
-                OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT |
-                OpenSSL::SSL::SSLContext::SESSION_CACHE_NO_INTERNAL_STORE
+              OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT |
+              OpenSSL::SSL::SSLContext::SESSION_CACHE_NO_INTERNAL_STORE
           end
           if @ssl_context.respond_to?(:session_new_cb) # not implemented under JRuby
             @ssl_context.session_new_cb = proc { |sock, sess| @ssl_session = sess }
@@ -108,9 +108,9 @@ if RUBY_VERSION.split(".")[0..1].join(".") == "3.1"
           Chef::Log.debug("SSL established, protocol: #{s.ssl_version}, cipher: #{s.cipher[0]}")
         end
         @socket = BufferedIO.new(s, read_timeout: @read_timeout,
-                                write_timeout: @write_timeout,
-                                continue_timeout: @continue_timeout,
-                                debug_output: @debug_output)
+          write_timeout: @write_timeout,
+          continue_timeout: @continue_timeout,
+          debug_output: @debug_output)
         @last_communicated = nil
         on_connect
       rescue => exception