chef 18.9.4 → 19.1.164

data/lib/chef/scan_access_control.rb

@@ -1,6 +1,6 @@
 #--
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -46,7 +46,7 @@ class Chef
 
     # Modifies @current_resource, setting the current access control state.
     def set_all!
-      if ::File.exist?(new_resource.path)
+      if ::TargetIO::File.exist?(new_resource.path)
         set_owner
         set_group
         set_mode
@@ -76,7 +76,7 @@ class Chef
     end
 
     def lookup_uid
-      unless (pwent = Etc.getpwuid(stat.uid)).nil?
+      unless (pwent = TargetIO::Etc.getpwuid(stat.uid)).nil?
         pwent.name
       else
         stat.uid
@@ -103,7 +103,7 @@ class Chef
     end
 
     def lookup_gid
-      unless (pwent = Etc.getgrgid(stat.gid)).nil?
+      unless (pwent = TargetIO::Etc.getgrgid(stat.gid)).nil?
         pwent.name
       else
         stat.gid
@@ -117,6 +117,8 @@ class Chef
     end
 
     def current_mode
+      return if stat.mode.nil?
+
       case new_resource.mode
       when String, Integer, nil
         "0#{(stat.mode & 07777).to_s(8)}"
@@ -128,10 +130,10 @@ class Chef
 
     def stat
       @stat ||= if @new_resource.instance_of?(Chef::Resource::Link)
-                  ::File.lstat(@new_resource.path)
+                  ::TargetIO::File.lstat(@new_resource.path)
                 else
-                  realpath = ::File.realpath(@new_resource.path)
-                  ::File.stat(realpath)
+                  realpath = ::TargetIO::File.realpath(@new_resource.path)
+                  ::TargetIO::File.stat(realpath)
                 end
     end
   end

data/lib/chef/search/query.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/secret_fetcher/akeyless_vault.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -54,4 +54,3 @@ class Chef
     end
   end
 end
-

data/lib/chef/secret_fetcher/aws_secrets_manager.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/secret_fetcher/base.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/secret_fetcher/example.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/secret_fetcher/hashi_vault.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,6 +18,15 @@
 
 require_relative "base"
 require "aws-sdk-core" # Support for aws instance profile auth
+
+# The vault gem mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS as it loads.
+# Ruby 3.4 can ship that hash frozen (seen on Windows builds), so duplicate it
+# before requiring vault to avoid a FrozenError during load.
+if defined?(OpenSSL::SSL::SSLContext::DEFAULT_PARAMS) && OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.frozen?
+  mutable_defaults = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
+  OpenSSL::SSL::SSLContext.const_set(:DEFAULT_PARAMS, mutable_defaults)
+end
+
 require "vault"
 class Chef
   class SecretFetcher
@@ -131,4 +140,3 @@ class Chef
     end
   end
 end
-

data/lib/chef/secret_fetcher.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/server_api.rb

@@ -1,6 +1,6 @@
 #
 # Author:: John Keiser (<jkeiser@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/server_api_versions.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/shell/model_wrapper.rb

@@ -1,6 +1,6 @@
 #--
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/shell/shell_session.rb

@@ -2,7 +2,7 @@
 # Author:: Daniel DeLeo (<dan@kallistec.com>)
 # Author:: Tim Hinderliter (<tim@chef.io>)
 # Copyright:: Copyright 2009-2016, Daniel DeLeo
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/shell.rb

@@ -38,6 +38,8 @@ require_relative "workstation_config_loader"
 require_relative "shell/ext"
 require_relative "json_compat"
 require_relative "util/path_helper"
+require "chef-licensing/cli_flags/mixlib_cli"
+require_relative "licensing"
 
 # = Shell
 # Shell is Chef in an IRB session. Shell can interact with a Chef server via the
@@ -57,17 +59,19 @@ module Shell
   def self.start
     setup_logger
 
-    # @ALIASES was removed from irb in v1.13.0, but chef-shell can still be run in contexts that
-    # use the Ruby 3.1.x default of irb v1.4.1
-    if IRB::ExtendCommandBundle.instance_variables.include? :@ALIASES
-      # FUGLY HACK: irb gives us no other choice.
-      irb_help = [:help, :irb_help, IRB::ExtendCommandBundle::NO_OVERRIDE]
-      IRB::ExtendCommandBundle.instance_variable_get(:@ALIASES).delete(irb_help)
-    end
+    IRB::Command.register(
+      :help,
+      proc { Shell::Options.print_help }
+    )
 
     parse_opts
     Chef::Config[:shell_config] = options.config
 
+    if ChefUtils::Dist::Infra::SHELL == "chef-shell"
+      Chef::Licensing.fetch_and_persist
+      Chef::Licensing.check_software_entitlement!
+    end
+
     # HACK: this duplicates the functions of IRB.start, but we have to do it
     # to get access to the main object before irb starts.
     ::IRB.setup(nil)
@@ -140,7 +144,7 @@ module Shell
       # remove this clause for any Chef version that has upgraded to ruby >= 3.3.0
       if RUBY_VERSION >= "3.3.0"
         conf.prompt_c       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)} > "
-        conf.prompt_n       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)} ?> "
+        # prompt_n deprecation warnings as of 3.4.x
         conf.prompt_s       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)}%l> "
       else
         # there's a bug if you use a left arrow and the alternative prompts
@@ -227,6 +231,7 @@ module Shell
   class Options
     include Mixlib::CLI
     include ChefConfig::Mixin::DotD
+    include ChefLicensing::CLIFlags::MixlibCLI
 
     def self.footer(text = nil)
       @footer = text if text
@@ -337,12 +342,29 @@ module Shell
       description: "Use cached cookbooks without overwriting local differences from the server",
       boolean: false
 
+    if ChefUtils::Dist::Infra::SHELL == "chef-shell"
+      option :license_add,
+             long: "--license-add",
+             description: "Add a license key to the license pool.",
+             boolean: true,
+             proc: lambda { |v| Chef::Licensing.license_add },
+             exit: 0
+
+      option :license_list,
+             long: "--license-list",
+             description: "List all license keys in the license pool.",
+             boolean: true,
+             proc: lambda { |v| Chef::Licensing.license_list },
+             exit: 0
+    end
+
     def self.print_help
       instance = new
       instance.parse_options([])
       puts instance.opt_parser
       puts
       puts footer
+      puts Chef::Licensing.licensing_help if ChefUtils::Dist::Infra::SHELL == "chef-shell"
       puts
       exit 1
     end

data/lib/chef/target_io/dir.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class Dir
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("Dir::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::Dir : ::Dir
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/etc.rb

@@ -0,0 +1,16 @@
+module TargetIO
+  class Etc
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("Etc::%s(%s)", m.to_s, args.join(", "))
+
+        if ChefConfig::Config.target_mode? && !Chef.run_context.transport_connection.os.unix?
+          raise "Etc support only on Unix, this is " + Chef.run_context.transport_connection.platform.title
+        end
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::Etc : ::Etc
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/file.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class File
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("File::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::File : ::File
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/fileutils.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class FileUtils
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("FileUtils::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::FileUtils : ::FileUtils
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/http.rb

@@ -0,0 +1,35 @@
+require "forwardable" unless defined?(Forwardable)
+
+require_relative "../http/simple"
+require_relative "../json_compat"
+require_relative "train/http"
+
+module TargetIO
+  class HTTP
+    extend Forwardable
+    def_delegators :@http_class, :get, :head, :patch, :post, :put, :delete
+
+    # Only for Chef::Provider::RemoteFile::HTTP
+    def_delegators :@http_class, :streaming_request, :streaming_request_with_progress, :last_response
+
+    def initialize(url, http_client_opts = {})
+      if ::ChefConfig::Config.target_mode?
+        @http_class = TargetIO::TrainCompat::HTTP.new(url, http_client_opts)
+      else
+        @http_class = Chef::HTTP::Simple.new(url, http_client_opts)
+      end
+    end
+
+    class SimpleJSON
+      def initialize(url, http_client_opts = {})
+        @http_class = TargetIO::HTTP.new(url, http_client_opts)
+      end
+
+      def get(path, headers = {})
+        response = @http_class.get(path, headers)
+
+        Chef::JSONCompat.from_json(response)
+      end
+    end
+  end
+end

data/lib/chef/target_io/io.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class IO
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("IO::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::IO : ::IO
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/shadow.rb

@@ -0,0 +1,44 @@
+module TargetIO
+  module Shadow
+    # sp_namp - pointer to null-terminated user name.
+    # sp_pwdp - pointer to null-terminated password.
+    # sp_lstchg - days  since  Jan  1,  1970 password was last
+    #             changed.
+    # sp_min - days before which password may not be changed.
+    # sp_max - days after which password must be changed.
+    # sp_warn - days before password is to expire that  user  is
+    #           warned of pending password expiration.
+    # sp_inact  -  days  after  password expires that account is
+    #              considered inactive and disabled.
+    # sp_expire - days since Jan 1, 1970 when  account  will  be
+    #             disabled
+    # sp_loginclass - pointer to null-terminated user login class.
+    Entry = Struct.new(
+      :sp_namp,
+      :sp_pwdp,
+      :sp_lstchg,
+      :sp_min,
+      :sp_max,
+      :sp_warn,
+      :sp_inact,
+      :sp_expire,
+      :sp_loginclass
+    )
+
+    class Passwd
+      class << self
+
+        def method_missing(m, *args, **kwargs, &block)
+          Chef::Log.debug format("Shadow::Passwd::%s(%s)", m.to_s, args.join(", "))
+
+          if ChefConfig::Config.target_mode? && !Chef.run_context.transport_connection.os.unix?
+            raise "Shadow support only on Unix, this is " + Chef.run_context.transport_connection.platform.title
+          end
+
+          backend = ChefConfig::Config.target_mode? ? TrainCompat::Shadow::Passwd : ::Shadow::Passwd
+          backend.send(m, *args, **kwargs, &block)
+        end
+      end
+    end
+  end
+end

data/lib/chef/target_io/support.rb

@@ -0,0 +1,73 @@
+require "tempfile" unless defined?(::Tempfile)
+
+module TargetIO
+  module Support
+    # "sudo" based connections need a staging area for file reading/writing
+    def read_file(filename)
+      accessible_file = filename
+
+      if sudo?
+        accessible_file = staging_file(filename)
+        ::TargetIO::FileUtils.cp(filename, accessible_file)
+      end
+
+      content = transport_connection.file(accessible_file).content
+
+      clean_staging(accessible_file) if sudo?
+
+      content
+    end
+
+    def write_file(remote_file, content)
+      tempfile = ::Tempfile.new
+      tempfile.write(tempfile, content)
+      tempfile.close
+
+      upload(tempfile.path, remote_file)
+      tempfile.unlink
+
+      remote_file
+    end
+
+    def upload(local_file, remote_file)
+      accessible_file = remote_file
+      accessible_file = staging_file(remote_file) if sudo?
+
+      transport_connection.upload(local_file, accessible_file)
+
+      if sudo?
+        ::TargetIO::FileUtils.mv(accessible_file, remote_file)
+        clean_staging(accessible_file)
+      end
+    end
+
+    def staging_file(filename)
+      staging_dir = ::TargetIO::Dir.mktmpdir(filename)
+      ::File.join(staging_dir, ::File.basename(filename))
+    end
+
+    def clean_staging(filename)
+      ::TargetIO::FileUtils.rm(filename)
+
+      staging_dir = ::File.dirname(filename)
+      ::TargetIO::FileUtils.rmdir(staging_dir)
+    rescue Errno::ENOENT
+    end
+
+    def run_command(cmd)
+      transport_connection.run_command(cmd)
+    end
+
+    def sudo?
+      transport_connection.transport_options[:sudo]
+    end
+
+    def remote_user
+      transport_connection.transport_options[:user]
+    end
+
+    def transport_connection
+      Chef.run_context&.transport_connection
+    end
+  end
+end

data/lib/chef/target_io/train/dir.rb

@@ -0,0 +1,86 @@
+require_relative "file"
+require_relative "fileutils"
+
+require_relative "../support"
+
+module TargetIO
+  module TrainCompat
+    class Dir
+      class << self
+        include TargetIO::Support
+
+        def [](*patterns, base: ".", sort: true)
+          Dir.glob(patterns, 0, base, sort)
+        end
+
+        def delete(dir_name)
+          ::TargetIO::FileUtils.rm_rf(dir_name)
+        end
+
+        def directory?(dir_name)
+          ::TargetIO::File.directory? dir_name
+        end
+
+        def entries(dirname)
+          cmd = "ls -1a #{dirname}"
+          output = run_command(cmd).stdout
+          output.split("\n")
+        end
+
+        def glob(pattern, flags = 0, base: ".", sort: true)
+          raise "Dir.glob flags not supported except FNM_DOTMATCH" unless [0, ::File::FNM_DOTMATCH].include? flags
+
+          pattern  = Array(pattern)
+          matchdot = flags || ::File::FNM_DOTMATCH ? "dotglob" : ""
+
+          cmd += <<-BASH4
+            shopt -s globstar #{matchdot}
+            cd #{base}
+            for f in #{pattern.join(" ")}; do
+              printf '%s\n' "$f";
+            done
+          BASH4
+
+          output = run_command(cmd).stdout
+          files  = output.split("\n")
+          files.sort! if sort
+
+          files
+        end
+
+        def mkdir(dir_name, mode = nil)
+          ::TargetIO::FileUtils.mkdir(dir_name)
+          ::TargetIO::FileUtils.chmod(dir_name, mode) if mode
+        end
+
+        # Borrowed and adapted from Ruby's Dir::tmpdir and Dir::mktmpdir
+        def mktmpdir(prefix_suffix = nil, *rest, **options)
+          prefix, suffix = ::File.basename(prefix_suffix || "d")
+          random = (::Random.urandom(4).unpack1("L") % 36**6).to_s(36)
+
+          t = Time.now.strftime("%Y%m%d%s")
+          path = "#{prefix}#{t}-#{$$}-#{random}" + "#{suffix || ""}"
+          path = ::File.join(tmpdir, path)
+
+          ::TargetIO::FileUtils.mkdir(path)
+          ::TargetIO::FileUtils.chmod(0700, path)
+          ::TargetIO::FileUtils.chown(remote_user, nil, path) if sudo?
+
+          at_exit do
+            ::TargetIO::FileUtils.rm_rf(path)
+          end
+
+          path
+        end
+
+        def tmpdir
+          ::Dir.tmpdir
+        end
+
+        def unlink(dir_name)
+          ::TargetIO::FileUtils.rmdir(dir_name)
+        end
+      end
+    end
+  end
+end