knife 17.0.246 → 17.2.18

data/spec/unit/knife/core/windows_bootstrap_context_spec.rb

@@ -0,0 +1,238 @@
+#
+# Author:: Bryan McLellan <btm@loftninjas.org>
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "knife_spec_helper"
+require "chef/knife/core/windows_bootstrap_context"
+describe Chef::Knife::Core::WindowsBootstrapContext do
+  let(:config) { {} }
+  let(:chef_config) { Chef::Config.save } # "dup" to a hash
+  let(:bootstrap_context) { Chef::Knife::Core::WindowsBootstrapContext.new(config, nil, chef_config, nil) }
+
+  describe "fips" do
+    context "when fips is set" do
+      before do
+        chef_config[:fips] = true
+      end
+
+      it "sets fips mode in the client.rb" do
+        expect(bootstrap_context.config_content).to match(/fips true/)
+      end
+    end
+
+    context "when fips is not set" do
+      before do
+        chef_config[:fips] = false
+      end
+
+      it "sets fips mode in the client.rb" do
+        expect(bootstrap_context.config_content).not_to match(/fips true/)
+      end
+    end
+  end
+
+  describe "trusted_certs_script" do
+    let(:mock_cert_dir) { ::File.absolute_path(::File.join("spec", "assets", "fake_trusted_certs")) }
+    let(:script_output) { bootstrap_context.trusted_certs_script }
+    let(:crt_files) { ::Dir.glob(::File.join(mock_cert_dir, "*.crt")) }
+    let(:pem_files) { ::Dir.glob(::File.join(mock_cert_dir, "*.pem")) }
+    let(:other_files) { ::Dir.glob(::File.join(mock_cert_dir, "*")) - crt_files - pem_files }
+
+    before do
+      bootstrap_context.instance_variable_set(:@chef_config, Mash.new(trusted_certs_dir: mock_cert_dir))
+    end
+
+    it "should echo every .crt file in the trusted_certs directory" do
+      crt_files.each do |f|
+        echo_file = ::File.read(f).gsub(/^/, "echo.")
+        expect(script_output).to include(::File.join("trusted_certs", ::File.basename(f)))
+        expect(script_output).to include(echo_file)
+      end
+    end
+
+    it "should echo every .pem file in the trusted_certs directory" do
+      pem_files.each do |f|
+        echo_file = ::File.read(f).gsub(/^/, "echo.")
+        expect(script_output).to include(::File.join("trusted_certs", ::File.basename(f)))
+        expect(script_output).to include(echo_file)
+      end
+    end
+
+    it "should not echo files which aren't .crt or .pem files" do
+      other_files.each do |f|
+        echo_file = ::File.read(f).gsub(/^/, "echo.")
+        expect(script_output).to_not include(::File.join("trusted_certs", ::File.basename(f)))
+        expect(script_output).to_not include(echo_file)
+      end
+    end
+  end
+
+  describe "validation_key" do
+    before do
+      bootstrap_context.instance_variable_set(:@chef_config, Mash.new(validation_key: "C:\\chef\\key.pem"))
+    end
+
+    it "should return false if validation_key does not exist" do
+      allow(::File).to receive(:expand_path).with("C:\\chef\\key.pem").and_call_original
+      allow(::File).to receive(:exist?).and_return(false)
+      expect(bootstrap_context.validation_key).to eq(false)
+    end
+  end
+
+  describe "#get_log_location" do
+
+    context "when config_log_location value is nil" do
+      it "sets STDOUT in client.rb as default" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: nil))
+        expect(bootstrap_context.get_log_location).to eq("STDOUT\n")
+      end
+    end
+
+    context "when config_log_location value is empty" do
+      it "sets STDOUT in client.rb as default" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: ""))
+        expect(bootstrap_context.get_log_location).to eq("STDOUT\n")
+      end
+    end
+
+    context "when config_log_location value is STDOUT" do
+      it "sets STDOUT in client.rb" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: STDOUT))
+        expect(bootstrap_context.get_log_location).to eq("STDOUT\n")
+      end
+    end
+
+    context "when config_log_location value is STDERR" do
+      it "sets STDERR in client.rb" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: STDERR))
+        expect(bootstrap_context.get_log_location).to eq("STDERR\n")
+      end
+    end
+
+    context "when config_log_location value is path to a file" do
+      it "sets file path in client.rb" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: "C:\\chef\\chef.log"))
+        expect(bootstrap_context.get_log_location).to eq("\"C:\\chef\\chef.log\"\n")
+      end
+    end
+
+    context "when config_log_location value is :win_evt" do
+      it "sets :win_evt in client.rb" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: :win_evt))
+        expect(bootstrap_context.get_log_location).to eq(":win_evt\n")
+      end
+    end
+
+    context "when config_log_location value is :syslog" do
+      it "raise error with message and exit" do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(config_log_location: :syslog))
+        expect { bootstrap_context.get_log_location }.to raise_error("syslog is not supported for log_location on Windows OS\n")
+      end
+    end
+
+  end
+
+  describe "#config_content" do
+    before do
+      bootstrap_context.instance_variable_set(
+        :@chef_config, Mash.new(
+          config_log_level: :info,
+          config_log_location: STDOUT,
+          chef_server_url: "http://chef.example.com:4444",
+          validation_client_name: "chef-validator-testing",
+          file_cache_path: "c:/chef/cache",
+          file_backup_path: "c:/chef/backup",
+          cache_options: ({ path: "c:/chef/cache/checksums", skip_expires: true })
+        )
+      )
+    end
+
+    it "generates the config file data" do
+      expected = <<~EXPECTED
+        echo.chef_server_url  "http://chef.example.com:4444"
+        echo.validation_client_name "chef-validator-testing"
+        echo.file_cache_path   "C:\\\\chef\\\\cache"
+        echo.file_backup_path  "C:\\\\chef\\\\backup"
+        echo.cache_options     ^({:path =^> "C:\\\\chef\\\\cache\\\\checksums", :skip_expires =^> true}^)
+        echo.# Using default node name ^(fqdn^)
+        echo.log_level        :auto
+        echo.log_location       STDOUT
+      EXPECTED
+      expect(bootstrap_context.config_content).to eq expected
+    end
+
+    describe "when chef_license is set" do
+      before do
+        bootstrap_context.instance_variable_set(:@chef_config, Mash.new(chef_license: "accept-no-persist"))
+      end
+      it "sets chef_license in the generated config file" do
+        expect(bootstrap_context.config_content).to include("chef_license \"accept-no-persist\"")
+      end
+    end
+  end
+
+  describe "#start_chef" do
+    it "returns the expected string" do
+      expect(bootstrap_context.start_chef).to eq(
+        <<~EOH
+          SET "PATH=%SYSTEM32%;%SystemRoot%;%SYSTEM32%\\Wbem;%SYSTEM32%\\WindowsPowerShell\\v1.0\\;C:\\ruby\\bin;C:\\opscode\\chef\\bin;C:\\opscode\\chef\\embedded\\bin;%PATH%"
+          chef-client -c C:\\chef\\client.rb -j C:\\chef\\first-boot.json
+        EOH
+      )
+    end
+  end
+
+  describe "msi_url" do
+    context "when msi_url config option is not set" do
+      let(:config) { { channel: "stable" } }
+      before do
+        expect(bootstrap_context).to receive(:version_to_install).and_return("something")
+      end
+
+      it "returns a chef.io msi url with minimal url parameters" do
+        reference_url = "https://omnitruck.chef.io/chef/download?p=windows&channel=stable&v=something"
+        expect(bootstrap_context.msi_url).to eq(reference_url)
+      end
+
+      it "returns a chef.io msi url with provided url parameters substituted" do
+        reference_url = "https://omnitruck.chef.io/chef/download?p=windows&pv=machine&m=arch&DownloadContext=ctx&channel=stable&v=something"
+        expect(bootstrap_context.msi_url("machine", "arch", "ctx")).to eq(reference_url)
+      end
+
+      context "when a channel is provided in config" do
+        let(:config) { { channel: "current" } }
+        it "returns a chef.io msi url with the requested channel" do
+          reference_url = "https://omnitruck.chef.io/chef/download?p=windows&channel=current&v=something"
+          expect(bootstrap_context.msi_url).to eq(reference_url)
+        end
+      end
+    end
+
+    context "when msi_url config option is set" do
+      let(:custom_url) { "file://something" }
+      let(:config) { { msi_url: custom_url, install: true } }
+
+      it "returns the overridden url" do
+        expect(bootstrap_context.msi_url).to eq(custom_url)
+      end
+
+      it "doesn't introduce any unnecessary query parameters if provided by the template" do
+        expect(bootstrap_context.msi_url("machine", "arch", "ctx")).to eq(custom_url)
+      end
+    end
+  end
+end

data/spec/unit/knife/data_bag_create_spec.rb

@@ -0,0 +1,175 @@
+#
+# Author:: Daniel DeLeo (<dan@chef.io>)
+# Author:: Seth Falcon (<seth@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "knife_spec_helper"
+require "tempfile"
+
+describe Chef::Knife::DataBagCreate do
+  let(:knife) do
+    k = Chef::Knife::DataBagCreate.new
+    allow(k).to receive(:rest).and_return(rest)
+    allow(k.ui).to receive(:stdout).and_return(stdout)
+    k
+  end
+
+  let(:rest) { double("Chef::ServerAPI") }
+  let(:stdout) { StringIO.new }
+
+  let(:bag_name) { "sudoing_admins" }
+  let(:item_name) { "ME" }
+
+  let(:secret) { "abc123SECRET" }
+
+  let(:raw_hash) { { "login_name" => "alphaomega", "id" => item_name } }
+
+  let(:config) { {} }
+
+  before do
+    Chef::Config[:node_name] = "webmonkey.example.com"
+    knife.name_args = [bag_name, item_name]
+    allow(knife).to receive(:config).and_return(config)
+  end
+
+  context "when data_bag already exists" do
+    it "doesn't create a data bag" do
+      expect(knife).to receive(:create_object).and_yield(raw_hash)
+      expect(rest).to receive(:get).with("data/#{bag_name}")
+      expect(rest).to_not receive(:post).with("data", { "name" => bag_name })
+      expect(knife.ui).to receive(:info).with("Data bag #{bag_name} already exists")
+
+      knife.run
+    end
+  end
+
+  context "when data_bag doesn't exist" do
+    before do
+      # Data bag doesn't exist by default so we mock the GET request to return 404
+      exception = double("404 error", code: "404")
+      allow(rest).to receive(:get)
+        .with("data/#{bag_name}")
+        .and_raise(Net::HTTPClientException.new("404", exception))
+    end
+
+    it "tries to create a data bag with an invalid name when given one argument" do
+      knife.name_args = ["invalid&char"]
+      expect(Chef::DataBag).to receive(:validate_name!).with(knife.name_args[0]).and_raise(Chef::Exceptions::InvalidDataBagName)
+      expect { knife.run }.to exit_with_code(1)
+    end
+
+    it "won't create a data bag with a reserved name for search" do
+      %w{node role client environment}.each do |name|
+        knife.name_args = [name]
+        expect(Chef::DataBag).to receive(:validate_name!).with(knife.name_args[0]).and_raise(Chef::Exceptions::InvalidDataBagName)
+        expect { knife.run }.to exit_with_code(1)
+      end
+    end
+
+    context "when part of the name is a reserved name" do
+      before do
+        exception = double("404 error", code: "404")
+        %w{node role client environment}.each do |name|
+          allow(rest).to receive(:get)
+            .with("data/sudoing_#{name}_admins")
+            .and_raise(Net::HTTPClientException.new("404", exception))
+        end
+      end
+
+      it "will create a data bag containing a reserved word" do
+        %w{node role client environment}.each do |name|
+          knife.name_args = ["sudoing_#{name}_admins"]
+          expect(rest).to receive(:post).with("data", { "name" => knife.name_args[0] })
+          expect(knife.ui).to receive(:info).with("Created data_bag[#{knife.name_args[0]}]")
+
+          knife.run
+        end
+      end
+    end
+
+    context "when given one argument" do
+      before do
+        knife.name_args = [bag_name]
+      end
+
+      it "creates a data bag" do
+        expect(rest).to receive(:post).with("data", { "name" => bag_name })
+        expect(knife.ui).to receive(:info).with("Created data_bag[#{bag_name}]")
+
+        knife.run
+      end
+    end
+
+    context "when given a data bag name partially matching a reserved name for search" do
+      %w{xnode rolex xenvironmentx xclientx}.each do |name|
+        let(:bag_name) { name }
+
+        before do
+          knife.name_args = [bag_name]
+        end
+
+        it "creates a data bag named '#{name}'" do
+          expect(rest).to receive(:post).with("data", { "name" => bag_name })
+          expect(knife.ui).to receive(:info).with("Created data_bag[#{bag_name}]")
+
+          knife.run
+        end
+      end
+    end
+
+    context "no secret is specified for encryption" do
+      let(:item) do
+        item = Chef::DataBagItem.from_hash(raw_hash)
+        item.data_bag(bag_name)
+        item
+      end
+
+      it "creates a data bag item" do
+        expect(knife).to receive(:create_object).and_yield(raw_hash)
+        expect(knife).to receive(:encryption_secret_provided?).and_return(false)
+        expect(rest).to receive(:post).with("data", { "name" => bag_name }).ordered
+        expect(rest).to receive(:post).with("data/#{bag_name}", item).ordered
+
+        knife.run
+      end
+    end
+
+    context "a secret is specified for encryption" do
+      let(:encoded_data) { Chef::EncryptedDataBagItem.encrypt_data_bag_item(raw_hash, secret) }
+
+      let(:item) do
+        item = Chef::DataBagItem.from_hash(encoded_data)
+        item.data_bag(bag_name)
+        item
+      end
+
+      it "creates an encrypted data bag item" do
+        expect(knife).to receive(:create_object).and_yield(raw_hash)
+        expect(knife).to receive(:encryption_secret_provided?).and_return(true)
+        expect(knife).to receive(:read_secret).and_return(secret)
+        expect(Chef::EncryptedDataBagItem)
+          .to receive(:encrypt_data_bag_item)
+          .with(raw_hash, secret)
+          .and_return(encoded_data)
+        expect(rest).to receive(:post).with("data", { "name" => bag_name }).ordered
+        expect(rest).to receive(:post).with("data/#{bag_name}", item).ordered
+
+        knife.run
+      end
+    end
+  end
+end

data/spec/unit/knife/data_bag_edit_spec.rb

@@ -0,0 +1,126 @@
+#
+# Author:: Seth Falcon (<seth@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "knife_spec_helper"
+require "tempfile"
+
+describe Chef::Knife::DataBagEdit do
+  before do
+    Chef::Config[:node_name] = "webmonkey.example.com"
+    knife.name_args = [bag_name, item_name]
+    allow(knife).to receive(:config).and_return(config)
+  end
+
+  let(:knife) do
+    k = Chef::Knife::DataBagEdit.new
+    allow(k).to receive(:rest).and_return(rest)
+    allow(k.ui).to receive(:stdout).and_return(stdout)
+    k
+  end
+
+  let(:raw_hash) { { "login_name" => "alphaomega", "id" => "item_name" } }
+  let(:db) { Chef::DataBagItem.from_hash(raw_hash) }
+  let(:raw_edited_hash) { { "login_name" => "rho", "id" => "item_name", "new_key" => "new_value" } }
+
+  let(:rest) { double("Chef::ServerAPI") }
+  let(:stdout) { StringIO.new }
+
+  let(:bag_name) { "sudoing_admins" }
+  let(:item_name) { "ME" }
+
+  let(:secret) { "abc123SECRET" }
+
+  let(:config) { {} }
+
+  let(:is_encrypted?) { false }
+  let(:transmitted_hash) { raw_edited_hash }
+  let(:data_to_edit) { db.raw_data }
+  shared_examples_for "editing a data bag" do
+    it "correctly edits then uploads the data bag" do
+      expect(Chef::DataBagItem).to receive(:load).with(bag_name, item_name).and_return(db)
+      expect(knife).to receive(:encrypted?).with(db.raw_data).and_return(is_encrypted?)
+      expect(knife).to receive(:edit_hash).with(data_to_edit).and_return(raw_edited_hash)
+      expect(rest).to receive(:put).with("data/#{bag_name}/#{item_name}", transmitted_hash).ordered
+
+      knife.run
+    end
+  end
+
+  it "requires data bag and item arguments" do
+    knife.name_args = []
+    expect(stdout).to receive(:puts).twice.with(anything)
+    expect { knife.run }.to exit_with_code(1)
+    expect(stdout.string).to eq("")
+  end
+
+  context "when no secret is provided" do
+    include_examples "editing a data bag"
+  end
+
+  context "when config[:print_after] is set" do
+    let(:config) { { print_after: true } }
+    before do
+      expect(knife.ui).to receive(:output).with(raw_edited_hash)
+    end
+
+    include_examples "editing a data bag"
+  end
+
+  context "when a secret is provided" do
+    let!(:enc_raw_hash) { Chef::EncryptedDataBagItem.encrypt_data_bag_item(raw_hash, secret) }
+    let!(:enc_edited_hash) { Chef::EncryptedDataBagItem.encrypt_data_bag_item(raw_edited_hash, secret) }
+    let(:transmitted_hash) { enc_edited_hash }
+
+    before(:each) do
+      expect(knife).to receive(:read_secret).at_least(1).times.and_return(secret)
+      expect(Chef::EncryptedDataBagItem).to receive(:encrypt_data_bag_item).with(raw_edited_hash, secret).and_return(enc_edited_hash)
+    end
+
+    context "the data bag starts encrypted" do
+      let(:is_encrypted?) { true }
+      let(:db) { Chef::DataBagItem.from_hash(enc_raw_hash) }
+      # If the data bag is encrypted, it gets passed to `edit` as a hash.  Otherwise, it gets passed as a DataBag
+      let(:data_to_edit) { raw_hash }
+
+      before(:each) do
+        expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
+      end
+
+      include_examples "editing a data bag"
+    end
+
+    context "the data bag starts unencrypted" do
+      before(:each) do
+        expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).exactly(0).times
+        expect(knife).to receive(:encryption_secret_provided?).and_return(true)
+      end
+
+      include_examples "editing a data bag"
+    end
+  end
+
+  it "fails to edit an encrypted data bag if the secret is missing" do
+    expect(Chef::DataBagItem).to receive(:load).with(bag_name, item_name).and_return(db)
+    expect(knife).to receive(:encrypted?).with(db.raw_data).and_return(true)
+    expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(false)
+
+    expect(knife.ui).to receive(:fatal).with("You cannot edit an encrypted data bag without providing the secret.")
+    expect { knife.run }.to exit_with_code(1)
+  end
+
+end