chef 19.3.15 → 19.4.46

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b2826c214024eece8ad5f19f58627b1f9102d9d7df7425fbd8d0dd65cce65993
-  data.tar.gz: e2a380dfb7165dcbd1c5984bb7ac5f4dee6e2fdfc766c6f759652449a8e422f7
+  metadata.gz: 8850f19e1d0b60534fef8df79d7d49b345b46eb651325084eaae19d88649e46f
+  data.tar.gz: efcd85be042071e417141f4567304106597e5d3abbd079c3b931ca48313e6a1a
 SHA512:
-  metadata.gz: 87932a0c176140829d996007a732be80b8692cafc7efe7edfca548d94a938d04351890a2ec9a05898cf93081b23782a1f4a581947ea2eba818600e4cd75d6609
-  data.tar.gz: e050d2dd52f2823ed156f0526824df52f75e7b8ed4f7ac7fa3711209997838135b9bd7c1fb3ce0b7beb686896f7897435e07d14699dc2dfe44bc3374c8aecaf1
+  metadata.gz: 4faa3811747991d8aceb95407ab2f30cef576066ada2114d1564829251b63d9ea7f4b5a87566bcf51b8041acd278c18b37ce2620b6ceeef21a8d9879d20839be
+  data.tar.gz: 777c66a062301e0f7bf809abc3fa85552db3b46ff5b066b1695a269fa1b887de1bf1606100069d5cede4876ba7dedaa27f328e32997b547bb0cc39f37dc09854

data/Gemfile

@@ -17,7 +17,7 @@ gem "chef-config", path: File.expand_path("chef-config", __dir__) if File.exist?
 
 # required for FIPS or bundler will pick up default openssl
 install_if -> { !Gem.platforms.any? { |platform| !platform.is_a?(String) && platform.os == "darwin" } } do
-  gem "openssl", "= 3.3.1"
+  gem "openssl", "= 3.3.3"
 end
 
 if File.exist?(File.expand_path("chef-bin", __dir__))
@@ -31,7 +31,7 @@ end
 group(:packaging) do
   gem "appbundler"
   gem "rb-readline"
-  gem "inspec-core-bin", "= 7.0.107" # need to provide the binaries for inspec
+  gem "inspec-core-bin", "= 7.2.1" # need to provide the binaries for inspec
   gem "chef-vault"
 end
 
@@ -61,6 +61,9 @@ group(:development, :test) do
   gem "webmock"
   gem "crack", "~> 1.0.1"
   gem "fauxhai-ng" # for chef-utils gem
+  # Pinned explicitly rather than floating in via inspec-core, since this is
+  # what the lint workflow runs and it also pins our RuboCop version.
+  gem "cookstyle", ">= 9.0"
 end
 
 instance_eval(ENV["GEMFILE_MOD"]) if ENV["GEMFILE_MOD"]

data/chef.gemspec

@@ -54,10 +54,11 @@ Gem::Specification.new do |s|
   s.add_dependency "mixlib-shellout", ">= 3.3.8", "< 3.5.0"
   s.add_dependency "mixlib-archive", ">= 0.4", "< 2.0"
   s.add_dependency "ohai", "~> 19.0"
-  s.add_dependency "inspec-core", "~> 7.0.107"
+  s.add_dependency "inspec-core", "~> 7.2.1"
 
   s.add_dependency "ffi", ">= 1.15.5", "< 1.18.0"
-  s.add_dependency "ffi-yajl", ">= 2.2", "< 4.0"
+  # ffi-yajl has a stale version in 3.0.0 specifically that is in use. 3.0.1 and higher is ok again
+  s.add_dependency "ffi-yajl", ">= 2.2", "!= 3.0.0", "< 4.0"
   s.add_dependency "net-sftp", ">= 2.1.2", "< 5.0" # remote_file resource
   s.add_dependency "net-ftp" # remote_file resource
   s.add_dependency "ed25519", "~> 1.2" # ssh-ed25519 support for target mode
@@ -70,13 +71,13 @@ Gem::Specification.new do |s|
 
   s.add_dependency "plist", "~> 3.2" # launchd, dscl/mac user, macos_userdefaults, and plist resources
   s.add_dependency "iniparse", "~> 1.4" # systemd_unit resource
-  s.add_dependency "addressable"
+  s.add_dependency "addressable", ">= 2.9.0"
   s.add_dependency "syslog"
   s.add_dependency "csv", "~> 3.3.5" # really needs to come from inspec?
   s.add_dependency "syslog-logger", "~> 1.6"
   s.add_dependency "unf_ext", "~> 0.0.9.1" # older platforms
   s.add_dependency "uri", ">= 1.0.4", "< 1.2.0" # CVE-2025-61594 fixed in >= 1.0.4
-  s.add_dependency "corefoundation", "~> 0.3.4" # macos_userdefaults resource
+  s.add_dependency "corefoundation", "~> 0.3.19" # macos_userdefaults resource
 
   s.add_dependency "proxifier2", "~> 1.1"
 

data/lib/chef/application/base.rb

@@ -219,11 +219,7 @@ class Chef::Application::Base < Chef::Application
   option :target,
     short: "-t TARGET",
     long: "--target TARGET",
-    description: "Target #{ChefUtils::Dist::Infra::PRODUCT} against a remote system or device",
-    proc: lambda { |target|
-      Chef::Log.warn "-- EXPERIMENTAL -- Target mode activated, resources and dsl may change without warning -- EXPERIMENTAL --"
-      target
-    }
+    description: "Target #{ChefUtils::Dist::Infra::PRODUCT} against a remote system or device"
 
   option :disable_config,
     long: "--disable-config",

data/lib/chef/chef_fs/file_system/chef_server/organization_invites_entry.rb

@@ -41,7 +41,7 @@ class Chef
 
           def write(contents)
             desired_invites = minimize_value(Chef::JSONCompat.parse(contents, create_additions: false))
-            actual_invites = _read_json.inject({}) { |h, val| h[val["username"]] = val["id"]; h }
+            actual_invites = _read_json.to_h { |val| [val["username"], val["id"]] }
             invites = actual_invites.keys
             (desired_invites - invites).each do |invite|
 

data/lib/chef/cookbook_manifest.rb

@@ -66,6 +66,7 @@ class Chef
       @manifest = nil
       @checksums = nil
       @manifest_records_by_path = nil
+      @relative_dir_cache = Hash.new { |h, k| h[k] = {} }
       true
     end
 
@@ -267,9 +268,21 @@ class Chef
       @manifest = manifest
     end
 
+    # Many files in a cookbook share a directory, and computing a file's path
+    # relative to a root path is expensive in deeply nested directories over
+    # large numbers of files. Cache the relative path per (root path,
+    # directory) and append the file's basename so the expensive computation
+    # runs once per directory instead of once per file.
+    def get_relative_path_from_root(root_path, file)
+      dirname = File.dirname(file)
+      @relative_dir_cache[root_path][dirname] ||=
+        Chef::Util::PathHelper.relative_path_from(root_path, dirname)
+      @relative_dir_cache[root_path][dirname] + File.basename(file)
+    end
+
     def parse_file_from_root_paths(file)
       root_paths.each do |root_path|
-        pathname = Chef::Util::PathHelper.relative_path_from(root_path, file)
+        pathname = get_relative_path_from_root(root_path, file)
 
         parts = pathname.each_filename.take(2)
         # Check if path is actually under root_path
@@ -299,9 +312,8 @@ class Chef
     end
 
     def extract_checksums_from_manifest(manifest)
-      manifest[:all_files].inject({}) do |memo, manifest_record|
-        memo[manifest_record[:checksum]] = nil
-        memo
+      manifest[:all_files].to_h do |manifest_record|
+        [manifest_record[:checksum], nil]
       end
     end
 
@@ -310,9 +322,8 @@ class Chef
     end
 
     def extract_manifest_records_by_path(manifest)
-      manifest[:all_files].inject({}) do |memo, manifest_record|
-        memo[manifest_record[:path]] = manifest_record
-        memo
+      manifest[:all_files].to_h do |manifest_record|
+        [manifest_record[:path], manifest_record]
       end
     end
 

data/lib/chef/cookbook_uploader.rb

@@ -54,7 +54,7 @@ class Chef
         checksum_files.merge!(cb.checksums)
       end
 
-      checksums = checksum_files.inject({}) { |memo, elt| memo[elt.first] = nil; memo }
+      checksums = checksum_files.to_h { |checksum, _path| [checksum, nil] }
       new_sandbox = rest.post("sandboxes", { checksums: checksums })
 
       Chef::Log.info("Uploading files")

data/lib/chef/cookbook_version.rb

@@ -605,13 +605,13 @@ class Chef
     # For each manifest record, produce a mapping of base filename (i.e. recipe name
     # or attribute file) to on disk location
     def relative_paths_by_name(records)
-      records.select { |record| record[:name].end_with?(".rb") }.inject({}) { |memo, record| memo[File.basename(record[:name], ".rb")] = record[:path]; memo }
+      records.select { |record| record[:name].end_with?(".rb") }.to_h { |record| [File.basename(record[:name], ".rb"), record[:path]] }
     end
 
     # For each manifest record, produce a mapping of base filename (i.e. recipe name
     # or attribute file) to on disk location
     def filenames_by_name(records)
-      records.select { |record| record[:name].end_with?(".rb") }.inject({}) { |memo, record| memo[File.basename(record[:name], ".rb")] = record[:full_path]; memo }
+      records.select { |record| record[:name].end_with?(".rb") }.to_h { |record| [File.basename(record[:name], ".rb"), record[:full_path]] }
     end
 
     # Filters YAML files from the superset of provided files.
@@ -639,7 +639,7 @@ class Chef
 
     # Filters JSON files from the superset of provided files.
     def json_filenames_by_name(records)
-      records.select { |record| record[:name].end_with?(".json") }.inject({}) { |memo, record| memo[File.basename(record[:name], ".json")] = record[:full_path]; memo }
+      records.select { |record| record[:name].end_with?(".json") }.to_h { |record| [File.basename(record[:name], ".json"), record[:full_path]] }
     end
 
     def file_vendor

data/lib/chef/data_bag.rb

@@ -100,13 +100,12 @@ class Chef
             Chef::Util::PathHelper.escape_glob_dir(path), "*"
           )).map { |f| File.basename(f) }.sort
         end
-        names.inject({}) { |h, n| h[n] = n; h }
+        names.to_h { |n| [n, n] }
       else
         if inflate
           # Can't search for all data bags like other objects, fall back to N+1 :(
-          list(false).inject({}) do |response, bag_and_uri|
-            response[bag_and_uri.first] = load(bag_and_uri.first)
-            response
+          list(false).to_h do |bag_name, _bag_uri|
+            [bag_name, load(bag_name)]
           end
         else
           Chef::ServerAPI.new(Chef::Config[:chef_server_url]).get("data")

data/lib/chef/data_collector.rb

@@ -66,6 +66,7 @@ class Chef
         @events = events
         @expanded_run_list = {}
         @deprecations = Set.new
+        @http_output_locations_clients = {}
       end
 
       # Hook to grab the run_status.  We also make the decision to run or not run here (our

data/lib/chef/encrypted_data_bag_item.rb

@@ -84,7 +84,7 @@ class Chef::EncryptedDataBagItem
   end
 
   def to_h
-    @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
+    @enc_hash.keys.to_h { |key| [key, self[key]] }
   end
 
   alias_method :to_hash, :to_h

data/lib/chef/formatters/error_description.rb

@@ -59,10 +59,17 @@ class Chef
 
       private
 
+      MAX_DISPLAY_TEXT_LENGTH = 10_000
+
       def display_section(heading, text, out)
         out.puts heading
         out.puts "-" * heading.size
-        out.puts text
+        if text.is_a?(String) && text.length > MAX_DISPLAY_TEXT_LENGTH
+          out.puts text[0, MAX_DISPLAY_TEXT_LENGTH]
+          out.puts "\n... [truncated #{text.length - MAX_DISPLAY_TEXT_LENGTH} characters of output]"
+        else
+          out.puts text
+        end
         out.puts "\n"
       end
 

data/lib/chef/http/auth_credentials.rb

@@ -56,7 +56,7 @@ class Chef
 
         sign_obj = Mixlib::Authentication::SignedHeaderAuth.signing_object(request_params)
         signed = sign_obj.sign(key, use_ssh_agent: @use_ssh_agent).merge({ host: host })
-        signed.inject({}) { |memo, kv| memo[(kv[0].to_s.upcase).to_s] = kv[1]; memo }
+        signed.to_h { |k, v| [k.to_s.upcase.to_s, v] }
       end
 
     end

data/lib/chef/http/authenticator.rb

@@ -150,8 +150,9 @@ class Chef
 
         if !!results
           @raw_key = results
-        elsif key_file == nil? && raw_key == nil?
-          puts "\nNo key detected\n"
+        elsif key_file.nil? && raw_key.nil?
+          Chef::Log.debug("No key detected")
+          return
         elsif !!key_file
           @raw_key = IO.read(key_file).strip
         elsif !!raw_key
@@ -305,14 +306,26 @@ class Chef
 
           if !!check_certstore_for_key(client_name)
             ps_blob = powershell_exec!(get_the_key_ps(client_name, password)).result
+            # ps_blob can be false when the PowerShell Catch block fires (e.g. cert export
+            # race condition or temporary store lock). Guard before calling Hash#[] to
+            # avoid NoMethodError: undefined method `[]' for false:FalseClass.
+            return false unless ps_blob.is_a?(Hash) && ps_blob["PSPath"]
+
             file_path = ps_blob["PSPath"].split("::")[1]
-            pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+
+            # Use begin/ensure to guarantee the unique temp file is deleted even if
+            # File.binread or OpenSSL::PKCS12.new raises an exception, preventing
+            # orphaned PFX files on disk.
+            begin
+              pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+            ensure
+              File.delete(file_path) if File.exist?(file_path)
+            end
 
             # We check the pfx we just extracted the private key from
             # if that cert is expiring in 7 days or less we generate a new pfx/p12 object
             # then we post the new public key from that to the client endpoint on
             # chef server.
-            File.delete(file_path)
             key_expiring = is_certificate_expiring?(pkcs)
             if key_expiring
               powershell_exec!(delete_old_key_ps(client_name))
@@ -338,7 +351,7 @@ class Chef
             Try {
               $my_pwd = ConvertTo-SecureString -String "#{password}" -Force -AsPlainText;
               $cert = Get-ChildItem -path cert:\\#{store}\\My -Recurse | Where-Object { $_.Subject -match "chef-#{client_name}$" } -ErrorAction Stop;
-              $tempfile = [System.IO.Path]::GetTempPath() + "export_pfx.pfx";
+              $tempfile = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), [System.IO.Path]::GetRandomFileName() + ".pfx");
               Export-PfxCertificate -Cert $cert -Password $my_pwd -FilePath $tempfile;
             }
             Catch {

data/lib/chef/http.rb

@@ -510,9 +510,9 @@ class Chef
 
     # @api private
     def redirected_to(response)
-      return nil  unless response.is_a?(Net::HTTPRedirection)
+      return nil unless response.is_a?(Net::HTTPRedirection)
       # Net::HTTPNotModified is undesired subclass of Net::HTTPRedirection so test for this
-      return nil  if response.is_a?(Net::HTTPNotModified)
+      return nil if response.is_a?(Net::HTTPNotModified)
 
       response["location"]
     end

data/lib/chef/mixin/properties.rb

@@ -100,7 +100,7 @@ class Chef
         def property(name, type = NOT_PASSED, **options)
           name = name.to_sym
 
-          options = options.inject({}) { |memo, (key, value)| memo[key.to_sym] = value; memo }
+          options.transform_keys!(&:to_sym)
 
           options[:instance_variable_name] = :"@#{name}" unless options.key?(:instance_variable_name)
           options[:name] = name

data/lib/chef/mixin/template.rb

@@ -93,6 +93,12 @@ class Chef
           @_extension_modules = []
         end
 
+        # Provide a compact inspect so exception messages do not dump the full
+        # template context, including node attributes and secrets.
+        def inspect
+          "#<#{self.class} template_name=#{@template_name.inspect} cookbook_name=#{@cookbook_name.inspect}>"
+        end
+
         ###
         # USER FACING API
         ###
@@ -220,8 +226,15 @@ class Chef
           @original_exception, @template, @context, @options = original_exception, template, context, options
         end
 
+        MAX_MESSAGE_LENGTH = 10_000
+
         def message
-          @original_exception.message
+          msg = @original_exception.message
+          if msg.length > MAX_MESSAGE_LENGTH
+            msg[0, MAX_MESSAGE_LENGTH] + "\n... [truncated #{msg.length - MAX_MESSAGE_LENGTH} characters]"
+          else
+            msg
+          end
         end
 
         def line_number
@@ -258,7 +271,16 @@ class Chef
         end
 
         def to_s
-          "\n\n#{self.class} (#{message}) #{source_location}:\n\n" +
+          location_parts = []
+          if @context.respond_to?(:cookbook_name) && @context.cookbook_name
+            location_parts << "cookbook: #{@context.cookbook_name}"
+          end
+          if @context.respond_to?(:template_name) && @context.template_name
+            location_parts << "template: #{@context.template_name}"
+          end
+          location_hint = location_parts.empty? ? "" : " (#{location_parts.join(", ")})"
+
+          "\n\n#{self.class} (#{message}) #{source_location}#{location_hint}:\n\n" +
             "#{source_listing}\n\n  #{original_exception.backtrace.join("\n  ")}\n\n"
         end
       end

data/lib/chef/property.rb

@@ -122,7 +122,9 @@ class Chef
     #     will create a deprecation warning.
     #
     def initialize(**options)
-      options = options.inject({}) { |memo, (key, value)| memo[key.to_sym] = value; memo }
+      # `**options` is already a fresh hash owned by this method, so normalize the
+      # keys in place rather than building a second hash to hold the same data.
+      options.transform_keys!(&:to_sym)
       @options = options
       options[:name] = options[:name].to_sym if options[:name]
       options[:instance_variable_name] = options[:instance_variable_name].to_sym if options[:instance_variable_name]
@@ -543,6 +545,14 @@ class Chef
           Chef::Mixin::ParamsValidate.validate({ name => value }, { name => validation_options })
         end
       end
+    rescue Chef::Exceptions::ValidationFailed
+      # validation_options strips :sensitive before it ever reaches the
+      # validators below, so they have no way to redact the value themselves --
+      # do it here instead of leaking it in the exception message.
+      raise unless sensitive?
+
+      raise Chef::Exceptions::ValidationFailed,
+        "Property #{name}'s value does not pass validation. The value has been suppressed because 'sensitive' is set to true on this property."
     end
 
     #

data/lib/chef/provider/group/dscl.rb

@@ -61,7 +61,6 @@ class Chef
               val.strip! if val
               case key.downcase
               when "primarygroupid"
-                new_resource.gid(val) unless new_resource.gid
                 current_resource.gid(val)
               when "groupmembership"
                 current_resource.members(val.split(" "))
@@ -99,10 +98,15 @@ class Chef
         end
 
         def set_gid
-          new_resource.gid(get_free_gid) if [nil, ""].include? new_resource.gid
-          raise(Chef::Exceptions::Group, "gid is already in use") if gid_used?(new_resource.gid)
-
-          safe_dscl("create", "/Groups/#{new_resource.group_name}", "PrimaryGroupID", new_resource.gid)
+          # Resolve the gid into a local so that the desired state on the new
+          # resource is left alone. Memoizing a free gid back onto the resource
+          # would mean a reused resource object gets the same gid every time
+          # rather than a fresh free one.
+          gid = new_resource.gid
+          gid = get_free_gid if [nil, ""].include?(gid)
+          raise(Chef::Exceptions::Group, "gid is already in use") if gid_used?(gid)
+
+          safe_dscl("create", "/Groups/#{new_resource.group_name}", "PrimaryGroupID", gid)
         end
 
         def set_members

data/lib/chef/provider/group.rb

@@ -111,6 +111,11 @@ class Chef
       end
 
       def group_gid_match?
+        # No gid requested means no desired gid, so whatever the group already
+        # has is a match. Providers must not backfill new_resource.gid from the
+        # current state to make this comparison work.
+        return true if new_resource.gid.nil?
+
         new_resource.gid.to_s == current_resource.gid.to_s
       end
 

data/lib/chef/provider/mount/solaris.rb

@@ -26,7 +26,7 @@ class Chef
     class Mount
       # Mount Solaris File systems
       class Solaris < Chef::Provider::Mount
-        provides :mount, platform_family: "solaris_based"
+        provides :mount, platform_family: "solaris_based", target_mode: true
 
         extend Forwardable
 
@@ -52,21 +52,21 @@ class Chef
 
         def define_resource_requirements
           requirements.assert(:mount, :remount) do |a|
-            a.assertion { !device_should_exist? || ::File.exist?(device) }
+            a.assertion { !device_should_exist? || ::TargetIO::File.exist?(device) }
             a.failure_message(Chef::Exceptions::Mount, "Device #{device} does not exist")
             a.whyrun("Assuming device #{device} would have been created")
           end
 
           unless fsck_device == "-"
             requirements.assert(:mount, :remount) do |a|
-              a.assertion { ::File.exist?(fsck_device) }
+              a.assertion { ::TargetIO::File.exist?(fsck_device) }
               a.failure_message(Chef::Exceptions::Mount, "Device #{fsck_device} does not exist")
               a.whyrun("Assuming device #{fsck_device} would have been created")
             end
           end
 
           requirements.assert(:mount, :remount) do |a|
-            a.assertion { ::File.exist?(mount_point) }
+            a.assertion { ::TargetIO::File.exist?(mount_point) }
             a.failure_message(Chef::Exceptions::Mount, "Mount point #{mount_point} does not exist")
             a.whyrun("Assuming mount point #{mount_point} would have been created")
           end
@@ -118,10 +118,6 @@ class Chef
           end
         end
 
-        def etc_tempfile
-          yield Tempfile.open("vfstab", "/etc")
-        end
-
         def mount_options_unchanged?
           new_options = native_options(options)
           current_options = native_options(current_resource.nil? ? nil : current_resource.options)
@@ -172,7 +168,7 @@ class Chef
           enabled = false
           pass = false
           fstype = options = nil
-          ::File.foreach(VFSTAB) do |line|
+          ::TargetIO::File.foreach(VFSTAB) do |line|
             case line
             when /^[#\s]/
               next
@@ -213,12 +209,8 @@ class Chef
         end
 
         def vfstab_write(contents)
-          etc_tempfile do |f|
+          ::TargetIO::File.open(VFSTAB, "w") do |f|
             f.write(contents.join(""))
-            f.close
-            # move, preserving modes of destination file
-            mover = Chef::FileContentManagement::Deploy.strategy(true)
-            mover.deploy(f.path, VFSTAB)
           end
         end
 
@@ -233,7 +225,7 @@ class Chef
         def delete_vfstab_entry
           contents = []
           found = false
-          ::File.readlines(VFSTAB).reverse_each do |line|
+          ::TargetIO::File.readlines(VFSTAB).reverse_each do |line|
             if !found && line =~ /^#{device_regex}\s+\S+\s+#{Regexp.escape(mount_point)}/
               found = true
               logger.trace("#{new_resource} is removed from vfstab")
@@ -245,7 +237,7 @@ class Chef
         end
 
         def merge_vfstab_entry
-          contents = ::File.readlines(VFSTAB)
+          contents = ::TargetIO::File.readlines(VFSTAB)
           contents[-1].chomp!
           contents << vfstab_entry
         end
@@ -262,8 +254,8 @@ class Chef
         end
 
         def device_regex
-          if ::File.symlink?(device)
-            "(?:#{Regexp.escape(device)}|#{Regexp.escape(::File.expand_path(::File.readlink(device), ::File.dirname(device)))})"
+          if ::TargetIO::File.symlink?(device)
+            "(?:#{Regexp.escape(device)}|#{Regexp.escape(::File.expand_path(::TargetIO::File.readlink(device), ::File.dirname(device)))})"
           else
             Regexp.escape(device)
           end

data/lib/chef/provider/package/chocolatey.rb

@@ -395,8 +395,8 @@ class Chef
               Chef::Log.debug("Choco List Command: #{cmd}")
 
               raw = parse_list_output(*cmd)
-              raw.keys.each_with_object({}) do |name, available|
-                available[name] = desired_name_versions[name] || raw[name]
+              raw.keys.to_h do |name|
+                [name, desired_name_versions[name] || raw[name]]
               end
             end
             @@choco_available_packages[new_resource.list_options].merge!(available_versions)

data/lib/chef/provider/package/homebrew.rb

@@ -72,8 +72,7 @@ class Chef
         # and which packages can be upgrades. We do this by checking if brew_info has an entry
         # via the installed_version helper.
         def upgrade_package(names, versions)
-          upgrade_pkgs = names.select { |x| installed_version(x) }
-          install_pkgs = names.reject { |x| installed_version(x) }
+          upgrade_pkgs, install_pkgs = names.partition { |x| installed_version(x) }
 
           brew_cmd_output("upgrade", options, upgrade_pkgs) unless upgrade_pkgs.empty?
           brew_cmd_output("install", options, install_pkgs) unless install_pkgs.empty?
@@ -198,7 +197,7 @@ class Chef
           # the package provider can magically handle that
           shell_out_cmd = options[:allow_failure] ? :shell_out : :shell_out!
 
-          output = send(shell_out_cmd, homebrew_bin_path, *command, user: homebrew_uid, environment: { "HOME" => homebrew_user.dir, "RUBYOPT" => nil, "TMPDIR" => nil })
+          output = send(shell_out_cmd, homebrew_bin_path, *command, user: homebrew_uid, timeout: new_resource.timeout, environment: { "HOME" => homebrew_user.dir, "RUBYOPT" => nil, "TMPDIR" => nil })
           output.stdout.chomp
         end
       end

data/lib/chef/provider/package/portage.rb

@@ -79,7 +79,6 @@ class Chef
 
           if pkginfo.exitstatus != 0
             pkginfo.stderr.each_line do |line|
-              # cspell:disable-next-line
               if /[Uu]nqualified atom .*match.* multiple/.match?(line)
                 raise_error_for_query("matched multiple packages (please specify a category):\n#{pkginfo.inspect}")
               end

data/lib/chef/provider/package/yum/python_helper.rb

@@ -116,7 +116,6 @@ class Chef
           end
 
           def is_arch?(arch)
-            # cspell:disable-next
             arches = %w{aarch64 alpha alphaev4 alphaev45 alphaev5 alphaev56 alphaev6 alphaev67 alphaev68 alphaev7 alphapca56 armv5tejl armv5tel armv5tl armv6l armv7l armv8l armv6hl armv7hl armv7hnl armv8hl i386 athlon geode i386 i486 i586 i686 ia64 mips mipsel mips64 mips64el noarch ppc ppc64 ppc64iseries ppc64p7 ppc64pseries ppc64le riscv32 riscv64 riscv128 s390 s390x sh3 sh4 sh4a sparc sparc64 sparc64v sparcv8 sparcv9 sparcv9v x86_64 amd64 ia32e}
             arches.include?(arch)
           end

data/lib/chef/provider/service/debian.rb

@@ -59,15 +59,15 @@ class Chef
             a.whyrun ["Unable to determine priority of service, assuming service would have been correctly installed earlier in the run.",
                       "Assigning temporary priorities to continue.",
                       "If this service is not properly installed prior to this point, this will fail."] do
-                        temp_priorities = { "6" => [:stop, "20"],
-                                            "0" => [:stop, "20"],
-                                            "1" => [:stop, "20"],
-                                            "2" => [:start, "20"],
-                                            "3" => [:start, "20"],
-                                            "4" => [:start, "20"],
-                                            "5" => [:start, "20"] }
-                        current_resource.priority(temp_priorities)
-                      end
+              temp_priorities = { "6" => [:stop, "20"],
+                                  "0" => [:stop, "20"],
+                                  "1" => [:stop, "20"],
+                                  "2" => [:start, "20"],
+                                  "3" => [:start, "20"],
+                                  "4" => [:start, "20"],
+                                  "5" => [:start, "20"] }
+              current_resource.priority(temp_priorities)
+            end
           end
         end
 

data/lib/chef/resource/apt_repository.rb

@@ -176,6 +176,10 @@ class Chef
         description: "Determines whether to rebuild the APT package cache.",
         default: true, desired_state: false
 
+      property :cache_rebuild_ignore_failure, [TrueClass, FalseClass],
+        description: "Determines whether to fail the run if rebuilding the APT package cache fails.",
+        default: true, desired_state: false
+
       property :options, [String, Array],
         description: "Additional options to set for the repository",
         default: [], coerce: proc { |x| Array(x) }
@@ -554,7 +558,7 @@ class Chef
         end
 
         apt_update new_resource.name do
-          ignore_failure true
+          ignore_failure new_resource.cache_rebuild_ignore_failure
           action :nothing
         end