chef 18.5.0 → 18.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6aeb4e21d11cdf70486e7d5c78992d1248331091782075950ed11103f16313eb
-  data.tar.gz: 0d0732e253f1ff220fa4460a98befd22879d206f09e3053527b0996c0a84c268
+  metadata.gz: 9758afdcd61880d10d2e6fcbd0097a3dc94ead3ce67004ba317ed1754cf529d2
+  data.tar.gz: 2ea4ff22776735a4ec71531e3c188769328e3dab07f1930ab4f59c6c2032a9b4
 SHA512:
-  metadata.gz: '067286ca73d5381ce8ffca9e20694d03b8b5032769ebec6805fdf51c03aadf5d7f2c55c6b1b27d32b81085b378b4e917410fa6dffb9532cae2130f3c6da8160f'
-  data.tar.gz: 1e35e9df95757159af9ab8a22b1d59cbbf8c0e916fdc8ec032c8383921e7de9a9a05d5f6aaba138b3d53af9e4e8359c39bba0f64fb42e90201c704e8ce3bcfe4
+  metadata.gz: 6f54220fa4591d43a562055250981453252a30db5bed94473ba0350b4d147ae0eb517da7ab371ef5963b8c7675b06206a5366585a86234ef0ede60a2d92ebf28
+  data.tar.gz: d096c1a73764313a572382cb45963efac685f4a33655225b447b8f58f9dbcfb4abf732da9c7bd2c855bf526a28d195a2a3af49e36029b9f7941bbe4b2ad6682b

data/Gemfile

@@ -2,7 +2,7 @@ source "https://rubygems.org"
 
 gem "chef", path: "."
 
-gem "ohai", git: "https://github.com/chef/ohai.git", branch: "main"
+gem "ohai", git: "https://github.com/chef/ohai.git", branch: "18-stable"
 
 # Nwed to file a bug with rest-client. In the meantime, we can use this until they accept the update.
 gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1"
@@ -10,8 +10,13 @@ gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt
 gem "ffi", ">= 1.15.5"
 gem "chef-utils", path: File.expand_path("chef-utils", __dir__) if File.exist?(File.expand_path("chef-utils", __dir__))
 gem "chef-config", path: File.expand_path("chef-config", __dir__) if File.exist?(File.expand_path("chef-config", __dir__))
+
 # required for FIPS or bundler will pick up default openssl
-gem "openssl", "= 3.2.0" unless Gem.platforms.any? { |platform| !platform.is_a?(String) && platform.os == "darwin" }
+install_if -> { RUBY_PLATFORM !~ /darwin/ } do
+  gem "openssl", "= 3.2.0"
+end
+
+gem "rdoc", "~> 6.4.1" # 6.4.1.1 required for CVE-2024-27281, allow patch upgrades
 
 if File.exist?(File.expand_path("chef-bin", __dir__))
   # bundling in a git checkout
@@ -51,7 +56,7 @@ group(:knife_windows_deps) do
 end
 
 group(:development, :test) do
-  gem "rake"
+  gem "rake", ">= 12.3.3"
   gem "rspec"
   gem "webmock"
   gem "crack", "< 0.4.6" # due to https://github.com/jnunemaker/crack/pull/75

data/chef-universal-mingw-ucrt.gemspec

@@ -1,6 +1,6 @@
 gemspec = instance_eval(File.read(File.expand_path("chef.gemspec", __dir__)))
 
-gemspec.platform = Gem::Platform.new(%w{x64-mingw-ucrt})
+gemspec.platform = Gem::Platform.new(%w{universal mingw-ucrt})
 
 gemspec.add_dependency "win32-api", "~> 1.10.0"
 gemspec.add_dependency "win32-event", "~> 0.6.1"

data/chef.gemspec

@@ -30,7 +30,7 @@ Gem::Specification.new do |s|
 
   s.add_dependency "chef-config", "= #{Chef::VERSION}"
   s.add_dependency "chef-utils", "= #{Chef::VERSION}"
-  s.add_dependency "train-core", "~> 3.10" # 3.2.28 fixes sudo prompts. See https://github.com/chef/chef/pull/9635
+  s.add_dependency "train-core", "~> 3.10", "<= 3.12.7"
   s.add_dependency "train-winrm", ">= 0.2.5"
   s.add_dependency "train-rest", ">= 0.4.1" # target mode with rest APIs
 
@@ -43,7 +43,7 @@ Gem::Specification.new do |s|
   s.add_dependency "ohai", "~> 18.0"
   s.add_dependency "inspec-core", ">= 5", "< 6"
 
-  s.add_dependency "ffi", ">= 1.15.5"
+  s.add_dependency "ffi", ">= 1.15.5", "<= 1.16.3"
   s.add_dependency "ffi-yajl", "~> 2.2"
   s.add_dependency "net-sftp", ">= 2.1.2", "< 5.0" # remote_file resource
   s.add_dependency "net-ftp" # remote_file resource

data/lib/chef/application/client.rb

@@ -40,10 +40,6 @@ class Chef::Application::Client < Chef::Application::Base
     long: "--config CONFIG",
     description: "The configuration file to use."
 
-  option :credentials,
-    long: "--credentials CREDENTIALS",
-    description: "Credentials file to use. Default: ~/.chef/credentials"
-
   unless ChefUtils.windows?
     option :daemonize,
       short: "-d [WAIT]",
@@ -129,14 +125,6 @@ class Chef::Application::Client < Chef::Application::Base
       Chef::Config.node_name = Chef::Config.target_mode.host unless Chef::Config.node_name
     end
 
-    if config[:credentials]
-      unless File.exist?(config[:credentials])
-        Chef::Application.fatal!("credentials file #{config[:credentials]} not found")
-      end
-
-      Chef::Config.credentials = config[:credentials]
-    end
-
     if Chef::Config[:daemonize]
       Chef::Config[:interval] ||= 1800
     end

data/lib/chef/client.rb

@@ -292,7 +292,6 @@ class Chef
         Chef.provider_handler_map.lock!
 
         setup_run_context
-        setup_targetmode if Chef::Config.target_mode?
 
         load_required_recipe(@rest, run_context) unless Chef::Config[:solo_legacy_mode]
 
@@ -572,15 +571,6 @@ class Chef
       end
     end
 
-    #
-    # Setup conditions for Target Mode.
-    #
-    # @api private
-    #
-    def setup_targetmode
-      TargetIO::FileUtils.mkdir_p(Chef::Config[:file_cache_path])
-    end
-
     #
     # Run ohai plugins.  Runs all ohai plugins unless minimal_ohai is specified.
     #
@@ -1100,3 +1090,4 @@ end
 require_relative "cookbook_loader"
 require_relative "cookbook_version"
 require_relative "cookbook/synchronizer"
+

data/lib/chef/compliance/runner.rb

@@ -208,16 +208,6 @@ class Chef
         logger.debug "Options are set to: #{opts}"
         runner = ::Inspec::Runner.new(opts)
 
-        # Switch from local to remote backend for Target Mode
-        if ChefConfig::Config.target_mode?
-          logger.info "Configure InSpec backend to use established connection"
-
-          connection = Chef.run_context.transport_connection
-          backend = Inspec::Backend.new(connection)
-
-          runner.set_backend(backend)
-        end
-
         if profiles.empty?
           failed_report("No #{Inspec::Dist::PRODUCT_NAME} profiles are defined.")
           return

data/lib/chef/cookbook/remote_file_vendor.rb

@@ -43,9 +43,10 @@ class Chef
           raise "get_filename: Cannot determine segment/filename for incoming filename #{filename}"
         end
 
-        raise "No such segment #{segment} in cookbook #{@cookbook_name}" unless @manifest.files_for(segment)
+        files_for_segment = @manifest.files_for(segment)
+        raise "No such segment #{segment} in cookbook #{@cookbook_name}" unless files_for_segment
 
-        found_manifest_record = @manifest.files_for(segment).find { |manifest_record| manifest_record[:path] == filename }
+        found_manifest_record = files_for_segment.find { |manifest_record| manifest_record[:path] == filename }
         raise "No such file #{filename} in #{@cookbook_name}" unless found_manifest_record
 
         cache_filename = File.join("cookbooks", @cookbook_name, found_manifest_record["path"])

data/lib/chef/cookbook/synchronizer.rb

@@ -61,11 +61,6 @@ class Chef
 
     def cleanup_file_cache
       unless Chef::Config[:solo_legacy_mode] || skip_removal
-        if Chef::Config.target_mode?
-          TargetIO::FileUtils.rm_rf(Chef::Config[:file_cache_path])
-          return
-        end
-
         # Delete each file in the cache that we didn't encounter in the
         # manifest.
         cache.find(File.join(%w{cookbooks ** {*,.*}})).each do |cache_filename|

data/lib/chef/exceptions.rb

@@ -170,7 +170,7 @@ class Chef
     class PowershellCmdletException < RuntimeError; end
     class LCMParser < RuntimeError; end
 
-    class CannotDetermineHomebrewOwner < Package; end
+    class CannotDetermineHomebrewPath < Package; end
     class CannotDetermineWindowsInstallerType < Package; end
     class NoWindowsPackageSource < Package; end
 

data/lib/chef/file_access_control/unix.rb

@@ -29,7 +29,7 @@ class Chef
       module ClassMethods
         # We want to mix these in as class methods
         def writable?(path)
-          ::TargetIO::File.writable?(path)
+          ::File.writable?(path)
         end
       end
 
@@ -120,7 +120,7 @@ class Chef
         return nil if resource.nil? || resource.group.nil?
 
         if resource.group.is_a?(String)
-          diminished_radix_complement( TargetIO::Etc.getgrnam(resource.group).gid )
+          diminished_radix_complement( Etc.getgrnam(resource.group).gid )
         elsif resource.group.is_a?(Integer)
           resource.group
         else
@@ -222,9 +222,9 @@ class Chef
 
       def stat
         if manage_symlink_attrs?
-          @stat ||= TargetIO::File.lstat(file)
+          @stat ||= File.lstat(file)
         else
-          @stat ||= TargetIO::File.stat(file)
+          @stat ||= File.stat(file)
         end
       end
 
@@ -237,20 +237,20 @@ class Chef
       def chmod(mode, file)
         if manage_symlink_attrs?
           begin
-            TargetIO::File.lchmod(mode, file)
+            File.lchmod(mode, file)
           rescue NotImplementedError
             Chef::Log.warn("#{file} mode not changed: File.lchmod is unimplemented on this OS and Ruby version")
           end
         else
-          TargetIO::File.chmod(mode, file)
+          File.chmod(mode, file)
         end
       end
 
       def chown(uid, gid, file)
         if manage_symlink_attrs?
-          TargetIO::File.lchown(uid, gid, file)
+          File.lchown(uid, gid, file)
         else
-          TargetIO::File.chown(uid, gid, file)
+          File.chown(uid, gid, file)
         end
       end
 
@@ -269,7 +269,7 @@ class Chef
         return nil if resource.nil? || resource.owner.nil?
 
         if resource.owner.is_a?(String)
-          diminished_radix_complement( TargetIO::Etc.getpwnam(resource.owner).uid )
+          diminished_radix_complement( Etc.getpwnam(resource.owner).uid )
         elsif resource.owner.is_a?(Integer)
           resource.owner
         else

data/lib/chef/file_content_management/deploy.rb

@@ -18,7 +18,6 @@
 
 require_relative "deploy/cp"
 require_relative "deploy/mv_unix"
-require_relative "deploy/target_io"
 if ChefUtils.windows?
   require_relative "deploy/mv_windows"
 end
@@ -27,9 +26,7 @@ class Chef
   class FileContentManagement
     class Deploy
       def self.strategy(atomic_update)
-        if ChefConfig::Config.target_mode?
-          TargetIO::Deploy.new
-        elsif atomic_update
+        if atomic_update
           ChefUtils.windows? ? MvWindows.new : MvUnix.new
         else
           Cp.new

data/lib/chef/mixin/file_class.rb

@@ -23,9 +23,7 @@ class Chef
     module FileClass
 
       def file_class
-        @host_os_file ||= if ChefConfig::Config.target_mode?
-                            ::TargetIO::File
-                          elsif ChefUtils.windows?
+        @host_os_file ||= if ChefUtils.windows?
                             require_relative "../win32/file"
                             Chef::ReservedNames::Win32::File
                           else

data/lib/chef/mixin/get_source_from_package.rb

@@ -38,7 +38,7 @@ class Chef
 
         # if we're passed something that looks like a filesystem path, with no source, use it
         #  - require at least one '/' in the path to avoid gem_package "foo" breaking if a file named 'foo' exists in the cwd
-        if new_resource.source.nil? && new_resource.package_name.include?(::File::SEPARATOR) && ::TargetIO::File.exist?(new_resource.package_name)
+        if new_resource.source.nil? && new_resource.package_name.include?(::File::SEPARATOR) && ::File.exist?(new_resource.package_name)
           Chef::Log.trace("No package source specified, but #{new_resource.package_name} exists on the filesystem, copying to package source")
           new_resource.source(new_resource.package_name)
         end

data/lib/chef/mixin/{homebrew_user.rb → homebrew.rb}

@@ -27,7 +27,7 @@ require "etc" unless defined?(Etc)
 
 class Chef
   module Mixin
-    module HomebrewUser
+    module Homebrew
       include Chef::Mixin::ShellOut
 
       ##
@@ -57,15 +57,19 @@ class Chef
         @homebrew_owner_username
       end
 
+      # Use homebrew_bin_path to return the path to the brew binary
+      # @param [String, Array(String)] brew_bin_path
+      # @return [String] path to the brew binary
       def homebrew_bin_path(brew_bin_path = nil)
         if brew_bin_path && ::File.exist?(brew_bin_path)
           brew_bin_path
         else
-          [which("brew"), "/opt/homebrew/bin/brew", "/usr/local/bin/brew", "/home/linuxbrew/.linuxbrew/bin/brew"].uniq.select do |x|
-            next if x == false
+          brew_path = which("brew", prepend_path: %w{/opt/homebrew/bin /usr/local/bin /home/linuxbrew/.linuxbrew/bin})
+          unless brew_path
+            raise Chef::Exceptions::CannotDetermineHomebrewPath, 'Couldn\'t find the "brew" executable anywhere on the path.'
+          end
 
-            ::File.exist?(x) && ::File.executable?(x)
-          end.first || nil
+          brew_path
         end
       end
 
@@ -73,18 +77,11 @@ class Chef
 
       def calculate_owner
         brew_path = homebrew_bin_path
-        if brew_path
-          # By default, this follows symlinks which is what we want
-          owner = ::File.stat(brew_path).uid
-        else
-          raise Chef::Exceptions::CannotDetermineHomebrewOwner,
-            'Couldn\'t find the "brew" executable anywhere on the path.'
-        end
-
-        Chef::Log.debug "Found Homebrew owner #{Etc.getpwuid(owner).name}; executing `brew` commands as them"
-        owner
+        # By default, this follows symlinks which is what we want
+        owner_uid = ::File.stat(brew_path).uid
+        Chef::Log.debug "Found Homebrew owner #{Etc.getpwuid(owner_uid).name}; executing `brew` commands as them"
+        owner_uid
       end
-
     end
   end
 end

data/lib/chef/mixin/openssl_helper.rb

@@ -170,18 +170,7 @@ class Chef
         key_content = ::File.exist?(priv_key) ? File.read(priv_key) : priv_key
         key = ::OpenSSL::PKey::EC.new key_content, priv_key_password
 
-        # Get curve type (prime256v1...)
-        group = ::OpenSSL::PKey::EC::Group.new(key.group.curve_name)
-        # Get Generator point & public point (priv * generator)
-        generator = group.generator
-        pub_point = generator.mul(key.private_key)
-        key.public_key = pub_point
-
-        # Public Key in pem
-        public_key = ::OpenSSL::PKey::EC.new
-        public_key.group = group
-        public_key.public_key = pub_point
-        public_key.to_pem
+        key.public_to_pem
       end
 
       # generate a pem file given a cipher, key, an optional key_password

data/lib/chef/provider/cookbook_file.rb

@@ -22,7 +22,7 @@ class Chef
   class Provider
     class CookbookFile < Chef::Provider::File
 
-      provides :cookbook_file, target_mode: true
+      provides :cookbook_file
 
       def initialize(new_resource, run_context)
         @content_class = Chef::Provider::CookbookFile::Content

data/lib/chef/provider/cron.rb

@@ -22,7 +22,7 @@ class Chef
   class Provider
     class Cron < Chef::Provider
 
-      provides :cron, os: ["!aix", "!solaris2"], target_mode: true
+      provides :cron, os: ["!aix", "!solaris2"]
 
       SPECIAL_TIME_VALUES = %i{reboot yearly annually monthly weekly daily midnight hourly}.freeze
       CRON_ATTRIBUTES = %i{minute hour day month weekday time command mailto path shell home environment}.freeze

data/lib/chef/provider/directory.rb

@@ -27,12 +27,12 @@ class Chef
   class Provider
     class Directory < Chef::Provider::File
 
-      provides :directory, target_mode: true
+      provides :directory
 
       def load_current_resource
         @current_resource = Chef::Resource::Directory.new(new_resource.name)
         current_resource.path(new_resource.path)
-        if ::TargetIO::File.exist?(current_resource.path) && @action != :create_if_missing
+        if ::File.exist?(current_resource.path) && @action != :create_if_missing
           load_resource_attributes_from_file(current_resource)
         end
         current_resource
@@ -50,15 +50,15 @@ class Chef
             if new_resource.recursive
               does_parent_exist = lambda do |base_dir|
                 base_dir = ::File.dirname(base_dir)
-                if ::TargetIO::File.exist?(base_dir)
-                  ::TargetIO::File.directory?(base_dir)
+                if ::File.exist?(base_dir)
+                  ::File.directory?(base_dir)
                 else
                   does_parent_exist.call(base_dir)
                 end
               end
               does_parent_exist.call(new_resource.path)
             else
-              ::TargetIO::File.directory?(parent_directory)
+              ::File.directory?(parent_directory)
             end
           end
           a.failure_message(Chef::Exceptions::EnclosingDirectoryDoesNotExist, "Parent directory #{parent_directory} does not exist, cannot create #{new_resource.path}")
@@ -73,7 +73,7 @@ class Chef
               # make sure we have write permissions to that directory
               is_parent_writable = lambda do |base_dir|
                 base_dir = ::File.dirname(base_dir)
-                if ::TargetIO::File.exist?(base_dir)
+                if ::File.exist?(base_dir)
                   if Chef::FileAccessControl.writable?(base_dir)
                     true
                   elsif Chef::Util::PathHelper.is_sip_path?(base_dir, node)
@@ -89,7 +89,7 @@ class Chef
             else
               # in why run mode & parent directory does not exist no permissions check is required
               # If not in why run, permissions must be valid and we rely on prior assertion that dir exists
-              if !whyrun_mode? || ::TargetIO::File.exist?(parent_directory)
+              if !whyrun_mode? || ::File.exist?(parent_directory)
                 if Chef::FileAccessControl.writable?(parent_directory)
                   true
                 elsif Chef::Util::PathHelper.is_sip_path?(parent_directory, node)
@@ -108,8 +108,8 @@ class Chef
 
         requirements.assert(:delete) do |a|
           a.assertion do
-            if ::TargetIO::File.exist?(new_resource.path)
-              ::TargetIO::File.directory?(new_resource.path) && Chef::FileAccessControl.writable?(new_resource.path)
+            if ::File.exist?(new_resource.path)
+              ::File.directory?(new_resource.path) && Chef::FileAccessControl.writable?(new_resource.path)
             else
               true
             end
@@ -122,12 +122,12 @@ class Chef
       end
 
       action :create, description: "Create a directory. If a directory already exists (but does not match), update that directory to match." do
-        unless ::TargetIO::File.exist?(new_resource.path)
+        unless ::File.exist?(new_resource.path)
           converge_by("create new directory #{new_resource.path}") do
             if new_resource.recursive == true
-              ::TargetIO::FileUtils.mkdir_p(new_resource.path)
+              ::FileUtils.mkdir_p(new_resource.path)
             else
-              ::TargetIO::Dir.mkdir(new_resource.path)
+              ::Dir.mkdir(new_resource.path)
             end
             logger.info("#{new_resource} created directory #{new_resource.path}")
           end
@@ -138,15 +138,15 @@ class Chef
       end
 
       action :delete, description: "Delete a directory." do
-        if ::TargetIO::File.exist?(new_resource.path)
+        if ::File.exist?(new_resource.path)
           converge_by("delete existing directory #{new_resource.path}") do
             if new_resource.recursive == true
               # we don't use rm_rf here because it masks all errors, including
               # IO errors or permission errors that would prevent the deletion
-              ::TargetIO::FileUtils.rm_r(new_resource.path)
+              FileUtils.rm_r(new_resource.path)
               logger.info("#{new_resource} deleted #{new_resource.path} recursively")
             else
-              ::TargetIO::Dir.delete(new_resource.path)
+              ::Dir.delete(new_resource.path)
               logger.info("#{new_resource} deleted #{new_resource.path}")
             end
           end