chef 13.5.3 → 13.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bac3c67c9e66c16a65ba7d66b4ae611a1f5a444c
-  data.tar.gz: 59ed93bbf14a7ac6decee44bb162516194704e90
+  metadata.gz: 061c506cbf2b89efb7f6cd0a3c34c3899fedf6e1
+  data.tar.gz: a5a41b7f39a7fa9bb3a0144d73ce16ebb9785051
 SHA512:
-  metadata.gz: 4ddc48aa325b0f0c2c036a0d82d0a13fd6cabcd9a7b947bfdb1dfd442d74f966a910ed197b09babb56491f8e1bc02e01d00bf1cc1fbf7487e813ec34247f9870
-  data.tar.gz: 6e9025a3314ae89811819c131a0c281a3e5aafbc9f8e397a3648d32e5cb2c561cc5142c1d671b7dcb6d024f1fc3ac8b2e3060264069430e34fdd26bad8aa87a2
+  metadata.gz: b639f26cb03a65f90db1bd19a40d9acbcffc4dba82a24aa99ea7307f82c90ec78814924eb064b377f4876cbfe79131ae6b2f77295d3112b34a5c7d4de2ee546d
+  data.tar.gz: e0d4542426510bb753a270016498566c8111566f3304c3d20dc091217950814cdaf36f2fc1e2e9682a84ea481b8f7d02ffffa64526e5e6705fa7b21d3feb1b83

data/VERSION

@@ -1 +1 @@
-13.5.3
+13.6.0

data/bin/chef-shell

@@ -23,6 +23,8 @@ begin
 rescue LoadError
 end
 
+Encoding.default_external = Encoding::UTF_8
+
 require "irb"
 require "irb/completion"
 require "irb/ext/save-history"

data/distro/powershell/chef/chef.psm1

@@ -282,6 +282,24 @@ function Run-ExecutableAndWait($AppPath, $ArgumentString) {
           break
         }
       }
+    } else {
+      # For some reason, you can't read from the read-end of the read-pipe before the write end has started
+      # to write.  Otherwise the process just blocks forever and never returns from the read.  So we peek
+      # at the pipe until there is something.  But don't peek too eagerly.  This is stupid stupid stupid.
+      # There must be a way to do this without having to peek at a pipe first but I have not found it.
+      #
+      # Note to the future intrepid soul who wants to fix this:
+      # 0) This is related to unreasonable CPU usage by the wrapper PS script on a 1 VCPU VM (either Hyper-V
+      #    or VirtualBox) running a consumer Windows SKU (Windows 10 for example...).  Test it there.
+      # 1) Maybe this entire script is unnecessary and the bugs mentioned below have been fixed or don't need
+      #    to be supported.
+      # 2) The server and consumer windows schedulers have different defaults. I had a hard time reproducing
+      #    any issue on a win 2008 on win 2012 server default setup.  See the "foreground application scheduler
+      #    priority" setting to see if it's relevant.
+      # 3) This entire endeavor is silly anyway - why are we reimplementing process forking all over? Maybe try
+      #    to get the folks above to accept patches instead of extending this crazy script.
+      Start-Sleep -s 1
+      # Start-Sleep -m 100
     }
     
     if ($global:LASTEXITCODE -ne [Chef.Kernel32]::STILL_ACTIVE) {
@@ -434,9 +452,12 @@ Export-ModuleMember -function chef-solo
 Export-ModuleMember -function chef-windows-service
 Export-ModuleMember -function knife
 
-# To debug this module, uncomment the line below and then run the following.
+# To debug this module, uncomment the line below
 # Export-ModuleMember -function Run-RubyCommand
+
+# Then run the following to reload the module.  Use puts_argv as a helpful debug executable.
 # Remove-Module chef
 # Import-Module chef
-# "puts ARGV" | Out-File C:\opscode\chef\bin\puts_args
+# "puts ARGV" | Out-File C:\opscode\chef\bin\puts_args -Encoding ASCII
+# Copy-Item C:\opscode\chef\bin\ohai.bat C:\opscode\chef\bin\puts_args.bat
 # Run-RubyCommand puts_args 'Here' "are" some '"very interesting"' 'arguments[to]' "`"try out`""

data/lib/chef/application/client.rb

@@ -501,7 +501,7 @@ class Chef::Application::Client < Chef::Application
       # we need to sleep again after reconfigure to avoid stampeding when logrotate runs out of cron
       if signal == RECONFIGURE_SIGNAL
         reconfigure
-        interval_sleep(sleep)
+        interval_sleep(sec)
       end
     else
       sleep(sec)

data/lib/chef/chef_fs/config.rb

@@ -66,7 +66,7 @@ class Chef
       # upgrade/migration of older Chef Servers, so they should be considered
       # frozen in time.
 
-      CHEF_11_OSS_STATIC_OBJECTS = %w{cookbooks cookbook_artifacts data_bags environments roles}.freeze
+      CHEF_11_OSS_STATIC_OBJECTS = %w{cookbooks data_bags environments roles}.freeze
       CHEF_11_OSS_DYNAMIC_OBJECTS = %w{clients nodes users}.freeze
       RBAC_OBJECT_NAMES = %w{acls containers groups }.freeze
       CHEF_12_OBJECTS = %w{ cookbook_artifacts policies policy_groups client_keys }.freeze

data/lib/chef/chef_fs/data_handler/data_bag_item_data_handler.rb

@@ -5,6 +5,8 @@ class Chef
   module ChefFS
     module DataHandler
       class DataBagItemDataHandler < DataHandlerBase
+        RESERVED_NAMES = /node|role|environment|client/
+
         def normalize(data_bag_item, entry)
           # If it's wrapped with raw_data, unwrap it.
           if data_bag_item["json_class"] == "Chef::DataBagItem" && data_bag_item["raw_data"]
@@ -43,6 +45,7 @@ class Chef
         end
 
         # Verify that the JSON hash for this type has a key that matches its name.
+        # Also check that the data bag name is not a reserved search index name.
         #
         # @param object [Object] JSON hash of the object
         # @param entry [Chef::ChefFS::FileSystem::BaseFSObject] filesystem object we are verifying
@@ -52,6 +55,8 @@ class Chef
           base_name = remove_dot_json(entry.name)
           if object["raw_data"]["id"] != base_name
             yield("ID in #{entry.path_for_printing} must be '#{base_name}' (is '#{object['raw_data']['id']}')")
+          elsif entry.parent.name =~ RESERVED_NAMES
+            yield("Data bag name ('#{entry.parent.name}') must not match #{RESERVED_NAMES.inspect}")
           end
         end
 

data/lib/chef/client.rb

@@ -605,6 +605,9 @@ class Chef
       filter = Chef::Config[:minimal_ohai] ? %w{fqdn machinename hostname platform platform_version os os_version} : nil
       ohai.all_plugins(filter)
       events.ohai_completed(node)
+    rescue Ohai::Exceptions::CriticalPluginFailure => e
+      Chef::Log.error("Critical Ohai plugins failed: #{e.message}")
+      exit(false)
     end
 
     #

data/lib/chef/cookbook/synchronizer.rb

@@ -154,6 +154,7 @@ class Chef
 
       queue = Chef::Util::ThreadedJobQueue.new
 
+      Chef::Log.warn("skipping cookbook synchronization! DO NOT LEAVE THIS ENABLED IN PRODUCTION!!!") if Chef::Config[:skip_cookbook_sync]
       files.each do |file|
         queue << lambda do |lock|
           full_file_path = sync_file(file)
@@ -279,10 +280,7 @@ class Chef
     end
 
     def cached_copy_up_to_date?(local_path, expected_checksum)
-      if Chef::Config[:skip_cookbook_sync]
-        Chef::Log.warn "skipping cookbook synchronization!  DO NOT LEAVE THIS ENABLED IN PRODUCTION!!!"
-        return true
-      end
+      return true if Chef::Config[:skip_cookbook_sync]
       if cache.has_key?(local_path)
         current_checksum = CookbookVersion.checksum_cookbook_file(cache.load(local_path, false))
         expected_checksum == current_checksum

data/lib/chef/data_bag.rb

@@ -33,6 +33,7 @@ class Chef
     include Chef::Mixin::ParamsValidate
 
     VALID_NAME = /^[\.\-[:alnum:]_]+$/
+    RESERVED_NAMES = /node|role|environment|client/
 
     attr_accessor :chef_server_rest
 
@@ -40,6 +41,9 @@ class Chef
       unless name =~ VALID_NAME
         raise Exceptions::InvalidDataBagName, "DataBags must have a name matching #{VALID_NAME.inspect}, you gave #{name.inspect}"
       end
+      if name =~ RESERVED_NAMES
+        raise Exceptions::InvalidDataBagName, "DataBags may not have a name matching #{RESERVED_NAMES.inspect}, you gave #{name.inspect}"
+      end
     end
 
     # Create a new Chef::DataBag

data/lib/chef/deprecated.rb

@@ -258,6 +258,16 @@ class Chef
       end
     end
 
+    class DeployResource < Base
+      def id
+        21
+      end
+
+      def target
+        "deploy_resource.html"
+      end
+    end
+
     # id 3694 was deleted
 
     class Generic < Base

data/lib/chef/knife/client_delete.rb

@@ -32,7 +32,7 @@ class Chef
        :long => "--delete-validators",
        :description => "Force deletion of client if it's a validator"
 
-      banner "knife client delete [CLIENT[,CLIENT]] (options)"
+      banner "knife client delete [CLIENT [CLIENT]] (options)"
 
       def run
         if @name_args.length == 0

data/lib/chef/knife/node_delete.rb

@@ -27,7 +27,7 @@ class Chef
         require "chef/json_compat"
       end
 
-      banner "knife node delete [NODE[,NODE]] (options)"
+      banner "knife node delete [NODE [NODE]] (options)"
 
       def run
         if @name_args.length == 0

data/lib/chef/knife/node_run_list_add.rb

@@ -27,7 +27,7 @@ class Chef
         require "chef/json_compat"
       end
 
-      banner "knife node run_list add [NODE] [ENTRY[,ENTRY]] (options)"
+      banner "knife node run_list add [NODE] [ENTRY [ENTRY]] (options)"
 
       option :after,
         :short => "-a ITEM",

data/lib/chef/knife/node_run_list_remove.rb

@@ -27,7 +27,7 @@ class Chef
         require "chef/json_compat"
       end
 
-      banner "knife node run_list remove [NODE] [ENTRY[,ENTRY]] (options)"
+      banner "knife node run_list remove [NODE] [ENTRY [ENTRY]] (options)"
 
       def run
         node = Chef::Node.load(@name_args[0])

data/lib/chef/knife/role_env_run_list_add.rb

@@ -27,7 +27,7 @@ class Chef
         require "chef/json_compat"
       end
 
-      banner "knife role env_run_list add [ROLE] [ENVIRONMENT] [ENTRY[,ENTRY]] (options)"
+      banner "knife role env_run_list add [ROLE] [ENVIRONMENT] [ENTRY [ENTRY]] (options)"
 
       option :after,
         :short => "-a ITEM",

data/lib/chef/knife/role_run_list_add.rb

@@ -27,7 +27,7 @@ class Chef
         require "chef/json_compat"
       end
 
-      banner "knife role run_list add [ROLE] [ENTRY[,ENTRY]] (options)"
+      banner "knife role run_list add [ROLE] [ENTRY [ENTRY]] (options)"
 
       option :after,
         :short => "-a ITEM",

data/lib/chef/mixin/user_context.rb

@@ -23,7 +23,7 @@ class Chef
     module UserContext
 
       def with_user_context(user, password, domain = nil, &block)
-        if node["platform_family"] != "windows"
+        unless Chef::Platform.windows?
           raise Exceptions::UnsupportedPlatform, "User context impersonation is supported only on the Windows platform"
         end
 

data/lib/chef/platform/rebooter.rb

@@ -33,14 +33,18 @@ class Chef
         def reboot!(node)
           reboot_info = node.run_context.reboot_info
 
-          cmd = if Chef::Platform.windows?
+          cmd = case
+                when Chef::Platform.windows?
                   # should this do /f as well? do we then need a minimum delay to let apps quit?
                   # Use explicit path to shutdown.exe, to protect against https://github.com/chef/chef/issues/5594
                   windows_shutdown_path = "#{ENV['SYSTEMROOT']}/System32/shutdown.exe"
                   "#{windows_shutdown_path} /r /t #{reboot_info[:delay_mins] * 60} /c \"#{reboot_info[:reason]}\""
+                when node["os"] == "solaris2"
+                  # SysV-flavored shutdown
+                  "shutdown -i6 -g#{reboot_info[:delay_mins]} -y \"#{reboot_info[:reason]}\" &"
                 else
-                  # probably Linux-only.
-                  "shutdown -r +#{reboot_info[:delay_mins]} \"#{reboot_info[:reason]}\""
+                  # Linux/BSD/Mac/AIX and other systems with BSD-ish shutdown
+                  "shutdown -r +#{reboot_info[:delay_mins]} \"#{reboot_info[:reason]}\" &"
                 end
 
           msg = "Rebooting server at a recipe's request. Details: #{reboot_info.inspect}"

data/lib/chef/provider/dsc_script.rb

@@ -161,7 +161,11 @@ class Chef
             if resource.changes_state?
               # We ignore the last log message because it only contains the time it took, which looks weird
               cleaned_messages = resource.change_log[0..-2].map { |c| c.sub(/^#{Regexp.escape(resource.name)}/, "").strip }
-              "converge DSC resource #{resource.name} by #{cleaned_messages.find_all { |c| c != '' }.join("\n")}"
+              unless cleaned_messages.empty?
+                "converge DSC resource #{resource.name} by #{cleaned_messages.find_all { |c| c != '' }.join("\n")}"
+              else
+                "converge DSC resource #{resource.name}"
+              end
             else
               # This is needed because a dsc script can have resources that are both converged and not
               "converge DSC resource #{resource.name} by doing nothing because it is already converged"

data/lib/chef/provider/package.rb

@@ -323,10 +323,38 @@ class Chef
       #
       # Note that most likely we need a spaceship operator on versions that subclasses can implement
       # and we should have `version_compare(v1, v2)` that returns `v1 <=> v2`.
+
+      # This method performs a strict equality check between two strings representing version numbers
       #
+      # This function will eventually be deprecated in favour of the below version_equals function.
+
       def target_version_already_installed?(current_version, target_version)
-        return false unless current_version && target_version
-        current_version == target_version
+        version_equals?(current_version, target_version)
+      end
+
+      # Note that most likely we need a spaceship operator on versions that subclasses can implement
+      # and we should have `version_compare(v1, v2)` that returns `v1 <=> v2`.
+
+      # This method performs a strict equality check between two strings representing version numbers
+      #
+      def version_equals?(v1, v2)
+        return false unless v1 && v2
+        v1 == v2
+      end
+
+      # This function compares two version numbers and returns 'spaceship operator' style results, ie:
+      # if v1 < v2 then return -1
+      # if v1 = v2 then return  0
+      # if v1 > v2 then return  1
+      # if v1 and v2 are not comparable then return nil
+      #
+      # By default, this function will use Gem::Version comparison. Subclasses can reimplement this method
+      # for package-management system specific versions.
+      def version_compare(v1, v2)
+        gem_v1 = Gem::Version.new(v1)
+        gem_v2 = Gem::Version.new(v2)
+
+        gem_v1 <=> gem_v2
       end
 
       # Check the current_version against the new_resource.version, possibly using fuzzy
@@ -439,16 +467,19 @@ class Chef
             each_package do |package_name, new_version, current_version, candidate_version|
               case action
               when :upgrade
-                if target_version_already_installed?(current_version, new_version)
+                if version_equals?(current_version, new_version)
                   # this is an odd use case
                   Chef::Log.debug("#{new_resource} #{package_name} #{new_version} is already installed -- you are equality pinning with an :upgrade action, this may be deprecated in the future")
                   target_version_array.push(nil)
-                elsif target_version_already_installed?(current_version, candidate_version)
+                elsif version_equals?(current_version, candidate_version)
                   Chef::Log.debug("#{new_resource} #{package_name} #{candidate_version} is already installed")
                   target_version_array.push(nil)
                 elsif candidate_version.nil?
                   Chef::Log.debug("#{new_resource} #{package_name} has no candidate_version to upgrade to")
                   target_version_array.push(nil)
+                elsif version_compare(current_version, candidate_version) == 1 && !new_resource.allow_downgrade
+                  Chef::Log.debug("#{new_resource} #{package_name} has installed version #{current_version}, which is newer than available version #{candidate_version}. Skipping...)")
+                  target_version_array.push(nil)
                 else
                   Chef::Log.debug("#{new_resource} #{package_name} is out of date, will upgrade to #{candidate_version}")
                   target_version_array.push(candidate_version)

data/lib/chef/provider/package/apt.rb

@@ -127,6 +127,13 @@ class Chef
 
         private
 
+        def version_compare(v1, v2)
+          gem_v1 =  v1.gsub(/[_+]/, "+" => "-", "_" => "-") unless v1.nil?
+          gem_v2 =  v2.gsub(/[_+]/, "+" => "-", "_" => "-") unless v2.nil?
+
+          Gem::Version.new(gem_v1) <=> Gem::Version.new(gem_v2)
+        end
+
         # Runs command via shell_out with magic environment to disable
         # interactive prompts. Command is run with default localization rather
         # than forcing locale to "C", so command output may not be stable.

data/lib/chef/provider/package/chocolatey.rb

@@ -141,6 +141,17 @@ EOS
 
         private
 
+        def version_compare(v1, v2)
+          if v1 == "latest" || v2 == "latest"
+            return 0
+          end
+
+          gem_v1 = Gem::Version.new(v1)
+          gem_v2 = Gem::Version.new(v2)
+
+          gem_v1 <=> gem_v2
+        end
+
         # Magic to find where chocolatey is installed in the system, and to
         # return the full path of choco.exe
         #
@@ -226,15 +237,20 @@ EOS
         #
         # @return [Hash] name-to-version mapping of available packages
         def available_packages
-          @available_packages ||=
-            begin
-              cmd = [ "list -r #{package_name_array.join ' '}" ]
-              cmd.push( "-source #{new_resource.source}" ) if new_resource.source
-              raw = parse_list_output(*cmd)
-              raw.keys.each_with_object({}) do |name, available|
-                available[name] = desired_name_versions[name] || raw[name]
+          return @available_packages if @available_packages
+          @available_packages = {}
+          package_name_array.each do |pkg|
+            available_versions =
+              begin
+                cmd = [ "list -r #{pkg}" ]
+                cmd.push( "-source #{new_resource.source}" ) if new_resource.source
+                raw = parse_list_output(*cmd)
+                raw.keys.each_with_object({}) do |name, available|
+                  available[name] = desired_name_versions[name] || raw[name]
+                end
               end
-            end
+            @available_packages.merge! available_versions
+          end
           @available_packages
         end
 

data/lib/chef/provider/package/dnf.rb

@@ -35,13 +35,18 @@ class Chef
         use_multipackage_api
         use_package_name_for_source
 
-        provides :package, platform_family: %w{fedora amazon} do
-          which("dnf") && shell_out("rpm -q dnf").stdout =~ /^dnf-[1-9]/
-        end
+        # all rhel variants >= 8 will use DNF
+        provides :package, platform_family: "rhel", platform_version: ">= 8"
+
+        # fedora >= 22 uses DNF
+        provides :package, platform: "fedora", platform_version: ">= 22"
 
-        provides :package, platform_family: %w{rhel}, platform_version: ">= 8"
+        # amazon will eventually use DNF
+        provides :package, platform: "amazon" do
+          which("dnf")
+        end
 
-        provides :dnf_package, os: "linux"
+        provides :dnf_package
 
         #
         # Most of the magic in this class happens in the python helper script.  The ruby side of this
@@ -126,6 +131,10 @@ class Chef
           end
         end
 
+        def version_compare(v1, v2)
+          python_helper.compare_versions(v1, v2)
+        end
+
         # @returns Array<Version>
         def available_version(index)
           @available_version ||= []

data/lib/chef/provider/package/dnf/dnf_helper.py

@@ -26,6 +26,14 @@ def flushcache():
         pass
     get_sack().load_system_repo(build_cache=True)
 
+def versioncompare(versions):
+    sack = get_sack()
+    if (versions[0] is None) or (versions[1] is None):
+      sys.stdout.write('0\n')
+    else:
+      evr_comparison = sack.evr_cmp(versions[0], versions[1])
+      sys.stdout.write('{}\n'.format(evr_comparison))
+
 def query(command):
     sack = get_sack()
 
@@ -86,5 +94,7 @@ while 1:
         query(command)
     elif command['action'] == "flushcache":
         flushcache()
+    elif command['action'] == "versioncompare":
+        versioncompare(command['versions'])
     else:
         raise RuntimeError("bad command")