omnibus-software 22.11.239

data/config/software/nodejs.rb

@@ -0,0 +1,58 @@
+#
+# Copyright:: Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# expeditor/ignore: deprecated 2021-11
+
+name "nodejs"
+
+license "MIT"
+license_file "LICENSE"
+skip_transitive_dependency_licensing true
+
+default_version "0.10.48"
+
+dependency "python"
+
+default_src_url = "https://nodejs.org/dist/v#{version}/node-v#{version}.tar.gz"
+
+version "12.22.3" do
+  source url: default_src_url, sha256: "30acec454f26a168afe6d1c55307c5186ef23dba66527cc34e4497d01f91bda4"
+end
+
+version "0.10.48" do
+  source url: default_src_url, sha256: "27a1765b86bf4ec9833e2f89e8421ba4bc01a326b883f125de2f0b3494bd5549"
+end
+
+relative_path "node-v#{version}"
+
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+
+  config_command = [
+    "--prefix=#{install_dir}/embedded",
+    "--without-dtrace",
+  ]
+
+  if version.satisfies?(">= 12")
+    config_command << "--without-node-snapshot"
+    config_command << "--without-inspector"
+    config_command << "--without-intl"
+  end
+
+  configure(*config_command, env: env)
+
+  make "-j #{workers}", env: env
+  make "install", env: env
+end

data/config/software/nokogiri.rb

@@ -0,0 +1,92 @@
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# expeditor/ignore: no version pinning
+
+name "nokogiri"
+
+license "MIT"
+license_file "https://raw.githubusercontent.com/sparklemotion/nokogiri/master/LICENSE.md"
+# We install only nokogiri from rubygems here.
+skip_transitive_dependency_licensing true
+
+dependency "ruby"
+
+using_prebuilt_ruby = windows? && (project.overrides[:ruby].nil? || project.overrides[:ruby][:version] == "ruby-windows")
+unless using_prebuilt_ruby
+  dependency "libxml2"
+  dependency "libxslt"
+  dependency "liblzma"
+  dependency "zlib"
+end
+
+#
+# NOTE: As of nokogiri 1.6.4 it will superficially 'work' to remove most
+# of the nonsense in this file and simply gem install nokogiri on most
+# platforms.  This is because nokogiri has improved its packaging so that
+# all of the dynamic libraries are 'statically' compiled into nokogiri.so
+# with -lz -llzma -lxslt -lxml2, etc.  What will happen in that case is
+# that the nokogiri build system will pull zlib, lzma, etc out of the
+# system and link it inside of nokogiri.so and ship it as one big
+# dynamic library.  This will essentially defeat one aspect of our
+# health_check system so that we will be shipping an embedded zlib inside
+# of nokogiri.so that we do not track and will have a high likelihood that
+# if there are security errata that we ship exploitable code without
+# knowing it.  For all other purposes, the built executable will work,
+# however, so it is likely that someone will 'discover' that 'everything
+# works' and remove all the junk in this file.  That will, however, have
+# unintended side effects.  We do not have a mechanism to inspect the
+# nokogiri.so and determine that it is shipping with an embedded zlib that
+# does not match the one that we ship in /opt/chef/embedded/lib, so there
+# will be nothing that alerts or fails on this.
+#
+# TL;DR: do not remove --use-system-libraries even if everything appears to
+# be green after you do.
+#
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+
+  gem_command = [ "install nokogiri" ]
+  gem_command << "--version '#{version}'" unless version.nil?
+
+  # windows uses the 'fat' precompiled binaries'
+  unless using_prebuilt_ruby
+    # Tell nokogiri to use the system libraries instead of compiling its own
+    env["NOKOGIRI_USE_SYSTEM_LIBRARIES"] = "true"
+
+    gem_command += [
+      "--platform ruby",
+      "--conservative",
+      "--minimal-deps",
+      "--",
+      "--use-system-libraries",
+      "--with-xml2-lib=#{install_dir}/embedded/lib",
+      "--with-xml2-include=#{install_dir}/embedded/include/libxml2",
+      "--with-xslt-lib=#{install_dir}/embedded/lib",
+      "--with-xslt-include=#{install_dir}/embedded/include/libxslt",
+      "--without-iconv",
+      "--with-zlib-dir=#{install_dir}/embedded",
+    ]
+  end
+
+  gem gem_command.join(" "), env: env
+
+  # The mini-portile2 gem ships with some test fixture data compressed in a format Apple's notarization
+  # service cannot understand. We need to delete that archive to pass notarization.
+  block "Delete test folder of mini-portile2 gem so downstream projects pass notarization" do
+    env["VISUAL"] = "echo"
+    gem_install_dir = shellout!("#{install_dir}/embedded/bin/gem open mini_portile2", env: env).stdout.chomp
+    remove_directory "#{gem_install_dir}/test"
+  end
+end

data/config/software/omnibus-ctl.rb

@@ -0,0 +1,42 @@
+#
+# Copyright 2012-2015 Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "omnibus-ctl"
+default_version "v0.6.0"
+
+license "Apache-2.0"
+license_file "https://raw.githubusercontent.com/chef/omnibus-ctl/main/LICENSE"
+# Even though omnibus-ctl is a gem, it does not have any dependencies.
+skip_transitive_dependency_licensing true
+
+dependency "ruby"
+
+# versions_list: https://github.com/chef/omnibus-ctl/tags filter=*.tar.gz
+source git: "https://github.com/chef/omnibus-ctl.git"
+
+relative_path "omnibus-ctl"
+
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+
+  # Remove existing built gems in case they exist in the current dir
+  delete "omnibus-ctl-*.gem"
+
+  gem "build omnibus-ctl.gemspec", env: env
+  gem "install omnibus-ctl-*.gem --no-document ", env: env
+
+  touch "#{install_dir}/embedded/service/omnibus-ctl/.gitkeep"
+end

data/config/software/openresty.rb

@@ -0,0 +1,94 @@
+#
+# Copyright:: Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "openresty"
+license "BSD-2-Clause"
+license_file "README.markdown"
+skip_transitive_dependency_licensing true
+default_version "1.21.4.1"
+
+dependency "pcre"
+dependency "openssl"
+dependency "zlib"
+dependency "lua" if ppc64? || ppc64le? || s390x?
+
+# versions_list: https://openresty.org/download/ filter=*.tar.gz
+version("1.21.4.1")    { source sha256: "0c5093b64f7821e85065c99e5d4e6cc31820cfd7f37b9a0dec84209d87a2af99" }
+version("1.21.4.1rc1") { source sha256: "1cb216bc57a253149cb5c4b815bfe00e1c0713e7355774bbc26cf306d2ff632f" }
+version("1.19.9.1")    { source sha256: "576ff4e546e3301ce474deef9345522b7ef3a9d172600c62057f182f3a68c1f6" }
+version("1.19.3.2")    { source sha256: "ce40e764990fbbeb782e496eb63e214bf19b6f301a453d13f70c4f363d1e5bb9" }
+version("1.19.3.1")    { source sha256: "f36fcd9c51f4f9eb8aaab8c7f9e21018d5ce97694315b19cacd6ccf53ab03d5d" }
+version("1.17.8.2")    { source sha256: "2f321ab11cb228117c840168f37094ee97f8f0316eac413766305409c7e023a0" }
+version("1.15.8.1")    { source sha256: "89a1238ca177692d6903c0adbea5bdf2a0b82c383662a73c03ebf5ef9f570842" }
+version("1.13.6.2")    { source sha256: "946e1958273032db43833982e2cec0766154a9b5cb8e67868944113208ff2942" }
+version("1.11.2.5")    { source sha256: "f8cc203e8c0fcd69676f65506a3417097fc445f57820aa8e92d7888d8ad657b9" }
+
+source url: "https://openresty.org/download/openresty-#{version}.tar.gz"
+
+relative_path "openresty-#{version}"
+
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+  env["PATH"] += "#{env["PATH"]}:/usr/sbin:/sbin"
+
+  configure = [
+    "./configure",
+    "--prefix=#{install_dir}/embedded",
+    "--sbin-path=#{install_dir}/embedded/sbin/nginx",
+    "--conf-path=#{install_dir}/embedded/conf/nginx.conf",
+    "--with-http_ssl_module",
+    "--with-debug",
+    "--with-http_stub_status_module",
+    # Building Nginx with non-system OpenSSL
+    # http://www.ruby-forum.com/topic/207287#902308
+    "--with-ld-opt=\"-L#{install_dir}/embedded/lib -Wl,-rpath,#{install_dir}/embedded/lib -lssl -lcrypto -ldl -lz\"",
+    "--with-cc-opt=\"-L#{install_dir}/embedded/lib -I#{install_dir}/embedded/include\"",
+    # Options inspired by the OpenResty Cookbook
+    "--with-md5-asm",
+    "--with-sha1-asm",
+    "--with-pcre-jit",
+    "--without-http_ssi_module",
+    "--without-mail_smtp_module",
+    "--without-mail_imap_module",
+    "--without-mail_pop3_module",
+    "--with-http_v2_module",
+    "--with-ipv6",
+    # AIO support define in Openresty cookbook. Requires Kernel >= 2.6.22
+    # Ubuntu 10.04 reports: 2.6.32-38-server #83-Ubuntu SMP
+    # However, they require libatomic-ops-dev and libaio
+    # '--with-file-aio',
+    # '--with-libatomic'
+  ]
+
+  # Currently LuaJIT doesn't support POWER correctly so use Lua51 there instead
+  if ppc64? || ppc64le? || s390x?
+    # 1.13 breaks these; discover a workaround
+    if version.satisfies?(">= 1.13")
+      exit("ppc64? || ppc64le? || s390x? unsupported for 1.13 and greater")
+    else
+      configure << "--with-lua51=#{install_dir}/embedded/lib"
+    end
+  else
+    configure << "--with-luajit"
+  end
+
+  command configure.join(" "), env: env
+
+  make "-j #{workers}", env: env
+  make "install", env: env
+
+  touch "#{install_dir}/embedded/nginx/logs/.gitkeep"
+end

data/config/software/opensearch.rb

@@ -0,0 +1,54 @@
+#
+# Copyright 2020 Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "opensearch"
+default_version "2.2.0"
+
+dependency "server-open-jre"
+license "Apache-2.0"
+license_file "LICENSE.txt"
+skip_transitive_dependency_licensing true
+
+source url: "https://artifacts.opensearch.org/releases/bundle/opensearch/#{version}/opensearch-#{version}-linux-x64.tar.gz"
+relative_path "opensearch-#{version}"
+
+# versions_list:https://opensearch.org/docs/latest/version-history/
+version("2.2.0") { source sha256: "4480c15682ddcd10cebb8a1103f4efafa789d7aee9d4c8c9201cd9864d5ed58c" }
+version("2.1.0") { source sha256: "bccd737e0f4e4554d3918f011a1e379ebda9e53473c70b4264aa28ce719611e3" }
+version("2.0.1") { source sha256: "8366dc71c839935330dbe841b415b37f28573de5ae7718e75f2e1c50756e0d99" }
+version("2.0.0") { source sha256: "bec706d221052cb962ed0e6973d28e1058f21ef3dfc054c97c991bb279b0564e" }
+version("1.3.2") { source sha256: "14199251a8aae2068fd54aa39c778ff29dcc8be33d57f36a8cc2d19e07ff4149" }
+version("1.2.4") { source sha256: "d40f2696623b6766aa235997e2847a6c661a226815d4ba173292a219754bd8a8" }
+
+target_path = "#{install_dir}/embedded/opensearch"
+
+build do
+  mkdir "#{target_path}"
+
+  delete "#{project_dir}/config"
+
+  # OpenSearch includes a compatible jdk but its files fail the omnibus health check.
+  # It isn't needed since we use the omnibus built server-open-jre so it can be deleted.
+  delete "#{project_dir}/jdk"
+
+  # Delete the opensearch-knn plugin because it causes health check failures
+  delete "#{project_dir}/plugins/opensearch-knn"
+
+  sync "#{project_dir}/", "#{target_path}"
+  # Dropping a VERSION file here allows additional software definitions
+  # to read it to determine ES plugin compatibility.
+  command "echo #{version} > #{target_path}/VERSION"
+end

data/config/software/openssl-customization.rb

@@ -0,0 +1,81 @@
+#
+# Copyright:: Copyright (c) 2014-2017, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This software makes sure that SSL_CERT_FILE environment variable is pointed
+# to the bundled CA certificates that ship with omnibus. With this, Chef
+# tools can be used with https URLs out of the box.
+# expeditor/ignore: logic only
+
+name "openssl-customization"
+
+license :project_license
+skip_transitive_dependency_licensing true
+
+source path: "#{project.files_path}/#{name}"
+
+dependency "ruby"
+
+build do
+  block "Add OpenSSL customization file" do
+    # gets directories for RbConfig::CONFIG and sanitizes them.
+    def get_sanitized_rbconfig(config)
+      ruby = windows_safe_path("#{install_dir}/embedded/bin/ruby")
+
+      config_dir = Bundler.with_clean_env do
+        command_output = `#{ruby} -rrbconfig -e "puts RbConfig::CONFIG['#{config}']"`.strip
+        windows_safe_path(command_output)
+      end
+
+      if config_dir.nil? || config_dir.empty?
+        raise "could not determine embedded ruby's RbConfig::CONFIG['#{config}']"
+      end
+
+      config_dir
+    end
+
+    if windows?
+      embedded_ruby_site_dir = get_sanitized_rbconfig("sitelibdir")
+      embedded_ruby_lib_dir  = get_sanitized_rbconfig("rubylibdir")
+
+      source_ssl_env_hack      = File.join(project_dir, "windows", "ssl_env_hack.rb")
+      destination_ssl_env_hack = File.join(embedded_ruby_site_dir, "ssl_env_hack.rb")
+
+      create_directory(embedded_ruby_site_dir)
+
+      copy(source_ssl_env_hack, destination_ssl_env_hack)
+
+      # Unfortunately there is no patch on windows, but luckily we only need to append a line to the openssl.rb
+      # to pick up our script which find the CA bundle in omnibus installations and points SSL_CERT_FILE to it
+      # if it's not already set
+      source_openssl_rb = File.join(embedded_ruby_lib_dir, "openssl.rb")
+      File.open(source_openssl_rb, "r+") do |f|
+        unpatched_openssl_rb = f.read
+        f.rewind
+        f.write("\nrequire 'ssl_env_hack'\n")
+        f.write(unpatched_openssl_rb)
+      end
+    else
+      embedded_ruby_lib_dir = get_sanitized_rbconfig("rubylibdir")
+      source_openssl_rb = File.join(embedded_ruby_lib_dir, "openssl.rb")
+      File.open(source_openssl_rb, "r+") do |f|
+        unpatched_openssl_rb = f.read
+        f.rewind
+        f.write(unpatched_openssl_rb)
+      end
+    end
+  end
+end

data/config/software/openssl-fips.rb

@@ -0,0 +1,81 @@
+#
+# Copyright 2014-2019 Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "openssl-fips"
+default_version "2.0.16"
+
+license "OpenSSL"
+license_file "https://www.openssl.org/source/license.html"
+skip_transitive_dependency_licensing true
+
+# HAHAHA According to the FIPS manual, you need to "securely" fetch the source
+# such as asking some humans to mail you a CD-ROM or something.
+# You are then supposed to manually verify the PGP signatures.
+# When making an "official" build - make sure you go do that...
+source url: "https://www.openssl.org/source/old/fips/openssl-fips-#{version}.tar.gz", extract: :lax_tar
+
+version("2.0.16") {
+  source sha256: "a3cd13d0521d22dd939063d3b4a0d4ce24494374b91408a05bdaca8b681c63d4", \
+         url: "https://www.openssl.org/source/openssl-fips-#{version}.tar.gz", extract: :lax_tar
+}
+version("2.0.14") { source sha256: "8ea069ec39f9c49d85b9831b16daa29936b4527446998336cf93e575f07626c0" }
+version("2.0.11") { source sha256: "a6532875956d357a05838ca2c9865b8eecac211543e4246512684b17acbbdfac" }
+version("2.0.10") { source sha256: "a42ccf5f08a8b510c0c78da1ba889532a0ce24e772b576604faf09b4d6a0f771" }
+version("2.0.9") { source md5: "c8256051d7a76471c6ad4fb771404e60" }
+
+relative_path "openssl-fips-#{version}"
+
+build do
+  # According to the FIPS manual, this is the only environment you are allowed
+  # to build it in, to ensure security.
+  env = {}
+  env["FIPSDIR"] = "#{install_dir}/embedded"
+
+  if windows?
+    default_env = with_standard_compiler_flags(with_embedded_path)
+
+    if windows_arch_i386?
+      # Patch Makefile.org to update the compiler flags/options table for mingw.
+      patch source: "openssl-fips-fix-compiler-flags-table-for-msys.patch", env: default_env
+
+      platform = "mingw"
+    else
+      platform = "mingw64"
+    end
+
+    configure_command = ["perl.exe ./Configure #{platform}"]
+    configure_command << "--prefix=#{install_dir}/embedded"
+  elsif ppc64? && rhel?
+    # you have to specify on el ppc64 (big-endian only) otherwise it has won't
+    # compile
+    configure_command = ["perl ./Configure linux-ppc64"]
+    configure_command << "--prefix=#{install_dir}/embedded"
+  elsif s390x?
+    configure_command = ["perl ./Configure linux64-s390x"]
+    configure_command << "--prefix=#{install_dir}/embedded"
+    # Unfortunately openssl-fips is not supported on s390x, so we have to tell it to
+    # compile solely in C
+    configure_command << "no-asm"
+  else
+    configure_command = ["./config"]
+  end
+
+  command configure_command.join(" "), env: env, in_msys_bash: true
+
+  # Cannot use -j with openssl :(.
+  make env: env
+  make "install", env: env
+end