chef 14.1.12 → 14.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a19bd139f5445bf506bae590535aeb2f88b4ad9afdfd1c33fa93433aca315b4
-  data.tar.gz: 84c7ecd4b5b4dc0c2e996031eaf7cd250c0cefb2d44c8c1fd9d811a5cea117d7
+  metadata.gz: 7767da10319c8ca381da651de33dc1c9a9a7c75e8565876923d524dc6139ff31
+  data.tar.gz: e068617337872d008492234873a0ba80f0df5909cb216b65608e08ce65b825f1
 SHA512:
-  metadata.gz: 22a417c2427576c0f50d73e1ad2b2f73af7d1004e7de17f9c23ca944fa816c682daed3c830f70b517467071f532d6c092f80a9a165654e1f8fa093e1730dbce3
-  data.tar.gz: f1e674b823e0ecb1e476c7a6e4ab842e986d7d6380b6fb260f9b76331eed251a8b5a6033eac835ba5f142d724fc1de476f502a345fdc96b01b17920401bf6b42
+  metadata.gz: c8d2726c84170ac1648d9459b717fa2483c4555d99e93b676d93f2cade7a16aa1d85846a1c68122b16e385528628247511f22a87130f171e851ef954c0831d11
+  data.tar.gz: a2ea71a5f80ed006c35c1e3b8b620a703dc365d267456d0e41b441e8039fd9df7c6a15ab1b58babae336fc6d529d4e3be99cf4801bb0ec324938fc4ceeae9be5

data/Gemfile

@@ -11,14 +11,9 @@ gem "chef-config", path: File.expand_path("../chef-config", __FILE__) if File.ex
 gem "cheffish", "~> 14"
 
 group(:omnibus_package) do
-  # override for unf_ext for inspec 2 until
-  # https://github.com/knu/ruby-unf_ext/pull/39
-  # is merged and released
-  gem "unf_ext", "=0.0.7.6", :git => "https://github.com/jquick/ruby-unf_ext.git"
-
   gem "appbundler"
   gem "rb-readline"
-  gem "inspec", "~> 2"
+  gem "inspec-core", "~> 2"
   gem "chef-vault"
 end
 

data/VERSION

@@ -1 +1 @@
-14.1.12
+14.2.0

data/chef.gemspec

@@ -19,13 +19,12 @@ Gem::Specification.new do |s|
 
   s.add_dependency "mixlib-cli", "~> 1.7"
   s.add_dependency "mixlib-log", "~> 2.0", ">= 2.0.3"
-  s.add_dependency "mixlib-authentication", "~> 2.0"
+  s.add_dependency "mixlib-authentication", "~> 2.1"
   s.add_dependency "mixlib-shellout", "~> 2.0"
   s.add_dependency "mixlib-archive", "~> 0.4"
   s.add_dependency "ohai", "~> 14.0"
 
-  # ffi 1.9.22+1.9.23 are buggy in our spec/unit/application/client_spec.rb tests on el6/el7
-  s.add_dependency "ffi", "< 1.9.22"
+  s.add_dependency "ffi", "~> 1.9", ">= 1.9.25"
   s.add_dependency "ffi-yajl", "~> 2.2"
   s.add_dependency "net-ssh", "~> 4.2"
   s.add_dependency "net-ssh-multi", "~> 1.2", ">= 1.2.1"

data/lib/chef/chef_fs/data_handler/data_handler_base.rb

@@ -63,11 +63,15 @@ class Chef
         def normalize_hash(object, defaults)
           # Make a normalized result in the specified order for diffing
           result = {}
-          defaults.each_pair do |key, default|
-            result[key] = object.has_key?(key) ? object[key] : default
+          defaults.each_pair do |key, value|
+            result[key] = object.is_a?(Hash) && object.key?(key) ? object[key] : value
           end
-          object.each_pair do |key, value|
-            result[key] = value if !result.has_key?(key)
+          if object.is_a?(Hash)
+            object.each_pair do |key, value|
+              result[key] = value unless result.key?(key)
+            end
+          else
+            Chef::Log.warn "Encountered invalid object during normalization. Using these defaults #{defaults}"
           end
           result
         end

data/lib/chef/cookbook/manifest_v0.rb

@@ -31,7 +31,7 @@ class Chef
         response[:all_files] = COOKBOOK_SEGMENTS.inject([]) do |memo, segment|
           next memo if hash[segment].nil? || hash[segment].empty?
           hash[segment].each do |file|
-            file["name"] = "#{segment}/#{file["name"]}" unless segment == "root_files"
+            file["name"] = "#{segment}/#{file["name"]}"
             memo << file
           end
           response.delete(segment)
@@ -49,7 +49,7 @@ class Chef
           if COOKBOOK_SEGMENTS.include?(parent)
             memo[parent] ||= []
             files[parent].each do |file|
-              file["name"] = file["name"].split("/")[1] unless parent == "root_files"
+              file["name"] = file["name"].split("/")[1]
               file.delete("full_path")
               memo[parent] << file
             end

data/lib/chef/cookbook_manifest.rb

@@ -204,7 +204,8 @@ class Chef
 
     def root_files
       manifest[:all_files].select do |file|
-        file[:name].split("/").length == 1
+        segment, name = file[:name].split("/")
+        name.nil? || segment == "root_files"
       end
     end
 
@@ -271,7 +272,7 @@ class Chef
         next if parts[0] == ".."
 
         # if we have a root_file, such as metadata.rb, the first part will be "."
-        return [ pathname.to_s, pathname.to_s, "default" ] if parts.length == 1
+        return [ "root_files/#{pathname}", pathname.to_s, "default" ] if parts.length == 1
 
         segment = parts[0]
 

data/lib/chef/cookbook_version.rb

@@ -131,7 +131,7 @@ class Chef
     def attribute_filenames_by_short_filename
       @attribute_filenames_by_short_filename ||= begin
         name_map = filenames_by_name(files_for("attributes"))
-        root_alias = cookbook_manifest.root_files.find { |record| record[:name] == "attributes.rb" }
+        root_alias = cookbook_manifest.root_files.find { |record| record[:name] == "root_files/attributes.rb" }
         name_map["default"] = root_alias[:full_path] if root_alias
         name_map
       end
@@ -140,7 +140,7 @@ class Chef
     def recipe_filenames_by_name
       @recipe_filenames_by_name ||= begin
         name_map = filenames_by_name(files_for("recipes"))
-        root_alias = cookbook_manifest.root_files.find { |record| record[:name] == "recipe.rb" }
+        root_alias = cookbook_manifest.root_files.find { |record| record[:name] == "root_files/recipe.rb" }
         if root_alias
           Chef::Log.error("Cookbook #{name} contains both recipe.rb and and recipes/default.rb, ignoring recipes/default.rb") if name_map["default"]
           name_map["default"] = root_alias[:full_path]
@@ -239,6 +239,7 @@ class Chef
                               filename.map { |name| "  #{File.join(segment.to_s, name)}" }
                             else
                               [
+                                "  #{segment}/host-#{node[:fqdn]}/#{filename}",
                                 "  #{segment}/#{node[:platform]}-#{node[:platform_version]}/#{filename}",
                                 "  #{segment}/#{node[:platform]}/#{filename}",
                                 "  #{segment}/default/#{filename}",

data/lib/chef/guard_interpreter/default_guard_interpreter.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Edwards (<adamed@chef.io>)
-# Copyright:: Copyright 2014-2017, Chef Software Inc.
+# Copyright:: Copyright 2014-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -33,7 +33,7 @@ class Chef
       public
 
       def evaluate
-        result = shell_out_with_systems_locale(@command, @command_opts)
+        result = shell_out(@command, default_env: false, **@command_opts)
         Chef::Log.debug "Command failed: #{result.stderr}" unless result.status.success?
         result.status.success?
       # Timeout fails command rather than chef-client run, see:

data/lib/chef/http/auth_credentials.rb

@@ -28,8 +28,10 @@ class Chef
     class AuthCredentials
       attr_reader :client_name, :key
 
-      def initialize(client_name = nil, key = nil)
-        @client_name, @key = client_name, key
+      def initialize(client_name = nil, key = nil, use_ssh_agent: false)
+        @client_name = client_name
+        @key = key
+        @use_ssh_agent = use_ssh_agent
       end
 
       def sign_requests?
@@ -48,7 +50,7 @@ class Chef
         host = request_params.delete(:host) || "localhost"
 
         sign_obj = Mixlib::Authentication::SignedHeaderAuth.signing_object(request_params)
-        signed = sign_obj.sign(key).merge({ :host => host })
+        signed = sign_obj.sign(key, use_ssh_agent: @use_ssh_agent).merge({ :host => host })
         signed.inject({}) { |memo, kv| memo["#{kv[0].to_s.upcase}"] = kv[1]; memo }
       end
 

data/lib/chef/http/authenticator.rb

@@ -40,7 +40,7 @@ class Chef
         @sign_request = true
         @signing_key_filename = opts[:signing_key_filename]
         @key = load_signing_key(opts[:signing_key_filename], opts[:raw_key])
-        @auth_credentials = AuthCredentials.new(opts[:client_name], @key)
+        @auth_credentials = AuthCredentials.new(opts[:client_name], @key, use_ssh_agent: opts[:ssh_agent_signing])
         @version_class = opts[:version_class]
         @api_version = opts[:api_version]
       end
@@ -89,12 +89,15 @@ class Chef
         else
           return nil
         end
-        @key = OpenSSL::PKey::RSA.new(@raw_key)
+        # Pass in '' as the passphrase to avoid OpenSSL prompting on the TTY if
+        # given an encrypted key. This also helps if using a single file for
+        # both the public and private key with ssh-agent mode.
+        @key = OpenSSL::PKey::RSA.new(@raw_key, "")
       rescue SystemCallError, IOError => e
         Chef::Log.warn "Failed to read the private key #{key_file}: #{e.inspect}"
         raise Chef::Exceptions::PrivateKeyMissing, "I cannot read #{key_file}, which you told me to use to sign requests!"
       rescue OpenSSL::PKey::RSAError
-        msg = "The file #{key_file} or :raw_key option does not contain a correctly formatted private key.\n"
+        msg = "The file #{key_file} or :raw_key option does not contain a correctly formatted private key or the key is encrypted.\n"
         msg << "The key file should begin with '-----BEGIN RSA PRIVATE KEY-----' and end with '-----END RSA PRIVATE KEY-----'"
         raise Chef::Exceptions::InvalidPrivateKey, msg
       end

data/lib/chef/knife.rb

@@ -234,7 +234,7 @@ class Chef
       end
     end
 
-    OFFICIAL_PLUGINS = %w{ec2 rackspace windows openstack terremark bluebox}
+    OFFICIAL_PLUGINS = %w{ec2 rackspace windows openstack azure google linode push vcenter lpar}
 
     class << self
       def list_commands(preferred_category = nil)
@@ -258,7 +258,6 @@ class Chef
         caller_line.split(/:\d+/).first
       end
 
-      # :nodoc:
       # Error out and print usage. probably because the arguments given by the
       # user could not be resolved to a subcommand.
       # @api private
@@ -272,10 +271,8 @@ class Chef
 
         if category_commands = guess_category(args)
           list_commands(category_commands)
-        elsif missing_plugin = ( OFFICIAL_PLUGINS.find { |plugin| plugin == args[0] } )
-          ui.info("The #{missing_plugin} commands were moved to plugins in Chef 0.10")
-          ui.info("You can install the plugin with `(sudo) gem install knife-#{missing_plugin}`")
-          ui.info("Use `chef gem install knife-#{missing_plugin}` instead if using ChefDK")
+        elsif OFFICIAL_PLUGINS.include?(args[0]) # command was an uninstalled official chef knife plugin
+          ui.info("Use `chef gem install knife-#{args[0]}` to install the plugin into ChefDK")
         else
           list_commands
         end

data/lib/chef/knife/configure.rb

@@ -69,15 +69,12 @@ class Chef
 
       def run
         FileUtils.mkdir_p(chef_config_path)
-        config_file = File.join(chef_config_path, "credentials")
 
         ask_user_for_config
 
-        config_file = File.expand_path(config_file)
-        if File.exist?(config_file)
-          confirm("Overwrite #{config_file}")
-        end
-        ::File.open(config_file, "w") do |f|
+        confirm("Overwrite #{config_file_path}") if ::File.exist?(config_file_path)
+
+        ::File.open(config_file_path, "w") do |f|
           f.puts <<-EOH
 [default]
 client_name     = '#{new_client_name}'
@@ -110,7 +107,7 @@ EOH
           ui.msg("*****")
         end
 
-        ui.msg("Configuration file written to #{config[:config_file]}")
+        ui.msg("Knife configuration file written to #{config_file_path}")
       end
 
       def ask_user_for_config
@@ -129,14 +126,21 @@ EOH
         @new_client_key = File.expand_path(@new_client_key)
       end
 
+      # @return [String] our best guess at what the servername should be using Ohai data and falling back to localhost
       def guess_servername
         o = Ohai::System.new
         o.all_plugins(%w{ os hostname fqdn })
         o[:fqdn] || o[:machinename] || o[:hostname] || "localhost"
       end
 
+      # @return [String] the path to the user's .chef directory
       def chef_config_path
-        Chef::Util::PathHelper.home(".chef")
+        @chef_config_path ||= Chef::Util::PathHelper.home(".chef")
+      end
+
+      # @return [String] the full path to the config file (credential file)
+      def config_file_path
+        @config_file_path ||= ::File.expand_path(::File.join(chef_config_path, "credentials"))
       end
     end
   end

data/lib/chef/knife/raw.rb

@@ -39,10 +39,15 @@ class Chef
         :default => false,
         :description => "Use webui proxy authentication. Client key must be the webui key."
 
+      # We need a custom HTTP client class here because we don't want to even
+      # try to decode the body, in case we get back corrupted JSON or whatnot.
       class RawInputServerAPI < Chef::HTTP
         def initialize(options = {})
+          # If making a change here, also update Chef::ServerAPI.
           options[:client_name] ||= Chef::Config[:node_name]
-          options[:signing_key_filename] ||= Chef::Config[:client_key]
+          options[:raw_key] ||= Chef::Config[:client_key_contents]
+          options[:signing_key_filename] ||= Chef::Config[:client_key] unless options[:raw_key]
+          options[:ssh_agent_signing] ||= Chef::Config[:ssh_agent_signing]
           super(Chef::Config[:chef_server_url], options)
         end
         use Chef::HTTP::JSONOutput

data/lib/chef/mixin/shell_out.rb

@@ -1,6 +1,6 @@
 #--
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright 2010-2017, Chef Software Inc.
+# Copyright:: Copyright 2010-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -104,13 +104,17 @@ class Chef
       # generally must support UTF-8 unicode.
       def shell_out(*args, **options)
         options = options.dup
-        env_key = options.has_key?(:env) ? :env : :environment
-        options[env_key] = {
-          "LC_ALL" => Chef::Config[:internal_locale],
-          "LANGUAGE" => Chef::Config[:internal_locale],
-          "LANG" => Chef::Config[:internal_locale],
-          env_path => sanitized_path,
-        }.update(options[env_key] || {})
+        default_env = options.delete(:default_env)
+        default_env = true if default_env.nil?
+        if default_env
+          env_key = options.key?(:env) ? :env : :environment
+          options[env_key] = {
+            "LC_ALL" => Chef::Config[:internal_locale],
+            "LANGUAGE" => Chef::Config[:internal_locale],
+            "LANG" => Chef::Config[:internal_locale],
+            env_path => sanitized_path,
+          }.update(options[env_key] || {})
+        end
         shell_out_command(*args, **options)
       end
 
@@ -121,14 +125,12 @@ class Chef
         cmd
       end
 
-      def shell_out_with_systems_locale(*command_args)
-        shell_out_command(*command_args)
+      def shell_out_with_systems_locale(*args, **options) # FIXME: deprecate
+        shell_out(*args, default_env: false, **options)
       end
 
-      def shell_out_with_systems_locale!(*command_args)
-        cmd = shell_out_with_systems_locale(*command_args)
-        cmd.error!
-        cmd
+      def shell_out_with_systems_locale!(*args, **options) # FIXME: deprecate
+        shell_out!(*args, default_env: false, **options)
       end
 
       # Helper for subclasses to convert an array of string args into a string.  It

data/lib/chef/provider/execute.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright 2008-2017, Chef Software Inc.
+# Copyright:: Copyright 2008-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -27,7 +27,7 @@ class Chef
 
       provides :execute
 
-      def_delegators :new_resource, :command, :returns, :environment, :user, :domain, :password, :group, :cwd, :umask, :creates, :elevated
+      def_delegators :new_resource, :command, :returns, :environment, :user, :domain, :password, :group, :cwd, :umask, :creates, :elevated, :default_env
 
       def load_current_resource
         current_resource = Chef::Resource::Execute.new(new_resource.name)
@@ -55,7 +55,7 @@ class Chef
 
         converge_by("execute #{description}") do
           begin
-            shell_out_with_systems_locale!(command, opts)
+            shell_out!(command, opts)
           rescue Mixlib::ShellOut::ShellCommandFailed
             if sensitive?
               ex = Mixlib::ShellOut::ShellCommandFailed.new("Command execution failed. STDOUT/STDERR suppressed for sensitive resource")
@@ -97,6 +97,7 @@ class Chef
         opts[:group]       = group if group
         opts[:cwd]         = cwd if cwd
         opts[:umask]       = umask if umask
+        opts[:default_env] = default_env
         opts[:log_level]   = :info
         opts[:log_tag]     = new_resource.to_s
         if (logger.info? || live_stream?) && !sensitive?

data/lib/chef/provider/git.rb

@@ -213,7 +213,7 @@ class Chef
             #   which we can fix by replacing them all with our target url (hence the --replace-all option)
 
             if multiple_remotes?(remote_status) || !remote_matches?(remote_url, remote_status)
-              git("config", "--replace-all", "remote.#{remote_name}.url", remote_url, cwd: cwd)
+              git("config", "--replace-all", "remote.#{remote_name}.url", %{"#{remote_url}"}, cwd: cwd)
             end
           when 1
             git("remote", "add", remote_name, remote_url, cwd: cwd)

data/lib/chef/provider/package/dnf.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright 2016-2017, Chef Software Inc.
+# Copyright:: Copyright 2016-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -95,10 +95,10 @@ class Chef
 
         def install_package(names, versions)
           if new_resource.source
-            dnf(options, "-y install", new_resource.source)
+            dnf(options, "-y", "install", new_resource.source)
           else
             resolved_names = names.each_with_index.map { |name, i| available_version(i).to_s unless name.nil? }
-            dnf(options, "-y install", resolved_names)
+            dnf(options, "-y", "install", resolved_names)
           end
           flushcache
         end
@@ -108,7 +108,7 @@ class Chef
 
         def remove_package(names, versions)
           resolved_names = names.each_with_index.map { |name, i| installed_version(i).to_s unless name.nil? }
-          dnf(options, "-y remove", resolved_names)
+          dnf(options, "-y", "remove", resolved_names)
           flushcache
         end
 
@@ -167,7 +167,7 @@ class Chef
         end
 
         def dnf(*args)
-          shell_out_with_timeout!(a_to_s("dnf", *args))
+          shell_out_compact_timeout!("dnf", *args)
         end
 
         def safe_version_array

data/lib/chef/provider/package/windows.rb

@@ -39,6 +39,13 @@ class Chef
             a.assertion { new_resource.source || msi? }
             a.failure_message Chef::Exceptions::NoWindowsPackageSource, "Source for package #{new_resource.name} must be specified in the resource's source property for package to be installed because the package_name property is used to test for the package installation state for this package type."
           end
+
+          unless uri_scheme?(new_resource.source)
+            requirements.assert(:install) do |a|
+              a.assertion { ::File.exist?(new_resource.source) }
+              a.failure_message Chef::Exceptions::Package, "Source for package #{new_resource.name} does not exist"
+            end
+          end
         end
 
         # load_current_resource is run in Chef::Provider#run_action when not in whyrun_mode?

data/lib/chef/provider/package/yum.rb

@@ -117,10 +117,10 @@ class Chef
           end
 
           if new_resource.source
-            yum(options, "-y #{method}", new_resource.source)
+            yum(options, "-y", method, new_resource.source)
           else
             resolved_names = names.each_with_index.map { |name, i| available_version(i).to_s unless name.nil? }
-            yum(options, "-y #{method}", resolved_names)
+            yum(options, "-y", method, resolved_names)
           end
           flushcache
         end
@@ -130,7 +130,7 @@ class Chef
 
         def remove_package(names, versions)
           resolved_names = names.each_with_index.map { |name, i| installed_version(i).to_s unless name.nil? }
-          yum(options, "-y remove", resolved_names)
+          yum(options, "-y", "remove", resolved_names)
           flushcache
         end
 
@@ -143,14 +143,14 @@ class Chef
         # NB: the yum_package provider manages individual single packages, please do not submit issues or PRs to try to add wildcard
         # support to lock / unlock.  The best solution is to write an execute resource which does a not_if `yum versionlock | grep '^pattern`` kind of approach
         def lock_package(names, versions)
-          yum("-d0 -e0 -y", options, "versionlock add", resolved_package_lock_names(names))
+          yum("-d0", "-e0", "-y", options, "versionlock", "add", resolved_package_lock_names(names))
         end
 
         # NB: the yum_package provider manages individual single packages, please do not submit issues or PRs to try to add wildcard
         # support to lock / unlock.  The best solution is to write an execute resource which does a only_if `yum versionlock | grep '^pattern`` kind of approach
         def unlock_package(names, versions)
           # yum versionlock delete on rhel6 needs the glob nonsense in the following command
-          yum("-d0 -e0 -y", options, "versionlock delete", resolved_package_lock_names(names).map { |n| "'*:#{n}-*'" })
+          yum("-d0", "-e0", "-y", options, "versionlock", "delete", resolved_package_lock_names(names).map { |n| "*:#{n}-*" })
         end
 
         private
@@ -171,7 +171,7 @@ class Chef
         def locked_packages
           @locked_packages ||=
             begin
-              locked = shell_out_with_timeout!("yum versionlock list")
+              locked = yum("versionlock", "list")
               locked.stdout.each_line.map do |line|
                 line.sub(/-[^-]*-[^-]*$/, "").split(":").last.strip
               end
@@ -260,7 +260,7 @@ class Chef
         end
 
         def yum(*args)
-          shell_out_with_timeout!(a_to_s(yum_binary, *args))
+          shell_out_compact_timeout!(yum_binary, *args)
         end
 
         def safe_version_array