OS X 10.11, was ChefDK 0.7.0.rc.2 released

we have an issue open in the chef repo about OS X 10.11. I'd like to note a
few things.

First, it's not a supported platform yet as it isn't GA. So until it's
supported, brokenness is likely. Fortunately this seems to be the main
issue and may be straightforward.

Second, we are working on getting a OS X 10.11 build node in our CI
infrastructure so that we can properly support it. This is high priority
work for our release engineering team.

Finally, I'd like to address the later query about why /usr/bin instead of
/opt/chef. That's because we originally wanted the binaries installed for
Chef (and then later ChefDK) to be in the default $PATH. On OS X,
/usr/local/bin isn't in the $PATH by default, and /opt/chef certainly
isn't. Also, with ChefDK, it's /opt/chefdk, not /opt/chef, where the
omnibus package is installed. This isn't a huge deal of course but in the
ease of use area it sure is helpful.

---------- Forwarded message ----------
From: Mike miketheman@gmail.com
Date: Saturday, July 11, 2015
Subject: [chef] ChefDK 0.7.0.rc.2 released
To: Kartik Cating-Subramanian ksubramanian@chef.io
Cc: "chef@lists.opscode.com" chef@lists.opscode.com, Chef Dev <
chef-dev@lists.opscode.com>

Hi Kartik,

Not sure of where you'd want to have bug reports posted, but I tried this
package out today and got an error 0 (see lines L58-L59).

This is likely due to the new restriction of OSX 10.11 disallowing
user-installed modifications to /usr/bin - I was always curious why chefdk
went into /usr/bin and not /usr/local/bin - any insight?

Quoting from the Linux Filesystem Hierarchy 1:

The original idea behind '/usr/local' was to have a separate ('local')
'/usr' directory on every machine besides '/usr', which might be just
mounted read-only from somewhere else. It copies the structure of '/usr'.
These days, '/usr/local' is widely regarded as a good place in which to
keep self-compiled or third-party programs. The /usr/local hierarchy is for
use by the system administrator when installing software locally. It needs
to be safe from being overwritten when the system software is updated. It
may be used for programs and data that are shareable amongst a group of
hosts, but not found in /usr. Locally installed software must be placed
within /usr/local rather than /usr unless it is being installed to replace
or upgrade software in /usr.

So it seems like OSX is taking a harder stance on the "don't even allow
root to write in /usr/bin".

There's more details on this feature on Quora 2.

One hackish way to get around this right now would be to insert another
conditional in the postinst and postrm scripts that tests for osx version
10.11 and uses a different path for symlinks, but I don't think that's
sustainable.

Another idea is that 0.7.0 could move to using /usr/local/bin as the path
for symlinked binaries, don't know how you feel about that. I created a
simple script 3 that uses the behavior from the postinst script to run
locally to get around it.

This would likely also necessitate changing the test paths in chef verify
4.

Hope this helps,
-M

On Thu, Jul 9, 2015 at 4:49 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io <javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');>>
wrote:

Debian: http://opscode-omnibus-packages.s3.amazonaws.com/debian/6/x86_64/chefdk_0.7.0~rc.2-1_amd64.deb

Ubuntu: http://opscode-omnibus-packages.s3.amazonaws.com/ubuntu/12.04/x86_64/chefdk_0.7.0~rc.2-1_amd64.deb

RHEL-6: http://opscode-omnibus-packages.s3.amazonaws.com/el/6/x86_64/chefdk-0.7.0~rc.2-1.el6.x86_64.rpm

RHEL-7: http://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chefdk-0.7.0~rc.2-1.el7.x86_64.rpm

Mac: http://opscode-omnibus-packages.s3.amazonaws.com/mac_os_x/10.8/x86_64/chefdk-0.7.0-rc.2-1.dmg

Windows: http://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.7.0-rc.2-1.msi

On Thu, Jul 9, 2015 at 2:59 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io
<javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');>> wrote:

Apologies - the links provided are to a nightly build and not to the rc.
I'll post the updated links shortly.

On Thu, Jul 9, 2015 at 2:34 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io
<javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');>> wrote:

An updated version of chefdk 0.7.0.rc.2 has been released. This release
updates rc.1 by:

  • pulling in chef-12.4.1
  • pulling in test-kitchen 1.4.1
  • allowing for multiple default_source lines in your policyfile.rb

You can acquire it from omnitruck (
https://docs.chef.io/api_omnitruck.html) using

http://www.chef.io/chef/metadata-chefdk?p=$platform&pv=$platform-version&m=$architecture&v=latest&prerelease=true
e.g.
http://www.chef.io/chef/metadata-chefdk?p=windows&pv=2012r2&m=x86_64&v=latest&prerelease=true

Here are some direct package links:

Windows: http://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.7.0-rc.2+20150709085009-1.msi

Mac: http://opscode-omnibus-packages.s3.amazonaws.com/mac_os_x/10.8/x86_64/chefdk-0.7.0-rc.2+20150709085009.git.6.492042f-1.dmg

RHEL-7 http://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chefdk-0.7.0~rc.2+20150709085009.git.6.492042f-1.el7.x86_64.rpm

RHEL-6 http://opscode-omnibus-packages.s3.amazonaws.com/el/6/x86_64/chefdk-0.7.0~rc.2+20150709085009.git.6.492042f-1.el6.x86_64.rpm

Debian: http://opscode-omnibus-packages.s3.amazonaws.com/debian/6/x86_64/chefdk_0.7.0~rc.2+20150709085009.git.6.492042f-1_amd64.deb

Ubuntu: http://opscode-omnibus-packages.s3.amazonaws.com/ubuntu/12.04/x86_64/chefdk_0.7.0~rc.2+20150709085009.git.6.492042f-1_amd64.deb

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io
<javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');> - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io
<javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');> - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io
<javascript:_e(%7B%7D,'cvml','ksubramanian@chef.io');> - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef

Hi Joshua,

Thanks for the link to the Chef-related issue - that's informative, for
sure.

Re: First:
The 'unsupportedness' of the platform is warranted, for sure - hence the
release candidates, beta programs that allow us access to these
environments prior to their release - precisely to find these problems
before they hit the general public.

Considering that "Rootless" is a big shift in Apple's methodology, it's
unlikely that this is a "break" in the beta, rather they are deciding that
users should not be able to modify a system-owned directory.

Re: Second:
That's awesome, glad to hear there's a push - there's bugs related to OSX
10.11 popping up all over GitHub for a variety of languages.

Re: Finally:
I understand the use of /usr/bin in environments where you are allowed to
modify the contents of this directory.

On OS X, /usr/local/bin isn't in the $PATH by default...

Ah, but it is! It's not first, which is why Homebrew (and MacPorts, etc)
suggest placing it at the front, so that the load order of the
packager-installed software will be selected with a higher precendence to
prevent cases like this:

using OSX default path built from unmodified /etc/paths

$ echo $PATH
/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
$ which -a python
/usr/bin/python
/usr/local/bin/python

So in this case, I definitely want to recommend to users to modify the PATH
to make /usr/local/bin first, so as not to use OSX's installed python.

In the case of Chef and ChefDK, OSX does not provide a built-in version of
any Chef-related binaries, so there's no need to ensure that the path is
inserted first, and since the $PATH contains /usr/local/bin, this one can
likely be used instead of /usr/bin.

In conclusion,

I'm glad to hear that I'm not the first to report this - maybe I'm the
first to note it about ChefDK (I looked! Didn't find!).

I'd take a look back at assumptions of the past and see if they are still
valid concerns - ChefDK on OSX supports 10.8 and up - I'm betting that your
build farm has some of these versions and can validate that the default
paths now include /usr/local/bin.

Best,
-M

On Sun, Jul 12, 2015 at 9:52 AM, Joshua Timberman joshua@chef.io wrote:

we have an issue open in the chef repo about OS X 10.11. I'd like to note
a few things.

First, it's not a supported platform yet as it isn't GA. So until it's
supported, brokenness is likely. Fortunately this seems to be the main
issue and may be straightforward.

Second, we are working on getting a OS X 10.11 build node in our CI
infrastructure so that we can properly support it. This is high priority
work for our release engineering team.

Finally, I'd like to address the later query about why /usr/bin instead of
/opt/chef. That's because we originally wanted the binaries installed for
Chef (and then later ChefDK) to be in the default $PATH. On OS X,
/usr/local/bin isn't in the $PATH by default, and /opt/chef certainly
isn't. Also, with ChefDK, it's /opt/chefdk, not /opt/chef, where the
omnibus package is installed. This isn't a huge deal of course but in the
ease of use area it sure is helpful.

directory/file provider fail on OS X 10.11 due to SIP (System Integrity Protection) · Issue #3625 · chef/chef · GitHub

---------- Forwarded message ----------
From: Mike miketheman@gmail.com
Date: Saturday, July 11, 2015
Subject: [chef] ChefDK 0.7.0.rc.2 released
To: Kartik Cating-Subramanian ksubramanian@chef.io
Cc: "chef@lists.opscode.com" chef@lists.opscode.com, Chef Dev <
chef-dev@lists.opscode.com>

Hi Kartik,

Not sure of where you'd want to have bug reports posted, but I tried this
package out today and got an error 0 (see lines L58-L59).

This is likely due to the new restriction of OSX 10.11 disallowing
user-installed modifications to /usr/bin - I was always curious why chefdk
went into /usr/bin and not /usr/local/bin - any insight?

Quoting from the Linux Filesystem Hierarchy 1:

The original idea behind '/usr/local' was to have a separate ('local')
'/usr' directory on every machine besides '/usr', which might be just
mounted read-only from somewhere else. It copies the structure of '/usr'.
These days, '/usr/local' is widely regarded as a good place in which to
keep self-compiled or third-party programs. The /usr/local hierarchy is for
use by the system administrator when installing software locally. It needs
to be safe from being overwritten when the system software is updated. It
may be used for programs and data that are shareable amongst a group of
hosts, but not found in /usr. Locally installed software must be placed
within /usr/local rather than /usr unless it is being installed to replace
or upgrade software in /usr.

So it seems like OSX is taking a harder stance on the "don't even allow
root to write in /usr/bin".

There's more details on this feature on Quora 2.

One hackish way to get around this right now would be to insert another
conditional in the postinst and postrm scripts that tests for osx version
10.11 and uses a different path for symlinks, but I don't think that's
sustainable.

Another idea is that 0.7.0 could move to using /usr/local/bin as the path
for symlinked binaries, don't know how you feel about that. I created a
simple script 3 that uses the behavior from the postinst script to run
locally to get around it.

This would likely also necessitate changing the test paths in chef verify 4.

Hope this helps,
-M

On Thu, Jul 9, 2015 at 4:49 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io> wrote:

Debian: http://opscode-omnibus-packages.s3.amazonaws.com/debian/6/x86_64/chefdk_0.7.0~rc.2-1_amd64.deb

Ubuntu: http://opscode-omnibus-packages.s3.amazonaws.com/ubuntu/12.04/x86_64/chefdk_0.7.0~rc.2-1_amd64.deb

RHEL-6: http://opscode-omnibus-packages.s3.amazonaws.com/el/6/x86_64/chefdk-0.7.0~rc.2-1.el6.x86_64.rpm

RHEL-7: http://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chefdk-0.7.0~rc.2-1.el7.x86_64.rpm

Mac: http://opscode-omnibus-packages.s3.amazonaws.com/mac_os_x/10.8/x86_64/chefdk-0.7.0-rc.2-1.dmg

Windows: http://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.7.0-rc.2-1.msi

On Thu, Jul 9, 2015 at 2:59 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io> wrote:

Apologies - the links provided are to a nightly build and not to the
rc. I'll post the updated links shortly.

On Thu, Jul 9, 2015 at 2:34 PM, Kartik Cating-Subramanian <
ksubramanian@chef.io> wrote:

An updated version of chefdk 0.7.0.rc.2 has been released. This
release updates rc.1 by:

  • pulling in chef-12.4.1
  • pulling in test-kitchen 1.4.1
  • allowing for multiple default_source lines in your policyfile.rb

You can acquire it from omnitruck (
Omnitruck API) using

http://www.chef.io/chef/metadata-chefdk?p=$platform&pv=$platform-version&m=$architecture&v=latest&prerelease=true
e.g.
http://www.chef.io/chef/metadata-chefdk?p=windows&pv=2012r2&m=x86_64&v=latest&prerelease=true

Here are some direct package links:

Windows: http://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.7.0-rc.2+20150709085009-1.msi

Mac: http://opscode-omnibus-packages.s3.amazonaws.com/mac_os_x/10.8/x86_64/chefdk-0.7.0-rc.2+20150709085009.git.6.492042f-1.dmg

RHEL-7 http://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chefdk-0.7.0~rc.2+20150709085009.git.6.492042f-1.el7.x86_64.rpm

RHEL-6 http://opscode-omnibus-packages.s3.amazonaws.com/el/6/x86_64/chefdk-0.7.0~rc.2+20150709085009.git.6.492042f-1.el6.x86_64.rpm

Debian: http://opscode-omnibus-packages.s3.amazonaws.com/debian/6/x86_64/chefdk_0.7.0~rc.2+20150709085009.git.6.492042f-1_amd64.deb

Ubuntu: http://opscode-omnibus-packages.s3.amazonaws.com/ubuntu/12.04/x86_64/chefdk_0.7.0~rc.2+20150709085009.git.6.492042f-1_amd64.deb

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef

--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 – ksubramanian@chef.io - my: Linkedin
https://www.linkedin.com/in/kartikcs/

CHEF

TM

chef.io http://www.chef.io/ Blog http://www.chef.io/blog/
Facebook https://www.facebook.com/getchefdotcom Twitter
https://twitter.com/chef Youtube https://www.youtube.com/getchef