cookstyle 8.7.6 → 9.0.0

data/lib/rubocop/cop/chef/redundant/service_guard_on_stop_disable.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module RedundantCode
+        # The `:stop` and `:disable` actions of the `service` resource are already no-ops when the service
+        # isn't installed, so guarding them with a check for the init script or unit file adds nothing. The
+        # base provider only converges these actions when `current_resource.running`/`current_resource.enabled`
+        # is set, and the platform providers never set that state for a service they can't find.
+        #
+        # The guard is also actively harmful because it hardcodes a single path while the provider searches
+        # several. A guard on `/usr/local/etc/rc.d/snmpd` skips a FreeBSD host running the service out of
+        # `/etc/rc.d`, and the run then reports success while leaving the service enabled.
+        #
+        # This cop only fires when every action is `:stop` or `:disable`. Actions like `:start`, `:enable`,
+        # `:restart`, and `:reload` are asserted against the init script, so a guard there is meaningful. The
+        # `systemd_unit` resource shells out unconditionally, so its guards are meaningful as well and are
+        # never flagged.
+        #
+        # @example
+        #
+        #   # bad
+        #   service 'snmpd' do
+        #     action %i(stop disable)
+        #     only_if { ::File.exist?('/usr/local/etc/rc.d/snmpd') }
+        #   end
+        #
+        #   # good
+        #   service 'snmpd' do
+        #     action %i(stop disable)
+        #   end
+        #
+        class ServiceGuardOnStopDisable < Base
+          include RuboCop::Chef::CookbookHelpers
+          include RangeHelp
+          extend AutoCorrector
+
+          MSG = 'A service resource that only stops or disables a service does not need a guard checking for the init script or unit file. Chef Infra Client already skips these actions when the service does not exist, and hardcoding a single path can silently skip services installed elsewhere.'
+
+          # actions that Chef Infra Client treats as no-ops when the service can't be found
+          NO_OP_ACTIONS = %i(stop disable).freeze
+
+          # the directories the various service providers search for init scripts and unit files
+          INIT_SCRIPT_PATH = %r{/(?:etc/init\.d|etc/rc\.d|usr/local/etc/rc\.d|etc/sv|systemd/system)/}.freeze
+
+          def_node_matcher :file_exist_check, <<~PATTERN
+            (send (const {nil? cbase} :File) {:exist? :exists? :executable? :file? :readable?} $_)
+          PATTERN
+
+          def_node_search :action_nodes, '(send nil? :action $...)'
+
+          def on_block(node)
+            match_property_in_resource?(:service, %i(only_if not_if), node) do |guard|
+              # a string guard like `only_if 'test -f /etc/init.d/foo'` isn't a Ruby block
+              next unless guard.block_type?
+              next unless only_no_op_actions?(node)
+
+              # `guard.body` is only a bare send when the block does nothing but the existence check.
+              # Anything more (a `&&`, a second statement) is a guard we shouldn't touch.
+              path = file_exist_check(guard.body)
+              next unless path && INIT_SCRIPT_PATH.match?(path.source)
+
+              add_offense(guard, severity: :refactor) do |corrector|
+                corrector.remove(range_by_whole_lines(guard.source_range, include_final_newline: true))
+              end
+            end
+          end
+
+          private
+
+          # @param [RuboCop::AST::BlockNode] node the resource block
+          #
+          # @return [Boolean] the resource declares at least one action and all of them are no-ops
+          #                   for a service that isn't installed
+          def only_no_op_actions?(node)
+            actions = action_nodes(node).flat_map { |args| args.flat_map { |arg| action_symbols(arg) } }
+            !actions.empty? && actions.all? { |action| NO_OP_ACTIONS.include?(action) }
+          end
+
+          # Unwrap the ways an action can be written: `action :stop`, `action %i(stop disable)`,
+          # and `action [:stop, :disable]`. Anything else (a variable, a node attribute) yields nil,
+          # which fails the NO_OP_ACTIONS check and leaves the resource alone.
+          #
+          # @param [RuboCop::AST::Node] node
+          #
+          # @return [Array<Symbol, nil>]
+          def action_symbols(node)
+            case node.type
+            when :sym
+              [node.value]
+            when :array
+              node.values.flat_map { |value| action_symbols(value) }
+            else
+              [nil]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/redundant/string_property_with_nil_default.rb

@@ -40,13 +40,13 @@ module RuboCop
 
           def_node_matcher :string_property_with_nil_default?, <<-PATTERN
             (send nil? :property (sym _)
-            {(const nil? :String) #string_and_nil_like?}
+            {(const {nil? cbase} :String) #string_and_nil_like?}
             (hash <$(pair (sym :default) (nil)) ...>))
           PATTERN
 
           # An array of types that includes String & either NilClass or nil
           def_node_matcher :string_and_nil_like?, <<-PATTERN
-            (array <(const nil? :String) {(const nil? :NilClass) (nil)}>)
+            (array <(const {nil? cbase} :String) {(const {nil? cbase} :NilClass) (nil)}>)
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/redundant/unnecessary_name_property.rb

@@ -39,7 +39,7 @@ module RuboCop
           def_node_matcher :name_property?, <<-PATTERN
           (send nil? {:attribute :property}
             (sym :name)
-            (const nil? :String)?
+            (const {nil? cbase} :String)?
             (hash $...)?
           )
           PATTERN

data/lib/rubocop/cop/chef/security/insecure_remote_file_source.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Security
+        # Files downloaded over plain HTTP or FTP can be modified in transit, and the resource will
+        # use whatever it receives. Fetch them over HTTPS so the transport is authenticated.
+        #
+        # Where an HTTPS endpoint genuinely isn't available, a `checksum` on the resource at least
+        # detects tampering, since the digest is compared before the file is used.
+        #
+        # @example
+        #
+        #   # bad
+        #   remote_file '/tmp/foo.tar.gz' do
+        #     source 'http://example.com/foo.tar.gz'
+        #   end
+        #
+        #   # good
+        #   remote_file '/tmp/foo.tar.gz' do
+        #     source 'https://example.com/foo.tar.gz'
+        #   end
+        #
+        class InsecureRemoteFileSource < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'Fetch remote files over HTTPS. A file downloaded over plain HTTP or FTP can be modified in transit and the resource will use whatever it receives.'
+
+          # the resources that download a file from the source property
+          RESOURCES = %i(remote_file windows_package msu_package dmg_package cab_package).freeze
+
+          # transports with no authentication of the server or the payload
+          INSECURE_SCHEME = %r{\A(?:http|ftp)://}i.freeze
+
+          def on_block(node)
+            match_property_in_resource?(RESOURCES, 'source', node) do |source|
+              source.arguments.each do |argument|
+                # remote_file also accepts an array of mirrors, any one of which may be insecure
+                urls = argument.array_type? ? argument.values : [argument]
+                urls.each { |url| add_offense(url, severity: :warning) if insecure_url?(url) }
+              end
+            end
+          end
+
+          private
+
+          # A dstr's leading literal is enough to read the scheme off an interpolated URL. Anything
+          # that isn't a literal string, such as a node attribute, tells us nothing and is left alone.
+          #
+          # @param [RuboCop::AST::Node] node
+          #
+          # @return [Boolean]
+          def insecure_url?(node)
+            literal = if node.str_type?
+                        node.value
+                      elsif node.dstr_type? && node.children.first&.str_type?
+                        node.children.first.value
+                      end
+
+            literal ? INSECURE_SCHEME.match?(literal) : false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/security/ssh_private_key.rb

@@ -29,6 +29,15 @@ module RuboCop
         #     mode '600'
         #   end
         #
+        #   # good
+        #   # fetch the key from a secrets management system instead
+        #   file '/home/bob/.ssh/id_rsa' do
+        #     content chef_vault_item('ssh_keys', 'bob')['private_key']
+        #     mode '600'
+        #     owner 'bob'
+        #     sensitive true
+        #   end
+        #
         class SshPrivateKey < Base
           MSG = 'Do not include plain text SSH private keys in your cookbook code. This sensitive data should be fetched from secrets management systems so that secrets are not uploaded in plain text to the Chef Infra Server or committed to source control systems.'
 

data/lib/rubocop/cop/chef/sharing/empty_property_description.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Sharing
+        # Resource properties should not set an empty `description`. Automated documentation tools have
+        # nothing to render from it, so it does no more than a missing field would while looking like the
+        # property has been documented.
+        #
+        # @example
+        #
+        #   # bad
+        #   property :site_name, String,
+        #            name_property: true,
+        #            description: ''
+        #
+        #   # good
+        #   property :site_name, String,
+        #            name_property: true,
+        #            description: 'The name of the site'
+        #
+        class EmptyPropertyDescription < Base
+          MSG = 'Resource properties should not set an empty `description`. Either describe the property or leave the field off entirely.'
+          RESTRICT_ON_SEND = [:property].freeze
+
+          # any method named property being called with a symbol argument and an options hash.
+          # capturing the hash rather than searching the whole send keeps us off `description`
+          # keys nested inside another option's value, such as `default: { description: '' }`
+          def_node_matcher :property_options, '(send nil? :property (sym _) ... $hash)'
+
+          def on_send(node)
+            property_options(node) do |options|
+              options.pairs.each do |pair|
+                next unless pair.key.sym_type? && pair.key.value == :description
+                # a description built by interpolation isn't a literal str node, so we can't tell
+                # whether it's empty and leave it alone
+                next unless pair.value.str_type? && pair.value.value.strip.empty?
+                add_offense(pair, severity: :refactor)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/style/include_recipe_with_parentheses.rb

@@ -36,7 +36,7 @@ module RuboCop
           RESTRICT_ON_SEND = [:include_recipe].freeze
 
           def_node_matcher :include_recipe?, <<-PATTERN
-            (send nil? :include_recipe $(str _))
+            (send {nil? (send nil? :run_context)} :include_recipe $(str _))
           PATTERN
 
           def on_send(node)
@@ -47,7 +47,10 @@ module RuboCop
               return if node.parent&.send_type?
 
               add_offense(node, severity: :refactor) do |corrector|
-                corrector.replace(node, "include_recipe #{recipe.source}")
+                # keep any receiver, otherwise run_context.include_recipe('foo') would correct to a
+                # bare include_recipe and lose the run_context
+                receiver = node.receiver ? "#{node.receiver.source}." : ''
+                corrector.replace(node, "#{receiver}include_recipe #{recipe.source}")
               end
             end
           end

data/lib/rubocop/cop/chef/style/true_false_resource_properties.rb

@@ -36,7 +36,7 @@ module RuboCop
           RESTRICT_ON_SEND = [:property, :attribute].freeze
 
           def_node_matcher :trueclass_falseclass_property?, <<-PATTERN
-            (send nil? {:property :attribute} (sym _) $(array (const nil? :TrueClass) (const nil? :FalseClass)) ... )
+            (send nil? {:property :attribute} (sym _) $(array (const {nil? cbase} :TrueClass) (const {nil? cbase} :FalseClass)) ... )
           PATTERN
 
           def on_send(node)

data/lib/rubocop/monkey_patches/directive_comment.rb

@@ -1,12 +1,30 @@
 # frozen_string_literal: true
 module RuboCop
-  # we're monkey patching the config regex to allow for "cookstyle: disable whatever"
-  # in addition to the "rubocop: disable whatever that comes with RuboCop"
+  # we're monkey patching the directive marker to allow for "cookstyle: disable whatever"
+  # in addition to the "rubocop: disable whatever" that comes with RuboCop.
+  #
+  # Everything below the marker is rebuilt exactly the way RuboCop builds it, from
+  # RuboCop's own constants, so that directive modes added upstream (push, pop,
+  # disable-next, todo-next, ...) keep working here without another patch.
   class DirectiveComment
+    remove_const(:DIRECTIVE_MARKER_PATTERN)
+    DIRECTIVE_MARKER_PATTERN = '# (?:rubocop|cookstyle) : '
+
+    remove_const(:DIRECTIVE_MARKER_REGEXP)
+    DIRECTIVE_MARKER_REGEXP = Regexp.new(DIRECTIVE_MARKER_PATTERN.gsub(' ', '\s*'))
+
+    remove_const(:DIRECTIVE_HEADER_PATTERN)
+    DIRECTIVE_HEADER_PATTERN = "#{DIRECTIVE_MARKER_PATTERN}((?:#{MODES_PATTERN}))\\b"
+
     remove_const(:DIRECTIVE_COMMENT_REGEXP)
     DIRECTIVE_COMMENT_REGEXP = Regexp.new(
-      "# (?:rubocop|cookstyle) : ((?:disable|enable|todo))\\b #{COPS_PATTERN}"
+      "#{DIRECTIVE_HEADER_PATTERN}(?:\\s+#{COPS_PATTERN}|\\s+#{PUSH_POP_ARGS_PATTERN})?"
         .gsub(' ', '\s*')
     )
+
+    remove_const(:MALFORMED_DIRECTIVE_WITHOUT_COP_NAME_REGEXP)
+    MALFORMED_DIRECTIVE_WITHOUT_COP_NAME_REGEXP = Regexp.new(
+      "\\A#{DIRECTIVE_HEADER_PATTERN}\\s*\\z".gsub(' ', '\s*')
+    )
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cookstyle
 version: !ruby/object:Gem::Version
-  version: 8.7.6
+  version: 9.0.0
 platform: ruby
 authors:
 - Thom May
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-21 00:00:00.000000000 Z
+date: 2026-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -17,14 +17,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.86.1
+        version: 1.90.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.86.1
+        version: 1.90.0
 description: 
 email:
 - thom@chef.io
@@ -53,9 +53,12 @@ files:
 - lib/rubocop/cop/chef/correctness/block_guard_clause_string_only.rb
 - lib/rubocop/cop/chef/correctness/chef_application_fatal.rb
 - lib/rubocop/cop/chef/correctness/conditional_ruby_shellout.rb
+- lib/rubocop/cop/chef/correctness/conditional_unified_mode_true.rb
 - lib/rubocop/cop/chef/correctness/dnf_package_allow_downgrades.rb
 - lib/rubocop/cop/chef/correctness/empty_resource_guard.rb
+- lib/rubocop/cop/chef/correctness/execute_delete_file.rb
 - lib/rubocop/cop/chef/correctness/incorrect_library_injection.rb
+- lib/rubocop/cop/chef/correctness/invalid_checksum.rb
 - lib/rubocop/cop/chef/correctness/invalid_cookbook_name.rb
 - lib/rubocop/cop/chef/correctness/invalid_default_action.rb
 - lib/rubocop/cop/chef/correctness/invalid_notification_resource.rb
@@ -81,12 +84,14 @@ files:
 - lib/rubocop/cop/chef/correctness/notifies_action_not_symbol.rb
 - lib/rubocop/cop/chef/correctness/octal_mode_as_string.rb
 - lib/rubocop/cop/chef/correctness/openssl_password_helpers.rb
+- lib/rubocop/cop/chef/correctness/platform_version_string_comparison.rb
 - lib/rubocop/cop/chef/correctness/powershell_delete_file.rb
 - lib/rubocop/cop/chef/correctness/powershell_file_exists.rb
 - lib/rubocop/cop/chef/correctness/property_without_type.rb
 - lib/rubocop/cop/chef/correctness/resource_sets_internal_properties.rb
 - lib/rubocop/cop/chef/correctness/resource_sets_name_property.rb
 - lib/rubocop/cop/chef/correctness/resource_with_none_action.rb
+- lib/rubocop/cop/chef/correctness/ruby_guard_without_block.rb
 - lib/rubocop/cop/chef/correctness/scoped_file_exist.rb
 - lib/rubocop/cop/chef/correctness/service_resource.rb
 - lib/rubocop/cop/chef/correctness/supports_must_be_float.rb
@@ -208,10 +213,12 @@ files:
 - lib/rubocop/cop/chef/modernize/dsl_include_in_resource.rb
 - lib/rubocop/cop/chef/modernize/empty_resource_initialize.rb
 - lib/rubocop/cop/chef/modernize/execute_apt_update.rb
+- lib/rubocop/cop/chef/modernize/execute_archive_extract.rb
 - lib/rubocop/cop/chef/modernize/execute_sc_exe.rb
 - lib/rubocop/cop/chef/modernize/execute_sleep.rb
 - lib/rubocop/cop/chef/modernize/execute_sysctl.rb
 - lib/rubocop/cop/chef/modernize/execute_tzutil.rb
+- lib/rubocop/cop/chef/modernize/execute_update_alternatives.rb
 - lib/rubocop/cop/chef/modernize/foodcritic_comments.rb
 - lib/rubocop/cop/chef/modernize/if_provides_default_action.rb
 - lib/rubocop/cop/chef/modernize/includes_mixin_shellout.rb
@@ -224,6 +231,7 @@ files:
 - lib/rubocop/cop/chef/modernize/openssl_rsa_key_resource.rb
 - lib/rubocop/cop/chef/modernize/openssl_x509_resource.rb
 - lib/rubocop/cop/chef/modernize/osx_config_profile_resource.rb
+- lib/rubocop/cop/chef/modernize/powershell_download_file.rb
 - lib/rubocop/cop/chef/modernize/powershell_expand_archive.rb
 - lib/rubocop/cop/chef/modernize/powershell_guard_interpreter.rb
 - lib/rubocop/cop/chef/modernize/powershell_install_package.rb
@@ -273,14 +281,17 @@ files:
 - lib/rubocop/cop/chef/redundant/replaces_metadata.rb
 - lib/rubocop/cop/chef/redundant/resource_with_nothing_action.rb
 - lib/rubocop/cop/chef/redundant/sensitive_property_in_resource.rb
+- lib/rubocop/cop/chef/redundant/service_guard_on_stop_disable.rb
 - lib/rubocop/cop/chef/redundant/string_property_with_nil_default.rb
 - lib/rubocop/cop/chef/redundant/suggests_metadata.rb
 - lib/rubocop/cop/chef/redundant/unnecessary_desired_state.rb
 - lib/rubocop/cop/chef/redundant/unnecessary_name_property.rb
 - lib/rubocop/cop/chef/redundant/use_create_if_missing.rb
+- lib/rubocop/cop/chef/security/insecure_remote_file_source.rb
 - lib/rubocop/cop/chef/security/ssh_private_key.rb
 - lib/rubocop/cop/chef/sharing/default_maintainer_metadata.rb
 - lib/rubocop/cop/chef/sharing/empty_metadata_field.rb
+- lib/rubocop/cop/chef/sharing/empty_property_description.rb
 - lib/rubocop/cop/chef/sharing/include_property_descriptions.rb
 - lib/rubocop/cop/chef/sharing/include_resource_descriptions.rb
 - lib/rubocop/cop/chef/sharing/include_resource_examples.rb