omnibus 6.0.25 → 7.0.12

data/lib/omnibus/project.rb

@@ -1007,6 +1007,7 @@ module Omnibus
     #
     def dirty!(software)
       raise ProjectAlreadyDirty.new(self) if culprit
+
       @culprit = software
     end
 

data/lib/omnibus/publisher.rb

@@ -44,10 +44,10 @@ module Omnibus
     #   mapping of build to publish platform(s)
     # @example
     #   {
-    #     'ubuntu-10.04' => [
-    #       'ubuntu-10.04',
-    #       'ubuntu-12.04',
-    #       'ubuntu-14.04',
+    #     'ubuntu-10.04-x86_64' => [
+    #       'ubuntu-10.04-x86_64',
+    #       'ubuntu-12.04-x86_64',
+    #       'ubuntu-14.04-x86_64',
     #     ],
     #   }
     #
@@ -69,39 +69,41 @@ module Omnibus
     #
     def packages
       @packages ||= begin
-        publish_packages = Array.new
+        publish_packages = []
         build_packages   = FileSyncer.glob(@pattern).map { |path| Package.new(path) }
 
         if @options[:platform_mappings]
           # the platform map is a simple hash with publish to build platform mappings
           @options[:platform_mappings].each_pair do |build_platform, publish_platforms|
-            # Splits `ubuntu-12.04` into `ubuntu` and `12.04`
-            build_platform, build_platform_version = build_platform.rpartition("-") - %w{ - }
+            # Splits `ubuntu-12.04-x86_64` into `ubuntu`, `12.04` and `x86_64`
+            build_platform, build_platform_version, build_architecture = build_platform.split("-")
 
             # locate the package for the build platform
             packages = build_packages.select do |p|
               p.metadata[:platform] == build_platform &&
-                p.metadata[:platform_version] == build_platform_version
+                p.metadata[:platform_version] == build_platform_version &&
+                p.metadata[:arch] == build_architecture
             end
 
             if packages.empty?
               log.warn(log_key) do
-                "Could not locate a package for build platform #{build_platform}-#{build_platform_version}. " \
-                "Publishing will be skipped for: #{publish_platforms.join(', ')}"
+                "Could not locate a package for build platform #{build_platform}-#{build_platform_version}-#{build_architecture}. " \
+                "Publishing will be skipped for: #{publish_platforms.join(", ")}"
               end
             end
 
             publish_platforms.each do |publish_platform|
-              publish_platform, publish_platform_version = publish_platform.rpartition("-") - %w{ - }
+              publish_platform, publish_platform_version, publish_architecture = publish_platform.split("-")
 
               packages.each do |p|
                 # create a copy of our package before mucking with its metadata
                 publish_package  = p.dup
                 publish_metadata = p.metadata.dup.to_hash
 
-                # override the platform and platform version in the metadata
+                # override the platform, platform version and architecture in the metadata
                 publish_metadata[:platform]         = publish_platform
                 publish_metadata[:platform_version] = publish_platform_version
+                publish_metadata[:arch]             = publish_architecture
 
                 # Set the updated metadata on the package object
                 publish_package.metadata = Metadata.new(publish_package, publish_metadata)

data/lib/omnibus/publishers/s3_publisher.rb

@@ -65,11 +65,13 @@ module Omnibus
         bucket_name: @options[:bucket],
       }
 
-      if Config.publish_s3_profile
-        config[:profile]            = Config.publish_s3_profile
+      if Config.publish_s3_iam_role_arn
+        config[:publish_s3_iam_role_arn] = Config.publish_s3_iam_role_arn
+      elsif Config.publish_s3_profile
+        config[:profile] = Config.publish_s3_profile
       else
-        config[:access_key_id]      = Config.publish_s3_access_key
-        config[:secret_access_key]  = Config.publish_s3_secret_key
+        config[:access_key_id] = Config.publish_s3_access_key
+        config[:secret_access_key] = Config.publish_s3_secret_key
       end
 
       config

data/lib/omnibus/s3_cache.rb

@@ -147,7 +147,9 @@ module Omnibus
           force_path_style: Config.s3_force_path_style,
         }
 
-        if Config.s3_profile
+        if Config.s3_iam_role_arn
+          config[:iam_role_arn] = Config.s3_iam_role_arn
+        elsif Config.s3_profile
           config[:profile] = Config.s3_profile
         else
           config[:access_key_id] = Config.s3_access_key

data/lib/omnibus/s3_helpers.rb

@@ -53,10 +53,7 @@ module Omnibus
       # @return [Aws::S3::Resource]
       #
       def client
-        Aws.config.update(
-          region: s3_configuration[:region],
-          credentials: get_credentials
-        )
+        Aws.config.update(region: s3_configuration[:region])
 
         @s3_client ||= Aws::S3::Resource.new(resource_params)
       end
@@ -70,6 +67,7 @@ module Omnibus
         params = {
           use_accelerate_endpoint: s3_configuration[:use_accelerate_endpoint],
           force_path_style: s3_configuration[:force_path_style],
+          credentials: get_credentials,
         }
 
         if s3_configuration[:use_accelerate_endpoint]
@@ -84,12 +82,14 @@ module Omnibus
       end
 
       #
-      # Create credentials object based on credential profile or access key
+      # Create credentials object based on AWS IAM role arn, credential profile or access key
       # parameters for use by the client object.
       #
       # @return [Aws::SharedCredentials, Aws::Credentials]
       def get_credentials
-        if s3_configuration[:profile]
+        if s3_configuration[:iam_role_arn]
+          Aws::AssumeRoleCredentials.new(role_arn: s3_configuration[:iam_role_arn], role_session_name: "omnibus-assume-role-s3-access")
+        elsif s3_configuration[:profile]
           Aws::SharedCredentials.new(profile_name: s3_configuration[:profile])
         elsif s3_configuration[:access_key_id] && s3_configuration[:secret_access_key]
           Aws::Credentials.new(s3_configuration[:access_key_id], s3_configuration[:secret_access_key])

data/lib/omnibus/software.rb

@@ -1,5 +1,5 @@
 #
-# Copyright 2012-2017, Chef Software Inc.
+# Copyright 2012-2018, Chef Software Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -205,6 +205,46 @@ module Omnibus
     end
     expose :maintainer
 
+    #
+    # Sets the bin_dirs where this software installs bins.
+    #
+    # @example
+    #   bin_dirs ['/opt/chef-workstation/bin']
+    #
+    # @param [Array<String>] val
+    #   the bin_dirs of the software
+    #
+    # @return [Array<String>]
+    #
+    def bin_dirs(val = NULL)
+      if null?(val)
+        @bin_dirs || [windows_safe_path("#{install_dir}/bin"), windows_safe_path("#{install_dir}/embedded/bin")]
+      else
+        @bin_dirs = val
+      end
+    end
+    expose :bin_dirs
+
+    #
+    # Sets the lib_dirs where this software installs libs.
+    #
+    # @example
+    #   lib_dirs ['/opt/chef-workstation/bin']
+    #
+    # @param [Array<String>] val
+    #   the lib_dirs of the software
+    #
+    # @return [Array<String>]
+    #
+    def lib_dirs(val = NULL)
+      if null?(val)
+        @lib_dirs || [windows_safe_path("#{install_dir}/embedded/lib")]
+      else
+        @lib_dirs = val
+      end
+    end
+    expose :lib_dirs
+
     #
     # Add a software dependency to this software.
     #
@@ -305,7 +345,7 @@ module Omnibus
             "only include valid keys. Invalid keys: #{extra_keys.inspect}")
         end
 
-        duplicate_keys = val.keys & [:git, :file, :path, :url]
+        duplicate_keys = val.keys & %i{git file path url}
         unless duplicate_keys.size < 2
           raise InvalidValue.new(:source,
             "not include duplicate keys. Duplicate keys: #{duplicate_keys.inspect}")
@@ -509,7 +549,7 @@ module Omnibus
     #   the list of currently whitelisted files
     #
     def whitelist_file(file)
-      file = Regexp.new(file) unless file.kind_of?(Regexp)
+      file = Regexp.new(file) unless file.is_a?(Regexp)
       whitelist_files << file
       whitelist_files.dup
     end
@@ -668,33 +708,22 @@ module Omnibus
             "ARFLAGS" => "-X64 cru",
           }
         when "solaris2"
-          if platform_version.satisfies?("<= 5.10")
-            solaris_flags = {
-              # this override is due to a bug in libtool documented here:
-              # http://lists.gnu.org/archive/html/bug-libtool/2005-10/msg00004.html
-              "CC" => "gcc -static-libgcc",
-              "LDFLAGS" => "-R#{install_dir}/embedded/lib -L#{install_dir}/embedded/lib -static-libgcc",
-              "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
-            }
-          elsif platform_version.satisfies?(">= 5.11")
-            solaris_flags = {
-              "CC" => "gcc -m64 -static-libgcc",
-              "LDFLAGS" => "-Wl,-rpath,#{install_dir}/embedded/lib -L#{install_dir}/embedded/lib -static-libgcc",
-              "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
-            }
-          end
-          solaris_flags
+          {
+            "CC" => "gcc -m64 -static-libgcc",
+            "LDFLAGS" => "-Wl,-rpath,#{install_dir}/embedded/lib -L#{install_dir}/embedded/lib -static-libgcc",
+            "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
+          }
         when "freebsd"
           {
             "CC" => "clang",
             "CXX" => "clang++",
             "LDFLAGS" => "-L#{install_dir}/embedded/lib",
-            "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
+            "CFLAGS" => "-I#{install_dir}/embedded/include -O2 -D_FORTIFY_SOURCE=2 -fstack-protector",
           }
         when "suse"
           suse_flags = {
             "LDFLAGS" => "-Wl,-rpath,#{install_dir}/embedded/lib -L#{install_dir}/embedded/lib",
-            "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
+            "CFLAGS" => "-I#{install_dir}/embedded/include -O2 -D_FORTIFY_SOURCE=2 -fstack-protector",
           }
           # Enable gcc version 4.8 if it is available
           if which("gcc-4.8") && platform_version.satisfies?("< 12")
@@ -721,7 +750,7 @@ module Omnibus
         else
           {
             "LDFLAGS" => "-Wl,-rpath,#{install_dir}/embedded/lib -L#{install_dir}/embedded/lib",
-            "CFLAGS" => "-I#{install_dir}/embedded/include -O2",
+            "CFLAGS" => "-I#{install_dir}/embedded/include -O2 -D_FORTIFY_SOURCE=2 -fstack-protector",
           }
         end
 
@@ -987,17 +1016,18 @@ module Omnibus
       fetcher.version_guid
     end
 
+    # This is the real version if one exists (nil if there's no real version)
+    def real_version
+      @real_version ||= fetcher.version_for_cache || version
+    end
+
     # Returns the version to be used in cache.
     def version_for_cache
-      @version_for_cache ||= if fetcher.version_for_cache
-                               fetcher.version_for_cache
-                             elsif version
-                               version
+      @version_for_cache ||= if real_version
+                               real_version
                              else
                                log.warn(log_key) do
-                                 "No version given! This is probably a bad thing. I am going to " \
-                                 "assume the version `0.0.0', but that is most certainly not your " \
-                                 "desired behavior. If git caching seems off, this is probably why."
+                                 "No version given! Git caching disabled." \
                                end
 
                                "0.0.0"
@@ -1070,7 +1100,13 @@ module Omnibus
     #
     def build_me(build_wrappers = [])
       if Config.use_git_caching
-        if project.dirty?
+        if !real_version
+          log.info(log_key) do
+            "Forcing a build because resolved version is nil"
+          end
+          execute_build(build_wrappers)
+          project.dirty!(self) unless project.dirty? # omnibus can only be mildly dirty
+        elsif project.dirty?
           log.info(log_key) do
             "Building because `#{project.culprit.name}' dirtied the cache"
           end

data/lib/omnibus/templating.rb

@@ -73,7 +73,7 @@ module Omnibus
 
       unless options.empty?
         raise ArgumentError,
-          "Unknown option(s): #{options.keys.map(&:inspect).join(', ')}"
+          "Unknown option(s): #{options.keys.map(&:inspect).join(", ")}"
       end
 
       # String value returned from #render_template_content

data/lib/omnibus/util.rb

@@ -80,7 +80,7 @@ module Omnibus
     #   populated with results of the command.
     #
     def shellout(*args)
-      options = args.last.kind_of?(Hash) ? args.pop : {}
+      options = args.last.is_a?(Hash) ? args.pop : {}
       options = SHELLOUT_OPTIONS.merge(options)
 
       command_string = args.join(" ")
@@ -158,6 +158,7 @@ module Omnibus
       yield
     rescue Exception => e
       raise e unless retried_exceptions.any? { |eclass| e.is_a?(eclass) }
+
       if retries != 0
         log.info(log_key) { "Retrying failed #{logstr} due to #{e} (#{retries} retries left)..." }
         retries -= 1
@@ -196,7 +197,7 @@ module Omnibus
     #
     def compiler_safe_path(*pieces)
       path = File.join(*pieces)
-      path = path.sub(/^([A-Za-z]):\//, "/\\1/") if ENV["MSYSTEM"]
+      path = path.sub(%r{^([A-Za-z]):/}, "/\\1/") if ENV["MSYSTEM"]
       path
     end
 

data/lib/omnibus/version.rb

@@ -15,5 +15,5 @@
 #
 
 module Omnibus
-  VERSION = "6.0.25".freeze
+  VERSION = "7.0.12".freeze
 end

data/lib/omnibus/whitelist.rb

@@ -1,5 +1,5 @@
 
-# Copyright 2012-2018 Chef Software, Inc.
+# Copyright 2012-2020, Chef Software Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 WHITELIST_LIBS = [
     /ld-linux/,
+    /libanl\.so/,
     /libc\.so/,
     /libcrypt\.so/,
     /libdl/,
@@ -33,6 +34,7 @@ WHITELIST_LIBS = [
   ].freeze
 
 ARCH_WHITELIST_LIBS = [
+  /libanl\.so/,
   /libc\.so/,
   /libcrypt\.so/,
   /libdb-5\.3\.so/,
@@ -133,8 +135,11 @@ MAC_WHITELIST_LIBS = [
   /libffi\.dylib/,
   /libncurses\.5\.4\.dylib/,
   /libiconv/,
+  /libidn2\.0\.dylib/,
   /libstdc\+\+\.6\.dylib/,
   /libc\+\+\.1\.dylib/,
+  /libc\+\+\.1\.dylib/,
+  /libzstd\.1\.dylib/,
   /Security/,
 ].freeze
 

data/omnibus.gemspec

@@ -18,25 +18,26 @@ Gem::Specification.new do |gem|
   gem.files = %w{ LICENSE README.md Rakefile Gemfile } + Dir.glob("*.gemspec") + Dir.glob("{bin,lib,resources,spec}/**/{*,.kitchen*}")
   gem.bindir = "bin"
   gem.executables = %w{omnibus}
-  gem.test_files = gem.files.grep(/^(test|spec|features)\//)
+  gem.test_files = gem.files.grep(%r{^(test|spec|features)/})
   gem.require_paths = ["lib"]
 
   gem.add_dependency "aws-sdk-s3",       "~> 1"
   gem.add_dependency "chef-sugar",       ">= 3.3"
-  gem.add_dependency "cleanroom",        "~> 1.0"
+  gem.add_dependency "chef-cleanroom",   "~> 1.0"
+  gem.add_dependency "ffi",              "< 1.13" # 1.13 does not work on Windows: https://github.com/ffi/ffi/issues/784
   gem.add_dependency "ffi-yajl",         "~> 2.2"
   gem.add_dependency "mixlib-shellout",  ">= 2.0", "< 4.0"
-  gem.add_dependency "ohai",             ">= 13", "< 16"
+  gem.add_dependency "ohai",             ">= 13", "< 17"
   gem.add_dependency "ruby-progressbar", "~> 1.7"
-  gem.add_dependency "thor",             "~> 0.18"
+  gem.add_dependency "thor",             ">= 0.18", "< 2.0"
   gem.add_dependency "license_scout",    "~> 1.0"
 
   gem.add_dependency "mixlib-versioning"
   gem.add_dependency "pedump"
 
-  gem.add_development_dependency "artifactory", "~> 2.0"
+  gem.add_development_dependency "artifactory", "~> 3.0"
   gem.add_development_dependency "aruba",       "~> 0.5"
-  gem.add_development_dependency "chefstyle",   "= 0.12"
+  gem.add_development_dependency "chefstyle",   "= 1.1.0"
   gem.add_development_dependency "fauxhai",     ">= 5.2"
   gem.add_development_dependency "rspec",       "~> 3.0"
   gem.add_development_dependency "rspec-json_expectations"

data/resources/rpm/signing.erb

@@ -11,25 +11,22 @@ require 'pty'
 
 puts rpm_cmd
 PTY.spawn(rpm_cmd) do |r, w, pid|
+  # Older versions of rpmsign will prompt right away for the passphrase
   prompt = r.read(19)
 
-  # match the expected prompt exactly, since that's the only way we know if
-  # something went wrong.
-  unless prompt == 'Enter pass phrase: '
-    STDERR.puts "unexpected output from `#{rpm_cmd}`: '#{prompt}'"
-    Process.kill(:KILL, pid)
-    exit 1
+  if prompt == 'Enter pass phrase: '
+    STDOUT.puts prompt
+    w.write("#{password}\n")
   end
 
-  STDOUT.puts prompt
-  w.write("#{password}\n")
-
   # Keep printing output unti the command exits
   loop do
     begin
       line = r.gets
       puts line
-      if (line =~ /failed/) && !(line =~ /warning:/)
+      if line =~ /Please enter the passphrase to unlock the OpenPGP secret key:/
+        w.write("#{password}\n")
+      elsif (line =~ /failed/) && !(line =~ /warning:/)
         STDERR.puts 'RPM signing failure'
         exit 1
       end

data/spec/functional/builder_spec.rb

@@ -22,6 +22,7 @@ module Omnibus
         ext = name == "ruby" ? ".exe" : ".bat"
         source = Bundler.which(name + ext)
         raise "Could not find #{name} in bundler environment" unless source
+
         File.open(File.join(embedded_bin_dir, name + ".bat"), "w") do |f|
           f.write <<-EOH.gsub(/^ {12}/, "")
             @"#{source}" %*
@@ -221,7 +222,7 @@ module Omnibus
         output = capture_logging { subject.build }
 
         appbundler_path = File.join(embedded_bin_dir, "appbundler")
-        appbundler_path.gsub!(/\//, '\\') if windows?
+        appbundler_path.gsub!(%r{/}, '\\') if windows?
         expect(output).to include("#{appbundler_path} '#{project_dir}' '#{bin_dir}'")
       end
     end