cookstyle 8.7.6 → 9.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a181e0d054a32ed0c26adfaf90fdacaa4641d4f40f06ab5042aade9648879141
-  data.tar.gz: 825d1445e28601db25cddf29ad2421156edc618fef3c0af2b18cb925f9e9877d
+  metadata.gz: b6cd3dcea2607da8e1f1393a8af2331944ea9e30b502447ed862fdf6d79e703a
+  data.tar.gz: bd596e0a8956d56b9e44c1dfd287263e1e04bac60d4767ab690deb14e093d9ea
 SHA512:
-  metadata.gz: dba569394dc9c18f79717c37e5de26581420a2136fa3bf8c26568286ad776b5ce8ecf13f596d339d9a0b0da485ea0a97443d9c205070806bee1d1d1213483c9f
-  data.tar.gz: 39660f1933a9bb99c5b99582facf640a05784c78ca5c3dc631dc281f9adce8c0aad2ac24e9d91baf020dfac8e0f0914ae346539f4a8d2d7f65b00032d26fda6d
+  metadata.gz: 1432d8dadec991fdc89d85ef38379bfa938f74cc26153a71e9e0a3c51de9f1ffa1e070e7a3eaf459491880a0922fad113517c0f8f8cea58c5b3f69a0cb6f48f3
+  data.tar.gz: 718d4c62405c34b6e392eb00f8e8a11e797086439f1c47e514ac3a49885704a46553d4217025951b9c882fae0fbe65d73acba300d46e41c923bc2dd49e502954

data/config/chefstyle.yml

@@ -164,6 +164,8 @@ Lint/RedundantCopDisableDirective:
 
 Security/Eval:
   Enabled: true
+Security/YAMLLoad:
+  Enabled: true
 
 #
 # Metrics

data/config/cookstyle.yml

@@ -133,6 +133,7 @@ Chef/Style/TrueClassFalseClassResourceProperties:
   StyleGuide: 'chef_style_trueclassfalseclassresourceproperties'
   Enabled: true
   VersionAdded: '5.16.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
     - '**/resources/*.rb'
@@ -173,6 +174,7 @@ Chef/Style/IncludeRecipeWithParentheses:
   Description: "There is no need to wrap the recipe name in parentheses when using `include_recipe`. Write `include_recipe 'foo'` instead of `include_recipe('foo')`."
   StyleGuide: 'chef_style_includerecipewithparentheses'
   VersionAdded: '6.11.0'
+  VersionChanged: '9.0.0'
   Enabled: true
   Exclude:
     - '**/attributes/*.rb'
@@ -187,11 +189,21 @@ Chef/Correctness:
   Enabled: true
   StyleGuideBaseURL: https://docs.chef.io/workstation/cookstyle/
 
+Chef/Correctness/ConditionalUnifiedModeTrue:
+  Description: "Set `unified_mode true` unconditionally. Setting it conditionally leaves a resource running in unified mode on newer Chef Infra Client releases and in legacy mode on older ones, so it has to be written and tested against both execution models."
+  StyleGuide: 'chef_correctness_conditionalunifiedmodetrue'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Include:
+    - '**/libraries/*.rb'
+    - '**/resources/*.rb'
+
 Chef/Correctness/ServiceResource:
-  Description: Use the `service` resource to start and stop services instead of shelling out with `execute` or `bash` resources. The `service` resource is idempotent and handles platform differences automatically.
+  Description: Use the `service` resource to manage services instead of shelling out to an init script, `service`, `systemctl`, or a similar tool. The `service` resource is idempotent and handles platform differences automatically.
   StyleGuide: 'chef_correctness_serviceresource'
   Enabled: true
   VersionAdded: '5.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -284,6 +296,7 @@ Chef/Correctness/ResourceWithNoneAction:
   StyleGuide: 'chef_correctness_resourcewithnoneaction'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -391,11 +404,51 @@ Chef/Correctness/DnfPackageAllowDowngrades:
     - '**/metadata.rb'
     - '**/Berksfile'
 
+Chef/Correctness/ExecuteDeleteFile:
+  Description: "Use the `file` or `directory` resources built into Chef Infra Client with the `:delete` action to remove files and directories instead of shelling out to `rm`. The resource has to match what is on disk: `file` for a file, `directory` with `recursive true` for a directory."
+  StyleGuide: 'chef_correctness_executedeletefile'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/RubyGuardWithoutBlock:
+  Description: "A Ruby expression used as a resource guard (`not_if`/`only_if`) has to be wrapped in a block. String guards are run as shell commands and are fine as they are; it is only a bare Ruby expression that is a problem, since the guard receives the expression result rather than the expression."
+  StyleGuide: 'chef_correctness_rubyguardwithoutblock'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/InvalidChecksum:
+  Description: "The `checksum` property of the file downloading resources takes a SHA-256 digest. An MD5 or SHA-1 digest can never match, so the run fails with a checksum mismatch rather than installing anything."
+  StyleGuide: 'chef_correctness_invalidchecksum'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/PlatformVersionStringComparison:
+  Description: "Ohai version attributes are strings, so comparing one with an ordering operator compares them character by character rather than as versions. `'7.9' >= '10'` is true. Use `.to_i` for a major version comparison, or `Gem::Version` to compare full versions."
+  StyleGuide: 'chef_correctness_platformversionstringcomparison'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
 Chef/Correctness/EmptyResourceGuard:
-  Description: "Resource guards (`not_if`/`only_if`) should not be empty strings. In Ruby, empty strings are 'truthy', so an empty guard string will always pass, which is almost certainly not what you intended."
+  Description: "Resource guards (`not_if`/`only_if`) should not be empty. In Ruby, an empty string is 'truthy', so an empty guard string always passes. An empty block returns `nil`, so it always fails. Neither is likely to be what you intended."
   StyleGuide: 'chef_correctness_emptyresourceguard'
   Enabled: true
   VersionAdded: '8.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -406,6 +459,7 @@ Chef/Correctness/ChefApplicationFatal:
   StyleGuide: 'chef_correctness_chefapplicationfatal'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -444,6 +498,7 @@ Chef/Correctness/OpenSSLPasswordHelpers:
   StyleGuide: 'chef_correctness_opensslpasswordhelpers'
   Enabled: true
   VersionAdded: '6.6.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -607,6 +662,15 @@ Chef/Sharing/EmptyMetadataField:
   Include:
     - '**/metadata.rb'
 
+Chef/Sharing/EmptyPropertyDescription:
+  Description: Resource properties should not set an empty `description`. Automated documentation tools have nothing to render from it, so it does no more than a missing field would while looking like the property has been documented.
+  StyleGuide: 'chef_sharing_emptypropertydescription'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Include:
+    - '**/libraries/*.rb'
+    - '**/resources/*.rb'
+
 Chef/Sharing/IncludePropertyDescriptions:
   Description: Resource properties should include a `description` field so that automated documentation tools can generate helpful documentation for your custom resources. Requires Chef Infra Client 13.9 or later.
   StyleGuide: 'chef_sharing_includepropertydescriptions'
@@ -745,6 +809,7 @@ Chef/Deprecations/UsesDeprecatedMixins:
   StyleGuide: 'chef_deprecations_usesdeprecatedmixins'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
     - '**/providers/*.rb'
@@ -755,6 +820,7 @@ Chef/Deprecations/IncludingXMLRubyRecipe:
   StyleGuide: 'chef_deprecations_includingxmlrubyrecipe'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -765,6 +831,7 @@ Chef/Deprecations/LegacyYumCookbookRecipes:
   StyleGuide: 'chef_deprecations_legacyyumcookbookrecipes'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -773,6 +840,7 @@ Chef/Deprecations/UsesChefRESTHelpers:
   StyleGuide: 'chef_deprecations_useschefresthelpers'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -781,6 +849,7 @@ Chef/Deprecations/ChocolateyPackageUninstallAction:
   StyleGuide: 'chef_deprecations_chocolateypackageuninstallaction'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -941,6 +1010,7 @@ Chef/Deprecations/ResourceInheritsFromCompatResource:
   StyleGuide: 'chef_deprecations_resourceinheritsfromcompatresource'
   Enabled: true
   VersionAdded: '5.10.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1029,6 +1099,7 @@ Chef/Deprecations/RubyBlockCreateAction:
   StyleGuide: 'chef_deprecations_rubyblockcreateaction'
   Enabled: true
   VersionAdded: '5.16.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1077,6 +1148,7 @@ Chef/Deprecations/ChefWindowsPlatformHelper:
   StyleGuide: 'chef_deprecations_chefwindowsplatformhelper'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1095,7 +1167,7 @@ Chef/Deprecations/HWRPWithoutProvides:
   StyleGuide: 'chef_deprecations_hwrpwithoutprovides'
   Enabled: true
   VersionAdded: '6.0.0'
-  VersionChanged: '6.8.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1159,6 +1231,7 @@ Chef/Deprecations/ChefHandlerRecipe:
   StyleGuide: 'chef_deprecations_chefhandlerrecipe'
   Enabled: true
   VersionAdded: '6.12.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1195,6 +1268,7 @@ Chef/Deprecations/ChefShellout:
   StyleGuide: 'chef_deprecations_chefshellout'
   Enabled: true
   VersionAdded: '6.17.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1287,6 +1361,7 @@ Chef/Deprecations/HWRPWithoutUnifiedTrue:
   StyleGuide: 'chef_deprecations_hwrpwithoutunifiedtrue'
   Enabled: true
   VersionAdded: '7.12.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1437,6 +1512,7 @@ Chef/Modernize/IncludingAptDefaultRecipe:
   StyleGuide: 'chef_modernize_includingaptdefaultrecipe'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1445,6 +1521,7 @@ Chef/Modernize/IncludingWindowsDefaultRecipe:
   StyleGuide: 'chef_modernize_includingwindowsdefaultrecipe'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1461,6 +1538,7 @@ Chef/Modernize/ExecuteAptUpdate:
   StyleGuide: 'chef_modernize_executeaptupdate'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1487,6 +1565,7 @@ Chef/Modernize/UseBuildEssentialResource:
   StyleGuide: 'chef_modernize_usebuildessentialresource'
   Enabled: true
   VersionAdded: '5.1.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1511,6 +1590,7 @@ Chef/Modernize/LibarchiveFileResource:
   StyleGuide: 'chef_modernize_libarchivefileresource'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1522,6 +1602,16 @@ Chef/Modernize/PowershellScriptExpandArchive:
   Exclude:
     - '**/metadata.rb'
 
+Chef/Modernize/PowershellDownloadFile:
+  Description: "Use the `remote_file` resource to download files instead of shelling out to PowerShell. `remote_file` is idempotent and supports checksum verification, proxies, and conditional downloads."
+  StyleGuide: 'chef_modernize_powershelldownloadfile'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
 Chef/Modernize/PowershellInstallPackage:
   Description: Use the package resource built into Chef Infra Client instead of using Install-Package in a powershell_script resource
   StyleGuide: 'chef_modernize_powershellinstallpackage'
@@ -1711,7 +1801,7 @@ Chef/Modernize/IncludingOhaiDefaultRecipe:
   StyleGuide: 'chef_modernize_includingohaidefaultrecipe'
   Enabled: true
   VersionAdded: '5.4.0'
-  VersionChanged: '5.15.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1768,6 +1858,7 @@ Chef/Modernize/DslIncludeInResource:
   StyleGuide: 'chef_modernize_dslincludeinresource'
   Enabled: true
   VersionAdded: '5.17.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/providers/*.rb'
@@ -1782,6 +1873,26 @@ Chef/Modernize/ResourceForcingCompileTime:
     - '**/attributes/*.rb'
     - '**/Berksfile'
 
+Chef/Modernize/ExecuteUpdateAlternatives:
+  Description: "Chef Infra Client 16.0 and later includes an `alternatives` resource that should be used to manage alternatives links instead of shelling out to `update-alternatives` or `alternatives`."
+  StyleGuide: 'chef_modernize_executeupdatealternatives'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
+Chef/Modernize/ExecuteArchiveExtract:
+  Description: "Use the `archive_file` resource built into Chef Infra Client 15+ instead of shelling out to `tar` or `unzip` to extract an archive."
+  StyleGuide: 'chef_modernize_executearchiveextract'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
 Chef/Modernize/ExecuteSysctl:
   Description: Chef Infra Client 14.0 and later includes a sysctl resource that should be used to idempotently load sysctl values instead of templating files and using execute to load them.
   StyleGuide: 'chef_modernize_executesysctl'
@@ -1807,6 +1918,7 @@ Chef/Modernize/UseRequireRelative:
   StyleGuide: 'chef_modernize_userequirerelative'
   Enabled: true
   VersionAdded: '5.22.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1856,6 +1968,7 @@ Chef/Modernize/DatabagHelpers:
   StyleGuide: 'chef_modernize_databaghelpers'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1889,10 +2002,11 @@ Chef/Modernize/ShellOutHelper:
     - '**/libraries/*.rb'
 
 Chef/Modernize/ConditionalUsingTest:
-  Description: Use ::File.exist?('/foo/bar') instead of the slower 'test -f /foo/bar' which requires shelling out.
+  Description: "Use `::File.exist?('/foo/bar')` in an `only_if` or `not_if` guard instead of the slower `'test -f /foo/bar'`, which requires shelling out. The Ruby check has to be passed as a block."
   StyleGuide: 'chef_modernize_conditionalusingtest'
   Enabled: true
   VersionAdded: '6.11.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -2114,7 +2228,7 @@ Chef/RedundantCode/UnnecessaryNameProperty:
   StyleGuide: 'chef_redundantcode_unnecessarynameproperty'
   Enabled: true
   VersionAdded: '5.8.0'
-  VersionChanged: '5.15.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/libraries/*.rb'
@@ -2199,6 +2313,7 @@ Chef/RedundantCode/StringPropertyWithNilDefault:
   StyleGuide: 'chef_redundantcode_stringpropertywithnildefault'
   Enabled: true
   VersionAdded: '5.21.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/libraries/*.rb'
@@ -2245,6 +2360,17 @@ Chef/RedundantCode/DoubleCompileTime:
   StyleGuide: 'chef_redundantcode_doublecompiletime'
   Enabled: true
   VersionAdded: '6.13.0'
+  VersionChanged: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
+Chef/RedundantCode/ServiceGuardOnStopDisable:
+  Description: "The `:stop` and `:disable` actions of the `service` resource are already no-ops when the service isn't installed, so guarding them with a check for the init script or unit file is redundant. It's also fragile, since the guard hardcodes a single path while the provider searches several."
+  StyleGuide: 'chef_redundantcode_serviceguardonstopdisable'
+  Enabled: true
+  VersionAdded: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -2366,6 +2492,15 @@ Chef/Security:
   Enabled: true
   StyleGuideBaseURL: https://docs.chef.io/workstation/cookstyle/
 
+Chef/Security/InsecureRemoteFileSource:
+  Description: "Fetch remote files over HTTPS. A file downloaded over plain HTTP or FTP can be modified in transit and the resource will use whatever it receives."
+  StyleGuide: 'chef_security_insecureremotefilesource'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
 Chef/Security/SshPrivateKey:
   Description: Do not include plain text SSH private keys in your cookbook code. This sensitive data should be fetched from secrets management systems so that secrets are not uploaded in plain text to the Chef Infra Server or committed to source control systems.
   StyleGuide: 'chef_security_sshprivatekey'
@@ -2704,6 +2839,8 @@ Lint/EnsureReturn:
   Enabled: true
 Security/Eval:
   Enabled: true
+Security/YAMLLoad:
+  Enabled: true
 Lint/FloatOutOfRange:
   Enabled: true
 Lint/FormatParameterMismatch:
@@ -2750,6 +2887,8 @@ Lint/UnusedMethodArgument:
   Enabled: true
 Lint/UnreachableCode:
   Enabled: true
+Lint/UriEscapeUnescape:
+  Enabled: true
 Lint/UselessAccessModifier:
   Enabled: true
 Lint/UselessAssignment:

data/lib/cookstyle/version.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 module Cookstyle
   # version of cookstyle
-  VERSION = "8.7.6" # rubocop: disable Style/StringLiterals
+  VERSION = "9.0.0" # rubocop: disable Style/StringLiterals
 
   # version of rubocop we pin to
-  RUBOCOP_VERSION = '1.86.1'
+  RUBOCOP_VERSION = '1.90.0'
 end

data/lib/rubocop/chef/cookbook_helpers.rb

@@ -67,6 +67,29 @@ module RuboCop
         end
       end
 
+      # Yield each action symbol declared by an `action` property, however it's written:
+      # `action :foo`, `action :foo, :bar`, `action [:foo, :bar]`, or `action %i(foo bar)`.
+      #
+      # The yielded prefix is what a corrector must put in front of a replacement action name.
+      # Inside a %i() literal the elements carry no colon, so replacing `%i(create)` with `:run`
+      # would produce the invalid `%i(:run)`.
+      #
+      # @param [RuboCop::AST::SendNode] action_property the `action` property node
+      #
+      # @yield [RuboCop::AST::SymbolNode, String] the action symbol and the replacement prefix
+      #
+      def each_action_symbol(action_property)
+        action_property.arguments.each do |arg|
+          if arg.sym_type?
+            yield(arg, ':')
+          elsif arg.array_type?
+            prefix = arg.percent_literal? ? '' : ':'
+            symbols = arg.values.select(&:sym_type?)
+            symbols.each { |symbol| yield(symbol, prefix) }
+          end
+        end
+      end
+
       def method_arg_ast_to_string(ast)
         # a property without a value. This is totally bogus, but they exist
         return if ast.children[2].nil?

data/lib/rubocop/chef.rb

@@ -4,7 +4,7 @@ module RuboCop
   module Chef
     PROJECT_ROOT   = Pathname.new(__dir__).parent.parent.expand_path.freeze
     CONFIG_DEFAULT = PROJECT_ROOT.join('config', 'cookstyle.yml').freeze
-    CONFIG         = YAML.load(CONFIG_DEFAULT.read).freeze
+    CONFIG         = YAML.safe_load(CONFIG_DEFAULT.read).freeze
 
     private_constant(*constants(false))
   end

data/lib/rubocop/cop/chef/correctness/chef_application_fatal.rb

@@ -21,10 +21,15 @@ module RuboCop
       module Correctness
         # Use `raise` to force Chef Infra Client to fail instead of using `Chef::Application.fatal`, which masks the full stack trace of the failure and makes debugging difficult.
         #
+        # `Chef::Application.fatal!` optionally takes an exit code as a second argument. That form is
+        # reported but not autocorrected, since `raise` has no way to express a specific exit code and
+        # rewriting it would silently change how the run terminates.
+        #
         # @example
         #
         #   # bad
         #   Chef::Application.fatal!('Something horrible happened!')
+        #   Chef::Application.fatal!('Something horrible happened!', 1)
         #
         #   # good
         #   raise "Something horrible happened!"
@@ -38,14 +43,21 @@ module RuboCop
           def_node_matcher :application_fatal?, <<-PATTERN
             (send
               (const
-                (const nil? :Chef) :Application) :fatal!
-              $( ... ))
+                (const {nil? cbase} :Chef) :Application) :fatal!
+              $...)
           PATTERN
 
           def on_send(node)
-            application_fatal?(node) do |val|
+            application_fatal?(node) do |args|
+              # Only the single message argument form maps cleanly onto raise. With an exit code (or
+              # with no message at all) we still report, but leave the rewrite to a human.
+              unless args.one?
+                add_offense(node, severity: :refactor)
+                next
+              end
+
               add_offense(node, severity: :refactor) do |corrector|
-                corrector.replace(node, "raise(#{val.source})")
+                corrector.replace(node, "raise(#{args.first.source})")
               end
             end
           end

data/lib/rubocop/cop/chef/correctness/conditional_unified_mode_true.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Setting `unified_mode true` conditionally leaves a resource running in unified mode on newer
+        # Chef Infra Client releases and in legacy mode on older ones. That's not a coherent thing to
+        # want: the resource has to be written, tested, and debugged against both execution models.
+        #
+        # Pick one. Set `unified_mode true` unconditionally and drop support for releases that predate
+        # it, or set `unified_mode false if respond_to?(:unified_mode)` to deliberately opt out of
+        # unified mode everywhere and keep writing the resource in the traditional style.
+        #
+        # Only `unified_mode true` is flagged. `unified_mode false` under a guard is the supported way
+        # to opt out and is left alone.
+        #
+        # @example
+        #
+        #   # bad
+        #   unified_mode true if respond_to?(:unified_mode)
+        #
+        #   # good
+        #   unified_mode true
+        #
+        #   # good - deliberately opting out of unified mode
+        #   unified_mode false if respond_to?(:unified_mode)
+        #
+        class ConditionalUnifiedModeTrue < Base
+          extend AutoCorrector
+          extend TargetChefVersion
+
+          minimum_target_chef_version '15.3'
+
+          MSG = 'Set `unified_mode true` unconditionally. Making it conditional gives you unified mode on newer Chef Infra Client releases and legacy mode on older ones, so the resource has to be tested and reasoned about both ways.'
+          RESTRICT_ON_SEND = [:unified_mode].freeze
+
+          def_node_matcher :unified_mode_true?, '(send nil? :unified_mode (true))'
+
+          def on_send(node)
+            return unless unified_mode_true?(node)
+
+            conditional = node.each_ancestor(:if).first
+            return unless conditional
+
+            add_offense(node, severity: :refactor) do |corrector|
+              # only unwrap the conditional when it wraps nothing but this property, otherwise
+              # we'd delete whatever else the branch was guarding. an elsif is never safe to unwrap:
+              # its node covers only the elsif itself, so replacing it drops that branch's condition
+              # and folds the property into the preceding branch
+              next if conditional.elsif?
+              next unless sole_branch_body?(conditional, node)
+
+              corrector.replace(conditional, node.source)
+            end
+          end
+
+          private
+
+          # Is the property the entire body of the conditional? `if` puts the body in the first
+          # child after the condition and `unless` puts it in the second, so check both. A branch
+          # holding anything else is a `begin` node rather than the property itself, and an `if`
+          # with an `else` (or an `elsif` chain) leaves the other branch non-nil.
+          #
+          # @param [RuboCop::AST::IfNode] conditional
+          # @param [RuboCop::AST::SendNode] node the `unified_mode true` property
+          #
+          # @return [Boolean]
+          def sole_branch_body?(conditional, node)
+            conditional.children[1..2].compact == [node]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/empty_resource_guard.rb

@@ -19,13 +19,18 @@ module RuboCop
   module Cop
     module Chef
       module Correctness
-        # Resource guards (not_if/only_if) should not be empty strings as empty strings will always evaluate to true.
-        # This will cause confusion in your cookbooks as the guard will always pass.
+        # Resource guards (not_if/only_if) should not be empty. An empty string always evaluates to true
+        # and an empty block always evaluates to false, so in either case the guard stops doing the job
+        # it was written for and the resource silently runs, or fails to run, on every converge.
         #
         # Empty strings in Ruby are "truthy", which means:
         # - `only_if ''` will ALWAYS execute the resource (guard always passes)
         # - `not_if ''` will NEVER execute the resource (guard always blocks)
         #
+        # An empty block behaves the other way around, since a block with no body returns `nil`:
+        # - `only_if { }` will NEVER execute the resource
+        # - `not_if { }` will ALWAYS execute the resource
+        #
         # This behavior is usually unintended and can lead to resources running when they shouldn't
         # or never running when they should.
         #
@@ -72,6 +77,7 @@ module RuboCop
         #
         class EmptyResourceGuard < Base
           MSG = 'Resource guards (not_if/only_if) should not be empty strings as empty strings will always evaluate to true.'
+          EMPTY_BLOCK_MSG = 'Resource guards (not_if/only_if) should not be empty blocks as an empty block returns nil, which always evaluates to false.'
           RESTRICT_ON_SEND = [:not_if, :only_if].freeze
 
           def_node_matcher :empty_string_guard?, <<-PATTERN
@@ -82,6 +88,12 @@ module RuboCop
             (block (send nil? {:not_if :only_if}) (args) (str #empty_string?))
           PATTERN
 
+          # A block with no body at all. Such a block returns nil rather than the empty string matched
+          # above, so the guard fails rather than passes.
+          def_node_matcher :empty_block_guard?, <<-PATTERN
+            (block (send nil? {:not_if :only_if}) (args) nil?)
+          PATTERN
+
           def empty_string?(str)
             str.empty?
           end
@@ -96,6 +108,10 @@ module RuboCop
             empty_string_block_guard?(node) do
               add_offense(node, severity: :refactor)
             end
+
+            empty_block_guard?(node) do
+              add_offense(node, message: EMPTY_BLOCK_MSG, severity: :refactor)
+            end
           end
         end
       end