chef 16.0.257 → 16.0.275

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1825ecbde1edecfa8a8bfbebe425f053bf176e06553f2c74bbf7d98a2d213967
-  data.tar.gz: 2f661249cfa4551fe980d52810b4e14bb12c776486dce1687a7ccc378e55e8d5
+  metadata.gz: d68311a7ab5b1738bbd739ab5b89069da39f8fc8c639e1d261ac1d5836261bf8
+  data.tar.gz: b5b5cac5dac1febf24cf947c70a868165d9c5dde49fad8a76128055e59b81f85
 SHA512:
-  metadata.gz: 34558ba429fea801f67e4296253e7f42cced441fe6304c7529ab8489740494f10f58ef21993508618fa3f67098f3bab2d552ef1dde984b32dbda1f652264e488
-  data.tar.gz: 33acd0f1f9d3707862505e4273f18525657487e9185586d54196c5d3cff9916f5ec37540c2737eabc439a9128ec99ebc759ce21470ed1c6874b4d0741d17f99b
+  metadata.gz: 758923d89c1f5eadcaf35cfd262f303b6c19309c1ae5a4faa2a7c7d5d2646f0501e76ca00de6a64f02b1ac76fb1b8527e901ab71607bcbc8996992877b51f5de
+  data.tar.gz: 200a93d8b87be3c3e46f764cd24b48414f46e118eb286b092beb7d3bd405905f1573437dd7c9597efb5e6d571876e2776a0f92f958dc966c8bb2c34c517fa130

data/Rakefile

@@ -17,6 +17,9 @@
 # limitations under the License.
 #
 
+# we need this to resolve files required by lib/chef/dist
+$LOAD_PATH.unshift(File.expand_path("../chef-config/lib", __FILE__))
+
 begin
   require_relative "tasks/rspec"
   require_relative "tasks/dependencies"
@@ -27,26 +30,36 @@ rescue LoadError => e
   puts "Skipping missing rake dep: #{e}"
 end
 
+require "bundler/gem_helper"
+
 ENV["CHEF_LICENSE"] = "accept-no-persist"
 
-# hack the chef-config install to run before the traditional install task
-task :super_install do
-  %w{chef-utils chef-config}.each do |gem|
-    path = ::File.join(::File.dirname(__FILE__), gem)
-    Dir.chdir(path)
-    sh("rake install")
+namespace :pre_install do
+  desc "Runs 'rake install' for the gems that live in subdirectories in this repo"
+  task :install_gems_from_dirs do
+    %w{chef-utils chef-config}.each do |gem|
+      path = ::File.join(::File.dirname(__FILE__), gem)
+      Dir.chdir(path) do
+        sh("rake install")
+      end
+    end
   end
 
-# Templating the powershell extensions so we can inject distro constants
-  template_file = ::File.join(::File.dirname(__FILE__), "distro", "templates", "powershell", "chef", "chef.psm1.erb")
-  psm1_path = ::File.join(::File.dirname(__FILE__), "distro", "powershell", "chef")
-  FileUtils.mkdir_p psm1_path
-  template = ERB.new(IO.read(template_file))
-  chef_psm1 = template.result
-  File.open(::File.join(psm1_path, "chef.psm1"), "w") { |f| f.write(chef_psm1) }
+  desc "Renders the powershell extensions with distro flavoring"
+  task :render_powershell_extension do
+    template_file = ::File.join(::File.dirname(__FILE__), "distro", "templates", "powershell", "chef", "chef.psm1.erb")
+    psm1_path = ::File.join(::File.dirname(__FILE__), "distro", "powershell", "chef")
+    FileUtils.mkdir_p psm1_path
+    template = ERB.new(IO.read(template_file))
+    chef_psm1 = template.result
+    File.open(::File.join(psm1_path, "chef.psm1"), "w") { |f| f.write(chef_psm1) }
+  end
+
+  task all: ["pre_install:install_gems_from_dirs", "pre_install:render_powershell_extension"]
 end
 
-task install: :super_install
+# hack in all the preinstall tasks to occur before the tradtional install task
+task install: "pre_install:all"
 
 # make sure we build the correct gemspec on windows
 gemspec = Gem.win_platform? ? "chef-universal-mingw32" : "chef"
@@ -55,8 +68,9 @@ Bundler::GemHelper.install_tasks name: gemspec
 # this gets appended to the normal bundler install helper
 task :install do
   chef_bin_path = ::File.join(::File.dirname(__FILE__), "chef-bin")
-  Dir.chdir(chef_bin_path)
-  sh("rake install:force")
+  Dir.chdir(chef_bin_path) do
+    sh("rake install:force")
+  end
 end
 
 task :pedant, :chef_zero_spec

data/chef.gemspec

@@ -34,7 +34,7 @@ Gem::Specification.new do |s|
   s.add_dependency "net-ssh-multi", "~> 1.2", ">= 1.2.1"
   s.add_dependency "net-sftp", "~> 2.1", ">= 2.1.2"
   s.add_dependency "ed25519", "~> 1.2" # ed25519 ssh key support
-  s.add_dependency "bcrypt_pbkdf", "~> 1.0" # ed25519 ssh key support
+  s.add_dependency "bcrypt_pbkdf", "= 1.1.0.rc1" # ed25519 ssh key support
   s.add_dependency "highline", ">= 1.6.9", "< 3"
   s.add_dependency "tty-screen", "~> 0.6" # knife list
   s.add_dependency "pastel" # knife ui.color

data/lib/chef/knife/environment_compare.rb

@@ -81,7 +81,7 @@ class Chef
 
       def constraint_list(environments)
         constraints = {}
-        environments.each do |env, url| # rubocop:disable Performance/HashEachMethods
+        environments.each do |env, url| # rubocop:disable Style/HashEachMethods
           # Because you cannot modify the default environment I filter it out here.
           unless env == "_default"
             envdata = Chef::Environment.load(env)

data/lib/chef/knife/list.rb

@@ -90,7 +90,7 @@ class Chef
 
         # Flatten out directory results if necessary
         if config[:flat]
-          dir_results.each do |result, children| # rubocop:disable Performance/HashEachMethods
+          dir_results.each do |result, children| # rubocop:disable Style/HashEachMethods
             results += children
           end
           dir_results = []

data/lib/chef/knife/supermarket_install.rb

@@ -96,7 +96,7 @@ class Chef
         extract_cookbook(upstream_file, downloader.version)
 
         # TODO: it'd be better to store these outside the cookbook repo and
-        # keep them around, e.g., in ~/Library/Caches on OS X.
+        # keep them around, e.g., in ~/Library/Caches on macOS.
         ui.info("Removing downloaded tarball")
         File.unlink(upstream_file)
 

data/lib/chef/knife/yaml_convert.rb

@@ -56,7 +56,7 @@ class Chef::Knife::YamlConvert < Chef::Knife
     end
 
     # Unfortunately, per the YAML spec, comments are stripped when we load, so we lose them on conversion
-    yaml_hash = ::YAML.safe_load(yaml_contents)
+    yaml_hash = ::YAML.safe_load(yaml_contents, permitted_classes: [Symbol])
     unless yaml_hash.is_a?(Hash) && yaml_hash.key?("resources")
       ui.fatal!("YAML recipe '#{source_file}' must contain a top-level 'resources' hash (YAML sequence), i.e. 'resources:'")
     end
@@ -81,7 +81,7 @@ class Chef::Knife::YamlConvert < Chef::Knife
 
       ruby_contents << "#{type} \"#{name}\" do"
       r.each do |k, v|
-        ruby_contents << "  #{k} \"#{v}\""
+        ruby_contents << "  #{k} #{v.inspect}"
       end
       ruby_contents << "end\n"
     end

data/lib/chef/provider/execute.rb

@@ -49,7 +49,7 @@ class Chef
 
         converge_by("execute #{description}") do
           begin
-            shell_out!(command, opts)
+            shell_out!(command, **opts)
           rescue Mixlib::ShellOut::ShellCommandFailed
             if sensitive?
               ex = Mixlib::ShellOut::ShellCommandFailed.new("Command execution failed. STDOUT/STDERR suppressed for sensitive resource")

data/lib/chef/provider/package/freebsd/base.rb

@@ -58,7 +58,8 @@ class Chef
 
           def makefile_variable_value(variable, dir = nil)
             options = dir ? { cwd: dir } : {}
-            make_v = shell_out!("make", "-V", variable, options.merge!(env: nil, returns: [0, 1]))
+            options.merge!(env: nil, returns: [0, 1])
+            make_v = shell_out!("make", "-V", variable, **options)
             make_v.exitstatus == 0 ? make_v.stdout.strip.split($OUTPUT_RECORD_SEPARATOR).first : nil # $\ is the line separator, i.e. newline.
           end
         end

data/lib/chef/provider/package/homebrew.rb

@@ -27,7 +27,7 @@ class Chef
         allow_nils
         use_multipackage_api
 
-        provides :package, os: "darwin", override: true
+        provides :package, os: "darwin"
         provides :homebrew_package
 
         include Chef::Mixin::HomebrewUser

data/lib/chef/provider/package/macports.rb

@@ -2,8 +2,6 @@ class Chef
   class Provider
     class Package
       class Macports < Chef::Provider::Package
-
-        provides :package, os: "darwin"
         provides :macports_package
 
         def load_current_resource

data/lib/chef/provider/package/windows.rb

@@ -36,6 +36,13 @@ class Chef
         require "chef/provider/package/windows/registry_uninstall_entry.rb"
 
         def define_resource_requirements
+          if new_resource.checksum
+            requirements.assert(:install) do |a|
+              a.assertion { new_resource.checksum.downcase == checksum(source_location) }
+              a.failure_message Chef::Exceptions::Package, "Checksum on resource (#{short_cksum(new_resource.checksum)}) does not match checksum on content (#{short_cksum(source_location)})"
+            end
+          end
+
           requirements.assert(:install) do |a|
             a.assertion { new_resource.source || msi? }
             a.failure_message Chef::Exceptions::NoWindowsPackageSource, "Source for package #{new_resource.package_name} must be specified in the resource's source property for package to be installed because the package_name property is used to test for the package installation state for this package type."
@@ -50,27 +57,15 @@ class Chef
           end
         end
 
-        # load_current_resource is run in Chef::Provider#run_action when not in whyrun_mode?
         def load_current_resource
-          @current_resource = Chef::Resource::WindowsPackage.new(new_resource.name)
-          if downloadable_file_missing?
-            logger.trace("We do not know the version of #{new_resource.source} because the file is not downloaded")
-            # FIXME: this label should not be used.  It could be set to nil.  Probably what should happen is that
-            # if the file hasn't been downloaded then load_current_resource must download the file here, and then
-            # the else clause to set current_resource.version can always be run.  Relying on a side-effect here
-            # produces at least less readable code, if not outright buggy...  (and I'm assuming that this isn't
-            # wholly just a bug -- since if we only need the package_name to determine if its installed then we
-            # need this, so I'm assuming we need to download the file to pull out the name in order to check
-            # the registry -- which it still feels like we get wrong in the sense we're forcing always downloading
-            # and then always installing(?) which violates idempotency -- and I'm having to think way too hard
-            # about this and would need to go surfing around the code to determine what actually happens, probably
-            # in every different package_provider...)
-            current_resource.version(:unknown.to_s)
-          else
-            current_resource.version(package_provider.installed_version)
-            new_resource.version(package_provider.package_version) if package_provider.package_version
+          if uri_scheme?(new_resource.source) && action == :install
+            download_source_file
           end
 
+          @current_resource = Chef::Resource::WindowsPackage.new(new_resource.name)
+          current_resource.version(package_provider.installed_version)
+          new_resource.version(package_provider.package_version) if package_provider.package_version
+
           current_resource
         end
 
@@ -139,17 +134,6 @@ class Chef
           end
         end
 
-        action :install do
-          if uri_scheme?(new_resource.source)
-            download_source_file
-            load_current_resource
-          else
-            validate_content!
-          end
-
-          super
-        end
-
         # Chef::Provider::Package action_install + action_remove call install_package + remove_package
         # Pass those calls to the correct sub-provider
         def install_package(name, version)
@@ -245,6 +229,7 @@ class Chef
         end
 
         def resource_for_provider
+          # XXX: this is crazy
           @resource_for_provider = Chef::Resource::WindowsPackage.new(new_resource.name).tap do |r|
             r.source(Chef::Util::PathHelper.validate_path(source_location)) unless source_location.nil?
             r.cookbook_name = new_resource.cookbook_name
@@ -257,23 +242,22 @@ class Chef
         end
 
         def download_source_file
-          source_resource.run_action(:create)
-          logger.trace("#{new_resource} fetched source file to #{source_resource.path}")
-        end
-
-        def source_resource
-          @source_resource ||= Chef::Resource::RemoteFile.new(default_download_cache_path, run_context).tap do |r|
-            r.source(new_resource.source)
-            r.cookbook_name = new_resource.cookbook_name
-            r.checksum(new_resource.checksum)
-            r.backup(false)
+          # It seems correct that this is a build_resource rather than declare_resource/DSL use since updating should not trigger a notification
+          # unless the downloaded file is actually installed.  The case where the remote_file downloads the package but the package is already
+          # installed on the target should not trigger a notification since the running state did not change.
+          build_resource(:remote_file, default_download_cache_path) do
+            source(new_resource.source)
+            cookbook_name = new_resource.cookbook_name
+            checksum(new_resource.checksum)
+            backup(false)
 
             if new_resource.remote_file_attributes
               new_resource.remote_file_attributes.each do |(k, v)|
-                r.send(k.to_sym, v)
+                send(k.to_sym, v)
               end
             end
-          end
+          end.run_action(:create)
+          logger.trace("#{new_resource} fetched source file to #{default_download_cache_path}")
         end
 
         def default_download_cache_path
@@ -287,22 +271,13 @@ class Chef
           if new_resource.source.nil?
             nil
           elsif uri_scheme?(new_resource.source)
-            source_resource.path
+            default_download_cache_path
           else
             new_source = Chef::Util::PathHelper.cleanpath(new_resource.source)
             ::File.exist?(new_source) ? new_source : nil
           end
         end
 
-        def validate_content!
-          if new_resource.checksum
-            source_checksum = checksum(source_location)
-            if new_resource.checksum.downcase != source_checksum
-              raise Chef::Exceptions::ChecksumMismatch.new(short_cksum(new_resource.checksum), short_cksum(source_checksum))
-            end
-          end
-        end
-
         def msi?
           return true if new_resource.installer_type == :msi
 

data/lib/chef/provider/user/dscl.rb

@@ -28,7 +28,7 @@ class Chef
     class User
       #
       # The most tricky bit of this provider is the way it deals with user passwords.
-      # Mac OS X has different password shadow calculations based on the version.
+      # macOS has different password shadow calculations based on the version.
       # < 10.7  => password shadow calculation format SALTED-SHA1
       #         => stored in: /var/db/shadow/hash/#{guid}
       #         => shadow binary length 68 bytes

data/lib/chef/resource/alternatives.rb

@@ -28,11 +28,72 @@ class Chef
 
       description "The alternatives resource allows for configuration of command alternatives in Linux using the alternatives or update-alternatives packages."
       introduced "16.0"
+      examples <<~DOC
+      **Install an alternative**:
+
+      ```ruby
+      alternatives 'python install 2' do
+        link_name 'python'
+        path '/usr/bin/python2.7'
+        priority 100
+        action :install
+      end
+      ```
+
+      **Set an alternative**:
+
+      ```ruby
+      alternatives 'python set version 3' do
+        link_name 'python'
+        path '/usr/bin/python3'
+        action :set
+      end
+      ```
+
+      **Set the automatic alternative state**:
+
+      ```ruby
+      alternatives 'python auto' do
+        link_name 'python'
+        action :auto
+      end
+      ```
+
+      **Refresh an alternative**:
+
+      ```ruby
+      alternatives 'python refresh' do
+        link_name 'python'
+        action :refresh
+      end
+      ```
+
+      **Remove an alternative**:
+
+      ```ruby
+      alternatives 'python remove' do
+        link_name 'python'
+        path '/usr/bin/python3'
+        action :remove
+      end
+      ```
+      DOC
+
+      property :link_name, String,
+        name_property: true,
+        description: "The name of the link to create. This will be the command you type on the command line such as `ruby` or `gcc`."
+
+      property :link, String,
+        default: lazy { |n| "/usr/bin/#{n.link_name}" },
+        default_description: "/usr/bin/LINK_NAME",
+        description: "The path to the alternatives link."
+
+      property :path, String,
+        description: "The full path to the original application binary such as `/usr/bin/ruby27`."
 
-      property :link_name, String, name_property: true
-      property :link, String, default: lazy { |n| "/usr/bin/#{n.link_name}" }
-      property :path, String
-      property :priority, [String, Integer], coerce: proc { |n| n.to_i }
+      property :priority, [String, Integer],
+        coerce: proc { |n| n.to_i },
+        description: "The priority of the alternative."
 
       def define_resource_requirements
         requirements.assert(:install) do |a|

data/lib/chef/resource/apt_package.rb

@@ -25,11 +25,40 @@ class Chef
 
       provides :apt_package, target_mode: true
       provides :package, platform_family: "debian", target_mode: true
+      examples <<~DOC
+      **Install a package using package manager**:
 
-      description "Use the apt_package resource to manage packages on Debian and Ubuntu platforms."
+      ```ruby
+      apt_package 'name of package' do
+        action :install
+      end
+      ```
+
+      **Install a package without specifying the default action**:
+
+      ```ruby
+      apt_package 'name of package'
+      ```
+
+      **Install multiple packages at once**:
+
+      ```ruby
+      apt_package %(package1 package2 package3)
+      ```
+
+      **Install without using recommend packages as a dependency**
+
+      ```ruby
+      package 'apache2' do
+        options '--no-install-recommends'
+      end
+      ```
+      DOC
+
+      description "Use the **apt_package** resource to manage packages on Debian and Ubuntu platforms."
 
       property :default_release, String,
-        description: "The default release. For example: stable.",
+        description: "The default release. For example: `stable`.",
         desired_state: false
 
       property :overwrite_config_files, [TrueClass, FalseClass],

data/lib/chef/resource/apt_preference.rb

@@ -20,14 +20,43 @@ require_relative "../resource"
 
 class Chef
   class Resource
-    # @since 13.3
     class AptPreference < Chef::Resource
       unified_mode true
 
       provides(:apt_preference) { true }
 
-      description "The apt_preference resource allows for the creation of APT preference files. Preference files are used to control which package versions and sources are prioritized during installation."
+      description "Use the **apt_preference** resource to create APT [preference files](https://wiki.debian.org/AptPreferences). Preference files are used to control which package versions and sources are prioritized during installation."
       introduced "13.3"
+      examples <<~DOC
+      **Pin libmysqlclient16 to a version 5.1.49-3**:
+
+      ```ruby
+      apt_preference 'libmysqlclient16' do
+        pin          'version 5.1.49-3'
+        pin_priority '700'
+      end
+      ```
+
+      Note: The `pin_priority` of `700` ensures that this version will be preferred over any other available versions.
+
+      **Unpin a libmysqlclient16**:
+
+      ```ruby
+      apt_preference 'libmysqlclient16' do
+        action :remove
+      end
+      ```
+
+      **Pin all packages to prefer the packages.dotdeb.org repository**:
+
+      ```ruby
+      apt_preference 'dotdeb' do
+        glob         '*'
+        pin          'origin packages.dotdeb.org'
+        pin_priority '700'
+      end
+      ```
+      DOC
 
       property :package_name, String,
         name_property: true,
@@ -36,15 +65,15 @@ class Chef
         validation_message: "The provided package name is not valid. Package names can only contain alphanumeric characters as well as _, -, +, or *!"
 
       property :glob, String,
-        description: "Pin by glob() expression or with regular expressions surrounded by /."
+        description: "Pin by a `glob()` expression or with a regular expression surrounded by `/`."
 
       property :pin, String,
         description: "The package version or repository to pin.",
-        required: true
+        required: [:add]
 
       property :pin_priority, [String, Integer],
         description: "Sets the Pin-Priority for a package. See <https://wiki.debian.org/AptPreferences> for more details.",
-        required: true
+        required: [:add]
 
       default_action :add
       allowed_actions :add, :remove