chef 12.0.0.rc.0 → 12.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 1bef47bedec10e78a63b563578b47919c68066b9
+  data.tar.gz: 2073eef92ea6cc252afa09d2c047de4798d6c997
+SHA512:
+  metadata.gz: efd4822d4ef0e0b4c01666d8093faf3a238cab14b3e421d802be7e19b666d51b2ba39e1c710cbd1e0dee6e8210ba4539a77e9a71aa2a889d317eb191f3f15897
+  data.tar.gz: 4a7d25fc7c1592c5484e7c47b8bfa38c5db25fed17c6d08c76a8e2d226ab173db93d3f7063c74462e148e8f865c29b5b59fc9bfb4179a1fbe73e019e0e3ab957

data/README.md

@@ -33,7 +33,7 @@ emerge, etc.):
 * git
 * C compiler, header files, etc. On Ubuntu/debian, use the
   `build-essential` package.
-* ruby 1.9.3 or later
+* ruby 2.0.0 or later
 * rubygems
 * bundler
 

data/lib/chef/api_client/registration.rb

@@ -153,7 +153,9 @@ class Chef
       def file_flags
         base_flags = File::CREAT|File::TRUNC|File::RDWR
         # Windows doesn't have symlinks, so it doesn't have NOFOLLOW
-        base_flags |= File::NOFOLLOW if defined?(File::NOFOLLOW)
+        if defined?(File::NOFOLLOW) && !Chef::Config[:follow_client_key_symlink]
+          base_flags |= File::NOFOLLOW
+        end
         base_flags
       end
     end

data/lib/chef/chef_fs/data_handler/group_data_handler.rb

@@ -36,6 +36,10 @@ class Chef
           result
         end
 
+        def normalize_for_post(group, entry)
+          normalize_for_put(group, entry)
+        end
+
         def preserve_key?(key)
           return key == 'name'
         end

data/lib/chef/config.rb

@@ -396,6 +396,12 @@ class Chef
     # If chef-zero is enabled, this defaults to nil (no authentication).
     default(:client_key) { chef_zero.enabled ? nil : platform_specific_path("/etc/chef/client.pem") }
 
+    # When registering the client, should we allow the client key location to
+    # be a symlink?  eg: /etc/chef/client.pem -> /etc/chef/prod-client.pem
+    # If the path of the key goes through a directory like /tmp this should
+    # never be set to true or its possibly an easily exploitable security hole.
+    default :follow_client_key_symlink, false
+
     # This secret is used to decrypt encrypted data bag items.
     default(:encrypted_data_bag_secret) do
       if File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret"))
@@ -491,7 +497,7 @@ class Chef
       default :ssh_gateway, nil
       default :bootstrap_version, nil
       default :bootstrap_proxy, nil
-      default :bootstrap_template, "chef-full"
+      default :bootstrap_template, nil
       default :secret, nil
       default :secret_file, nil
       default :identity_file, nil
@@ -554,10 +560,12 @@ class Chef
     # used to update files.
     default :file_atomic_update, true
 
-    # If false file staging is will be done via tempfiles that are
-    # created under ENV['TMP'] otherwise tempfiles will be created in
-    # the directory that files are going to reside.
-    default :file_staging_uses_destdir, true
+    # There are 3 possible values for this configuration setting.
+    # true => file staging is done in the destination directory
+    # false => file staging is done via tempfiles under ENV['TMP']
+    # :auto => file staging will try using destination directory if possible and
+    #   will fall back to ENV['TMP'] if destination directory is not usable.
+    default :file_staging_uses_destdir, :auto
 
     # Exit if another run is in progress and the chef-client is unable to
     # get the lock before time expires. If nil, no timeout is enforced. (Exits
@@ -617,44 +625,44 @@ class Chef
     #
     # If there is no 'locale -a' then we return 'en_US.UTF-8' since that is the most commonly
     # available English UTF-8 locale.  However, all modern POSIXen should support 'locale -a'.
-    default :internal_locale do
-      begin
-        # https://github.com/opscode/chef/issues/2181
-        # Some systems have the `locale -a` command, but the result has
-        # invalid characters for the default encoding.
-        #
-        # For example, on CentOS 6 with ENV['LANG'] = "en_US.UTF-8",
-        # `locale -a`.split fails with ArgumentError invalid UTF-8 encoding.
-        locales = shell_out_with_systems_locale("locale -a").stdout.split
-        case
-        when locales.include?('C.UTF-8')
-          'C.UTF-8'
-        when locales.include?('en_US.UTF-8'), locales.include?('en_US.utf8')
-          'en_US.UTF-8'
-        when locales.include?('en.UTF-8')
-          'en.UTF-8'
-        else
-          # Will match en_ZZ.UTF-8, en_ZZ.utf-8, en_ZZ.UTF8, en_ZZ.utf8
-          guesses = locales.select { |l| l =~ /^en_.*UTF-?8$/i }
-          unless guesses.empty?
-            guessed_locale = guesses.first
-            # Transform into the form en_ZZ.UTF-8
-            guessed_locale.gsub(/UTF-?8$/i, "UTF-8")
-          else
-            Chef::Log.warn "Please install an English UTF-8 locale for Chef to use, falling back to C locale and disabling UTF-8 support."
-            'C'
-          end
-        end
-      rescue
-        if Chef::Platform.windows?
-          Chef::Log.debug "Defaulting to locale en_US.UTF-8 on Windows, until it matters that we do something else."
+    def self.guess_internal_locale
+      # https://github.com/opscode/chef/issues/2181
+      # Some systems have the `locale -a` command, but the result has
+      # invalid characters for the default encoding.
+      #
+      # For example, on CentOS 6 with ENV['LANG'] = "en_US.UTF-8",
+      # `locale -a`.split fails with ArgumentError invalid UTF-8 encoding.
+      locales = shell_out_with_systems_locale!("locale -a").stdout.split
+      case
+      when locales.include?('C.UTF-8')
+        'C.UTF-8'
+      when locales.include?('en_US.UTF-8'), locales.include?('en_US.utf8')
+        'en_US.UTF-8'
+      when locales.include?('en.UTF-8')
+        'en.UTF-8'
+      else
+        # Will match en_ZZ.UTF-8, en_ZZ.utf-8, en_ZZ.UTF8, en_ZZ.utf8
+        guesses = locales.select { |l| l =~ /^en_.*UTF-?8$/i }
+        unless guesses.empty?
+          guessed_locale = guesses.first
+          # Transform into the form en_ZZ.UTF-8
+          guessed_locale.gsub(/UTF-?8$/i, "UTF-8")
         else
-          Chef::Log.debug "No usable locale -a command found, assuming you have en_US.UTF-8 installed."
+          Chef::Log.warn "Please install an English UTF-8 locale for Chef to use, falling back to C locale and disabling UTF-8 support."
+          'C'
         end
-        'en_US.UTF-8'
       end
+    rescue
+      if Chef::Platform.windows?
+        Chef::Log.debug "Defaulting to locale en_US.UTF-8 on Windows, until it matters that we do something else."
+      else
+        Chef::Log.debug "No usable locale -a command found, assuming you have en_US.UTF-8 installed."
+      end
+      'en_US.UTF-8'
     end
 
+    default :internal_locale, guess_internal_locale
+
     # Force UTF-8 Encoding, for when we fire up in the 'C' locale or other strange locales (e.g.
     # japanese windows encodings).  If we do not do this, then knife upload will fail when a cookbook's
     # README.md has UTF-8 characters that do not encode in whatever surrounding encoding we have been

data/lib/chef/event_loggers/windows_eventlog.rb

@@ -26,7 +26,6 @@ if Chef::Platform::windows? and not Chef::Platform::windows_server_2003?
   end
 
   require 'win32/eventlog'
-  include Win32
 end
 
 class Chef
@@ -51,12 +50,12 @@ class Chef
       end
 
       def initialize
-        @eventlog = EventLog::open('Application')
+        @eventlog = ::Win32::EventLog::open('Application')
       end
 
       def run_start(version)
         @eventlog.report_event(
-          :event_type => EventLog::INFO_TYPE,
+          :event_type => ::Win32::EventLog::INFO_TYPE,
           :source => SOURCE,
           :event_id => RUN_START_EVENT_ID,
           :data => [version]
@@ -66,7 +65,7 @@ class Chef
       def run_started(run_status)
         @run_status = run_status
         @eventlog.report_event(
-          :event_type => EventLog::INFO_TYPE,
+          :event_type => ::Win32::EventLog::INFO_TYPE,
           :source => SOURCE,
           :event_id => RUN_STARTED_EVENT_ID,
           :data => [run_status.run_id]
@@ -75,7 +74,7 @@ class Chef
 
       def run_completed(node)
         @eventlog.report_event(
-          :event_type => EventLog::INFO_TYPE,
+          :event_type => ::Win32::EventLog::INFO_TYPE,
           :source => SOURCE,
           :event_id => RUN_COMPLETED_EVENT_ID,
           :data => [@run_status.run_id, @run_status.elapsed_time.to_s]
@@ -88,7 +87,7 @@ class Chef
       #Exception backtrace: %5
       def run_failed(e)
         @eventlog.report_event(
-          :event_type => EventLog::ERROR_TYPE,
+          :event_type => ::Win32::EventLog::ERROR_TYPE,
           :source => SOURCE,
           :event_id => RUN_FAILED_EVENT_ID,
           :data => [@run_status.run_id,

data/lib/chef/exceptions.rb

@@ -126,6 +126,13 @@ class Chef
 
     class CannotDetermineHomebrewOwner < Package; end
 
+    # Can not create staging file during file deployment
+    class FileContentStagingError < RuntimeError
+      def initialize(errors)
+        super "Staging tempfile can not be created during file deployment.\n Errors: #{errors.join('\n')}!"
+      end
+    end
+
     # A different version of a cookbook was added to a
     # VersionedRecipeList than the one already there.
     class CookbookVersionConflict < ArgumentError ; end
@@ -155,7 +162,12 @@ class Chef
     # Node::Attribute computes the merged version of of attributes
     # and makes it read-only. Attempting to modify a read-only
     # attribute will cause this error.
-    class ImmutableAttributeModification < NoMethodError; end
+    class ImmutableAttributeModification < NoMethodError
+      def initialize
+        super "Node attributes are read-only when you do not specify which precedence level to set. " +
+          %Q(To set an attribute use code like `node.default["key"] = "value"')
+      end
+    end
 
     # Merged node attributes are invalidated when the component
     # attributes are updated. Attempting to read from a stale copy

data/lib/chef/file_content_management/tempfile.rb

@@ -35,7 +35,22 @@ class Chef
       private
 
       def tempfile_open
-        tf = ::Tempfile.open(tempfile_basename, tempfile_dirname)
+        tf = nil
+        errors = [ ]
+
+        tempfile_dirnames.each do |tempfile_dirname|
+          begin
+            tf = ::Tempfile.open(tempfile_basename, tempfile_dirname)
+            break
+          rescue SystemCallError => e
+            message = "Creating temp file under '#{tempfile_dirname}' failed with: '#{e.message}'"
+            Chef::Log.debug(message)
+            errors << message
+          end
+        end
+
+        raise Chef::Exceptions::FileContentStagingError(errors) if tf.nil?
+
         # We always process the tempfile in binmode so that we
         # preserve the line endings of the content.
         tf.binmode
@@ -53,16 +68,29 @@ class Chef
         basename
       end
 
-      def tempfile_dirname
+      # Returns the possible directories for the tempfile to be created in.
+      def tempfile_dirnames
         # in why-run mode we need to create a Tempfile to compare against, which we will never
         # wind up deploying, but our enclosing directory for the destdir may not exist yet, so
         # instead we can reliably always create a Tempfile to compare against in Dir::tmpdir
-        if Chef::Config[:file_staging_uses_destdir] && !Chef::Config[:why_run]
-          ::File.dirname(@new_resource.path)
+        if Chef::Config[:why_run]
+          [ Dir.tmpdir ]
         else
-          Dir::tmpdir
+          case Chef::Config[:file_staging_uses_destdir]
+          when :auto
+            # In auto mode we try the destination directory first and fallback to ENV['TMP'] if
+            # that doesn't work.
+            [ ::File.dirname(@new_resource.path), Dir.tmpdir ]
+          when true
+            [ ::File.dirname(@new_resource.path) ]
+          when false
+            [ Dir.tmpdir ]
+          else
+            raise Chef::Exceptions::ConfigurationError, "Unknown setting '#{Chef::Config[:file_staging_uses_destdir]}' for Chef::Config[:file_staging_uses_destdir]. Possible values are :auto, true or false."
+          end
         end
       end
+
     end
   end
 end

data/lib/chef/knife.rb

@@ -72,6 +72,11 @@ class Chef
       ui.msg(msg)
     end
 
+    def self.reset_config_loader!
+      @@chef_config_dir = nil
+      @config_loader = nil
+    end
+
     def self.reset_subcommands!
       @@subcommands = {}
       @subcommands_by_category = nil
@@ -162,12 +167,15 @@ class Chef
     # Shared with subclasses
     @@chef_config_dir = nil
 
+    def self.config_loader
+      @config_loader ||= WorkstationConfigLoader.new(nil, Chef::Log)
+    end
+
     def self.load_config(explicit_config_file)
-      config_loader = WorkstationConfigLoader.new(explicit_config_file, Chef::Log)
+      config_loader.explicit_config_file = explicit_config_file
       config_loader.load
 
       ui.warn("No knife configuration file found") if config_loader.no_config_found?
-      @@chef_config_dir = config_loader.chef_config_dir
 
       config_loader
     rescue Exceptions::ConfigurationError => e
@@ -176,7 +184,7 @@ class Chef
     end
 
     def self.chef_config_dir
-      @@chef_config_dir
+      @@chef_config_dir ||= config_loader.chef_config_dir
     end
 
     # Run knife for the given +args+ (ARGV), adding +options+ to the list of

data/lib/chef/knife/bootstrap.rb

@@ -194,13 +194,15 @@ class Chef
         :description => "Verify the SSL cert for HTTPS requests to the Chef server API.",
         :boolean     => true
 
+      def default_bootstrap_template
+        "chef-full"
+      end
+
       def bootstrap_template
-        # For some reason knife.merge_configs doesn't pick up the default values from
-        # Chef::Config[:knife][:bootstrap_template] unless Chef::Config[:knife][:bootstrap_template]
-        # is forced to pick up the values before calling merge_configs.
-        # We therefore have Chef::Config[:knife][:bootstrap_template] to pick up the defaults
-        # if no option is specified.
-        config[:bootstrap_template] || config[:distro] || config[:template_file] || Chef::Config[:knife][:bootstrap_template]
+        # The order here is important. We want to check if we have the new Chef 12 option is set first.
+        # Knife cloud plugins unfortunately all set a default option for the :distro so it should be at
+        # the end.
+        config[:bootstrap_template] || config[:template_file] || config[:distro] || default_bootstrap_template
       end
 
       def find_template
@@ -210,7 +212,6 @@ class Chef
         if File.exists?(template)
           Chef::Log.debug("Using the specified bootstrap template: #{File.dirname(template)}")
           return template
-
         end
 
         # Otherwise search the template directories until we find the right one

data/lib/chef/mixin/deep_merge.rb

@@ -27,16 +27,6 @@ class Chef
     #   http://trac.misuse.org/science/wiki/DeepMerge
     module DeepMerge
 
-      class InvalidSubtractiveMerge < ArgumentError; end
-
-      OLD_KNOCKOUT_PREFIX = "!merge:".freeze
-
-      # Regex to match the "knockout prefix" that was used to indicate
-      # subtractive merging in Chef 10.x and previous. Subtractive merging is
-      # removed as of Chef 11, but we detect attempted use of it and raise an
-      # error (see: raise_if_knockout_used!)
-      OLD_KNOCKOUT_MATCH = %r[!merge].freeze
-
       extend self
 
       def merge(first, second)
@@ -46,15 +36,6 @@ class Chef
         DeepMerge.deep_merge(second, first)
       end
 
-      # Inherited roles use the knockout_prefix array subtraction functionality
-      # This is likely to go away in Chef >= 0.11
-      def role_merge(first, second)
-        first  = Mash.new(first)  unless first.kind_of?(Mash)
-        second = Mash.new(second) unless second.kind_of?(Mash)
-
-        DeepMerge.deep_merge(second, first)
-      end
-
       class InvalidParameter < StandardError; end
 
       # Deep Merge core documentation.
@@ -77,22 +58,15 @@ class Chef
           dest = source; return dest
         end
 
-        raise_if_knockout_used!(source)
-        raise_if_knockout_used!(dest)
         case source
         when nil
           dest
         when Hash
           if dest.kind_of?(Hash)
             source.each do |src_key, src_value|
-              if dest.has_key? src_key
-                if dest[src_key].nil?
-                  dest[src_key] = nil
-                else
-                  dest[src_key] = deep_merge!(src_value, dest[src_key])
-                end
+              if dest[src_key]
+                dest[src_key] = deep_merge!(src_value, dest[src_key])
               else # dest[src_key] doesn't exist so we take whatever source has
-                raise_if_knockout_used!(src_value)
                 dest[src_key] = src_value
               end
             end
@@ -131,11 +105,19 @@ class Chef
         # If there are two Hashes, recursively merge.
         if merge_onto.kind_of?(Hash) && merge_with.kind_of?(Hash)
           merge_with.each do |key, merge_with_value|
-            merge_onto[key] = if merge_onto.has_key?(key)
-                                hash_only_merge(merge_onto[key], merge_with_value)
-                              else
-                                merge_with_value
-                              end
+            value =
+              if merge_onto.has_key?(key)
+                hash_only_merge(merge_onto[key], merge_with_value)
+              else
+                merge_with_value
+              end
+
+            if merge_onto.respond_to?(:public_method_that_only_deep_merge_should_use)
+              # we can't call ImmutableMash#[]= because its immutable, but we need to mutate it to build it in-place
+              merge_onto.public_method_that_only_deep_merge_should_use(key, value)
+            else
+              merge_onto[key] = value
+            end
           end
           merge_onto
 
@@ -149,27 +131,6 @@ class Chef
         end
       end
 
-      # Checks for attempted use of subtractive merge, which was removed for
-      # Chef 11.0. If subtractive merge use is detected, will raise an
-      # InvalidSubtractiveMerge exception.
-      def raise_if_knockout_used!(obj)
-        if uses_knockout?(obj)
-          raise InvalidSubtractiveMerge, "subtractive merge with !merge is no longer supported"
-        end
-      end
-
-      # Checks for attempted use of subtractive merge in +obj+.
-      def uses_knockout?(obj)
-        case obj
-        when String
-          obj =~ OLD_KNOCKOUT_MATCH
-        when Array
-          obj.any? {|element| element.respond_to?(:gsub) && element =~ OLD_KNOCKOUT_MATCH }
-        else
-          false
-        end
-      end
-
       def deep_merge(source, dest)
         deep_merge!(safe_dup(source), safe_dup(dest))
       end