train-core 3.10.8 → 3.16.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd9123fc8c77d6d2913633bb544aae171f440d3a0558bacda3136fa62d856661
-  data.tar.gz: b8e558c2c7fa1479725228f1745ff5ed610f6975babc43cb07bbfb6289f41806
+  metadata.gz: 5c7ff43a79457e6d900c1e1e293c1e2ad48c6c555863cb816d64ddd96e02f03f
+  data.tar.gz: b42bdd2900ac7cc3c43f0df0467def0d46906a51ebfa64de3344b35e7504ae7a
 SHA512:
-  metadata.gz: 0ed3576117bf704f08d0170e3f9c9d08e20da634300f02b986aaa8fb18094d0b027d9943bcc04043d986102e641ed7c09a4ed163ca6b9f8de1488d3063043721
-  data.tar.gz: deb114924bc9f537bb8a8c4df1f0b48936c8b7e081539109b886b4c26f994a6f96b214d514d2109ab75b526e2328473fb56f323e0746a28f8cf4cfce4df8e334
+  metadata.gz: 27b1d7e67fed6319322a3928ed0ef0b24a5846bfa32a2998627ece0c943fa712205086fafb0a063214fe6c7659dd7979e8182e2984a41e9d0983590b7d5a9556
+  data.tar.gz: 13a9e5d5da5bdda8468f95c2bbb1b259c4052c4c6af4e0191038027f3f7ad226b269093e487f593a47418defda016151e33bad08cf0f01b19ae25a5520d5ac5a

data/lib/train/audit_log.rb

@@ -0,0 +1,21 @@
+module Train
+  class AuditLog
+    # Default values for audit log options are set in the options.rb
+    def self.create(options = {})
+      # Load monkey-patch to disable leading comment in logfiles
+      require_relative "logger_ext"
+
+      logger = Logger.new(options[:audit_log_location], options[:audit_log_frequency], options[:audit_log_size])
+      logger.level = options[:level] || Logger::INFO
+      logger.progname = options[:audit_log_app_name]
+      logger.datetime_format = "%Y-%m-%d %H:%M:%S"
+      logger.formatter = proc do |severity, datetime, progname, msg|
+        {
+          timestamp: datetime.to_s,
+          app: progname,
+        }.merge(msg).compact.to_json + $/
+      end
+      logger
+    end
+  end
+end

data/lib/train/extras/stat.rb

@@ -34,7 +34,7 @@ module Train::Extras
 
     def self.linux_stat(shell_escaped_path, backend, follow_symlink)
       lstat = follow_symlink ? " -L" : ""
-      format = (backend.os.esx? || %w{alpine yocto ubios}.include?(backend.os[:name])) ? "-c" : "--printf"
+      format = (backend.os.esx? || %w{alpine yocto ubios}.include?(backend.os[:name]) || %w{chainguard}.include?(backend.os[:family])) ? "-c" : "--printf"
       res = backend.run_command("stat#{lstat} #{shell_escaped_path} 2>/dev/null #{format} '%s\n%f\n%U\n%u\n%G\n%g\n%X\n%Y\n%C'")
       # ignore the exit_code: it is != 0 if selinux labels are not supported
       # on the system.

data/lib/train/logger_ext.rb

@@ -0,0 +1,8 @@
+
+# Part of Audit Log.
+# The default logger implementation injects a comment as the first line of the
+# log file, which makes it an invalid JSON file. No way to disable that other than monkey-patching.
+
+class Logger::LogDevice
+  def add_log_header(file); end
+end

data/lib/train/options.rb

@@ -34,6 +34,18 @@ module Train
         @default_options
       end
 
+      # Created separate method to set the default audit log options so that it will be handled separately
+      # and will not break any existing functionality
+      def default_audit_log_options
+        {
+          enable_audit_log: { default: false },
+          audit_log_location: { required: true, default: nil },
+          audit_log_app_name: { default: "train" },
+          audit_log_size: { default: nil },
+          audit_log_frequency: { default: 0 },
+        }
+      end
+
       def include_options(other)
         unless other.respond_to?(:default_options)
           raise "Trying to include options from module #{other.inspect}, "\
@@ -47,13 +59,18 @@ module Train
       # @return [Hash] options, which created this Transport
       attr_reader :options
 
+      def default_audit_log_options
+        self.class.default_audit_log_options
+      end
+
       def default_options
         self.class.default_options
       end
 
       def merge_options(base, opts)
         res = base.merge(opts || {})
-        default_options.each do |field, hm|
+        # Also merge the default audit log options into the options so that those are available at the time of validation.
+        default_options.merge(default_audit_log_options).each do |field, hm|
           next unless res[field].nil? && hm.key?(:default)
 
           default = hm[:default]
@@ -78,6 +95,18 @@ module Train
         end
         opts
       end
+
+      # Introduced this method to validate only audit log options and avoiding call to validate_options so
+      # that it will no break existing implementation.
+      def validate_audit_log_options(opts)
+        default_audit_log_options.each do |field, hm|
+          if opts[field].nil? && hm[:required]
+            raise Train::ClientError,
+              "You must provide a value for #{field.to_s.inspect}."
+          end
+        end
+        opts
+      end
     end
   end
 end

data/lib/train/platforms/detect/helpers/os_common.rb

@@ -8,7 +8,7 @@ module Train::Platforms::Detect::Helpers
     include Train::Platforms::Detect::Helpers::Windows
 
     def ruby_host_os(regex)
-      ::RbConfig::CONFIG["host_os"] =~ regex
+      regex.match?(::RbConfig::CONFIG["host_os"])
     end
 
     def winrm?
@@ -35,8 +35,9 @@ module Train::Platforms::Detect::Helpers
 
     def command_output(cmd)
       res = @backend.run_command(cmd)
-      stdout = res.stdout
-      stderr = res.stderr
+      # To suppress warning: literal string will be frozen in the future
+      stdout = String.new(res.stdout)
+      stderr = String.new(res.stderr)
       # When you try to execute command using ssh connection as root user and you have provided ssh user identity file
       # it gives standard output to login as authorized user other than root. To show this standard output as an error
       # to user we are matching the string of stdout and raising the error here so that user gets exact information.

data/lib/train/platforms/detect/helpers/os_windows.rb

@@ -25,7 +25,9 @@ module Train::Platforms::Detect::Helpers
         @platform[:name] = "Windows #{@platform[:release]}"
       end
 
-      read_wmic
+      # Prefer retrieving the OS details via `wmic` if available on the system to retain existing behavior.
+      # If `wmic` is not available, fall back to using cmd-only commands as an alternative method.
+      wmic_available? ? read_wmic : read_cmd_os
       true
     end
 
@@ -42,7 +44,9 @@ module Train::Platforms::Detect::Helpers
         @platform[:release] = payload["Version"]
         @platform[:name] = payload["Caption"]
 
-        read_wmic
+        # Prefer retrieving the OS details via `wmic` if available on the system to retain existing behavior.
+        # If `wmic` is not available, fall back to using CIM as an alternative method.
+        wmic_available? ? read_wmic : read_cim_os
         true
       rescue
         false
@@ -108,7 +112,7 @@ module Train::Platforms::Detect::Helpers
     def windows_uuid
       uuid = windows_uuid_from_chef
       uuid = windows_uuid_from_machine_file if uuid.nil?
-      uuid = windows_uuid_from_wmic if uuid.nil?
+      uuid = windows_uuid_from_wmic_or_cim if uuid.nil?
       uuid = windows_uuid_from_registry if uuid.nil?
       raise Train::TransportError, "Cannot find a UUID for your node." if uuid.nil?
 
@@ -134,11 +138,51 @@ module Train::Platforms::Detect::Helpers
       json["node_uuid"]
     end
 
+    def windows_uuid_from_wmic_or_cim
+      # Retrieve the Windows UUID using `wmic` if it is available and not marked as deprecated, maintaining compatibility with older systems.
+      # If `wmic` is unavailable or deprecated, use the `Get-CimInstance` command, which is the modern and recommended approach by Microsoft.
+      wmic_available? ? windows_uuid_from_wmic : windows_uuid_from_cim
+    end
+
     def windows_uuid_from_wmic
-      result = @backend.run_command("wmic csproduct get UUID")
+      # Switched from `wmic csproduct get UUID` to `wmic csproduct get UUID /value`
+      # to make the parsing of the UUID more reliable and consistent.
+      #
+      # When using the original `wmic csproduct get UUID` command, the output includes
+      # a header line and spacing that can vary depending on the system, making it harder
+      # to reliably extract the UUID. In some cases, splitting by line and taking the last
+      # element returns an empty string, even when exit_status is 0.
+      #
+      # Example:
+      #
+      # (byebug) result = @backend.run_command("wmic csproduct get UUID")
+      # #<struct Train::Extras::CommandResult stdout="UUID                                  \r\r\nEC20EBD7-8E03-06A8-645F-2D22E5A3BA4B  \r\r\n\r\r\n", stderr="", exit_status=0>
+      # (byebug) result.stdout
+      # "UUID                                  \r\r\nEC20EBD7-8E03-06A8-645F-2D22E5A3BA4B  \r\r\n\r\r\n"
+      # (byebug) result.exit_status
+      # 0
+      # (byebug) result.stdout.split("\r\n")[-1].strip
+      # ""
+      #
+      # In contrast, `wmic csproduct get UUID /value` returns a consistent `UUID=<value>` format,
+      # which is more suitable for regex matching.
+      #
+      # Example:
+      #
+      # byebug) result = @backend.run_command("wmic csproduct get UUID /value")
+      # #<struct Train::Extras::CommandResult stdout="\r\r\n\r\r\nUUID=EC20EBD7-8E03-06A8-645F-2D22E5A3BA4B\r\r\n\r\r\n\r\r\n\r\r\n", stderr="", exit_status=0>
+      # (byebug) result.stdout
+      # "\r\r\n\r\r\nUUID=EC20EBD7-8E03-06A8-645F-2D22E5A3BA4B\r\r\n\r\r\n\r\r\n\r\r\n"
+      # (byebug) result.stdout&.match(/UUID=([A-F0-9\-]+)/i)&.captures&.first
+      # "EC20EBD7-8E03-06A8-645F-2D22E5A3BA4B"
+      #
+      # This change improves parsing reliability and handles edge cases where the previous
+      # approach would return `nil` or raise errors on empty output lines.
+
+      result = @backend.run_command("wmic csproduct get UUID /value")
       return unless result.exit_status == 0
 
-      result.stdout.split("\r\n")[-1].strip
+      result.stdout&.match(/UUID=([A-F0-9\-]+)/i)&.captures&.first
     end
 
     def windows_uuid_from_registry
@@ -148,5 +192,119 @@ module Train::Platforms::Detect::Helpers
 
       result.stdout.chomp
     end
+
+    # Checks if `wmic` is available and not deprecated
+    def wmic_available?
+      # Return memoized value if already checked
+      return @wmic_available unless @wmic_available.nil?
+
+      # Runs the `wmic /?`` command, which provides help information for the WMIC (Windows Management Instrumentation Command-line) tool.
+      # It displays a list of available global switches and aliases, as well as details about their usage.
+      # The output also includes information about deprecated status for the 'wmic' tool.
+      result = @backend.run_command("wmic /?")
+
+      # Check if command ran successfully and output does not contain 'wmic is deprecated'
+      @wmic_available = result.exit_status == 0 && !(result.stdout.downcase.include?("wmic is deprecated"))
+    end
+
+    def read_cim_os
+      cmd = 'powershell -Command "Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber | ConvertTo-Json"'
+      res = @backend.run_command(cmd)
+      return unless res.exit_status == 0
+
+      begin
+        sys_info = JSON.parse(res.stdout)
+        @platform[:release] = sys_info["Version"]
+        @platform[:build] = sys_info["BuildNumber"]
+        @platform[:name] = sys_info["Caption"]
+        @platform[:name] = @platform[:name].gsub("Microsoft", "").strip unless @platform[:name].empty?
+        @platform[:arch] = read_cim_cpu
+      rescue
+        nil
+      end
+    end
+
+    def read_cim_cpu
+      cmd = 'powershell -Command "(Get-CimInstance Win32_Processor).Architecture"'
+      res = @backend.run_command(cmd)
+      return unless res.exit_status == 0
+
+      arch_map = {
+        0 => "i386",
+        1 => "mips",
+        2 => "alpha",
+        3 => "powerpc",
+        5 => "arm",
+        6 => "ia64",
+        9 => "x86_64",
+      }
+
+      arch_map[res.stdout.strip.to_i]
+    end
+
+    # Fallback method for reading OS info using cmd-only commands when wmic is not available
+    def read_cmd_os
+      # Try to get architecture from PROCESSOR_ARCHITECTURE environment variable
+      # This covers the same architectures as wmic CPU detection but uses environment variables
+      # which are available on all Windows versions since NT
+      arch_res = @backend.run_command("echo %PROCESSOR_ARCHITECTURE%")
+      if arch_res.exit_status == 0
+        arch_string = arch_res.stdout.strip.downcase
+        # Only set architecture if we got actual output
+        unless arch_string.empty?
+          @platform[:arch] = case arch_string
+                            when "x86"
+                              "i386"
+                            when "amd64", "x64"
+                              "x86_64"
+                            when "ppc", "powerpc"
+                              "powerpc"
+                            else
+                              # For any unknown architecture, preserve the original value
+                              # This handles: arm64, ia64, arm, mips, alpha, and future architectures
+                              arch_string
+                             end
+        end
+      end
+      # If PROCESSOR_ARCHITECTURE fails, architecture remains unset (consistent with other methods)
+
+      # Try to get more detailed OS info from systeminfo command as fallback
+      # This is slower than wmic but works without PowerShell
+      # Only override the basic info from check_cmd if systeminfo provides better data
+      sysinfo_res = @backend.run_command("systeminfo")
+      if sysinfo_res.exit_status == 0
+        sysinfo_res.stdout.lines.each do |line|
+          line = line.strip
+          if line =~ /^OS Name:\s*(.+)$/i
+            os_name = $1.strip
+            # Only override if we get a more detailed name than the basic "Windows X.X.X" from check_cmd
+            detailed_name = os_name.gsub("Microsoft", "").strip
+            @platform[:name] = detailed_name unless detailed_name.empty?
+          elsif line =~ /^OS Version:\s*(.+)$/i
+            version_info = $1.strip
+            # Extract version number from format like "10.0.19044 N/A Build 19044"
+            if version_info =~ /^(\d+\.\d+\.\d+)/
+              # Only override release if systeminfo provides the same or more detailed version
+              systeminfo_release = $1
+              @platform[:release] = systeminfo_release if systeminfo_release
+            end
+            # Extract build number (this is additional info not available from check_cmd)
+            if version_info =~ /Build (\d+)/
+              @platform[:build] = $1
+            end
+          end
+        end
+      end
+      # If systeminfo fails, we keep the basic info from check_cmd method
+    end
+
+    def windows_uuid_from_cim
+      cmd = 'powershell -Command "(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID"'
+      res = @backend.run_command(cmd)
+      return unless res.exit_status == 0
+
+      res.stdout.strip
+    end
+
   end
 end

data/lib/train/platforms/detect/specifications/os.rb

@@ -232,6 +232,27 @@ module Train::Platforms::Detect::Specifications
         end
       end
 
+      declare_category("chainguard", "linux") do
+        rel = linux_os_release
+        rel && rel["ID"] =~ /(wolfi|chainguard)/
+      end
+
+      declare_instance("wolfi", "Wolfi Linux", "chainguard") do
+        rel = linux_os_release
+        if rel && rel["ID"] =~ /wolfi/
+          @platform[:release] = rel["VERSION_ID"]
+          true
+        end
+      end
+
+      declare_instance("chainguard", "Chainguard Linux", "chainguard") do
+        rel = linux_os_release
+        if rel && rel["ID"] =~ /chainguard/
+          @platform[:release] = rel["VERSION_ID"]
+          true
+        end
+      end
+
       # brocade family detected here if device responds to 'uname' command,
       # happens when logging in as root
       plat.family("brocade").title("Brocade Family").in_family("linux")

data/lib/train/plugins/base_connection.rb

@@ -3,6 +3,7 @@ require_relative "../extras"
 require_relative "../file"
 require "fileutils" unless defined?(FileUtils)
 require "logger"
+require_relative "../audit_log"
 
 class Train::Plugins::Transport
   # A Connection instance can be generated and re-generated, given new
@@ -20,10 +21,21 @@ class Train::Plugins::Transport
     # @yield [self] yields itself for block-style invocation
     def initialize(options = nil)
       @options = options || {}
+
       @logger = @options.delete(:logger) || Logger.new($stdout, level: :fatal)
       Train::Platforms::Detect::Specifications::OS.load
       Train::Platforms::Detect::Specifications::Api.load
 
+      # In run_command all options are not accessible as some of them gets deleted in transit.
+      # To make the data like hostname, username available to aduit logs dup the options
+      @audit_log_data = options.dup || {}
+      # For transport other than local all audit log options accessible inside transport_options key
+      if !@options.empty? && @options[:transport_options] && @options[:transport_options][:enable_audit_log]
+        @audit_log = Train::AuditLog.create(options[:transport_options])
+      elsif !@options.empty? && @options[:enable_audit_log]
+        @audit_log = Train::AuditLog.create(@options)
+      end
+
       # default caching options
       @cache_enabled = {
         file: true,
@@ -140,11 +152,14 @@ class Train::Plugins::Transport
       # Some implementations do not accept an opts argument.
       # We cannot update all implementations to accept opts due to them being separate plugins.
       # Therefore here we check the implementation's arity to maintain compatibility.
+      @audit_log.info({ type: "cmd", command: "#{cmd}", user: @audit_log_data[:username], hostname: @audit_log_data[:hostname] }) if @audit_log
+
       case method(:run_command_via_connection).arity.abs
       when 1
         return run_command_via_connection(cmd, &data_handler) unless cache_enabled?(:command)
 
         @cache[:command][cmd] ||= run_command_via_connection(cmd, &data_handler)
+
       when 2
         return run_command_via_connection(cmd, opts, &data_handler) unless cache_enabled?(:command)
 
@@ -157,29 +172,31 @@ class Train::Plugins::Transport
     # This is the main file call for all connections. This will call the private
     # file_via_connection on the connection with optional caching
     def file(path, *args)
+      @audit_log.info({ type: "file", path: "#{path}", user: @audit_log_data[:username], hostname: @audit_log_data[:hostname] }) if @audit_log
       return file_via_connection(path, *args) unless cache_enabled?(:file)
 
       @cache[:file][path] ||= file_via_connection(path, *args)
     end
 
-    # Uploads local files or directories to remote host.
+    # Uploads local files to remote host.
     #
-    # @param locals [Array<String>] paths to local files or directories
+    # @param locals [String, Array<String>] path to local files
     # @param remote [String] path to remote destination
     # @raise [TransportFailed] if the files could not all be uploaded
     #   successfully, which may vary by implementation
     def upload(locals, remote)
-      unless file(remote).directory?
-        raise TransportError, "#{self.class} expects remote directory as second upload parameter"
+      remote_directory = file(remote).directory?
+
+      if locals.is_a?(Array) && !remote_directory
+        raise Train::TransportError, "#{self.class} expects remote directory as second upload parameter for multi-file uploads"
       end
 
       Array(locals).each do |local|
-        new_content = File.read(local)
-        remote_file = File.join(remote, File.basename(local))
-
+        remote_file = remote_directory ? File.join(remote, File.basename(local)) : remote
+        @audit_log.info({ type: "file upload", source: local, destination: remote_file, user: @audit_log_data[:username], hostname: @audit_log_data[:hostname] }) if @audit_log
         logger.debug("Attempting to upload '#{local}' as file #{remote_file}")
 
-        file(remote_file).content = new_content
+        file(remote_file).content = File.read(local)
       end
     end
 
@@ -197,7 +214,6 @@ class Train::Plugins::Transport
       Array(remotes).each do |remote|
         new_content = file(remote).content
         local_file = File.join(local, File.basename(remote))
-
         logger.debug("Attempting to download '#{remote}' as file #{local_file}")
 
         File.open(local_file, "w") { |fp| fp.write(new_content) }

data/lib/train/plugins/transport.rb

@@ -21,6 +21,12 @@ class Train::Plugins
     def initialize(options = {})
       @options = merge_options({}, options || {})
       @logger = @options[:logger] || Logger.new($stdout, level: :fatal)
+      # Validates audit log configuration options if audit log is enabled
+      # The reason to implement different validate method for audit log options is
+      # to validate only audit log options and not to break any existing validate_option implementation.
+      if !@options.empty? && @options[:enable_audit_log]
+        validate_audit_log_options(options)
+      end
     end
 
     # Create a connection to the target. Options may be provided

data/lib/train/transports/local.rb

@@ -5,6 +5,7 @@
 require_relative "../plugins"
 require_relative "../errors"
 require "mixlib/shellout" unless defined?(Mixlib::ShellOut)
+require "ostruct" unless defined?(OpenStruct)
 
 module Train::Transports
   class Local < Train.plugin(1)
@@ -228,11 +229,28 @@ module Train::Transports
           at_exit { close rescue Errno::EIO }
 
           pipe = nil
+          ownership_verified = false
 
           # PowerShell needs time to create pipe.
           100.times do
+            unless ownership_verified
+              owner, current_user, is_owner = pipe_owned_by_current_user?(pipe_name)
+              if owner.nil?
+                sleep 0.1
+                next
+              end
+
+              unless is_owner
+                raise PipeError, "Unauthorized user '#{current_user}' tried to connect to pipe '#{pipe_name}'. Pipe is owned by '#{owner}'."
+              end
+
+              ownership_verified = true
+            end
+
             pipe = open("//./pipe/#{pipe_name}", "r+")
             break
+          rescue PipeError
+            raise
           rescue
             sleep 0.1
           end
@@ -245,17 +263,30 @@ module Train::Transports
 
           script = <<-EOF
             $ErrorActionPreference = 'Stop'
+            $ProgressPreference = 'SilentlyContinue'
+            $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+            $pipeSecurity = New-Object System.IO.Pipes.PipeSecurity
+            $rule = New-Object System.IO.Pipes.PipeAccessRule($user, "FullControl", "Allow")
+            $pipeSecurity.AddAccessRule($rule)
+            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}', [System.IO.Pipes.PipeDirection]::InOut, 1, [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::None, 4096, 4096, $pipeSecurity)
+
+            try {
+              $pipeServer.WaitForConnection()
+            } catch {
+              exit 1
+            }
 
-            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}')
             $pipeReader = New-Object System.IO.StreamReader($pipeServer)
             $pipeWriter = New-Object System.IO.StreamWriter($pipeServer)
 
-            $pipeServer.WaitForConnection()
-
             # Create loop to receive and process user commands/scripts
             $clientConnected = $true
             while($clientConnected) {
               $input = $pipeReader.ReadLine()
+              if ($input -eq $null) {
+                $clientConnected = $false
+                break
+              }
               $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($input))
 
               # Execute user command/script and convert result to JSON
@@ -277,8 +308,14 @@ module Train::Transports
 
               # Encode JSON in Base64 and write to pipe
               $encodedResult = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($resultJSON))
-              $pipeWriter.WriteLine($encodedResult)
-              $pipeWriter.Flush()
+              try {
+                $pipeWriter.WriteLine($encodedResult)
+                $pipeWriter.Flush()
+              } catch [System.IO.IOException] {
+                # Pipe was closed by client, exit gracefully
+                $clientConnected = $false
+                break
+              }
             }
           EOF
 
@@ -287,6 +324,29 @@ module Train::Transports
           cmd = "#{@powershell_cmd} -NoProfile -ExecutionPolicy bypass -NonInteractive -EncodedCommand #{base64_script}"
           Process.create(command_line: cmd).process_id
         end
+
+        def current_windows_user
+          user = `powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"`.strip
+          if user.nil? || user.empty?
+            user = `whoami`.strip
+          end
+          if user.nil? || user.empty?
+            raise "Unable to determine current Windows user"
+          end
+
+          user
+        end
+
+        # Verify pipe ownership before connecting
+        def pipe_owned_by_current_user?(pipe_name)
+          exists = `powershell -Command "Test-Path \\\\.\\pipe\\#{pipe_name}"`.strip.downcase == "true"
+          current_user = current_windows_user
+          return [nil, current_user, false] unless exists
+
+          owner = `powershell -Command "(Get-Acl \\\\.\\pipe\\#{pipe_name}).Owner" 2>&1`.strip
+          is_owner = !owner.nil? && !current_user.nil? && owner.casecmp(current_user) == 0
+          [owner, current_user, is_owner]
+        end
       end
     end
   end

data/lib/train/transports/ssh_connection.rb

@@ -364,9 +364,14 @@ class Train::Transports::SSH
           channel.on_request("exit-signal") do |_, data|
             exit_status = data.read_long
           end
+
+          channel.on_close do
+            session.channels.each { |_, session_channel| session_channel.close }
+          end
         end
       end
-      session.loop
+
+      session.loop { session.busy? }
 
       if timeout && timeoutable?(cmd) && exit_status == GNU_TIMEOUT_EXIT_STATUS
         logger.debug("train ssh command '#{cmd}' reached requested timeout (#{timeout}s)")

data/lib/train/version.rb

@@ -2,5 +2,5 @@
 # Author:: Dominik Richter (<dominik.richter@gmail.com>)
 
 module Train
-  VERSION = "3.10.8".freeze
+  VERSION = "3.16.3".freeze
 end

data/lib/train.rb

@@ -26,7 +26,8 @@ module Train
   # @return [Hash] map of default options
   def self.options(name)
     cls = load_transport(name)
-    cls.default_options unless cls.nil?
+    # Merging default_audit_log_options so that they will get listed in the options that are available.
+    cls.default_options.merge(cls.default_audit_log_options) unless cls.nil?
   end
 
   # Load the transport plugin indicated by name. If the plugin is not

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: train-core
 version: !ruby/object:Gem::Version
-  version: 3.10.8
+  version: 3.16.3
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-06-23 00:00:00.000000000 Z
+date: 2026-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -28,23 +28,29 @@ dependencies:
   name: ffi
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "!="
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.16.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: '1.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "!="
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.16.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: '1.18'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: 2.19.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
@@ -54,7 +60,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: 2.19.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
@@ -127,6 +133,7 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - lib/train.rb
+- lib/train/audit_log.rb
 - lib/train/errors.rb
 - lib/train/extras.rb
 - lib/train/extras/command_wrapper.rb
@@ -142,6 +149,7 @@ files:
 - lib/train/file/remote/unix.rb
 - lib/train/file/remote/windows.rb
 - lib/train/globals.rb
+- lib/train/logger_ext.rb
 - lib/train/options.rb
 - lib/train/platforms.rb
 - lib/train/platforms/common.rb
@@ -181,14 +189,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.3.27
 signing_key: 
 specification_version: 4
 summary: Transport interface to talk to a selected set of backends.