First pass at moving to tempfile.close to get past the handle errors on Server 2012

Signed-off-by: John McCrae <john.mccrae@progress.com>

46 files changed, 151 insertions, 127 deletions

diff --git a/Gemfile.lock b/Gemfile.lock
index 7585dd20ec..55d2253994 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -35,13 +35,6 @@ GIT
       netrc (~> 0.8)
 
 GIT
-  remote: https://github.com/chef/ruby-shadow
-  revision: 3b8ea40b0e943b5de721d956741308ce805a5c3c
-  branch: lcg/ruby-3.0
-  specs:
-    ruby-shadow (2.5.0)
-
-GIT
   remote: https://github.com/chef/ruby-proxifier
   revision: 8b87d0b5b469adbd93eabc0d20f3e47007aef743
   branch: lcg/ruby-3
@@ -514,7 +507,6 @@ DEPENDENCIES
   rb-readline
   rest-client!
   rspec
-  ruby-shadow!
   webmock
 
 BUNDLED WITH
diff --git a/chef-config/spec/unit/workstation_config_loader_spec.rb b/chef-config/spec/unit/workstation_config_loader_spec.rb
index 70b42ad961..a09cb7a785 100644
--- a/chef-config/spec/unit/workstation_config_loader_spec.rb
+++ b/chef-config/spec/unit/workstation_config_loader_spec.rb
@@ -245,7 +245,7 @@ RSpec.describe ChefConfig::WorkstationConfigLoader do
       # We need to keep a reference to the tempfile because while #close does
       # not unlink the file, the object being GC'd will.
       let(:tempfile) do
-        Tempfile.new("Chef-WorkstationConfigLoader-rspec-test").tap do |t|
+        Tempfile.create("Chef-WorkstationConfigLoader-rspec-test").tap do |t|
           t.print(config_content)
           t.close
         end
@@ -366,7 +366,7 @@ RSpec.describe ChefConfig::WorkstationConfigLoader do
       let(:tempdir) { Dir.mktmpdir("chef-workstation-test") }
 
       let!(:confd_file) do
-        Tempfile.new(["Chef-WorkstationConfigLoader-rspec-test", ".rb"], tempdir).tap do |t|
+        Tempfile.create(["Chef-WorkstationConfigLoader-rspec-test", ".rb"], tempdir).tap do |t|
           t.print(config_content)
           t.close
         end
@@ -406,7 +406,7 @@ RSpec.describe ChefConfig::WorkstationConfigLoader do
         let(:config_content) { "config_d_file_evaluated(true)" }
 
         let!(:not_confd_file) do
-          Tempfile.new(["Chef-WorkstationConfigLoader-rspec-test", ".foorb"], tempdir).tap do |t|
+          Tempfile.create(["Chef-WorkstationConfigLoader-rspec-test", ".foorb"], tempdir).tap do |t|
             t.print(syntax_error_content)
             t.close
           end
diff --git a/knife/lib/chef/knife/bootstrap/train_connector.rb b/knife/lib/chef/knife/bootstrap/train_connector.rb
index 1faae2eeff..bd2369ac19 100644
--- a/knife/lib/chef/knife/bootstrap/train_connector.rb
+++ b/knife/lib/chef/knife/bootstrap/train_connector.rb
@@ -151,15 +151,15 @@ class Chef
         # @param remote_path [String] The destination path on the remote file system.
         # @return NilClass
         def upload_file_content!(content, remote_path)
-          t = Tempfile.new("chef-content")
+          t = Tempfile.create("chef-content")
           t.binmode
           t << content
-          t.close
+          t.close!
           upload_file!(t.path, remote_path)
           nil
         ensure
-          t.close
-          t.unlink
+          t.close!
+          # t.unlink
         end
 
         #
diff --git a/knife/lib/chef/knife/core/cookbook_site_streaming_uploader.rb b/knife/lib/chef/knife/core/cookbook_site_streaming_uploader.rb
index 85e83af5da..9abbac3a01 100644
--- a/knife/lib/chef/knife/core/cookbook_site_streaming_uploader.rb
+++ b/knife/lib/chef/knife/core/cookbook_site_streaming_uploader.rb
@@ -28,8 +28,11 @@ module Mixlib
     autoload :SignedHeaderAuth, "mixlib/authentication/signedheaderauth"
   end
 end
-require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 require_relative "../cookbook_metadata"
+
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+require "tempfile" unless defined?(Tempfile)
+
 class Chef
   class Knife
     module Core
@@ -45,7 +48,7 @@ class Chef
         class << self
 
           def create_build_dir(cookbook)
-            tmp_cookbook_path = Tempfile.new("#{ChefUtils::Dist::Infra::SHORT}-#{cookbook.name}-build")
+            tmp_cookbook_path = Tempfile.create("#{ChefUtils::Dist::Infra::SHORT}-#{cookbook.name}-build")
             tmp_cookbook_path.close
             tmp_cookbook_dir = tmp_cookbook_path.path
             File.unlink(tmp_cookbook_dir)
diff --git a/knife/lib/chef/knife/ssh.rb b/knife/lib/chef/knife/ssh.rb
index b474696d02..9698aeb3e1 100644
--- a/knife/lib/chef/knife/ssh.rb
+++ b/knife/lib/chef/knife/ssh.rb
@@ -17,6 +17,7 @@
 #
 
 require_relative "../knife"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Knife
@@ -475,7 +476,7 @@ class Chef
       end
 
       def screen
-        tf = Tempfile.new("knife-ssh-screen")
+        tf = Tempfile.create("knife-ssh-screen")
         ChefConfig::PathHelper.home(".screenrc") do |screenrc_path|
           if File.exist? screenrc_path
             tf.puts("source #{screenrc_path}")
@@ -490,7 +491,7 @@ class Chef
           server.user ? tf.puts("#{server.user}@#{server.host}") : tf.puts(server.host)
           window += 1
         end
-        tf.close
+        tf.close!
         exec("screen -c #{tf.path}")
       end
 
diff --git a/knife/lib/chef/knife/xargs.rb b/knife/lib/chef/knife/xargs.rb
index fc82d390cb..549cc34627 100644
--- a/knife/lib/chef/knife/xargs.rb
+++ b/knife/lib/chef/knife/xargs.rb
@@ -15,6 +15,7 @@
 #
 
 require_relative "../chef_fs/knife"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Knife
@@ -174,7 +175,7 @@ class Chef
         begin
           # Create the temporary files
           files.each do |file|
-            tempfile = Tempfile.new(file.name)
+            tempfile = Tempfile.create(file.name)
             tempfiles[tempfile] = { file: file }
           end
         rescue
@@ -213,13 +214,13 @@ class Chef
         rescue Chef::ChefFS::FileSystem::OperationNotAllowedError => e
           ui.error "#{format_path(e.entry)}: #{e.reason}."
           error = true
-          tempfile.close!
+          tempfile.close
           tempfiles.delete(tempfile)
           next
         rescue Chef::ChefFS::FileSystem::NotFoundError => e
           ui.error "#{format_path(e.entry)}: No such file or directory"
           error = true
-          tempfile.close!
+          tempfile.close
           tempfiles.delete(tempfile)
           next
 
diff --git a/knife/spec/unit/knife/bootstrap_spec.rb b/knife/spec/unit/knife/bootstrap_spec.rb
index bb613f6646..be200cd5aa 100644
--- a/knife/spec/unit/knife/bootstrap_spec.rb
+++ b/knife/spec/unit/knife/bootstrap_spec.rb
@@ -18,6 +18,7 @@
 #
 
 require "knife_spec_helper"
+require_relative "../cookbook_metadata"
 
 Chef::Knife::Bootstrap.load_deps
 
@@ -320,7 +321,7 @@ describe Chef::Knife::Bootstrap do
 
     context "with bootstrap_attribute options" do
       let(:jsonfile) do
-        file = Tempfile.new(["node", ".json"])
+        file = Tempfile.create(["node", ".json"])
         File.open(file.path, "w") { |f| f.puts '{"foo":{"bar":"baz"}}' }
         file
       end
diff --git a/knife/spec/unit/knife/core/ui_spec.rb b/knife/spec/unit/knife/core/ui_spec.rb
index d5d09c0fdf..3b7d34c9b6 100644
--- a/knife/spec/unit/knife/core/ui_spec.rb
+++ b/knife/spec/unit/knife/core/ui_spec.rb
@@ -131,7 +131,7 @@ describe Chef::Knife::UI do
       before do
         @ui.config[:disable_editing] = false
         @ui.config[:editor] = my_editor
-        @tempfile = Tempfile.new([ "knife-edit-", ".json" ])
+        @tempfile = Tempfile.create([ "knife-edit-", ".json" ])
         expect(Tempfile).to receive(:open).with([ "knife-edit-", ".json" ]).and_yield(@tempfile)
       end
 
@@ -146,7 +146,7 @@ describe Chef::Knife::UI do
             expect(subject).to eql(json_from_editor)
           end
           it "the tempfile should have mode 0600", :unix_only do
-            # XXX: this looks odd because we're really testing Tempfile.new here
+            # XXX: this looks odd because we're really testing Tempfile.create here
             expect(File.stat(@tempfile.path).mode & 0777).to eql(0600)
             expect(subject).to eql(json_from_editor)
           end
@@ -159,7 +159,7 @@ describe Chef::Knife::UI do
             expect(subject).to eql(ruby_from_editor)
           end
           it "the tempfile should have mode 0600", :unix_only do
-            # XXX: this looks odd because we're really testing Tempfile.new here
+            # XXX: this looks odd because we're really testing Tempfile.create here
             expect(File.stat(@tempfile.path).mode & 0777).to eql(0600)
             expect(subject).to eql(ruby_from_editor)
           end
diff --git a/knife/spec/unit/knife/data_bag_from_file_spec.rb b/knife/spec/unit/knife/data_bag_from_file_spec.rb
index 4d7c506d0d..26f12c2a06 100644
--- a/knife/spec/unit/knife/data_bag_from_file_spec.rb
+++ b/knife/spec/unit/knife/data_bag_from_file_spec.rb
@@ -54,10 +54,10 @@ describe Chef::Knife::DataBagFromFile do
 
   let(:tmp_dir) { make_canonical_temp_directory }
   let(:db_folder) { File.join(tmp_dir, data_bags_path, bag_name) }
-  let(:db_file) { Tempfile.new(["data_bag_from_file_test", ".json"], db_folder) }
-  let(:db_file2) { Tempfile.new(["data_bag_from_file_test2", ".json"], db_folder) }
+  let(:db_file) { Tempfile.create(["data_bag_from_file_test", ".json"], db_folder) }
+  let(:db_file2) { Tempfile.create(["data_bag_from_file_test2", ".json"], db_folder) }
   let(:db_folder2) { File.join(tmp_dir, data_bags_path, bag_name2) }
-  let(:db_file3) { Tempfile.new(["data_bag_from_file_test3", ".json"], db_folder2) }
+  let(:db_file3) { Tempfile.create(["data_bag_from_file_test3", ".json"], db_folder2) }
 
   def new_bag_expects(b = bag_name, d = plain_data)
     data_bag = double
diff --git a/knife/spec/unit/knife/data_bag_secret_options_spec.rb b/knife/spec/unit/knife/data_bag_secret_options_spec.rb
index 9946b82110..6d34242825 100644
--- a/knife/spec/unit/knife/data_bag_secret_options_spec.rb
+++ b/knife/spec/unit/knife/data_bag_secret_options_spec.rb
@@ -36,15 +36,15 @@ describe Chef::Knife::DataBagSecretOptions do
 
   let(:secret) { "abc123SECRET" }
   let(:secret_file) do
-    sfile = Tempfile.new("encrypted_data_bag_secret")
+    sfile = Tempfile.create("encrypted_data_bag_secret")
     sfile.puts(secret)
     sfile.flush
     sfile
   end
 
   after do
-    secret_file.close
-    secret_file.unlink
+    secret_file.close!
+    # secret_file.unlink
   end
 
   describe "#validate_secrets" do
diff --git a/lib/chef/chef_fs/command_line.rb b/lib/chef/chef_fs/command_line.rb
index 16d9bd93f4..f32d9bd4d5 100644
--- a/lib/chef/chef_fs/command_line.rb
+++ b/lib/chef/chef_fs/command_line.rb
@@ -275,11 +275,11 @@ class Chef
           # Copy to tempfiles before diffing
           # TODO don't copy things that are already in files!  Or find an in-memory diff algorithm
 
-          new_tempfile = Tempfile.new("new")
+          new_tempfile = Tempfile.create("new")
           new_tempfile.write(new_value)
           new_tempfile.close
 
-          old_tempfile = Tempfile.new("old")
+          old_tempfile = Tempfile.create("old")
           old_tempfile.write(old_value)
           old_tempfile.close
 
@@ -290,8 +290,8 @@ class Chef
         rescue => e
           "!!! Unable to diff #{old_path} and #{new_path} due to #{e}"
         ensure
-          old_tempfile.close!
-          new_tempfile.close!
+          old_tempfile.close
+          new_tempfile.close
         end
       end
     end
diff --git a/lib/chef/client.rb b/lib/chef/client.rb
index e5fcd56eb0..9a23d5de3c 100644
--- a/lib/chef/client.rb
+++ b/lib/chef/client.rb
@@ -56,6 +56,7 @@ require "chef-utils" unless defined?(ChefUtils::CANARY)
 require "ohai" unless defined?(Ohai::System)
 require "rbconfig" unless defined?(RbConfig)
 require "forwardable" unless defined?(Forwardable)
+require "tempfile" unless defined?(Tempfile)
 
 require_relative "compliance/runner"
 
@@ -816,12 +817,12 @@ class Chef
     def self.import_pfx_to_store(new_pfx)
       password = ::Chef::HTTP::Authenticator.get_cert_password
       require "win32-certstore"
-      tempfile = Tempfile.new("#{Chef::Config[:node_name]}.pfx")
+      tempfile = Tempfile.create("#{Chef::Config[:node_name]}.pfx")
       File.open(tempfile, "wb") { |f| f.print new_pfx.to_der }
 
       store = ::Win32::Certstore.open("MY")
       store.add_pfx(tempfile, password, CRYPT_EXPORTABLE)
-      tempfile.unlink
+      tempfile.close
     end
 
     #
diff --git a/lib/chef/file_content_management/tempfile.rb b/lib/chef/file_content_management/tempfile.rb
index 27efe34191..083bec6d15 100644
--- a/lib/chef/file_content_management/tempfile.rb
+++ b/lib/chef/file_content_management/tempfile.rb
@@ -41,7 +41,8 @@ class Chef
         tempfile_dirnames.each do |tempfile_dirname|
 
           # preserving the file extension of the target filename should be considered a public API
-          tf = ::Tempfile.open([tempfile_basename, tempfile_extension], tempfile_dirname)
+          # tf = ::Tempfile.open([tempfile_basename, tempfile_extension], tempfile_dirname)
+          tf = ::Tempfile.create([tempfile_basename, tempfile_extension], tempfile_dirname)
           break
         rescue SystemCallError => e
           message = "Creating temp file under '#{tempfile_dirname}' failed with: '#{e.message}'"
diff --git a/lib/chef/http.rb b/lib/chef/http.rb
index f3d3308206..fd23dd786b 100644
--- a/lib/chef/http.rb
+++ b/lib/chef/http.rb
@@ -242,7 +242,7 @@ class Chef
         begin
           yield tempfile
         ensure
-          tempfile && tempfile.close!
+          tempfile && tempfile.close
         end
       end
       tempfile
diff --git a/lib/chef/provider/cron/unix.rb b/lib/chef/provider/cron/unix.rb
index cb3a2f9a61..77032e35ad 100644
--- a/lib/chef/provider/cron/unix.rb
+++ b/lib/chef/provider/cron/unix.rb
@@ -21,6 +21,7 @@
 require_relative "../../log"
 require_relative "../../provider"
 require_relative "../cron"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Provider
@@ -45,7 +46,7 @@ class Chef
         end
 
         def write_crontab(crontab)
-          tempcron = Tempfile.new("chef-cron")
+          tempcron = Tempfile.create("chef-cron")
           tempcron << crontab
           tempcron.flush
           tempcron.chmod(0644)
diff --git a/lib/chef/provider/file.rb b/lib/chef/provider/file.rb
index 4ac86a6c8a..f4014e70f2 100644
--- a/lib/chef/provider/file.rb
+++ b/lib/chef/provider/file.rb
@@ -419,9 +419,9 @@ class Chef
           end
         end
 
-        # unlink necessary to clean up in why-run mode
+        # unlink NOT necessary to clean up in why-run mode
         tempfile.close
-        tempfile.unlink
+        # tempfile.unlink
       end
 
       # This logic ideally will be  made into some kind of generic
diff --git a/lib/chef/provider/remote_file/http.rb b/lib/chef/provider/remote_file/http.rb
index 40f64a0e85..40d95ea6e1 100644
--- a/lib/chef/provider/remote_file/http.rb
+++ b/lib/chef/provider/remote_file/http.rb
@@ -78,7 +78,7 @@ class Chef
             # cache_control shows the file is unchanged, so we got back nil from the streaming_request above, and it is
             # now our responsibility to unlink the tempfile we created
             orig_tempfile.close
-            orig_tempfile.unlink
+            # orig_tempfile.unlink
           end
           tempfile
         end
diff --git a/lib/chef/provider/user/solaris.rb b/lib/chef/provider/user/solaris.rb
index abf6cd94c8..4458e5f978 100644
--- a/lib/chef/provider/user/solaris.rb
+++ b/lib/chef/provider/user/solaris.rb
@@ -19,6 +19,7 @@
 # limitations under the License.
 
 require_relative "../user"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Provider
@@ -121,7 +122,7 @@ class Chef
         # XXX: this was straight copypasta'd back in 2013 and I don't think we've ever evaluated using
         # a pipe to passwd(1) or evaluating modern ruby-shadow.  See https://github.com/chef/chef/pull/721
         def write_shadow_file
-          buffer = Tempfile.new("shadow", "/etc")
+          buffer = Tempfile.create("shadow", "/etc")
           ::File.open(PASSWORD_FILE) do |shadow_file|
             shadow_file.each do |entry|
               user = entry.split(":").first
@@ -132,7 +133,7 @@ class Chef
               end
             end
           end
-          buffer.close
+          buffer.close!
 
           # FIXME: mostly duplicates code with file provider deploying a file
           s = ::File.stat(PASSWORD_FILE)
diff --git a/lib/chef/resource/habitat_config.rb b/lib/chef/resource/habitat_config.rb
index 5c06fa43f5..f9f7a137cd 100644
--- a/lib/chef/resource/habitat_config.rb
+++ b/lib/chef/resource/habitat_config.rb
@@ -16,6 +16,7 @@
 require_relative "../http"
 require_relative "../json_compat"
 require_relative "../resource"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Resource
@@ -85,7 +86,7 @@ class Chef
           opts << ["--remote-sup", new_resource.remote_sup] if new_resource.remote_sup
           opts << ["--user", new_resource.user] if new_resource.user
 
-          tempfile = Tempfile.new(["habitat_config", ".toml"])
+          tempfile = Tempfile.create(["habitat_config", ".toml"])
           begin
             tempfile.write(render_toml(new_resource.config))
             tempfile.close
@@ -93,7 +94,7 @@ class Chef
             hab("config", "apply", opts, new_resource.service_group, incarnation, tempfile.path)
           ensure
             tempfile.close
-            tempfile.unlink
+            # tempfile.unlink
           end
         end
       end
diff --git a/lib/chef/resource/windows_security_policy.rb b/lib/chef/resource/windows_security_policy.rb
index ff3597eeee..af5f85a59a 100644
--- a/lib/chef/resource/windows_security_policy.rb
+++ b/lib/chef/resource/windows_security_policy.rb
@@ -105,7 +105,7 @@ class Chef
           security_option = new_resource.secoption
           security_value = new_resource.secvalue
 
-          file = Tempfile.new(["#{security_option}", ".inf"])
+          file = Tempfile.create(["#{security_option}", ".inf"])
           case security_option
           when "LockoutBadCount"
             cmd = "net accounts /LockoutThreshold:#{security_value}"
@@ -122,12 +122,12 @@ class Chef
           else
             policy_line = "#{security_option} = #{security_value}"
             file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
-            file.close
+            file.close!
             file_path = file.path.tr("/", "\\")
             cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
           end
           shell_out!(cmd)
-          file.unlink
+          file.close!
         end
       end
 
diff --git a/lib/chef/util/diff.rb b/lib/chef/util/diff.rb
index 0774dea813..edf04b3b25 100644
--- a/lib/chef/util/diff.rb
+++ b/lib/chef/util/diff.rb
@@ -40,6 +40,8 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OF OTHER DEALINGS IN THE
 # SOFTWARE.
 
+require "tempfile" unless defined?(Tempfile)
+
 class Chef
   class Util
     class Diff
@@ -62,13 +64,13 @@ class Chef
         tempfile = nil
         unless File.exist?(file)
           Chef::Log.trace("File #{file} does not exist to diff against, using empty tempfile")
-          tempfile = Tempfile.new("chef-diff")
+          tempfile = Tempfile.create("chef-diff")
           file = tempfile.path
         end
         yield file
         unless tempfile.nil?
           tempfile.close
-          tempfile.unlink
+          # tempfile.unlink
         end
       end
 
diff --git a/spec/functional/resource/powershell_script_spec.rb b/spec/functional/resource/powershell_script_spec.rb
index 68fa94afe9..8b9f372ef1 100644
--- a/spec/functional/resource/powershell_script_spec.rb
+++ b/spec/functional/resource/powershell_script_spec.rb
@@ -18,6 +18,7 @@
 
 require "chef/platform/query_helpers"
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
 
@@ -55,16 +56,16 @@ describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
     end
 
     it "returns the exit status 27 for a powershell script that exits with 27" do
-      file = Tempfile.new(["foo", ".ps1"])
+      file = Tempfile.create(["foo", ".ps1"])
       begin
         file.write "exit 27"
-        file.close
+        file.close!
         resource.code(". \"#{file.path}\"")
         resource.returns(27)
         resource.run_action(:run)
       ensure
-        file.close
-        file.unlink
+        file.close!
+        # file.unlink
       end
     end
 
@@ -74,10 +75,10 @@ describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
 
       # Versions of PowerShell prior to 4.0 return a 16-bit unsigned value --
       # PowerShell 4.0 and later versions return a 32-bit signed value.
-      file = Tempfile.new(["foo", ".ps1"])
+      file = Tempfile.create(["foo", ".ps1"])
       begin
         file.write "exit #{negative_exit_status}"
-        file.close
+        file.close!
         resource.code(". \"#{file.path}\"")
 
         # PowerShell earlier than 4.0 takes negative exit codes
@@ -89,8 +90,8 @@ describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
         resource.returns([negative_exit_status, unsigned_exit_status])
         expect { resource.run_action(:run) }.not_to raise_error
       ensure
-        file.close
-        file.unlink
+        file.close!
+        # file.unlink
       end
     end
 
diff --git a/spec/functional/resource/user/windows_spec.rb b/spec/functional/resource/user/windows_spec.rb
index 72db110266..6b7c7a7e3c 100644
--- a/spec/functional/resource/user/windows_spec.rb
+++ b/spec/functional/resource/user/windows_spec.rb
@@ -60,7 +60,7 @@ describe Chef::Provider::User::Windows, :windows_only do
   def set_windows_minimum_password_length(minimum_password_length = 0)
     require "tempfile"
     temp_security_database = "C:\\windows\\security\\database\\seceditnew.sdb"
-    temp_security_template = Tempfile.new(["chefpolicy", ".inf"])
+    temp_security_template = Tempfile.create(["chefpolicy", ".inf"])
     file_content = <<~EOF
       [Unicode]
       Unicode=yes
diff --git a/spec/integration/client/client_spec.rb b/spec/integration/client/client_spec.rb
index 1bd84fa940..33e417ce4a 100644
--- a/spec/integration/client/client_spec.rb
+++ b/spec/integration/client/client_spec.rb
@@ -3,6 +3,7 @@ require "support/shared/integration/integration_helper"
 require "chef/mixin/shell_out"
 require "tiny_server"
 require "tmpdir"
+require "tempfile" unless defined?(Tempfile)
 require "chef-utils/dist"
 require "chef/mixin/powershell_exec"
 
@@ -106,7 +107,7 @@ describe "chef-client" do
     let(:validation_path) { "" }
 
     before do
-      tempfile = Tempfile.new(validation_path)
+      tempfile = Tempfile.create(validation_path)
       tempfile.write "string"
       tempfile.close
       @path = tempfile.path
diff --git a/spec/integration/recipes/accumulator_spec.rb b/spec/integration/recipes/accumulator_spec.rb
index 9cdbd3978d..c1d559cf8f 100644
--- a/spec/integration/recipes/accumulator_spec.rb
+++ b/spec/integration/recipes/accumulator_spec.rb
@@ -1,6 +1,7 @@
 require "spec_helper"
 require "support/shared/integration/integration_helper"
 require "chef/mixin/shell_out"
+require "tempfile" unless defined?(Tempfile)
 
 describe "Accumulators" do
   include IntegrationSupport
@@ -20,10 +21,10 @@ describe "Accumulators" do
   let(:chef_client) { "bundle exec #{ChefUtils::Dist::Infra::CLIENT} --minimal-ohai --always-dump-stacktrace" }
 
   let(:aliases_temppath) do
-    t = Tempfile.new("chef_accumulator_test")
+    t = Tempfile.create("chef_accumulator_test")
     path = t.path
-    t.close
-    t.unlink
+    t.close!
+    # t.unlink
     path
   end
 
diff --git a/spec/support/shared/unit/provider/file.rb b/spec/support/shared/unit/provider/file.rb
index 3a717e91c1..381974500c 100644
--- a/spec/support/shared/unit/provider/file.rb
+++ b/spec/support/shared/unit/provider/file.rb
@@ -543,7 +543,7 @@ shared_examples_for Chef::Provider::File do
           allow(content).to receive(:tempfile).and_return(tempfile)
           expect(File).to receive(:exist?).with("/tmp/foo-bar-baz").and_return(true)
           expect(tempfile).to receive(:close).once
-          expect(tempfile).to receive(:unlink).once
+          # expect(tempfile).to receive(:unlink).once
         end
 
         context "when the contents have changed" do
diff --git a/spec/unit/application/base_spec.rb b/spec/unit/application/base_spec.rb
index ce90464603..a554c12a1a 100644
--- a/spec/unit/application/base_spec.rb
+++ b/spec/unit/application/base_spec.rb
@@ -1,4 +1,5 @@
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Application::Base, "setup_application" do
   let(:validation_path) { "" }
@@ -6,7 +7,7 @@ describe Chef::Application::Base, "setup_application" do
   context "when validation key is supplied" do
     before do
       @app = Chef::Application::Base.new
-      tempfile = Tempfile.new(validation_path)
+      tempfile = Tempfile.create(validation_path)
       tempfile.write "string"
       tempfile.close
       @path = tempfile.path
diff --git a/spec/unit/application_spec.rb b/spec/unit/application_spec.rb
index b84f0c99f2..a469e2ef06 100644
--- a/spec/unit/application_spec.rb
+++ b/spec/unit/application_spec.rb
@@ -17,6 +17,7 @@
 # limitations under the License.
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Application do
   before do
@@ -415,7 +416,7 @@ describe Chef::Application do
     end
 
     context "when cli arguments contain valid recipe file path" do
-      let(:tempfile) { Tempfile.new("default.rb").path }
+      let(:tempfile) { Tempfile.create("default.rb").path }
       before do
         allow(app).to receive(:cli_arguments).and_return([tempfile])
       end
@@ -478,7 +479,7 @@ describe Chef::Application do
     context "when cli arguments contain valid recipe file path and invalid string" do
       let(:fatal) { false }
       before do
-        tempfile = Tempfile.new("default.rb").path
+        tempfile = Tempfile.create("default.rb").path
         allow(app).to receive(:cli_arguments).and_return([tempfile, "test"])
         allow(Chef::Application).to receive(:fatal!).and_return(fatal)
       end
@@ -504,14 +505,14 @@ describe Chef::Application do
 
     describe "when config file exists but contains errors" do
       def create_config_file(text)
-        @config_file = Tempfile.new("rspec-chef-config")
+        @config_file = Tempfile.create("rspec-chef-config")
         @config_file.write(text)
         @config_file.close
         @app.config[:config_file] = @config_file.path
       end
 
       after(:each) do
-        @config_file.unlink
+        @config_file.close! unless @config_file.closed?
       end
 
       it "should raise informative fatals for badly written config" do
diff --git a/spec/unit/client_spec.rb b/spec/unit/client_spec.rb
index 7f02eacb39..ce9e17deed 100644
--- a/spec/unit/client_spec.rb
+++ b/spec/unit/client_spec.rb
@@ -459,13 +459,13 @@ describe Chef::Client do
 
       context "with an output path" do
         before do
-          @tmpout = Tempfile.open("rspec-for-client-formatter-selection-#{Process.pid}")
+          @tmpout = Tempfile.create("rspec-for-client-formatter-selection-#{Process.pid}")
           Chef::Config.add_formatter(:min, @tmpout.path)
         end
 
         after do
           @tmpout.close unless @tmpout.closed?
-          @tmpout.unlink
+          # @tmpout.unlink
         end
 
         it "configures the formatter for the file path" do
diff --git a/spec/unit/compliance/input_spec.rb b/spec/unit/compliance/input_spec.rb
index a65adfb284..61b8f53fb7 100644
--- a/spec/unit/compliance/input_spec.rb
+++ b/spec/unit/compliance/input_spec.rb
@@ -90,7 +90,7 @@ ssh-01:
   run: false
   justification: "waived, yo"
     EOH
-    tempfile = Tempfile.new("chef-compliance-test")
+    tempfile = Tempfile.create("chef-compliance-test")
     tempfile.write string
     tempfile.close
     newinput = Chef::Compliance::Input.from_file(events, tempfile.path, cookbook_name)
diff --git a/spec/unit/compliance/profile_spec.rb b/spec/unit/compliance/profile_spec.rb
index 8487b26691..c8ed5c7b40 100644
--- a/spec/unit/compliance/profile_spec.rb
+++ b/spec/unit/compliance/profile_spec.rb
@@ -106,7 +106,7 @@ version: 2.6.4#{" "}
 supports:#{"     "}
   - os-family: unix
     EOH
-    tempfile = Tempfile.new("chef-compliance-test")
+    tempfile = Tempfile.create("chef-compliance-test")
     tempfile.write string
     tempfile.close
     newprofile = Chef::Compliance::Profile.from_file(events, tempfile.path, cookbook_name)
diff --git a/spec/unit/compliance/waiver_spec.rb b/spec/unit/compliance/waiver_spec.rb
index e001e3a97d..67b5e4c93b 100644
--- a/spec/unit/compliance/waiver_spec.rb
+++ b/spec/unit/compliance/waiver_spec.rb
@@ -90,7 +90,7 @@ ssh-01:
   run: false
   justification: "waived, yo"
     EOH
-    tempfile = Tempfile.new("chef-compliance-test")
+    tempfile = Tempfile.create("chef-compliance-test")
     tempfile.write string
     tempfile.close
     newwaiver = Chef::Compliance::Waiver.from_file(events, tempfile.path, cookbook_name)
diff --git a/spec/unit/cookbook/file_vendor_spec.rb b/spec/unit/cookbook/file_vendor_spec.rb
index f020cb3683..dd9c92b41d 100644
--- a/spec/unit/cookbook/file_vendor_spec.rb
+++ b/spec/unit/cookbook/file_vendor_spec.rb
@@ -17,6 +17,7 @@
 #
 require "spec_helper"
 require "chef/cookbook_version"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Cookbook::FileVendor do
 
@@ -116,6 +117,8 @@ describe Chef::Cookbook::FileVendor do
     end
 
     it "retrieves the file from the correct location based on path to the cookbook that contains the correct name metadata" do
+      # require "pry"
+      # binding.pry
       file_vendor = file_vendor_class.create_from_manifest(manifest)
       file_vendor.get_filename("metadata.rb")
     end
diff --git a/spec/unit/data_collector_spec.rb b/spec/unit/data_collector_spec.rb
index eb698d6661..812db11e72 100644
--- a/spec/unit/data_collector_spec.rb
+++ b/spec/unit/data_collector_spec.rb
@@ -18,6 +18,7 @@
 require "spec_helper"
 require "chef/data_collector"
 require "socket"
+require "tempfile" unless defined?(Tempfile)
 
 #
 # FIXME FIXME FIXME:  What we need to do here is have the ability to construct a real resource collection
@@ -881,7 +882,7 @@ describe Chef::DataCollector do
   end
 
   describe "#send_to_file_location(file_name, message)" do
-    let(:tempfile) { Tempfile.new("rspec-chef-datacollector-out") }
+    let(:tempfile) { Tempfile.create("rspec-chef-datacollector-out") }
     let(:shift_jis) { "I have no idea what this character is:\n #{0x83.chr}#{0x80.chr}.\n" }
     it "handles invalid UTF-8 properly" do
       data_collector.send(:send_to_file_location, tempfile, { invalid: shift_jis })
diff --git a/spec/unit/file_content_management/deploy/mv_unix_spec.rb b/spec/unit/file_content_management/deploy/mv_unix_spec.rb
index a514667c71..cdee52fe8f 100644
--- a/spec/unit/file_content_management/deploy/mv_unix_spec.rb
+++ b/spec/unit/file_content_management/deploy/mv_unix_spec.rb
@@ -17,6 +17,7 @@
 #
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::FileContentManagement::Deploy::MvUnix do
 
@@ -101,13 +102,13 @@ describe Chef::FileContentManagement::Deploy::MvUnix do
 
   describe "when testing against real files", unix_only: true do
     it "preserves sticky bits" do
-      staging_file = Tempfile.new("staging_file")
-      target_file = Tempfile.new("target_file")
+      staging_file = Tempfile.create("staging_file")
+      target_file = Tempfile.create("target_file")
       File.chmod(04755, target_file.path)
       content_deployer.deploy(staging_file.path, target_file.path)
       expect(::File.stat(target_file.path).mode & 07777).to eql(04755)
-      staging_file.unlink
-      target_file.unlink
+      staging_file.close!
+      target_file.close!
     end
   end
 end
diff --git a/spec/unit/mixin/openssl_helper_spec.rb b/spec/unit/mixin/openssl_helper_spec.rb
index 7766e8f9b2..6b930ce7b6 100644
--- a/spec/unit/mixin/openssl_helper_spec.rb
+++ b/spec/unit/mixin/openssl_helper_spec.rb
@@ -15,6 +15,7 @@
 
 require "spec_helper"
 require "chef/mixin/openssl_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Mixin::OpenSSLHelper do
   let(:instance) do
@@ -71,7 +72,7 @@ describe Chef::Mixin::OpenSSLHelper do
     require "tempfile"
 
     before(:each) do
-      @dhparam_file = Tempfile.new("dhparam")
+      @dhparam_file = Tempfile.create("dhparam")
     end
 
     context "When the dhparam.pem file does not exist" do
@@ -99,7 +100,7 @@ describe Chef::Mixin::OpenSSLHelper do
     end
 
     after(:each) do
-      @dhparam_file.unlink
+      @dhparam_file.close unless @dhparam_file.closed?
     end
   end
 
@@ -110,7 +111,7 @@ describe Chef::Mixin::OpenSSLHelper do
     cipher = ::OpenSSL::Cipher.new("des3")
 
     before(:each) do
-      @keyfile = Tempfile.new("keyfile")
+      @keyfile = Tempfile.create("keyfile")
     end
 
     context "When the key file does not exist" do
@@ -176,7 +177,7 @@ describe Chef::Mixin::OpenSSLHelper do
     end
 
     after(:each) do
-      @keyfile.unlink
+      @keyfile.close unless @keyfile.closed?
     end
   end
 
@@ -184,7 +185,7 @@ describe Chef::Mixin::OpenSSLHelper do
     require "tempfile"
 
     before(:each) do
-      @crlfile = Tempfile.new("crlfile")
+      @crlfile = Tempfile.create("crlfile")
     end
 
     context "When the crl file doesnt not exist" do
@@ -210,7 +211,7 @@ describe Chef::Mixin::OpenSSLHelper do
     end
 
     after(:each) do
-      @crlfile.unlink
+      @crlfile.close unless @crlfile.closed?
     end
   end
 
@@ -852,7 +853,7 @@ describe Chef::Mixin::OpenSSLHelper do
     require "tempfile"
 
     before(:each) do
-      @certfile = Tempfile.new("certfile")
+      @certfile = Tempfile.create("certfile")
     end
 
     context "When the cert file doesn't exist" do
@@ -886,7 +887,7 @@ describe Chef::Mixin::OpenSSLHelper do
     end
 
     after(:each) do
-      @certfile.unlink
+      @certfile.close
     end
   end
 end
diff --git a/spec/unit/mixin/template_spec.rb b/spec/unit/mixin/template_spec.rb
index 63522839e9..938dd68928 100644
--- a/spec/unit/mixin/template_spec.rb
+++ b/spec/unit/mixin/template_spec.rb
@@ -105,7 +105,7 @@ describe Chef::Mixin::Template, "render_template" do
 
     it "should render local files" do
 
-      tf = Tempfile.new("partial")
+      tf = Tempfile.create("partial")
       tf.write "test"
       tf.rewind
 
@@ -125,7 +125,7 @@ describe Chef::Mixin::Template, "render_template" do
 
     it "should render using the source argument if provided" do
 
-      tf = Tempfile.new("partial")
+      tf = Tempfile.create("partial")
       tf.write "test"
       tf.rewind
 
diff --git a/spec/unit/monologger_spec.rb b/spec/unit/monologger_spec.rb
index 5448de32b2..7d9f10290c 100644
--- a/spec/unit/monologger_spec.rb
+++ b/spec/unit/monologger_spec.rb
@@ -36,7 +36,7 @@ describe MonoLogger do
 
   describe "when given an object that is stringable (to_str)" do
     it "should open a File object with the given path" do
-      temp_file = Tempfile.new("rspec-monologger-log")
+      temp_file = Tempfile.create("rspec-monologger-log")
       temp_file.close
       MonoLogger.new(temp_file.path).fatal("Do, or do not. There is no try.")
       expect(File.read(temp_file.path)).to match(/Do, or do not. There is no try./)
diff --git a/spec/unit/provider/ifconfig/debian_spec.rb b/spec/unit/provider/ifconfig/debian_spec.rb
index 7cf951498d..93057ed562 100644
--- a/spec/unit/provider/ifconfig/debian_spec.rb
+++ b/spec/unit/provider/ifconfig/debian_spec.rb
@@ -18,6 +18,7 @@
 
 require "spec_helper"
 require "chef/exceptions"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Provider::Ifconfig::Debian do
 
@@ -56,7 +57,7 @@ describe Chef::Provider::Ifconfig::Debian do
   describe "generate_config" do
 
     context "when writing a file" do
-      let(:tempfile) { Tempfile.new("rspec-chef-ifconfig-debian") }
+      let(:tempfile) { Tempfile.create("rspec-chef-ifconfig-debian") }
 
       let(:tempdir_path) { Dir.mktmpdir("rspec-chef-ifconfig-debian-dir") }
 
@@ -105,7 +106,7 @@ describe Chef::Provider::Ifconfig::Debian do
     end
 
     context "when the file is up-to-date" do
-      let(:tempfile) { Tempfile.new("rspec-chef-ifconfig-debian") }
+      let(:tempfile) { Tempfile.create("rspec-chef-ifconfig-debian") }
 
       let(:tempdir_path) { Dir.mktmpdir("rspec-chef-ifconfig-debian-dir") }
 
@@ -182,7 +183,7 @@ describe Chef::Provider::Ifconfig::Debian do
       context "when writing a file" do
         let(:config_file_ifcfg) { StringIO.new }
 
-        let(:tempfile) { Tempfile.new("rspec-chef-ifconfig-debian") }
+        let(:tempfile) { Tempfile.create("rspec-chef-ifconfig-debian") }
 
         let(:tempdir_path) { Dir.mktmpdir("rspec-chef-ifconfig-debian-dir") }
 
@@ -231,7 +232,7 @@ describe Chef::Provider::Ifconfig::Debian do
       end
 
       context "when the file is up-to-date" do
-        let(:tempfile) { Tempfile.new("rspec-chef-ifconfig-debian") }
+        let(:tempfile) { Tempfile.create("rspec-chef-ifconfig-debian") }
 
         let(:tempdir_path) { Dir.mktmpdir("rspec-chef-ifconfig-debian-dir") }
 
@@ -295,7 +296,7 @@ describe Chef::Provider::Ifconfig::Debian do
 
   describe "delete_config for action_delete" do
 
-    let(:tempfile) { Tempfile.new("rspec-chef-ifconfig-debian") }
+    let(:tempfile) { Tempfile.create("rspec-chef-ifconfig-debian") }
 
     let(:tempdir_path) { Dir.mktmpdir("rspec-chef-ifconfig-debian-dir") }
 
diff --git a/spec/unit/provider/mount/solaris_spec.rb b/spec/unit/provider/mount/solaris_spec.rb
index 4ca22b4b78..a5c0d4d0b5 100644
--- a/spec/unit/provider/mount/solaris_spec.rb
+++ b/spec/unit/provider/mount/solaris_spec.rb
@@ -18,6 +18,7 @@
 
 require "spec_helper"
 require "ostruct"
+require "tempfile" unless defined?(Tempfile)
 
 # Do not run these tests on windows because some path handling
 # code is not implemented to handle windows paths.
@@ -77,7 +78,7 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
   end
 
   let(:vfstab_file) do
-    t = Tempfile.new("rspec-vfstab")
+    t = Tempfile.create("rspec-vfstab")
     t.write(vfstab_file_contents)
     t.close
     t
diff --git a/spec/unit/provider/remote_file/http_spec.rb b/spec/unit/provider/remote_file/http_spec.rb
index 8eca721cd0..7d3b3d7378 100644
--- a/spec/unit/provider/remote_file/http_spec.rb
+++ b/spec/unit/provider/remote_file/http_spec.rb
@@ -17,6 +17,7 @@
 #
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Provider::RemoteFile::HTTP do
 
@@ -159,7 +160,7 @@ describe Chef::Provider::RemoteFile::HTTP do
 
     let(:tempfile_path) { tempfile.path }
 
-    let(:tempfile) { Tempfile.open("muhtempfile") }
+    let(:tempfile) { Tempfile.create("muhtempfile") }
 
     let(:last_response) { {} }
 
@@ -189,7 +190,7 @@ describe Chef::Provider::RemoteFile::HTTP do
       # Streaming request returns nil for a 304 not modified (etags / last-modified)
       expect(rest).to receive(:streaming_request).with(uri, {}, tempfile).and_return(nil)
       expect(tempfile).to receive(:close)
-      expect(tempfile).to receive(:unlink)
+      # expect(tempfile).to receive(:unlink)
       expect(fetcher.fetch).to be_nil
     end
 
diff --git a/spec/unit/provider/user/solaris_spec.rb b/spec/unit/provider/user/solaris_spec.rb
index 58c3c0bd68..14d8b556d2 100644
--- a/spec/unit/provider/user/solaris_spec.rb
+++ b/spec/unit/provider/user/solaris_spec.rb
@@ -21,6 +21,7 @@
 #
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Provider::User::Solaris do
 
@@ -64,18 +65,18 @@ describe Chef::Provider::User::Solaris do
     it "should write out a modified version of the password file" do
       # Let this test run #write_shadow_file
       allow(provider).to receive(:write_shadow_file).and_call_original
-      password_file = Tempfile.new("shadow")
+      password_file = Tempfile.create("shadow")
       password_file.puts "adam:existingpassword:15441::::::"
       password_file.close
       stub_const("Chef::Provider::User::Solaris::PASSWORD_FILE", password_file.path)
       allow(provider).to receive(:shell_out_compacted!).and_return(true)
       # may not be able to write to /etc for tests...
-      temp_file = Tempfile.new("shadow")
+      temp_file = Tempfile.create("shadow")
       allow(Tempfile).to receive(:new).with("shadow", "/etc").and_return(temp_file)
       new_resource.password "verysecurepassword"
       provider.manage_user
       expect(::File.read(password_file.path)).to match(/adam:verysecurepassword:/)
-      password_file.unlink
+      password_file.close
     end
   end
 
diff --git a/spec/unit/resource/inspec_input_spec.rb b/spec/unit/resource/inspec_input_spec.rb
index 4acdfd60a9..f7da3e496e 100644
--- a/spec/unit/resource/inspec_input_spec.rb
+++ b/spec/unit/resource/inspec_input_spec.rb
@@ -16,6 +16,7 @@
 #
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Resource::InspecInput do
   def load_input(filename)
@@ -153,7 +154,7 @@ ssh_custom_path = "/whatever2"
 
   context "with a input in a file" do
     it "loads a YAML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yaml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yaml"])
       tempfile.write input_yaml
       tempfile.close
       resource.name tempfile.path
@@ -169,7 +170,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a YAML file in a source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yaml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yaml"])
       tempfile.write input_yaml
       tempfile.close
       resource.name "my-resource-name"
@@ -186,7 +187,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a YML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yml"])
       tempfile.write input_yaml
       tempfile.close
       resource.name tempfile.path
@@ -202,7 +203,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a YML file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yml"])
       tempfile.write input_yaml
       tempfile.close
       resource.name "my-resource-name"
@@ -219,7 +220,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a JSON file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".json"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".json"])
       tempfile.write input_json
       tempfile.close
       resource.name tempfile.path
@@ -235,7 +236,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a JSON file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".json"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".json"])
       tempfile.write input_json
       tempfile.close
       resource.name "my-resource-name"
@@ -252,7 +253,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a TOML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".toml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".toml"])
       tempfile.write input_toml
       tempfile.close
       resource.name tempfile.path
@@ -268,7 +269,7 @@ ssh_custom_path = "/whatever2"
     end
 
     it "loads a TOML file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".toml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".toml"])
       tempfile.write input_toml
       tempfile.close
       resource.name "my-resource-name"
diff --git a/spec/unit/resource/inspec_waiver_spec.rb b/spec/unit/resource/inspec_waiver_spec.rb
index 3154bcc9fa..632a050d9f 100644
--- a/spec/unit/resource/inspec_waiver_spec.rb
+++ b/spec/unit/resource/inspec_waiver_spec.rb
@@ -16,6 +16,7 @@
 #
 
 require "spec_helper"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Resource::InspecWaiver do
   def load_waiver(filename)
@@ -165,7 +166,7 @@ justification = "waived, yo"
 
   context "with a waiver in a file" do
     it "loads a YAML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yaml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yaml"])
       tempfile.write waiver_yaml
       tempfile.close
       resource.name tempfile.path
@@ -181,7 +182,7 @@ justification = "waived, yo"
     end
 
     it "loads a YAML file in a source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yaml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yaml"])
       tempfile.write waiver_yaml
       tempfile.close
       resource.name "my-resource-name"
@@ -198,7 +199,7 @@ justification = "waived, yo"
     end
 
     it "loads a YML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yml"])
       tempfile.write waiver_yaml
       tempfile.close
       resource.name tempfile.path
@@ -214,7 +215,7 @@ justification = "waived, yo"
     end
 
     it "loads a YML file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".yml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".yml"])
       tempfile.write waiver_yaml
       tempfile.close
       resource.name "my-resource-name"
@@ -231,7 +232,7 @@ justification = "waived, yo"
     end
 
     it "loads a JSON file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".json"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".json"])
       tempfile.write waiver_json
       tempfile.close
       resource.name tempfile.path
@@ -247,7 +248,7 @@ justification = "waived, yo"
     end
 
     it "loads a JSON file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".json"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".json"])
       tempfile.write waiver_json
       tempfile.close
       resource.name "my-resource-name"
@@ -264,7 +265,7 @@ justification = "waived, yo"
     end
 
     it "loads a TOML file" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".toml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".toml"])
       tempfile.write waiver_toml
       tempfile.close
       resource.name tempfile.path
@@ -280,7 +281,7 @@ justification = "waived, yo"
     end
 
     it "loads a TOML file using the source attribute" do
-      tempfile = Tempfile.new(["spec-compliance-test", ".toml"])
+      tempfile = Tempfile.create(["spec-compliance-test", ".toml"])
       tempfile.write waiver_toml
       tempfile.close
       resource.name "my-resource-name"
diff --git a/spec/unit/util/backup_spec.rb b/spec/unit/util/backup_spec.rb
index d7a57dce1a..323adafceb 100644
--- a/spec/unit/util/backup_spec.rb
+++ b/spec/unit/util/backup_spec.rb
@@ -18,11 +18,12 @@
 
 require "spec_helper"
 require "tmpdir"
+require "tempfile" unless defined?(Tempfile)
 
 describe Chef::Util::Backup do
 
   let(:tempfile) do
-    Tempfile.new("chef-util-backup-spec-test")
+    Tempfile.create("chef-util-backup-spec-test")
   end
 
   before(:each) do
diff --git a/spec/unit/util/diff_spec.rb b/spec/unit/util/diff_spec.rb
index d1440dbaaa..b36ffd8bf0 100644
--- a/spec/unit/util/diff_spec.rb
+++ b/spec/unit/util/diff_spec.rb
@@ -18,15 +18,16 @@
 
 require "spec_helper"
 require "tmpdir"
+require "tempfile" unless defined?(Tempfile)
 
 shared_context "using file paths with spaces" do
-  let!(:old_tempfile) { Tempfile.new("chef-util diff-spec") }
-  let!(:new_tempfile) { Tempfile.new("chef-util diff-spec") }
+  let!(:old_tempfile) { Tempfile.create("chef-util diff-spec") }
+  let!(:new_tempfile) { Tempfile.create("chef-util diff-spec") }
 end
 
 shared_context "using file paths without spaces" do
-  let!(:old_tempfile) { Tempfile.new("chef-util-diff-spec") }
-  let!(:new_tempfile) { Tempfile.new("chef-util-diff-spec") }
+  let!(:old_tempfile) { Tempfile.create("chef-util-diff-spec") }
+  let!(:new_tempfile) { Tempfile.create("chef-util-diff-spec") }
 end
 
 shared_examples_for "a diff util" do
@@ -36,13 +37,13 @@ shared_examples_for "a diff util" do
 
   it "produces a diff even if the old_file does not exist" do
     old_tempfile.close
-    old_tempfile.unlink
+    # old_tempfile.unlink
     expect(differ.for_output).to eql(["(no diff)"])
   end
 
   it "produces a diff even if the new_file does not exist" do
     new_tempfile.close
-    new_tempfile.unlink
+    # new_tempfile.unlink
     expect(differ.for_output).to eql(["(no diff)"])
   end