Merge pull request #4820 from chef/jk/lock-deps

Lock dependencies of chef through a `Gemfile.lock`

60 files changed, 3413 insertions, 339 deletions

diff --git a/.bundle/config b/.bundle/config
new file mode 100644
index 0000000000..7544be9dd7
--- /dev/null
+++ b/.bundle/config
@@ -0,0 +1,2 @@
+---
+BUNDLE_FROZEN: '1'
diff --git a/.gitignore b/.gitignore
index 732589b2e3..1e60843467 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,32 +8,14 @@ tags
 .chef
 
 # You should check in your Gemfile.lock in applications, and not in gems
-# This also matches Berksfile.lock
-Gemfile.lock
-Berksfile.lock
 external_tests/*.lock
-acceptance/Gemfile.lock
-omnibus/Gemfile.lock
-/*.lock
 /Gemfile.local
 
-# Do not check in the .bundle directory, or any of the files inside it. Those
-# files are specific to each particular machine, and are used to persist
-# installation options between runs of the bundle install command.
-.bundle
-
 # ignore some common Bundler 'binstubs' directory names
 # http://gembundler.com/man/bundle-exec.1.html
 b/
 binstubs/
-bin
-!bin/chef-apply
-!bin/chef-client
-!bin/chef-service-manager
-!bin/chef-shell
-!bin/chef-solo
-!bin/chef-windows-service
-!bin/knife
+**/.bundle
 # RVM and RBENV ruby version files
 .rbenv-version
 .rvmrc
diff --git a/.travis.yml b/.travis.yml
index e93d6ce246..4294f3865e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,28 +1,22 @@
 language: ruby
+sudo: false
 cache: bundler
 
-sudo: false
 # Early warning system to catch if Rubygems breaks something
 before_install:
-  - gem update --system
-  - gem install bundler
+  - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+  - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+  - rm -f .bundle/config
+
+bundler_args: --without changelog compat_testing development docgen guard maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
 
+# do not run expensive spec tests on PRs, only on branches
 branches:
   only:
   - master
   - 10-stable
   - 11-stable
 
-# do not run expensive spec tests on PRs, only on branches
-script: "
-set -e;
-echo '--color\n-fp' > .rspec;
-sudo sed -i -e 's/^Defaults\tsecure_path.*$//' /etc/sudoers;
-sudo -E $(which bundle) exec rake spec;
-bundle exec rake style;
-bundle exec bundle-audit check --update;
-"
-
 env:
   global:
     - FORCE_FFI_YAJL=ext
@@ -31,109 +25,133 @@ matrix:
   include:
   - rvm: 2.1
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without changelog compat_testing development docgen guard integration maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
   - rvm: 2.2
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without changelog compat_testing development docgen guard integration maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
   - rvm: 2.3.0
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without changelog compat_testing development docgen guard integration maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
   - rvm: rbx
     sudo: true
-    bundler_args: --without server docgen maintenance ruby_prof pry
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-zero', github: 'chef/chef-zero'\""
-    script: bundle exec rake chef_zero_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'cheffish', github: 'chef/cheffish'\""
-    script: bundle exec rake cheffish_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-provisioning', github: 'chef/chef-provisioning'\""
-    script: bundle exec rake chef_provisioning_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-provisioning-aws', github: 'chef/chef-provisioning-aws'\""
-    script: bundle exec rake chef_provisioning_aws_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chefspec'\""
-    script: bundle exec rake chefspec_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-sugar'\""
-    script: bundle exec rake chef_sugar_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'knife-windows', github: 'chef/knife-windows'\""
-    script: bundle exec rake knife_windows_spec
-  # Requires vagrant
-  # - rvm: 2.2
-  #   cache:
-  #   env: "GEMFILE_MOD=\"gem 'chef-rewind'\""
-  #   script: bundle exec rake chef_rewind_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'foodcritic', github: 'acrmp/foodcritic', branch: 'v5.0.0'\""
-    script: bundle exec rake foodcritic_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'halite', github: 'poise/halite'\""
-    script: bundle exec rake halite_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'poise', github: 'poise/poise'\""
-    script: bundle exec rake poise_spec
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without changelog compat_testing development docgen guard integration maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
+  #
+  # External tests
+  #
+  - env:
+      TEST_GEM: chef-provisioning
+    script: tasks/bin/run_external_test $TEST_GEM rake spec
+    rvm: 2.2
+  - env:
+      TEST_GEM: chef-provisioning-aws
+    script: tasks/bin/run_external_test $TEST_GEM rake spec
+    rvm: 2.2
+# requires vagrant
+#  - env: TEST_GEM=chef-rewind
+#    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+#    bundler_args: --without development
+#    rvm: 2.2
+  - env:
+      TEST_GEM: chef-sugar
+    script: tasks/bin/run_external_test $TEST_GEM rake
+    rvm: 2.2
+  - env:
+      - TEST_GEM: chef-zero
+    script: tasks/bin/run_external_test $TEST_GEM rake spec cheffs
+    rvm: 2.2
+  - env:
+      TEST_GEM: cheffish
+    script: tasks/bin/run_external_test $TEST_GEM rake spec
+    rvm: 2.2
+  - env:
+      TEST_GEM: chefspec
+    # The chefspec tests + bundler cache + "gem update --system" interact badly :/
+    # (Cucumber doesn't start.)
+    before_install:
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+      - bundle config --local without server:docgen:maintenance:omnibus_package:development:ruby_prof:pry
+    script: tasks/bin/run_external_test $TEST_GEM rake
+    rvm: 2.2.0
+  - env:
+      TEST_GEM: foodcritic
+    script: tasks/bin/run_external_test $TEST_GEM rake test
+    rvm: 2.2
+  - env:
+      TEST_GEM: halite
+    script: tasks/bin/run_external_test $TEST_GEM rake spec
+    rvm: 2.2
+  - env:
+      TEST_GEM: knife-windows
+    script: tasks/bin/run_external_test $TEST_GEM rake unit_spec
+    rvm: 2.2
+  - env:
+      TEST_GEM: poise
+    script: tasks/bin/run_external_test $TEST_GEM rake spec
+    rvm: 2.2
+  #
   ### START TEST KITCHEN ONLY ###
+  #
   - rvm: 2.2
     gemfile: kitchen-tests/Gemfile
     before_install:
-    - gem update --system
-    - gem install bundler
-    - echo -n $DO_KEY_CHUNK_{0..30} >> ~/.ssh/id_aws.base64
-    - cat ~/.ssh/id_aws.base64 | tr -d ' ' | base64 --decode > ~/.ssh/id_aws.pem
+      - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+      - echo -n $DO_KEY_CHUNK_{0..30} >> ~/.ssh/id_aws.base64
+      - cat ~/.ssh/id_aws.base64 | tr -d ' ' | base64 --decode > ~/.ssh/id_aws.pem
     before_script:
-    - cd kitchen-tests
+      - cd kitchen-tests
     script:
-# FIXME: we should fix centos-6 against AWS and then enable it here
-    - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen test ubuntu; fi
+      # FIXME: we should fix centos-6 against AWS and then enable it here
+      - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen test ubuntu; fi
     after_failure:
-    - cat .kitchen/logs/kitchen.log
+      - cat .kitchen/logs/kitchen.log
     after_script:
-    - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen destroy ubuntu; fi
+      - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen destroy ubuntu; fi
     env:
-    - KITCHEN_YAML=.kitchen.travis.yml
-    - EC2_SSH_KEY_PATH=~/.ssh/id_aws.pem
-    - secure: VAauyVnAMWhqvnhJOJ/tCDn3XAdWqzbWiDVQPNBkqtm2SBIvhmZl2hlrusvw6YLU31Prdf8fSFhOSysVQQs/rJYrmD/1BfV79p6M7cGXYZ0nGWwldF81N296lyFoZLyrqtmG4G0cx3Pw2ojADFgFe+B5eTGlqJFD+z371g4RF/Y=
-    - secure: A+qtUF2LPJGkUAdvt04AwZMt69rzaeTyR0/1XEOAuntBKKXSCzddUzr5ePDc9QQ/57AWywKxhVLpnxk3QzKN7r7zerDxyIJBgklNDpNAKkeQjP3T6FpaKEIN9ROcpPtsM6FJ5Agb+bEQoRJF7s+ampO3wLV3XpTiWNuWkcAhv9A=
-    - secure: J8JIg15trrPgc8X/1DsaUWDQCdDWTvN/AorXzZ/ReudHS6G/KpoynZ5lTmKjlgFiFNE/TGMDv486pStGtIcarTKTuIEmNADdEWlAVH7bxclpayMjtppVuapRCkZWccs5gz5CJyhX7yhQCFTYoqVox9Y4qHGCluF3oqCcPRtCOOw=
-    - secure: NJYn0blTMwIoFxZlsoMWK8hPO/fi45rgWOqEImnjvSRk++5WL+GgjLBgLvEi7wCMkBijhIMWtnva60ojd4MrxeS7evrmGRjJKXnPuSKEsrGbArZPskBjCAcg+3PlnQQUkFf6hvbGD3HZlJtcbs4hrx8tbDT2Ie7bmQfqpsawKY4=
-    - secure: FipoX1VzZkzPUP6Gxd05DEva7cX6xKK2Wdq+Y18nNkyW2afPLXCNl5kCsNrgvbqAzbjKaP2M8+b0zwKjrFzNebqmmx1RRfZUJWUkNRF1EgE+tHytmMZW6tNcQlTlvA0KqXi4Dt6SIQ0l/DhwwNKZ80jmpiyYi/ErxIXzbVgVtYA=
-    - secure: T2MbE9twIkdaor796/lDioCgb2+FP3G8lXq+lIqnjaL22WMP8yKtkjNo8ggSlvQZE7MAQHqi5LISw5MU2MI6ImTU50/pgdWreM5Cx37WWYqntcbJ0Sz7v396KGJzeqbDql1fGolHDlykfi+OJzzbIGC8cjz7iAD2RUZU95wEC5s=
-    - secure: hWEQInvuanQavFCE3m6/q9BjNEFZQmLc94EWnBKTMiwUAdYgQQMLohN7K1Gc8irxYKp86F+P+XWE4lfDZNK3sqmxyk51TtT2EfmKWs+jSLq4+NBYQwXCpRELC5Irpm0GRCYthhsQSuarpVWss/0s0o7iJQaHxrSPcQiwDouIpwU=
-    - secure: OllJUaR/WUu+H0FIjU7vQxU10JT4d+/FZuTqnX6ZTcXN3dXCirnabYp/j+r5OBY3QeOojOyzGfHUWYEUGH/PTxcxYjrohtFTWht9N9x+SxfX2fLqieH/kRKyDmIidsY8qKChf/LD9f+SwpXRXND/PctKhNR4C5BH57fGUEqE9FU=
-    - secure: KgKnGtM4e+cVYfLn78eTWJ1q4ORv128abB72QBc/xiSh0rvxSIojVKZCXmRetQPXIl7NoIzU2IyjR1ABEZ+vA83PayTEsOr2KDRDgolSIgZSSiDFt4U2phQsxl4fX7wFv/jWlbxM2fysKBSIRAF57CwBjGhLjmpUO+5PdoR7N2s=
-    - secure: IgOx4STauKnJWENQGcn2iBp32XcNd2anNR0Fua0ugjudu1+CV+IxcIhI8ohOfZEXyVK4MGTF8uXWrYtoiwyExG4mTXqpRWJCgIkncqiWlfT+8BoAGWxCQhUYub3MaNZANPgebKPJhTPQ8OwNz09gPMNkewRfAqNF05eb8FU2kGA=
-    - secure: CPXP6g3c1FH4Zm4U19XaPvq9nnyNsQCXRkxiPcGqsJZsGG2QMgzPQyjiAuPqnWxxZHit/6NgzUszJC+skSgcTzDTeD6rOA0Wcxtbr/Un4RRxRnTcRc6mSEZqSu9RbAZMYur/mSQ9HDHnjFe1ok85He4s9jM1iFdgjtg1ToelEmA=
-    - secure: fp9pzNe09PIyZ/8NjbMPGW1zdG3Q/KhJ+stUKqA+FRopAMX/Hh24gFIVJhFOmfr4Vhn0J8sF7RsFaR1mdzcPewliOzKxknWhGEGMcG9LFCZcv+vVK0Fxs4nUzCRtaXUt08FpsRofG0iBvfapZ7YBhK7lslqGVI+fxCd3ZXmayG8=
-    - secure: NT/6qcecxmuKYOnw1Atc6hsyJlfB6XI2Z1lg7dE0PhlEVW2EpkckHjAc+5hgg8Zt7TifYm2qDQWJwblwPP0mMj3ra4ZIMaZAiG2kzQoZ5kthqwjAV9fatZvrDXi+jd9wBF2hPyiCokAQiTLmKTYjzY2FBqPO3VDLWdf9qZqRmxw=
-    - secure: MjIWyfquKANh/YeoyHGksdvAUQ4wc2tBCQmq1QcRhKwb7Sy6wcDk1nujDmnGE7HFpZUS6CyoZF7AMzJGFkCzrChpsLQYUP4hc7VjkXOLzi90vJUl+ANq7KPOmxC0MjKpgeHqCysRbTYbUsnJZfbbZbIZjCAjY0YCY2pGniXpvQc=
-    - secure: AsZLOiFrHkGsY6jp2ShI5kYz78V6PEUyizgtPCWTgevTRGWpdCq9csIEoqUBY+vMUxmQPC6IY4fwHkrRCbv/rJyhwRl/Rnwa3aw8bdD+YD17IxnpXKGXXUyXdTZmF7HzAkVgStehL+qWZ3x9TBdExIV37KVgrVw/b+S0QqBUlQo=
-    - secure: jwEnSquLreMM1M6N3gGpgTGHd8VtjBUTLDdkrokhiH1jHLpz7Hmr6xeajhZws+2sLtLiB7hYi6WsZBE5VcymBoObh9MeodO9Ve5/1z06lFmx1DyYV6euyo9WUkU2WpoVfu8k7O+eAvyrXXZVqm8Oz1p7Isb6Bh5+fJH2H8rhed4=
-    - secure: HOAK620U6mlS11XK+JtXTBk26Tt2vWO4shA/6Zit/y0/kAz7JnbXtup7FSysXliBoSv4YsxA6IbgZ8V0tuIXj+q7EcqtHMmQhqzMJG5jRKVhtGiFIhDmwmxJvdfIvwtZOO3mMk0OspLz24sWp8wCciYZMPj0hZJR04R9aWEO3cE=
-    - secure: DfTRP74UWWxA460XfLoJFgRLwoKbHWNIueL6qr982AnuAxeZFofsxCqxSxcSJmu67TxuPc+b201+BmanHKYmSauGS31t0F4QXk7lCTaT/x38mAPsWvMFkY8HEl56JhmzEp2hAKDB/t0/HItwmvxT1vd5WvNRSSojEVzChftV/zE=
-    - secure: JoCWsJzTgj+epgzmgbvV7/bdAPHwUGXZA7Jdvv9vIJ5lCo6h9WwCw6/KCvH+bHtrT/RfZmUmxouCxJCLKwts1ZrMmedTIXpMrQJo/YgWRp7ziFnLyZ8jG8bD7rep3ngq1x/cRGc3cZvYN6IK3GS6C27OviYLFsTw74AUnWTaFSo=
-    - secure: iXfl0WnAnfKurZUrMeV1yOoFiiZ+MKx/Zj6ZVP2++A9EOxxIxb/fS/gIOzSjBQwzrR+fJVHIlX0g42CiBKDQWUvIl5I8kZCVIP6AHa1jyzlmZE9lqSlojz3k5RPS7pW6nIX+z1NHMvtb3e5xeLv8y4J5kwZErqZ+YDJmBRtPxPU=
-    - secure: RhAW5kABDPB3GWKD+NCg05Kcd92F/+kg+0icXXN166DWQYUut3MLrSY80xNzkz5nXTI9EFU4fUqlKLDiF/kelr0Zp/zpCQAB54o4cu5FkZz0Bgs9k7yUdCRyz6Vt2ChV5cYI4JTn9bMaeXEaGlOjP1iE51rYT6KO6kKlwsEnjUc=
-    - secure: jy/3fC+UtrDcE/X6/IxkyT2SrYMKkiEMP1ht4d5mxvNA0Xxn43E16c6FNP0JWPpWRGRIP38vnQRB4yOPU9BXvRmmswVL9Ge4e/6flJvKwD5Rlqb2dfaGaHRYV9v8Nkdzl2FvZ9eBH5KHxgG19gCG6L3RXP/+zYwrr4AQdm0fpfw=
-    - secure: RYEwBWYVXRTEdUWhQxdWXo6tldlVx8pha9zB0rgafcUQxaatAefnRc4X4HXTQnqr2n9TZ2TQGpM8vte/wr6Pjc85VZbimWGzgrvn0kg4MwPR8ZYiEM5qQ/pUpj4+93rpA91PhCGvZoZTqOrXHm4kMPuKro5I6qA4BFUXuANeC/s=
-    - secure: gHSicpqkqcZT04QurSgszrAiI6HOCw1DBlfIIi9KAJj7mG5GijD/4AQ6HCmcRMbCDJ0nUuvm/kckASnRtF5+3xvIJnuoyyEfCZWxt1lhK2UbS87VU+pVdws/VzwpisXuKsh3H0uT8DDVkWPH/ZWDgfVa74eYDEHiQFjo+2xx5ZA=
-    - secure: Q42bco3JXEpyVbL2akiOsaCHnAagAFIb3TF6H5qJfaLLqmGs/XrrgxliNaVMfWVSwPT2wpQvg9UGF9x37No9bZBv33DgYcWExmXb/lvGPpkctX37+FTMzECQHxOuUbYPQA7ZEuJ4AA7bwgpMISUeSyz5XXz44KcXIrZK2GWH+X4=
-    - secure: hugd8NVukJc3redDvlOt6zhaqa63XLNMp/eIIlNllW8VfQ6CJ1P7KJPwgxH24sDyrw7rLzOkBl6R4kaVWsCLCFp+NE6yFFHl9wDkSdLC1OX1DMrJnDsogwUqqe+jX8dxePSy26MSTfG8eo9/NxN9uXr+tKaHoi6G7BRXDHtQ8dQ=
-    - secure: TRkW9pIuIYHXJmPlDYoddxIp2M2W2f7qBGNJKEMB5xrOezES7w9XTg2eQXrD8jBO+fUUmMnAaDAXZuU58nMysPXx3vhtZKncg8w5CyuXJk2P8nkdPh0u5nmRhEpWrLKtLwJrX48xmJhNQvQqDAyL5c9WUzlWJ4WJFgoP5IDWmLc=
-    - secure: QHuMdtFCvttiIOx6iS+lH4bKXZMwsgVQ6FPsUW5zJ7uw6mAEWKEil9xNk4aYV9FywinwUs4fnFlnIW/Gj1gLkUjm4DtxdmRZIlRXIbgsNch6H916TCPg4Q2oPsW2nVdXPjW/2jhkfLUiSnuhL+ylami1NF8Up7vokXknh/jFNZU=
-    - secure: GTfrUVmMQSxho3Ia4Y1ONqKvVMD34GHF2/TJb8UdQV7iH+nVxVXpy3nWaCXa9ri7lRzMefkoVLy0gKK13YoVd7w3d2S3/IfNakC85XfN6VuOzK/FDkA0WoPrgKjcQ64I+3dQ6cgrMWWTieKwRZy+Ve24iRbnN055Hk+VRMu6OGw=
-    - secure: SOMYGVfHLkHsH6koxpw68YQ4ydEo6YXPhHbrYGQbehUbFa6+OZzBcAJRJbKjyhD2AZRvNr2jB8XnjYKvVyDGQRpkWhGYZ7CpHqINpDsqKBsbiMe3/+KmKQqS+UKxNGefquoOvyQ1N8Xy77dkWYokRtGMEuR12RkZLonxiDW8Qyg=
-    - secure: bSsDg+dJnPFdFiC/tbb61HdLh/Q0z2RVVAReT1wvV1BN4fN4NydvkUGbQmyFNyyunLulEs+X0oFma9L0497nUlTnan8UOg9sIleTSybPX6E9xSKKCItH1GgDw8bM9Igez5OOrrePBD3altVrH+FmGx0dlTQgM/KZMN50BJ79cXw=
+      - KITCHEN_YAML=.kitchen.travis.yml
+      - EC2_SSH_KEY_PATH=~/.ssh/id_aws.pem
+      - secure: VAauyVnAMWhqvnhJOJ/tCDn3XAdWqzbWiDVQPNBkqtm2SBIvhmZl2hlrusvw6YLU31Prdf8fSFhOSysVQQs/rJYrmD/1BfV79p6M7cGXYZ0nGWwldF81N296lyFoZLyrqtmG4G0cx3Pw2ojADFgFe+B5eTGlqJFD+z371g4RF/Y=
+      - secure: A+qtUF2LPJGkUAdvt04AwZMt69rzaeTyR0/1XEOAuntBKKXSCzddUzr5ePDc9QQ/57AWywKxhVLpnxk3QzKN7r7zerDxyIJBgklNDpNAKkeQjP3T6FpaKEIN9ROcpPtsM6FJ5Agb+bEQoRJF7s+ampO3wLV3XpTiWNuWkcAhv9A=
+      - secure: J8JIg15trrPgc8X/1DsaUWDQCdDWTvN/AorXzZ/ReudHS6G/KpoynZ5lTmKjlgFiFNE/TGMDv486pStGtIcarTKTuIEmNADdEWlAVH7bxclpayMjtppVuapRCkZWccs5gz5CJyhX7yhQCFTYoqVox9Y4qHGCluF3oqCcPRtCOOw=
+      - secure: NJYn0blTMwIoFxZlsoMWK8hPO/fi45rgWOqEImnjvSRk++5WL+GgjLBgLvEi7wCMkBijhIMWtnva60ojd4MrxeS7evrmGRjJKXnPuSKEsrGbArZPskBjCAcg+3PlnQQUkFf6hvbGD3HZlJtcbs4hrx8tbDT2Ie7bmQfqpsawKY4=
+      - secure: FipoX1VzZkzPUP6Gxd05DEva7cX6xKK2Wdq+Y18nNkyW2afPLXCNl5kCsNrgvbqAzbjKaP2M8+b0zwKjrFzNebqmmx1RRfZUJWUkNRF1EgE+tHytmMZW6tNcQlTlvA0KqXi4Dt6SIQ0l/DhwwNKZ80jmpiyYi/ErxIXzbVgVtYA=
+      - secure: T2MbE9twIkdaor796/lDioCgb2+FP3G8lXq+lIqnjaL22WMP8yKtkjNo8ggSlvQZE7MAQHqi5LISw5MU2MI6ImTU50/pgdWreM5Cx37WWYqntcbJ0Sz7v396KGJzeqbDql1fGolHDlykfi+OJzzbIGC8cjz7iAD2RUZU95wEC5s=
+      - secure: hWEQInvuanQavFCE3m6/q9BjNEFZQmLc94EWnBKTMiwUAdYgQQMLohN7K1Gc8irxYKp86F+P+XWE4lfDZNK3sqmxyk51TtT2EfmKWs+jSLq4+NBYQwXCpRELC5Irpm0GRCYthhsQSuarpVWss/0s0o7iJQaHxrSPcQiwDouIpwU=
+      - secure: OllJUaR/WUu+H0FIjU7vQxU10JT4d+/FZuTqnX6ZTcXN3dXCirnabYp/j+r5OBY3QeOojOyzGfHUWYEUGH/PTxcxYjrohtFTWht9N9x+SxfX2fLqieH/kRKyDmIidsY8qKChf/LD9f+SwpXRXND/PctKhNR4C5BH57fGUEqE9FU=
+      - secure: KgKnGtM4e+cVYfLn78eTWJ1q4ORv128abB72QBc/xiSh0rvxSIojVKZCXmRetQPXIl7NoIzU2IyjR1ABEZ+vA83PayTEsOr2KDRDgolSIgZSSiDFt4U2phQsxl4fX7wFv/jWlbxM2fysKBSIRAF57CwBjGhLjmpUO+5PdoR7N2s=
+      - secure: IgOx4STauKnJWENQGcn2iBp32XcNd2anNR0Fua0ugjudu1+CV+IxcIhI8ohOfZEXyVK4MGTF8uXWrYtoiwyExG4mTXqpRWJCgIkncqiWlfT+8BoAGWxCQhUYub3MaNZANPgebKPJhTPQ8OwNz09gPMNkewRfAqNF05eb8FU2kGA=
+      - secure: CPXP6g3c1FH4Zm4U19XaPvq9nnyNsQCXRkxiPcGqsJZsGG2QMgzPQyjiAuPqnWxxZHit/6NgzUszJC+skSgcTzDTeD6rOA0Wcxtbr/Un4RRxRnTcRc6mSEZqSu9RbAZMYur/mSQ9HDHnjFe1ok85He4s9jM1iFdgjtg1ToelEmA=
+      - secure: fp9pzNe09PIyZ/8NjbMPGW1zdG3Q/KhJ+stUKqA+FRopAMX/Hh24gFIVJhFOmfr4Vhn0J8sF7RsFaR1mdzcPewliOzKxknWhGEGMcG9LFCZcv+vVK0Fxs4nUzCRtaXUt08FpsRofG0iBvfapZ7YBhK7lslqGVI+fxCd3ZXmayG8=
+      - secure: NT/6qcecxmuKYOnw1Atc6hsyJlfB6XI2Z1lg7dE0PhlEVW2EpkckHjAc+5hgg8Zt7TifYm2qDQWJwblwPP0mMj3ra4ZIMaZAiG2kzQoZ5kthqwjAV9fatZvrDXi+jd9wBF2hPyiCokAQiTLmKTYjzY2FBqPO3VDLWdf9qZqRmxw=
+      - secure: MjIWyfquKANh/YeoyHGksdvAUQ4wc2tBCQmq1QcRhKwb7Sy6wcDk1nujDmnGE7HFpZUS6CyoZF7AMzJGFkCzrChpsLQYUP4hc7VjkXOLzi90vJUl+ANq7KPOmxC0MjKpgeHqCysRbTYbUsnJZfbbZbIZjCAjY0YCY2pGniXpvQc=
+      - secure: AsZLOiFrHkGsY6jp2ShI5kYz78V6PEUyizgtPCWTgevTRGWpdCq9csIEoqUBY+vMUxmQPC6IY4fwHkrRCbv/rJyhwRl/Rnwa3aw8bdD+YD17IxnpXKGXXUyXdTZmF7HzAkVgStehL+qWZ3x9TBdExIV37KVgrVw/b+S0QqBUlQo=
+      - secure: jwEnSquLreMM1M6N3gGpgTGHd8VtjBUTLDdkrokhiH1jHLpz7Hmr6xeajhZws+2sLtLiB7hYi6WsZBE5VcymBoObh9MeodO9Ve5/1z06lFmx1DyYV6euyo9WUkU2WpoVfu8k7O+eAvyrXXZVqm8Oz1p7Isb6Bh5+fJH2H8rhed4=
+      - secure: HOAK620U6mlS11XK+JtXTBk26Tt2vWO4shA/6Zit/y0/kAz7JnbXtup7FSysXliBoSv4YsxA6IbgZ8V0tuIXj+q7EcqtHMmQhqzMJG5jRKVhtGiFIhDmwmxJvdfIvwtZOO3mMk0OspLz24sWp8wCciYZMPj0hZJR04R9aWEO3cE=
+      - secure: DfTRP74UWWxA460XfLoJFgRLwoKbHWNIueL6qr982AnuAxeZFofsxCqxSxcSJmu67TxuPc+b201+BmanHKYmSauGS31t0F4QXk7lCTaT/x38mAPsWvMFkY8HEl56JhmzEp2hAKDB/t0/HItwmvxT1vd5WvNRSSojEVzChftV/zE=
+      - secure: JoCWsJzTgj+epgzmgbvV7/bdAPHwUGXZA7Jdvv9vIJ5lCo6h9WwCw6/KCvH+bHtrT/RfZmUmxouCxJCLKwts1ZrMmedTIXpMrQJo/YgWRp7ziFnLyZ8jG8bD7rep3ngq1x/cRGc3cZvYN6IK3GS6C27OviYLFsTw74AUnWTaFSo=
+      - secure: iXfl0WnAnfKurZUrMeV1yOoFiiZ+MKx/Zj6ZVP2++A9EOxxIxb/fS/gIOzSjBQwzrR+fJVHIlX0g42CiBKDQWUvIl5I8kZCVIP6AHa1jyzlmZE9lqSlojz3k5RPS7pW6nIX+z1NHMvtb3e5xeLv8y4J5kwZErqZ+YDJmBRtPxPU=
+      - secure: RhAW5kABDPB3GWKD+NCg05Kcd92F/+kg+0icXXN166DWQYUut3MLrSY80xNzkz5nXTI9EFU4fUqlKLDiF/kelr0Zp/zpCQAB54o4cu5FkZz0Bgs9k7yUdCRyz6Vt2ChV5cYI4JTn9bMaeXEaGlOjP1iE51rYT6KO6kKlwsEnjUc=
+      - secure: jy/3fC+UtrDcE/X6/IxkyT2SrYMKkiEMP1ht4d5mxvNA0Xxn43E16c6FNP0JWPpWRGRIP38vnQRB4yOPU9BXvRmmswVL9Ge4e/6flJvKwD5Rlqb2dfaGaHRYV9v8Nkdzl2FvZ9eBH5KHxgG19gCG6L3RXP/+zYwrr4AQdm0fpfw=
+      - secure: RYEwBWYVXRTEdUWhQxdWXo6tldlVx8pha9zB0rgafcUQxaatAefnRc4X4HXTQnqr2n9TZ2TQGpM8vte/wr6Pjc85VZbimWGzgrvn0kg4MwPR8ZYiEM5qQ/pUpj4+93rpA91PhCGvZoZTqOrXHm4kMPuKro5I6qA4BFUXuANeC/s=
+      - secure: gHSicpqkqcZT04QurSgszrAiI6HOCw1DBlfIIi9KAJj7mG5GijD/4AQ6HCmcRMbCDJ0nUuvm/kckASnRtF5+3xvIJnuoyyEfCZWxt1lhK2UbS87VU+pVdws/VzwpisXuKsh3H0uT8DDVkWPH/ZWDgfVa74eYDEHiQFjo+2xx5ZA=
+      - secure: Q42bco3JXEpyVbL2akiOsaCHnAagAFIb3TF6H5qJfaLLqmGs/XrrgxliNaVMfWVSwPT2wpQvg9UGF9x37No9bZBv33DgYcWExmXb/lvGPpkctX37+FTMzECQHxOuUbYPQA7ZEuJ4AA7bwgpMISUeSyz5XXz44KcXIrZK2GWH+X4=
+      - secure: hugd8NVukJc3redDvlOt6zhaqa63XLNMp/eIIlNllW8VfQ6CJ1P7KJPwgxH24sDyrw7rLzOkBl6R4kaVWsCLCFp+NE6yFFHl9wDkSdLC1OX1DMrJnDsogwUqqe+jX8dxePSy26MSTfG8eo9/NxN9uXr+tKaHoi6G7BRXDHtQ8dQ=
+      - secure: TRkW9pIuIYHXJmPlDYoddxIp2M2W2f7qBGNJKEMB5xrOezES7w9XTg2eQXrD8jBO+fUUmMnAaDAXZuU58nMysPXx3vhtZKncg8w5CyuXJk2P8nkdPh0u5nmRhEpWrLKtLwJrX48xmJhNQvQqDAyL5c9WUzlWJ4WJFgoP5IDWmLc=
+      - secure: QHuMdtFCvttiIOx6iS+lH4bKXZMwsgVQ6FPsUW5zJ7uw6mAEWKEil9xNk4aYV9FywinwUs4fnFlnIW/Gj1gLkUjm4DtxdmRZIlRXIbgsNch6H916TCPg4Q2oPsW2nVdXPjW/2jhkfLUiSnuhL+ylami1NF8Up7vokXknh/jFNZU=
+      - secure: GTfrUVmMQSxho3Ia4Y1ONqKvVMD34GHF2/TJb8UdQV7iH+nVxVXpy3nWaCXa9ri7lRzMefkoVLy0gKK13YoVd7w3d2S3/IfNakC85XfN6VuOzK/FDkA0WoPrgKjcQ64I+3dQ6cgrMWWTieKwRZy+Ve24iRbnN055Hk+VRMu6OGw=
+      - secure: SOMYGVfHLkHsH6koxpw68YQ4ydEo6YXPhHbrYGQbehUbFa6+OZzBcAJRJbKjyhD2AZRvNr2jB8XnjYKvVyDGQRpkWhGYZ7CpHqINpDsqKBsbiMe3/+KmKQqS+UKxNGefquoOvyQ1N8Xy77dkWYokRtGMEuR12RkZLonxiDW8Qyg=
+      - secure: bSsDg+dJnPFdFiC/tbb61HdLh/Q0z2RVVAReT1wvV1BN4fN4NydvkUGbQmyFNyyunLulEs+X0oFma9L0497nUlTnan8UOg9sIleTSybPX6E9xSKKCItH1GgDw8bM9Igez5OOrrePBD3altVrH+FmGx0dlTQgM/KZMN50BJ79cXw=
     ### END TEST KITCHEN ONLY ###
   - rvm: 2.2
     sudo: required
     dist: trusty
     before_install:
-      - gem update --system
-      - gem install bundler
+      - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
       - sudo apt-get update
       - sudo apt-get -y install squid3 git curl
     env:
@@ -149,9 +167,6 @@ matrix:
       - sudo cat /var/log/squid3/access.log
 
   allow_failures:
-    - rvm: 2.2
-      env: "GEMFILE_MOD=\"gem 'poise', github: 'poise/poise'\""
-      script: bundle exec rake poise_spec
     - rvm: 2.3.0
     - rvm: rbx
 
diff --git a/Gemfile b/Gemfile
index e39a50a586..d80f33f2ad 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,12 +1,51 @@
-source "https://rubygems.org"
-gemspec name: "chef"
+# This buys us the ability to be included in other Gemfiles
+require_relative "tasks/gemfile_util"
+extend GemfileUtil
 
-gem "activesupport", "< 4.0.0", group: :compat_testing, platform: "ruby"
+source "https://rubygems.org"
 
-gem "chef-config", path: "chef-config" if File.exist?(File.expand_path("../chef-config", __FILE__))
+# Pick the gemspec for our platform
+gemspec_name = "chef"
+Dir.glob("chef-*.gemspec").each do |gemspec_filename|
+  gemspec_filename =~ /^chef-(.+).gemspec/
+  gemspec_platform = $1
+  if Gem::Platform.match(Gem::Platform.new(gemspec_platform))
+    Bundler.ui.info "Using gemspec #{gemspec_filename} for current platform."
+    gemspec_name = "chef-#{gemspec_platform}"
+  end
+end
+gemspec name: gemspec_name
 
+gem "activesupport", "< 4.0.0", group: :compat_testing, platform: "ruby"
+gem "chef-config", path: File.expand_path("../chef-config", __FILE__) if File.exist?(File.expand_path("../chef-config", __FILE__))
 # Ensure that we can always install rake, regardless of gem groups
 gem "rake"
+gem "bundler"
+gem "cheffish"
+
+group(:omnibus_package) do
+  gem "appbundler"
+  gem "rb-readline"
+  gem "nokogiri"
+end
+group(:omnibus_package, :pry) do
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "pry-stack_explorer"
+end
+# These are used for external tests
+group(:integration) do
+  gem "chef-provisioning"
+  gem "chef-provisioning-aws"
+  gem "chef-rewind"
+  gem "chef-sugar"
+  gem "chefspec"
+  gem "halite"
+  gem "poise"
+  gem "knife-windows"
+  gem "foodcritic"
+end
 
 group(:docgen) do
   gem "yard"
@@ -20,26 +59,27 @@ group(:maintenance) do
   gem "netrc"
 end
 
-group(:pry) do
-  gem "pry"
-  gem "pry-byebug"
-  gem "pry-stack_explorer"
-end
-
-group(:ruby_prof) do
+# Everything except AIX
+group(:linux, :bsd, :mac_os_x, :solaris, :windows) do
   # may need to disable this in insolation on fussy builds like AIX, RHEL4, etc
   gem "ruby-prof"
 end
+# Everything except AIX and Windows
+group(:linux, :bsd, :mac_os_x, :solaris) do
+  gem "ruby-shadow"
+end
 
 group(:development, :test) do
   gem "simplecov"
-  gem "rack", "~> 1.5.1"
+  gem "rack"
 
   # for testing new chefstyle rules
   # gem 'chefstyle', github: 'chef/chefstyle'
   gem "chefstyle", git: "https://github.com/chef/chefstyle.git", branch: "master"
+end
 
-  gem "ruby-shadow", platforms: :ruby unless RUBY_PLATFORM.downcase =~ /(aix|cygwin)/
+group(:changelog) do
+  gem "github_changelog_generator", "1.11.3"
 end
 
 group(:travis) do
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000000..1256976775
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,449 @@
+GIT
+  remote: https://github.com/chef/chefstyle.git
+  revision: cc37808b7849fdcf49f04011626143940f83fe92
+  branch: master
+  specs:
+    chefstyle (0.3.1)
+      rubocop (= 0.39.0)
+
+GIT
+  remote: https://github.com/rubysec/bundler-audit.git
+  revision: 4e32fca89d75f0e249671431ff38aadc02bfb28b
+  ref: 4e32fca
+  specs:
+    bundler-audit (0.4.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
+
+PATH
+  remote: .
+  specs:
+    chef (12.10.6)
+      bundler (>= 1.10)
+      chef-config (= 12.10.6)
+      chef-zero (~> 4.5)
+      diff-lcs (~> 1.2, >= 1.2.4)
+      erubis (~> 2.7)
+      ffi-yajl (~> 2.2)
+      highline (~> 1.6, >= 1.6.9)
+      mixlib-authentication (~> 1.4)
+      mixlib-cli (~> 1.4)
+      mixlib-log (~> 1.3)
+      mixlib-shellout (~> 2.0)
+      net-sftp (~> 2.1, >= 2.1.2)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-multi (~> 1.1)
+      ohai (>= 8.6.0.alpha.1, < 9)
+      plist (~> 3.2)
+      proxifier (~> 1.0)
+      rspec-core (~> 3.4)
+      rspec-expectations (~> 3.4)
+      rspec-mocks (~> 3.4)
+      rspec_junit_formatter (~> 0.2.0)
+      serverspec (~> 2.7)
+      specinfra (~> 2.10)
+      syslog-logger (~> 1.6)
+      uuidtools (~> 2.1.5)
+    chef (12.10.6-universal-mingw32)
+      bundler (>= 1.10)
+      chef-config (= 12.10.6)
+      chef-zero (~> 4.5)
+      diff-lcs (~> 1.2, >= 1.2.4)
+      erubis (~> 2.7)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      highline (~> 1.6, >= 1.6.9)
+      mixlib-authentication (~> 1.4)
+      mixlib-cli (~> 1.4)
+      mixlib-log (~> 1.3)
+      mixlib-shellout (~> 2.0)
+      net-sftp (~> 2.1, >= 2.1.2)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-multi (~> 1.1)
+      ohai (>= 8.6.0.alpha.1, < 9)
+      plist (~> 3.2)
+      proxifier (~> 1.0)
+      rspec-core (~> 3.4)
+      rspec-expectations (~> 3.4)
+      rspec-mocks (~> 3.4)
+      rspec_junit_formatter (~> 0.2.0)
+      serverspec (~> 2.7)
+      specinfra (~> 2.10)
+      syslog-logger (~> 1.6)
+      uuidtools (~> 2.1.5)
+      win32-api (~> 1.5.3)
+      win32-dir (~> 0.5.0)
+      win32-event (~> 0.6.1)
+      win32-eventlog (= 0.6.3)
+      win32-mmap (~> 0.4.1)
+      win32-mutex (~> 0.4.2)
+      win32-process (~> 0.8.2)
+      win32-service (~> 0.8.7)
+      windows-api (~> 0.4.4)
+      wmi-lite (~> 1.0)
+
+PATH
+  remote: chef-config
+  specs:
+    chef-config (12.10.6)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (3.2.22.2)
+      i18n (~> 0.6, >= 0.6.4)
+      multi_json (~> 1.0)
+    addressable (2.4.0)
+    appbundler (0.9.0)
+      mixlib-cli (~> 1.4)
+    artifactory (2.3.2)
+    ast (2.2.0)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    aws-sdk-v1 (1.66.0)
+      json (~> 1.4)
+      nokogiri (>= 1.4.4)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.2)
+    byebug (8.2.4)
+    chef-api (0.5.0)
+      logify (~> 0.1)
+      mime-types
+    chef-provisioning (1.7.0)
+      cheffish (>= 1.3.1, < 3.0)
+      inifile (>= 2.0.2)
+      mixlib-install (~> 1.0)
+      net-scp (~> 1.0)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-gateway (~> 1.2.0)
+      winrm (~> 1.3)
+    chef-provisioning-aws (1.9.0)
+      aws-sdk (>= 2.1.26, < 3.0)
+      aws-sdk-v1 (>= 1.59.0)
+      chef-provisioning (~> 1.4)
+      retryable (~> 2.0, >= 2.0.1)
+      ubuntu_ami (~> 0.4, >= 0.4.1)
+    chef-rewind (0.0.9)
+    chef-sugar (3.3.0)
+    chef-zero (4.6.1)
+      ffi-yajl (~> 2.2)
+      hashie (>= 2.0, < 4.0)
+      mixlib-log (~> 1.3)
+      rack
+      uuidtools (~> 2.1)
+    cheffish (2.0.4)
+      chef-zero (~> 4.3)
+      compat_resource
+    chefspec (4.6.1)
+      chef (>= 11.14)
+      fauxhai (~> 3.2)
+      rspec (~> 3.0)
+    childprocess (0.5.9)
+      ffi (~> 1.0, >= 1.0.11)
+    coderay (1.1.1)
+    colorize (0.7.7)
+    compat_resource (12.9.1)
+    cucumber-core (1.4.0)
+      gherkin (~> 3.2.0)
+    debug_inspector (0.0.2)
+    descendants_tracker (0.0.4)
+      thread_safe (~> 0.3, >= 0.3.1)
+    diff-lcs (1.2.5)
+    docile (1.1.5)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    fauxhai (3.3.0)
+      net-ssh
+    ffi (1.9.10)
+    ffi (1.9.10-x86-mingw32)
+    ffi-yajl (2.2.3)
+      libyajl2 (~> 1.2)
+    foodcritic (6.1.1)
+      cucumber-core (>= 1.3)
+      erubis
+      nokogiri (>= 1.5, < 2.0)
+      rake
+      rufus-lru (~> 1.0)
+      treetop (~> 1.4)
+      yajl-ruby (~> 1.1)
+    fuzzyurl (0.8.0)
+    gherkin (3.2.0)
+    github_api (0.13.1)
+      addressable (~> 2.4.0)
+      descendants_tracker (~> 0.0.4)
+      faraday (~> 0.8, < 0.10)
+      hashie (>= 3.4)
+      multi_json (>= 1.7.5, < 2.0)
+      oauth2
+    github_changelog_generator (1.11.3)
+      bundler (>= 1.7)
+      colorize (~> 0.7)
+      github_api (~> 0.12)
+      overcommit (>= 0.31)
+      rake (>= 10.0)
+      rspec (>= 3.2)
+      rubocop (>= 0.31)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    halite (1.2.1)
+      bundler
+      chef (~> 12.0)
+      stove (~> 3.2, >= 3.2.3)
+      thor
+    hashie (3.4.3)
+    highline (1.7.8)
+    httpclient (2.7.1)
+    i18n (0.7.0)
+    inifile (3.0.0)
+    iniparse (1.4.2)
+    ipaddress (0.8.3)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    jwt (1.5.1)
+    knife-windows (1.4.0)
+      winrm (~> 1.7)
+    libyajl2 (1.2.0)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    logify (0.2.0)
+    method_source (0.8.2)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
+    mini_portile2 (2.0.0)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-cli (1.5.0)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.7)
+      artifactory
+      mixlib-shellout
+      mixlib-versioning
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-shellout (2.2.6-universal-mingw32)
+      win32-process (~> 0.8.2)
+      wmi-lite (~> 1.0)
+    mixlib-versioning (1.1.0)
+    multi_json (1.11.2)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-sftp (2.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    net-ssh-gateway (1.2.0)
+      net-ssh (>= 2.6.5)
+    net-ssh-multi (1.2.1)
+      net-ssh (>= 2.6.5)
+      net-ssh-gateway (>= 1.2.0)
+    net-telnet (0.1.1)
+    netrc (0.11.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    nokogiri (1.6.7.2-x86-mingw32)
+      mini_portile2 (~> 2.0.0.rc2)
+    nori (2.6.0)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    ohai (8.14.0)
+      chef-config (>= 12.5.0.alpha.1, < 13)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli
+      mixlib-config (~> 2.0)
+      mixlib-log
+      mixlib-shellout (~> 2.0)
+      plist (~> 3.1)
+      systemu (~> 2.6.4)
+      wmi-lite (~> 1.0)
+    overcommit (0.33.0)
+      childprocess (~> 0.5.8)
+      iniparse (~> 1.4)
+    parser (2.3.0.7)
+      ast (~> 2.2)
+    plist (3.2.0)
+    poise (2.7.0)
+      halite (~> 1.0)
+    polyglot (0.3.5)
+    powerpack (0.1.1)
+    proxifier (1.0.3)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-byebug (3.3.0)
+      byebug (~> 8.0)
+      pry (~> 0.10)
+    pry-remote (0.1.8)
+      pry (~> 0.9)
+      slop (~> 3.0)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    rack (1.6.4)
+    rainbow (2.1.0)
+    rake (11.1.2)
+    rb-readline (0.5.3)
+    retryable (2.0.3)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rspec_junit_formatter (0.2.3)
+      builder (< 4)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    rubocop (0.39.0)
+      parser (>= 2.3.0.7, < 3.0)
+      powerpack (~> 0.1)
+      rainbow (>= 1.99.1, < 3.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (~> 1.0, >= 1.0.1)
+    ruby-prof (0.15.9)
+    ruby-progressbar (1.7.5)
+    ruby-shadow (2.5.0)
+    rubyntlm (0.6.0)
+    rufus-lru (1.0.5)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    serverspec (2.31.1)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.53)
+    sfl (2.2)
+    simplecov (0.11.2)
+      docile (~> 1.1.0)
+      json (~> 1.8)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.0)
+    slop (3.6.0)
+    specinfra (2.56.1)
+      net-scp
+      net-ssh (>= 2.7, < 4.0)
+      net-telnet
+      sfl
+    stove (3.2.8)
+      chef-api (~> 0.5)
+      logify (~> 0.2)
+    syslog-logger (1.6.8)
+    systemu (2.6.5)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tomlrb (1.2.1)
+    treetop (1.6.5)
+      polyglot (~> 0.3)
+    ubuntu_ami (0.4.1)
+    unicode-display_width (1.0.3)
+    uuidtools (2.1.5)
+    win32-api (1.5.3-universal-mingw32)
+    win32-dir (0.5.1)
+      ffi (>= 1.0.0)
+    win32-event (0.6.3)
+      win32-ipc (>= 0.6.0)
+    win32-eventlog (0.6.3)
+      ffi
+    win32-ipc (0.6.6)
+      ffi
+    win32-mmap (0.4.2)
+      ffi
+    win32-mutex (0.4.3)
+      win32-ipc (>= 0.6.0)
+    win32-process (0.8.3)
+      ffi (>= 1.0.0)
+    win32-service (0.8.7)
+      ffi
+    windows-api (0.4.4)
+      win32-api (>= 1.4.5)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
+    wmi-lite (1.0.0)
+    yajl-ruby (1.2.1)
+    yard (0.8.7.6)
+
+PLATFORMS
+  ruby
+  x86-mingw32
+
+DEPENDENCIES
+  activesupport (< 4.0.0)
+  appbundler
+  bundler
+  bundler-audit!
+  chef!
+  chef-config!
+  chef-provisioning
+  chef-provisioning-aws
+  chef-rewind
+  chef-sugar
+  cheffish
+  chefspec
+  chefstyle!
+  foodcritic
+  github_changelog_generator (= 1.11.3)
+  halite
+  knife-windows
+  netrc
+  nokogiri
+  octokit
+  poise
+  pry
+  pry-byebug
+  pry-remote
+  pry-stack_explorer
+  rack
+  rake
+  rb-readline
+  ruby-prof
+  ruby-shadow
+  simplecov
+  tomlrb
+  yard
+
+BUNDLED WITH
+   1.11.2
diff --git a/README.md b/README.md
index 5ec4d509ec..4697e55190 100644
--- a/README.md
+++ b/README.md
@@ -116,6 +116,151 @@ tests in spec/functional/ and spec/unit/ respectively. These will be run on Ubun
 through Travis CI, and on Windows through AppVeyor. The status of these runs will
 be displayed with your pull request.
 
+## Building the Full Package
+
+To build chef as a standalone package (with ruby and all dependent libraries included in a .deb, .rpm, .pkg or .msi), we use the omnibus system. Go to the [omnibus README](omnibus/README.md) to find out how to build!
+
+## Updating Dependencies
+
+If you want to change our constraints (change which packages and versions we accept in the chef), there are several places to do so:
+
+* To add or remove a gem from chef, or update a gem version, edit [Gemfile](Gemfile).
+* To change the version of binary packages, edit [version_policy.rb](version_policy.rb).
+* To add new packages to chef, edit [omnibus/config/projects/chef.rb](omnibus/config/projects/chef.rb).
+
+Once you've made any changes you want, you have to update the lockfiles that actually drive the build:
+* To update chef's gem dependencies to the very latest versions available, run `rake bundle:update`.
+* To update chef's gem dependencies *conservatively* (changing as little as possible), run `rake bundle:install`.
+* To update specific gems only, run `rake bundle:update[gem1 gem2 ...]`
+* **`bundle update` and `bundle install` will *not* work, on purpose:** the rake task handles both the windows and non-windows lockfiles and updates them in sync.
+
+To perform a full update of all dependencies in chef (including binary packages, tests and build system dependencies), run `rake dependencies`. This will update the `Gemfile.lock`, `omnibus/Gemfile.lock`, `acceptance/Gemfile.lock`, `omnibus/Berksfile.lock`, and `omnibus_overrides.rb`.  It will also show you any outdated dependencies due to conflicting constraints. Some outdated dependencies are to be expected; it will inform you if any new ones appear that we don't know about, and tell you how to proceed.
+
+# How Chef Builds and Versions
+
+Chef is an amalgam of many components. These components update all the time, necessitating new builds. This is an overview of the process of versioning, building and releasing Chef.
+
+## Chef Packages
+
+Chef is distributed as packages for debian, rhel, ubuntu, windows and os/x. It includes a large number of components from various sources, and these are versioned and maintained separately from chef project, which bundles them all together conveniently for the user.
+
+These packages go through several milestones:
+- `master`: When code is checked in to master, the patch version of chef is bumped (e.g. 0.9.10 -> 0.9.11) and a build is kicked off automatically to create and test the packages in Chef's Jenkins cluster.
+- `unstable`: When a package is built, it enters the unstable channel. When all packages for all OS's have successfully built, the test phase is kicked off in Jenkins across all supported OS's. These builds are password-protected and generally only available to the test systems.
+- `current`: If the packages pass all the tests on all supported OS's, it is promoted as a unit to `current`, and is available via Chef's artifactory by running `curl https://omnitruck.chef.io/install.sh | sudo bash -s -- -c current -P chef`
+- `stable`: Periodically, Chef will pick a release to "bless" for folks who would like a slower update schedule than "every time a build passes the tests." When this happens, it is manually promoted to stable and an announcement is sent to the list. It can be reached at https://downloads.chef.io or installed using the `curl` command without specifying `-c current`. Packages in `stable` are no longer available in `current`.
+
+Additionally, periodically Chef will update the desired versions of chef components and check that in to `master`, triggering a new build with the updated components in it.
+
+## Automated Version Bumping
+
+Whenever a change is checked in to `master`, the patch version of `chef` is bumped. To do this, the `lita-versioner` bot listens to github for merged PRs, and when it finds one, takes these actions:
+
+1. Bumps the patch version in `lib/chef/version.rb` (e.g. 0.9.14 -> 0.9.15).
+2. Runs `rake dependencies:update_conservative` to update the `Gemfile.lock` to include the new version.
+3. Pushes to `master` and submits a new build to Chef's Jenkins cluster.
+
+## Component Versions
+
+Chef has two sorts of component: ruby components like `berkshelf` and `test-kitchen`, and binary components like `openssl` and even `ruby` itself.
+
+In general, you can find all chef desired versions in the [Gemfile](Gemfile) and [version_policy.rb](version_policy.rb) files. The [Gemfile.lock](Gemfile.lock) is the locked version of the Gemfile, and [omnibus_overrides](omnibus_overrides.rb) is the locked version of omnibus. [build](omnibus/Gemfile) and [test](acceptance/Gemfile) Gemfiles and [Berksfile](omnibus/Berksfile) version the toolset we use to build and test.
+
+### Binary Components
+
+The versions of binary components (as well as rubygems and bundler, which can't be versioned in a Gemfile) are stored in [version_policy.rb](version_policy.rb) (the `OMNIBUS_OVERRIDES` constant) and locked in [omnibus_overrides](omnibus_overrides.rb).  `rake dependencies` will update the `bundler` version, and the rest are be updated manually by Chef every so often.
+
+These have software definitions either in [omnibus/config/software](omnibus/config/software) or, more often, in the [omnibus-software](https://github.com/chef/omnibus-software/tree/master/config/software) project.
+
+### Rubygems Components
+
+Most of the actual front-facing software in chef is composed of ruby projects. berkshelf, test-kitchen and even chef itself are made of ruby gems. Chef uses the typical ruby way of controlling rubygems versions, the `Gemfile`. Specifically, the `Gemfile` at the top of chef repository governs the version of every single gem we install into chef package. It's a one-stop shop.
+
+Our rubygems component versions are locked down with `Gemfile.lock`, and can be updated with `rake dependencies`.
+
+There are three gems versioned outside the `Gemfile`: `rubygems`, `bundler` and `chef`. `rubygems` and `bundler` are in the `RUBYGEMS_AT_LATEST_VERSION` constant in [version_policy.rb](version-policy.rb) and locked in [omnibus_overrides](omnibus_overrides.rb). They are kept up to date by `rake dependencies`.
+
+**Windows**: [Gemfile.lock](Gemfile.lock) is generated platform-agnostic, and then generated again for Windows. The one file has the solution for both Linux and Windows.
+
+The tool we use to generate Windows-specific lockfiles on non-Windows machines is [tasks/bin/bundle-platform](bundle-platform), which takes the first argument and sets `Gem.platforms`, and then calls `bundle` with the remaining arguments.
+
+### Build Tooling Versions
+
+Of special mention is the software we use to build omnibus itself. There are two distinct bits of code that control the versions of compilers, make, git, and other tools we use to build.
+
+First, the Jenkins machines that run the build are configured entirely by the [opscode-ci cookbook](https://github.com/chef-cookbooks/opscode-ci) cookbook. They install most of the tools we use via `build-essentials`, and standardize the build environment so we can tear down and bring up builders at will. These machines are kept alive long-running, are periodically updated by Chef to the latest opscode-ci, omnibus and build-essentials cookbooks.
+
+Second, the version of omnibus we use to build chef is governed by `omnibus/Gemfile`. When software definitions or the omnibus framework is updated, this is the file that drives whether we pick it up.
+
+The omnibus tooling versions are locked down with `omnibus/Gemfile.lock`, and can be updated by running `rake dependencies`.
+
+### Test Versions
+
+chef is tested by the [chef-acceptance framework](https://github.com/chef/chef-acceptance), which contains suites that are run on the Jenkins test machines. The definitions of the tests are in the `acceptance` directory. The version of chef-acceptance and test-kitchen, are governed by `acceptance/Gemfile`.
+
+The test tooling versions are locked down with `acceptance/Gemfile.lock`, which can be updated by running `rake dependencies`.
+
+## The Build Process
+
+The actual Chef build process is done with Omnibus, and has several general steps:
+
+1. `bundle install` from `chef/Gemfile.lock`
+2. Reinstall any gems that came from git or path using `rake install`
+3. appbundle chef, chef, test-kitchen and berkshelf
+4. Put miscellaneous powershell scripts and cleanup
+
+### Kicking Off The Build
+
+The build is kicked off in Jenkins by running this on the machine (which is already the correct OS and already has the correct dependencies, loaded by the `omnibus` cookbook):
+
+```
+load-omnibus-toolchain.bat
+cd chef/omnibus
+bundle install
+bundle exec omnibus build chef
+```
+
+This causes the [chef project definition](omnibus/config/projects/chef.rb) to load, which runs the [chef-complete](omnibus/config/software/chef-complete.rb) software definition, the primary software definition driving the whole build process. The reason we embed it all in a software definiton instead of the project is to take advantage of omnibus caching: omnibus will invalidate the entire project (and recompile ruby, openssl, and everything else) if you change anything at all in the project file. Not so with a software definition.
+
+### Installing the Gems
+
+The primary build definition that installs the many Chef rubygems is [`software/chef.rb`](omnibus/software/chef.rb). This has dependencies on any binary libraries, ruby, rubygems and bundler. It has a lot of steps, so it uses a [library](omnibus/files/chef/build-chef.rb) to help reuse code and make it manageable to look at.
+
+What it does:
+
+1. Depends on software defs for pre-cached gems (see "Gems and Caching" below).
+2. Installs all gems from the bundle:
+   - Sets up a `.bundle/config` ([code](omnibus/files/chef/build-chef.rb#L17-L39)) with --retries=4, --jobs=1, --without=development,no_<platform>, and `build.config.nokogiri` to pass.
+   - Sets up a common environment, standardizing the compilers and flags we use, in [`env`](omnibus/files/chef-gem/build-chef-gem.rb#L32-L54).
+   - [Runs](omnibus/config/software/chef.rb#L68) `bundle install --verbose`
+3. Reinstalls any gems that were installed via path:
+   - [Runs](omnibus/files/chef/build-chef.rb#L80) `bundle list --paths` to get the installed directories of all gems.
+   - For each gem not installed in the main gem dir, [runs](omnibus/files/chef/build-chef.rb#L89) `rake install` from the installed gem directory.
+   - [Deletes](omnibus/files/chef/build-chef.rb#L139-L143) the bundler git cache and path- and git-installed gems from the build.
+4. [Creates](omnibus/files/chef/build-chef.rb#L102-L152) `/opt/chef/Gemfile` and `/opt/chef/Gemfile.lock` with the gems that were installed in the build.
+
+#### Gems and Caching
+
+Some gems take a super long time to install (particularly native-compiled ones such as nokogiri and dep-selector-libgecode) and do not change version very often. In order to avoid doing this work every time, we take advantage of omnibus caching by separating out these gems into their own software definitions. [chef-gem-dep-selector-libgecode](omnibus/config/software/chef-gem-dep-selector-libgecode.rb) for example.
+
+Each of these gems uses the `config/files/chef-gem/build-chef-gem` library to define itself. The name of the software definition itself indicates the .
+
+We only create software definitions for long-running gems. Everything else is just installed in the [chef](omnibus/config/software/chef.rb) software definition in a big `bundle install` catchall.
+
+Most gems we just install in the single `chef` software definition.
+
+The first thing
+
+### Appbundling
+
+After the gems are installed, we *appbundle* them in [chef-appbundle](omnibus/config/software/chef-appbundle.rb). This creates binstubs that use the bundle to pin the software .
+
+During the process of appbundling, we update the gem's `Gemfile` to include the locks in the top level `/opt/chef/Gemfile.lock`, so we can guarantee they will never pick up things outside the build. We then run `bundle lock` to update the gem's `Gemfile.lock`, and `bundle check` to ensure all the gems are actually installed. The appbundler then uses these pins.
+
+### Other Cleanup
+
+Finally, chef does several more steps including installing powershell scripts and shortcuts, and removing extra documentation to keep the build slim.
+
 # License
 
 Chef - A configuration management system
diff --git a/Rakefile b/Rakefile
index 772b2bca18..c085f94d7a 100644
--- a/Rakefile
+++ b/Rakefile
@@ -24,14 +24,19 @@ require "chef/version"
 require "chef-config/package_task"
 require "rdoc/task"
 require_relative "tasks/rspec"
-require_relative "tasks/external_tests"
 require_relative "tasks/maintainers"
 require_relative "tasks/cbgb"
+require_relative "tasks/dependencies"
+require_relative "tasks/changelog"
 
 ChefConfig::PackageTask.new(File.expand_path("..", __FILE__), "Chef") do |package|
   package.component_paths = ["chef-config"]
   package.generate_version_class = true
 end
+# Add a conservative dependency update to version:bump (which was created by PackageTask)
+task "version:bump" => %w{version:bump_patch version:update} do
+  Rake::Task["dependencies:update"].invoke("conservative")
+end
 
 task :pedant, :chef_zero_spec
 
@@ -72,16 +77,3 @@ begin
 rescue LoadError
   puts "yard is not available. (sudo) gem install yard to generate yard documentation."
 end
-
-begin
-  require "github_changelog_generator/task"
-
-  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
-    config.future_release = Chef::VERSION
-    config.enhancement_labels = "enhancement,Enhancement,New Feature,Feature".split(",")
-    config.bug_labels = "bug,Bug,Improvement,Upstream Bug".split(",")
-    config.exclude_labels = "duplicate,question,invalid,wontfix,no_changelog,Exclude From Changelog,Question,Discussion".split(",")
-  end
-rescue LoadError
-  puts "github_changelog_generator is not available. gem install github_changelog_generator to generate changelogs"
-end
diff --git a/acceptance/.gitignore b/acceptance/.gitignore
index 0d2aa76a44..c2ab70737d 100644
--- a/acceptance/.gitignore
+++ b/acceptance/.gitignore
@@ -1,2 +1 @@
-/Gemfile.lock
 .acceptance_logs
diff --git a/acceptance/Gemfile b/acceptance/Gemfile
index 72dded468c..185437ed71 100644
--- a/acceptance/Gemfile
+++ b/acceptance/Gemfile
@@ -2,12 +2,12 @@ source "https://rubygems.org"
 
 gem "chef-acceptance", github: "chef/chef-acceptance"
 gem "test-kitchen"
-gem "kitchen-ec2", github: "test-kitchen/kitchen-ec2", branch: "jk/image-search-only"
+gem "kitchen-ec2"
 gem "kitchen-inspec"
 gem "inspec"
 # Pinning to github for kitchen-vagrant because 0.19.0 incorrectly
 # puts in a box_url for bento when a vagrant box in atlas is specified
-gem "kitchen-vagrant", github: "test-kitchen/kitchen-vagrant"
+gem "kitchen-vagrant"
 gem "windows_chef_zero"
 gem "winrm-fs"
 gem "berkshelf"
diff --git a/acceptance/Gemfile.lock b/acceptance/Gemfile.lock
new file mode 100644
index 0000000000..009c7cee73
--- /dev/null
+++ b/acceptance/Gemfile.lock
@@ -0,0 +1,235 @@
+GIT
+  remote: git://github.com/chef/chef-acceptance.git
+  revision: 49458ec493dbd12588680eea9f2f9beb76463d09
+  specs:
+    chef-acceptance (0.2.0)
+      mixlib-shellout (~> 2.0)
+      thor (~> 0.19)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.4.0)
+    artifactory (2.3.2)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (4.3.2)
+      addressable (~> 2.3, >= 2.3.4)
+      berkshelf-api-client (~> 2.0, >= 2.0.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (= 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      minitar (~> 0.5, >= 0.5.4)
+      octokit (~> 4.0)
+      retryable (~> 2.0)
+      ridley (~> 4.5)
+      solve (~> 2.0)
+      thor (~> 0.19)
+    berkshelf-api-client (2.0.2)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.7.0)
+      ridley (~> 4.5)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    builder (3.2.2)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    cleanroom (1.0.0)
+    coderay (1.1.1)
+    diff-lcs (1.2.5)
+    docker-api (1.26.2)
+      excon (>= 0.38.0)
+      json
+    erubis (2.7.0)
+    excon (0.49.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10)
+    fuzzyurl (0.8.0)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    httpclient (2.7.1)
+    inspec (0.19.1)
+      json (~> 1.8)
+      method_source (~> 0.8)
+      pry (~> 0)
+      r-train (~> 0.10.5)
+      rainbow (~> 2)
+      rspec (~> 3)
+      rspec-its (~> 1.2)
+      rubyzip (~> 1.1)
+      thor (~> 0.19)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-ec2 (1.0.0)
+      aws-sdk (~> 2)
+      excon
+      multi_json
+      retryable (~> 2.0)
+      test-kitchen (~> 1.4, >= 1.4.1)
+    kitchen-inspec (0.12.5)
+      inspec (>= 0.14.1, < 1.0.0)
+      test-kitchen (~> 1.6)
+    kitchen-vagrant (0.20.0)
+      test-kitchen (~> 1.4)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    method_source (0.8.2)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.7)
+      artifactory
+      mixlib-shellout
+      mixlib-versioning
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-versioning (1.1.0)
+    molinillo (0.4.4)
+    multi_json (1.11.2)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    nori (2.6.0)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    r-train (0.10.5)
+      docker-api (~> 1.26.2)
+      json (~> 1.8)
+      mixlib-shellout (~> 2.1)
+      net-scp (~> 1.2)
+      net-ssh (>= 2.9, < 4.0)
+      winrm (~> 1.6)
+      winrm-fs (~> 0.3)
+    rainbow (2.1.0)
+    retryable (2.0.3)
+    ridley (4.5.0)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config (>= 12.5.0)
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.7)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rubyntlm (0.6.0)
+    rubyzip (1.2.0)
+    safe_yaml (1.0.4)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    slop (3.6.0)
+    solve (2.0.3)
+      molinillo (~> 0.4.2)
+      semverse (~> 1.1)
+    test-kitchen (1.7.3)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+    windows_chef_zero (2.0.0)
+      test-kitchen (>= 1.2.1)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
+    winrm-fs (0.4.2)
+      erubis (~> 2.7)
+      logging (>= 1.6.1, < 3.0)
+      rubyzip (~> 1.1)
+      winrm (~> 1.5)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  berkshelf
+  chef-acceptance!
+  inspec
+  kitchen-ec2
+  kitchen-inspec
+  kitchen-vagrant
+  test-kitchen
+  windows_chef_zero
+  winrm-fs
+
+BUNDLED WITH
+   1.11.2
diff --git a/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb b/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb
index 66380a37f4..4f408cd063 100644
--- a/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb
+++ b/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb
@@ -10,30 +10,38 @@ describe "Chef Fips Specs" do
     end
   end
 
-  let(:chef_dir) do
+  let(:omnibus_root) do
     if windows?
-      Dir.glob("c:/opscode/chef/embedded/lib/ruby/gems/*/gems/chef-[0-9]*").last
+      "c:/opscode/chef"
     else
-      Dir.glob("/opt/chef/embedded/lib/ruby/gems/*/gems/chef-[0-9]*").last
+      "/opt/chef"
     end
   end
 
-  let(:path) do
-    if windows?
-      'C:\opscode\chef\embedded\bin'
-    else
-      "/opt/chef/embedded/bin"
-    end
+  let(:env) do
+    {
+      "PATH" => [ "#{omnibus_root}/embedded/bin", ENV["PATH"] ].join(File::PATH_SEPARATOR),
+      "BUNDLE_GEMFILE" => "#{omnibus_root}/Gemfile",
+      "GEM_PATH" => nil, "GEM_CACHE" => nil, "GEM_HOME" => nil,
+      "BUNDLE_IGNORE_CONFIG" => "true",
+      "BUNDLE_FROZEN" => "1",
+      "CHEF_FIPS" => "1"
+    }
+  end
+
+  let(:chef_dir) do
+    cmd = Mixlib::ShellOut.new("bundle show chef", env: env).run_command
+    cmd.error!
+    cmd.stdout.chomp
   end
 
   it "passes the unit and functional specs" do
     Bundler.with_clean_env do
-      ruby_cmd = Mixlib::ShellOut.new(
-        "bundle exec rspec -t ~requires_git spec/unit spec/functional", :env => { "PATH" => [ENV["PATH"], path].join(File::PATH_SEPARATOR),
-                                                                                  "GEM_PATH" => nil, "GEM_CACHE" => nil, "GEM_HOME" => nil,
-                                                                                  "CHEF_FIPS" => "1" },
-                                                                        :live_stream => STDOUT, :cwd => chef_dir, :timeout => 3600)
-      expect { ruby_cmd.run_command.error! }.not_to raise_exception
+      cmd = Mixlib::ShellOut.new(
+        "bundle exec rspec -t ~requires_git spec/unit spec/functional",
+        env: env, live_stream: STDOUT, cwd: chef_dir, timeout: 3600
+      )
+      cmd.run_command.error!
     end
   end
 end
diff --git a/appveyor.yml b/appveyor.yml
index d6459b6b96..108794c865 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -23,11 +23,14 @@ install:
   - SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
   - echo %PATH%
   - ruby --version
+  - gem update --system || gem update --system || gem update --system
   - gem install bundler --quiet --no-ri --no-rdoc || gem install bundler --quiet --no-ri --no-rdoc || gem install bundler --quiet --no-ri --no-rdoc
-  - gem install rubygems-pkg/rubygems-update-2.4.6.gem
   - update_rubygems
   - gem --version
   - bundler --version
+  - SET BUNDLE_IGNORE_CONFIG=true
+  - SET BUNDLE_FROZEN=1
+  - SET BUNDLE_WITHOUT=development:guard:maintenance:tools:integration:changelog:compat_testing:docgen:travis:style:omnibus_package:aix:bsd:linux:mac_os_x:solaris
 
 build_script:
   - bundle install || bundle install || bundle install
diff --git a/chef-config/lib/chef-config/package_task.rb b/chef-config/lib/chef-config/package_task.rb
index 43d01f53ef..b984f60f9f 100644
--- a/chef-config/lib/chef-config/package_task.rb
+++ b/chef-config/lib/chef-config/package_task.rb
@@ -211,18 +211,20 @@ end
 
       task :version => "version:update"
 
-      Dir[File.expand_path("*gemspec", root_path)].reverse_each do |gemspec_path|
+      gemspec_platform_to_install = ""
+      Dir[File.expand_path("*.gemspec", root_path)].reverse_each do |gemspec_path|
         gemspec = eval(IO.read(gemspec_path))
         Gem::PackageTask.new(gemspec) do |task|
           task.package_dir = full_package_dir
         end
+        gemspec_platform_to_install = "-#{gemspec.platform}" if gemspec.platform != Gem::Platform::RUBY && Gem::Platform.match(gemspec.platform)
       end
 
       desc "Build and install a #{module_path} gem"
       task :install => [:package] do
         with_clean_env do
           full_module_path = File.join(full_package_dir, module_path)
-          sh %{gem install #{full_module_path}-#{version}.gem --no-rdoc --no-ri}
+          sh %{gem install #{full_module_path}-#{version}#{gemspec_platform_to_install}.gem --no-rdoc --no-ri}
         end
       end
 
diff --git a/chef-windows.gemspec b/chef-universal-mingw32.gemspec
index a4f086cfaf..a4f086cfaf 100644
--- a/chef-windows.gemspec
+++ b/chef-universal-mingw32.gemspec
diff --git a/chef.gemspec b/chef.gemspec
index e1055e01b5..59367b00f8 100644
--- a/chef.gemspec
+++ b/chef.gemspec
@@ -50,12 +50,6 @@ Gem::Specification.new do |s|
   # very deliberately avoiding putting a ceiling on this to avoid depsolver conflicts.
   s.add_dependency "bundler", ">= 1.10"
 
-  s.add_development_dependency "rack"
-  s.add_development_dependency "cheffish", ">= 1.1", "< 3.0"
-  s.add_development_dependency "github_changelog_generator", "1.11.3"
-
-  s.add_development_dependency "rake", "~> 10.1"
-
   s.bindir       = "bin"
   s.executables  = %w{ chef-client chef-solo knife chef-shell chef-apply }
 
diff --git a/ci/verify-chef.bat b/ci/verify-chef.bat
index 1f8be56ef1..7ba0817938 100755
--- a/ci/verify-chef.bat
+++ b/ci/verify-chef.bat
@@ -46,8 +46,8 @@ call %EMBEDDED_BIN_DIR%\rspec --version
 
 SET PATH=C:\opscode\%PROJECT_NAME%\bin;C:\opscode\%PROJECT_NAME%\embedded\bin;%PATH%
 
-REM ; Test against the vendored chef gem
-cd C:\opscode\%PROJECT_NAME%\embedded\lib\ruby\gems\2*\gems\chef-*-mingw32
+REM ; Test against the vendored chef gem (cd into the output of "bundle show chef")
+for /f "delims=" %%a in ('bundle show chef') do cd %%a
 
 IF NOT EXIST "Gemfile.lock" (
   ECHO "Chef gem does not contain a Gemfile.lock! This is needed to run any tests."
@@ -61,4 +61,7 @@ IF "%PIPELINE_NAME%" == "chef-fips" (
 REM ; ffi-yajl must run in c-extension mode for perf, so force it so we don't accidentally fall back to ffi
 set FORCE_FFI_YAJL=ext
 
+set BUNDLE_GEMFILE=C:\opscode\%PROJECT_NAME%\Gemfile
+set BUNDLE_IGNORE_CONFIG=true
+set BUNDLE_FROZEN=1
 call bundle exec rspec -r rspec_junit_formatter -f RspecJunitFormatter -o %WORKSPACE%\test.xml -f documentation spec/functional
diff --git a/ci/verify-chef.sh b/ci/verify-chef.sh
index d6486f3b35..8118d2da33 100755
--- a/ci/verify-chef.sh
+++ b/ci/verify-chef.sh
@@ -1,5 +1,7 @@
 #!/bin/sh
 
+set -evx
+
 # Set up a custom tmpdir, and clean it up before and after the tests
 TMPDIR="${TMPDIR:-/tmp}/cheftest"
 export TMPDIR
@@ -84,22 +86,33 @@ export FORCE_FFI_YAJL
 # ACCEPTANCE environment variable will be set on acceptance testers.
 # If is it set; we run the acceptance tests, otherwise run rspec tests.
 if [ "x$ACCEPTANCE" != "x" ]; then
+  # Find the Chef gem and cd there.
+  OLD_PATH=$PATH
+  PATH=/opt/$PROJECT_NAME/bin:/opt/$PROJECT_NAME/embedded/bin:$PATH
+  cd /opt/$PROJECT_NAME
+  CHEF_GEM=`bundle show chef`
+  PATH=$OLD_PATH
+  cd $CHEF_GEM/acceptance
+
   # On acceptance testers we have Chef DK. We will use its Ruby environment
   # to cut down the gem installation time.
   PATH=/opt/chefdk/bin:/opt/chefdk/embedded/bin:$PATH
   export PATH
 
-  # Test against the vendored Chef gem
-  cd /opt/$PROJECT_NAME/embedded/lib/ruby/gems/*/gems/chef-[0-9]*/acceptance
+  # Test against the Chef bundle
+  # sudo env PATH=$PATH AWS_SSH_KEY_ID=$AWS_SSH_KEY_ID ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD gem install bundler
+  sudo env PATH=$PATH AWS_SSH_KEY_ID=$AWS_SSH_KEY_ID ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD pwd
+  sudo env PATH=$PATH AWS_SSH_KEY_ID=$AWS_SSH_KEY_ID ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD bundle config
   sudo env PATH=$PATH AWS_SSH_KEY_ID=$AWS_SSH_KEY_ID ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD bundle install
   sudo env PATH=$PATH AWS_SSH_KEY_ID=$AWS_SSH_KEY_ID ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD KITCHEN_DRIVER=ec2 bundle exec chef-acceptance test --force-destroy
 else
   PATH=/opt/$PROJECT_NAME/bin:/opt/$PROJECT_NAME/embedded/bin:$PATH
   export PATH
 
-  # Test against the vendored Chef gem
-  cd /opt/$PROJECT_NAME/embedded/lib/ruby/gems/*/gems/chef-[0-9]*
-
+  # Test against the installed Chef gem
+  cd /opt/$PROJECT_NAME
+  CHEF_GEM=`bundle show chef`
+  cd $CHEF_GEM
   if [ ! -f "Gemfile.lock" ]; then
     echo "Chef gem does not contain a Gemfile.lock! This is needed to run any tests."
     exit 1
@@ -111,5 +124,6 @@ else
       CHEF_FIPS=1
       export CHEF_FIPS
   fi
-  sudo env PATH=$PATH TERM=xterm CHEF_FIPS=$CHEF_FIPS bundle exec rspec -r rspec_junit_formatter -f RspecJunitFormatter -o $WORKSPACE/test.xml -f documentation spec/functional
+
+  sudo env BUNDLE_GEMFILE=/opt/$PROJECT_NAME/Gemfile BUNDLE_IGNORE_CONFIG=true BUNDLE_FROZEN=1 GIT_SSL_NO_VERIFY=true PATH=$PATH TERM=xterm CHEF_FIPS=$CHEF_FIPS bundle exec rspec -r rspec_junit_formatter -f RspecJunitFormatter -o $WORKSPACE/test.xml -f documentation spec/functional
 fi
diff --git a/kitchen-tests/Berksfile.lock b/kitchen-tests/Berksfile.lock
new file mode 100644
index 0000000000..ee5027e4b7
--- /dev/null
+++ b/kitchen-tests/Berksfile.lock
@@ -0,0 +1,59 @@
+DEPENDENCIES
+  php (~> 1.5.0)
+  webapp
+    path: cookbooks/webapp
+
+GRAPH
+  apache2 (3.2.2)
+  apt (3.0.0)
+  aws (3.3.2)
+    ohai (>= 2.1.0)
+  build-essential (3.2.0)
+    seven_zip (>= 0.0.0)
+  chef-sugar (3.3.0)
+  chef_handler (1.3.0)
+  database (2.3.1)
+    aws (>= 0.0.0)
+    mysql (~> 5.0)
+    mysql-chef_gem (~> 0.0)
+    postgresql (>= 1.0.0)
+    xfs (>= 0.0.0)
+  iis (4.1.7)
+    windows (>= 1.34.6)
+  mysql (5.6.3)
+    yum-mysql-community (>= 0.0.0)
+  mysql-chef_gem (0.0.5)
+    build-essential (>= 0.0.0)
+    mysql (>= 0.0.0)
+  ohai (3.0.1)
+  openssl (4.4.0)
+    chef-sugar (>= 3.1.1)
+  php (1.5.0)
+    build-essential (>= 0.0.0)
+    iis (>= 0.0.0)
+    mysql (>= 0.0.0)
+    windows (>= 0.0.0)
+    xml (>= 0.0.0)
+    yum-epel (>= 0.0.0)
+  postgresql (4.0.6)
+    apt (>= 1.9.0)
+    build-essential (>= 0.0.0)
+    openssl (~> 4.0)
+  seven_zip (2.0.0)
+    windows (>= 1.2.2)
+  webapp (0.1.0)
+    apache2 (>= 0.0.0)
+    database (~> 2.3.1)
+    mysql (>= 0.0.0)
+    php (>= 0.0.0)
+  windows (1.39.2)
+    chef_handler (>= 0.0.0)
+  xfs (2.0.1)
+  xml (2.0.0)
+    build-essential (>= 0.0.0)
+    chef-sugar (>= 0.0.0)
+  yum (3.10.0)
+  yum-epel (0.6.6)
+    yum (~> 3.10.0)
+  yum-mysql-community (0.2.0)
+    yum (>= 3.2)
diff --git a/kitchen-tests/Gemfile.lock b/kitchen-tests/Gemfile.lock
new file mode 100644
index 0000000000..78caba0014
--- /dev/null
+++ b/kitchen-tests/Gemfile.lock
@@ -0,0 +1,173 @@
+GIT
+  remote: git://github.com/test-kitchen/kitchen-ec2.git
+  revision: fec3f199a646980dc289ac6db9f90e9a9e4b0f6b
+  specs:
+    kitchen-ec2 (1.0.0)
+      aws-sdk (~> 2)
+      excon
+      multi_json
+      retryable (~> 2.0)
+      test-kitchen (~> 1.4, >= 1.4.1)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.4.0)
+    artifactory (2.3.2)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (4.3.2)
+      addressable (~> 2.3, >= 2.3.4)
+      berkshelf-api-client (~> 2.0, >= 2.0.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (= 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      minitar (~> 0.5, >= 0.5.4)
+      octokit (~> 4.0)
+      retryable (~> 2.0)
+      ridley (~> 4.5)
+      solve (~> 2.0)
+      thor (~> 0.19)
+    berkshelf-api-client (2.0.2)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.7.0)
+      ridley (~> 4.5)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    cleanroom (1.0.0)
+    diff-lcs (1.2.5)
+    erubis (2.7.0)
+    excon (0.49.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10-x86-mingw32)
+    fuzzyurl (0.8.0)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    hitimes (1.2.3-x86-mingw32)
+    httpclient (2.7.1)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-appbundle-updater (0.1.2)
+    kitchen-vagrant (0.20.0)
+      test-kitchen (~> 1.4)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.7)
+      artifactory
+      mixlib-shellout
+      mixlib-versioning
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-shellout (2.2.6-universal-mingw32)
+      win32-process (~> 0.8.2)
+      wmi-lite (~> 1.0)
+    mixlib-versioning (1.1.0)
+    molinillo (0.4.4)
+    multi_json (1.11.2)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    retryable (2.0.3)
+    ridley (4.5.0)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config (>= 12.5.0)
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.7)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    safe_yaml (1.0.4)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    solve (2.0.3)
+      molinillo (~> 0.4.2)
+      semverse (~> 1.1)
+    test-kitchen (1.7.3)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    vagrant-wrapper (2.0.3)
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+    win32-process (0.8.3)
+      ffi (>= 1.0.0)
+    wmi-lite (1.0.0)
+
+PLATFORMS
+  ruby
+  x86-mingw32
+
+DEPENDENCIES
+  berkshelf
+  kitchen-appbundle-updater
+  kitchen-ec2!
+  kitchen-vagrant (~> 0.17)
+  test-kitchen (~> 1.4)
+  vagrant-wrapper
+
+BUNDLED WITH
+   1.11.2
diff --git a/kitchen-tests/cookbooks/audit_test/.gitignore b/kitchen-tests/cookbooks/audit_test/.gitignore
index ec2a890bd3..1e074046f0 100644
--- a/kitchen-tests/cookbooks/audit_test/.gitignore
+++ b/kitchen-tests/cookbooks/audit_test/.gitignore
@@ -1,5 +1,4 @@
 .vagrant
-Berksfile.lock
 *~
 *#
 .#*
diff --git a/kitchen-tests/cookbooks/audit_test/Berksfile.lock b/kitchen-tests/cookbooks/audit_test/Berksfile.lock
new file mode 100644
index 0000000000..ef9f28a3be
--- /dev/null
+++ b/kitchen-tests/cookbooks/audit_test/Berksfile.lock
@@ -0,0 +1,7 @@
+DEPENDENCIES
+  audit_test
+    path: .
+    metadata: true
+
+GRAPH
+  audit_test (0.1.0)
diff --git a/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock b/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock
new file mode 100644
index 0000000000..ac6c11f28c
--- /dev/null
+++ b/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock
@@ -0,0 +1,19 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ffi (1.9.10)
+    ffi (1.9.10-x86-mingw32)
+    ffi-yajl (1.4.0)
+      ffi (~> 1.5)
+      libyajl2 (~> 1.2)
+    libyajl2 (1.2.0)
+
+PLATFORMS
+  ruby
+  x86-mingw32
+
+DEPENDENCIES
+  ffi-yajl (~> 1.1)
+
+BUNDLED WITH
+   1.11.2
diff --git a/omnibus/.kitchen.yml b/omnibus/.kitchen.yml
index 6a56b92dcb..e64cadca26 100644
--- a/omnibus/.kitchen.yml
+++ b/omnibus/.kitchen.yml
@@ -11,9 +11,7 @@ driver:
     cpus: 4
     memory: 4096
   synced_folders:
-    - ['..', '/home/vagrant/chef']
-    - ['../../omnibus', '/home/vagrant/omnibus']
-    - ['../../omnibus-software', '/home/vagrant/omnibus-software']
+    - ['../..', '/home/vagrant']
 
 provisioner:
   name: chef_zero
@@ -21,6 +19,11 @@ provisioner:
   # This is not the version of chef that we're building - this is the version
   # of chef that omnibus needs to build chef/chef.
   require_chef_omnibus: true
+  attributes:
+    vagrant:
+      this_key_exists_so_we_have_a_vagrant_key: true
+  chef_omnibus_install_options: -P angrychef
+  chef_omnibus_root: /opt/angrychef
 
 platforms:
   - name: centos-5.11
@@ -73,6 +76,8 @@ platforms:
   - name: windows-2012r2-standard
     driver:
       box: chef/windows-server-2012r2-standard # private
+    provisioner:
+      chef_omnibus_root: /opscode/angrychef
 
 attribute_defaults: &attribute_defaults
   build_user:          vagrant
@@ -80,27 +85,17 @@ attribute_defaults: &attribute_defaults
   build_user_password: vagrant
 
 suites:
-  - name: angrychef
-    attributes:
-      omnibus:
-        <<: *attribute_defaults
-        install_dir: /opt/angrychef
-    run_list:
-      - omnibus::default
-  - name: chef-fips
-    attributes:
-      omnibus:
-        <<: *attribute_defaults
-        install_dir: /opt/chef-fips
-    run_list:
-      - omnibus::default
+  # - name: angrychef
+  #   attributes:
+  #     omnibus:
+  #       <<: *attribute_defaults
+  #       install_dir: /opt/angrychef
+  #   run_list:
+  #     - omnibus::default
   - name: chef
-    provisioner:
-      chef_omnibus_install_options: -P angrychef
-      chef_omnibus_root: /opt/angrychef
     attributes:
       omnibus:
         <<: *attribute_defaults
-        install_dir: /opt/chef
+        install_dir: /opscode/chef
     run_list:
       - omnibus::default
diff --git a/omnibus/Berksfile.lock b/omnibus/Berksfile.lock
new file mode 100644
index 0000000000..93ed1a1f46
--- /dev/null
+++ b/omnibus/Berksfile.lock
@@ -0,0 +1,47 @@
+DEPENDENCIES
+  apt (~> 2.3)
+  freebsd (~> 0.1)
+  omnibus
+  yum-epel (~> 0.3)
+
+GRAPH
+  apt (2.9.2)
+  build-essential (3.2.0)
+    seven_zip (>= 0.0.0)
+  chef-sugar (3.3.0)
+  chef_handler (1.3.0)
+  dmg (2.3.0)
+  freebsd (0.6.0)
+  git (4.4.1)
+    build-essential (>= 0.0.0)
+    dmg (>= 0.0.0)
+    windows (>= 0.0.0)
+    yum-epel (>= 0.0.0)
+  homebrew (2.1.0)
+    build-essential (>= 2.1.2)
+  languages (0.2.6)
+    build-essential (>= 0.0.0)
+    chef-sugar (>= 0.0.0)
+    homebrew (>= 0.0.0)
+    remote_install (>= 0.0.0)
+  omnibus (3.3.0)
+    build-essential (>= 3.0.0)
+    chef-sugar (>= 3.2.0)
+    git (>= 0.0.0)
+    homebrew (>= 0.0.0)
+    languages (>= 0.0.0)
+    remote_install (>= 0.0.0)
+    windows (>= 0.0.0)
+    windows-sdk (>= 0.0.0)
+    wix (>= 0.0.0)
+  remote_install (1.0.2)
+  seven_zip (2.0.0)
+    windows (>= 1.2.2)
+  windows (1.39.2)
+    chef_handler (>= 0.0.0)
+  windows-sdk (1.0.2)
+  wix (2.0.2)
+    windows (>= 1.38.2)
+  yum (3.10.0)
+  yum-epel (0.6.6)
+    yum (~> 3.10.0)
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
new file mode 100644
index 0000000000..5214847aa1
--- /dev/null
+++ b/omnibus/Gemfile.lock
@@ -0,0 +1,267 @@
+GIT
+  remote: https://github.com/chef/omnibus-software.git
+  revision: 6127be3af79941c32419228cbd9e63c4f061d76b
+  specs:
+    omnibus-software (4.0.0)
+      omnibus (>= 5.2.0)
+
+GIT
+  remote: https://github.com/chef/omnibus.git
+  revision: e73722f46fbd5f302d9e1541aaae0b2f8be2110e
+  specs:
+    omnibus (5.3.0)
+      aws-sdk (~> 2)
+      chef-sugar (~> 3.3)
+      cleanroom (~> 1.0)
+      ffi-yajl (~> 2.2)
+      mixlib-shellout (~> 2.0)
+      mixlib-versioning
+      ohai (~> 8.0)
+      ruby-progressbar (~> 1.7)
+      thor (~> 0.18)
+
+GIT
+  remote: https://github.com/ksubrama/pedump.git
+  revision: b4319556e18c80d2cba064ffe57fe0dea549dfe2
+  branch: patch-1
+  specs:
+    pedump (0.5.0)
+      awesome_print
+      iostruct (>= 0.0.4)
+      multipart-post (~> 1.2)
+      progressbar
+      zhexdump (>= 0.0.2)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.3.8)
+    artifactory (2.3.2)
+    awesome_print (1.6.1)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (3.3.0)
+      addressable (~> 2.3.4)
+      berkshelf-api-client (~> 1.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9.0)
+      httpclient (~> 2.6.0)
+      minitar (~> 0.5.4)
+      octokit (~> 3.0)
+      retryable (~> 2.0)
+      ridley (~> 4.0)
+      solve (~> 1.1)
+      thor (~> 0.19)
+    berkshelf-api-client (1.3.1)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.6.0)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    builder (3.2.2)
+    byebug (8.2.4)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    chef-sugar (3.3.0)
+    cleanroom (1.0.0)
+    coderay (1.1.1)
+    debug_inspector (0.0.2)
+    dep-selector-libgecode (1.2.0)
+    dep_selector (1.0.3)
+      dep-selector-libgecode (~> 1.0)
+      ffi (~> 1.9)
+    diff-lcs (1.2.5)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10)
+    ffi (1.9.10-x86-mingw32)
+    ffi-yajl (2.2.3)
+      libyajl2 (~> 1.2)
+    fuzzyurl (0.8.0)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    hitimes (1.2.3-x86-mingw32)
+    httpclient (2.6.0.1)
+    iostruct (0.0.4)
+    ipaddress (0.8.3)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-vagrant (0.19.0)
+      test-kitchen (~> 1.4)
+    libyajl2 (1.2.0)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    method_source (0.8.2)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-cli (1.5.0)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.7)
+      artifactory
+      mixlib-shellout
+      mixlib-versioning
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-shellout (2.2.6-universal-mingw32)
+      win32-process (~> 0.8.2)
+      wmi-lite (~> 1.0)
+    mixlib-versioning (1.1.0)
+    multi_json (1.11.2)
+    multipart-post (1.2.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    nori (2.6.0)
+    octokit (3.8.0)
+      sawyer (~> 0.6.0, >= 0.5.3)
+    ohai (8.14.0)
+      chef-config (>= 12.5.0.alpha.1, < 13)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli
+      mixlib-config (~> 2.0)
+      mixlib-log
+      mixlib-shellout (~> 2.0)
+      plist (~> 3.1)
+      systemu (~> 2.6.4)
+      wmi-lite (~> 1.0)
+    plist (3.2.0)
+    progressbar (0.21.0)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-byebug (3.3.0)
+      byebug (~> 8.0)
+      pry (~> 0.10)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    retryable (2.0.3)
+    ridley (4.4.2)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.6)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    ruby-progressbar (1.7.5)
+    rubyntlm (0.6.0)
+    rubyzip (1.2.0)
+    safe_yaml (1.0.4)
+    sawyer (0.6.0)
+      addressable (~> 2.3.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    slop (3.6.0)
+    solve (1.2.1)
+      dep_selector (~> 1.0)
+      semverse (~> 1.1)
+    systemu (2.6.5)
+    test-kitchen (1.7.3)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+    win32-process (0.8.3)
+      ffi (>= 1.0.0)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
+    winrm-fs (0.4.2)
+      erubis (~> 2.7)
+      logging (>= 1.6.1, < 3.0)
+      rubyzip (~> 1.1)
+      winrm (~> 1.5)
+    wmi-lite (1.0.0)
+    zhexdump (0.0.2)
+
+PLATFORMS
+  ruby
+  x86-mingw32
+
+DEPENDENCIES
+  berkshelf (~> 3.0)
+  kitchen-vagrant (~> 0.19.0)
+  omnibus!
+  omnibus-software!
+  pedump!
+  pry
+  pry-byebug
+  pry-stack_explorer
+  test-kitchen (~> 1.7.1)
+  winrm-fs (~> 0.4.0)
+
+BUNDLED WITH
+   1.11.2
diff --git a/omnibus/config/projects/chef.rb b/omnibus/config/projects/chef.rb
index aec14bfe0e..fa6f30b322 100644
--- a/omnibus/config/projects/chef.rb
+++ b/omnibus/config/projects/chef.rb
@@ -36,61 +36,22 @@ else
   install_dir "#{default_root}/#{name}"
 end
 
-override :ruby, version: "2.1.8"
-# Leave dev-kit pinned to 4.5 because 4.7 is 20MB larger and we don't want
-# to unnecessarily make the client any fatter.
-override :'ruby-windows-devkit', version: "4.5.2-20111229-1559" if windows? && windows_arch_i386?
-override :bundler,      version: "1.11.2"
-override :rubygems,     version: "2.5.2"
-
-# Chef Release version pinning
-override :chef, version: "local_source"
-override :ohai, version: "master"
-
 # Global FIPS override flag.
 if windows? || rhel?
   override :fips, enabled: true
 end
 
-dependency "preparation"
-dependency "rb-readline"
-dependency "nokogiri"
-dependency "pry"
-dependency "chef"
-dependency "shebang-cleanup"
-dependency "version-manifest"
-dependency "openssl-customization"
+# Load dynamically updated overrides
+overrides_path = File.expand_path("../../../../omnibus_overrides.rb", __FILE__)
+instance_eval(IO.read(overrides_path), overrides_path)
 
-if windows?
-  dependency "ruby-windows-devkit"
-  dependency "ruby-windows-devkit-bash"
-end
+override :"ruby-windows-devkit", version: "4.5.2-20111229-1559" if windows? && windows_arch_i386?
 
-# Lower level library pins
-override :xproto,             version: "7.0.28"
-override :"util-macros",      version: "1.19.0"
-override :makedepend,         version: "1.0.5"
-
-## We are currently on the latest of these:
-#override :"ncurses",          version: "5.9"
-#override :"zlib",             version: "1.2.8"
-#override :"pkg-config-lite",  version: "0.28-1"
-#override :"libffi",           version: "3.2.1"
-#override :"libyaml",          version: "0.1.6"
-#override :"libiconv",         version: "1.14"
-#override :"liblzma",          version: "5.2.2"
-#override :"libxml2",          version: "2.9.3"
-#override :"libxslt",          version: "1.1.28"
-
-## according to comment in omnibus-sw, latest versions don't work on solaris
-# https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
-#override :"libtool"
-
-## These can float as they are frequently updated in a way that works for us
-#override :"cacerts",                             # probably best to float?
-#override :"openssl"                              # leave this?
+dependency "preparation"
 
-dependency "clean-static-libs"
+# All actual dependencies are in chef-complete, so that the addition
+# or removal of a dependency doesn't dirty the entire project file
+dependency "chef-complete"
 
 package :rpm do
   signing_passphrase ENV["OMNIBUS_RPM_SIGNING_PASSPHRASE"]
diff --git a/omnibus/config/software/chef-appbundle.rb b/omnibus/config/software/chef-appbundle.rb
new file mode 100644
index 0000000000..19228738c3
--- /dev/null
+++ b/omnibus/config/software/chef-appbundle.rb
@@ -0,0 +1,14 @@
+name "chef-appbundle"
+default_version "local_source"
+source path: project.files_path
+
+dependency "chef"
+
+build do
+  # This is where we get the definitions below
+  require_relative "../../files/chef-appbundle/build-chef-appbundle"
+  extend BuildChefAppbundle
+
+  appbundle_gem "chef"
+  appbundle_gem "ohai"
+end
diff --git a/omnibus/config/software/chef-complete.rb b/omnibus/config/software/chef-complete.rb
new file mode 100644
index 0000000000..46fc8046e4
--- /dev/null
+++ b/omnibus/config/software/chef-complete.rb
@@ -0,0 +1,20 @@
+name "chef-complete"
+
+license :project_license
+
+dependency "chef"
+dependency "chef-appbundle"
+dependency "chef-remove-docs"
+
+dependency "shebang-cleanup"
+dependency "version-manifest"
+dependency "openssl-customization"
+
+if windows?
+  # TODO can this be safely moved to before the chef?
+  # It would make caching better ...
+  dependency "ruby-windows-devkit"
+  dependency "ruby-windows-devkit-bash"
+end
+
+dependency "clean-static-libs"
diff --git a/omnibus/config/software/chef-gem-binding_of_caller.rb b/omnibus/config/software/chef-gem-binding_of_caller.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-binding_of_caller.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-byebug.rb b/omnibus/config/software/chef-gem-byebug.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-byebug.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-debug_inspector.rb b/omnibus/config/software/chef-gem-debug_inspector.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-debug_inspector.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-ffi-yajl.rb b/omnibus/config/software/chef-gem-ffi-yajl.rb
new file mode 100644
index 0000000000..e8279f7d81
--- /dev/null
+++ b/omnibus/config/software/chef-gem-ffi-yajl.rb
@@ -0,0 +1,8 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
+
+dependency "chef-gem-libyajl2"
diff --git a/omnibus/config/software/chef-gem-ffi.rb b/omnibus/config/software/chef-gem-ffi.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-ffi.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-json.rb b/omnibus/config/software/chef-gem-json.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-json.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-libyajl2.rb b/omnibus/config/software/chef-gem-libyajl2.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-libyajl2.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-mini_portile2.rb b/omnibus/config/software/chef-gem-mini_portile2.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-mini_portile2.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-nokogiri.rb b/omnibus/config/software/chef-gem-nokogiri.rb
new file mode 100644
index 0000000000..a18d156e11
--- /dev/null
+++ b/omnibus/config/software/chef-gem-nokogiri.rb
@@ -0,0 +1,8 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
+
+dependency "chef-gem-mini_portile2"
diff --git a/omnibus/config/software/chef-gem-ruby-prof.rb b/omnibus/config/software/chef-gem-ruby-prof.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-ruby-prof.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-gem-ruby-shadow.rb b/omnibus/config/software/chef-gem-ruby-shadow.rb
new file mode 100644
index 0000000000..a9f8b758c9
--- /dev/null
+++ b/omnibus/config/software/chef-gem-ruby-shadow.rb
@@ -0,0 +1,6 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
diff --git a/omnibus/config/software/chef-remove-docs.rb b/omnibus/config/software/chef-remove-docs.rb
new file mode 100644
index 0000000000..2e71e63792
--- /dev/null
+++ b/omnibus/config/software/chef-remove-docs.rb
@@ -0,0 +1,33 @@
+#
+# Copyright 2012-2014 Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "chef-remove-docs"
+
+license :project_license
+
+build do
+  # This is where we get the definitions below
+  require_relative "../../files/chef/build-chef"
+  extend BuildChef
+
+  delete "#{install_dir}/embedded/docs"
+  delete "#{install_dir}/embedded/share/man"
+  delete "#{install_dir}/embedded/share/doc"
+  delete "#{install_dir}/embedded/share/gtk-doc"
+  delete "#{install_dir}/embedded/ssl/man"
+  delete "#{install_dir}/embedded/man"
+  delete "#{install_dir}/embedded/info"
+end
diff --git a/omnibus/config/software/chef.rb b/omnibus/config/software/chef.rb
new file mode 100644
index 0000000000..49db136e94
--- /dev/null
+++ b/omnibus/config/software/chef.rb
@@ -0,0 +1,90 @@
+name "chef"
+default_version "local_source"
+
+license :project_license
+
+# For the specific super-special version "local_source", build the source from
+# the local git checkout. This is what you'd want to occur by default if you
+# just ran omnibus build locally.
+version("local_source") do
+  source path: File.expand_path("../..", project.files_path),
+         # Since we are using the local repo, we try to not copy any files
+         # that are generated in the process of bundle installing omnibus.
+         # If the install steps are well-behaved, this should not matter
+         # since we only perform bundle and gem installs from the
+         # omnibus cache source directory, but we do this regardless
+         # to maintain consistency between what a local build sees and
+         # what a github based build will see.
+         options: { exclude: [ "omnibus/vendor" ] }
+end
+
+# For any version other than "local_source", fetch from github.
+if version != "local_source"
+  source git: "git://github.com/chef/chef.git"
+end
+
+# For nokogiri
+dependency "libxml2"
+dependency "libxslt"
+dependency "libiconv"
+dependency "liblzma"
+dependency "zlib"
+
+# ruby and bundler and friends
+dependency "ruby"
+dependency "rubygems"
+dependency "bundler"
+
+# Install all the native gems separately
+# Worst offenders first to take best advantage of cache:
+dependency "chef-gem-ffi-yajl"
+dependency "chef-gem-nokogiri"
+dependency "chef-gem-libyajl2"
+dependency "chef-gem-ruby-prof"
+dependency "chef-gem-byebug"
+dependency "chef-gem-debug_inspector"
+dependency "chef-gem-binding_of_caller"
+
+# Now everyone else, in alphabetical order because we don't care THAT much
+Dir.entries(File.dirname(__FILE__)).sort.each do |gem_software|
+  if gem_software =~ /^(chef-gem-.+)\.rb$/
+    dependency $1
+  end
+end
+
+build do
+  # This is where we get the definitions below
+  require_relative "../../files/chef/build-chef"
+  extend BuildChef
+
+  project_env = env.dup
+  project_env["BUNDLE_GEMFILE"] = project_gemfile
+
+  # Prepare to install: build config, retries, job, frozen=true
+  # TODO Windows install seems to sometimes install already-installed gems such
+  # as gherkin (and fail as a result) if you use jobs > 1.
+  create_bundle_config(project_gemfile, retries: 4, jobs: windows? ? 1 : 7, frozen: true)
+
+  # Install all the things. Arguments are specified in .bundle/config (see create_bundle_config)
+  block { log.info(log_key) { "" } }
+  bundle "install --verbose", env: project_env
+
+  # For whatever reason, nokogiri software def deletes this (rather small) directory
+  block { log.info(log_key) { "" } }
+  block "Remove mini_portile test dir" do
+    mini_portile = shellout!("#{bundle_bin} show mini_portile").stdout.chomp
+    remove_directory File.join(mini_portile, "test")
+  end
+
+  # Check that it worked
+  block { log.info(log_key) { "" } }
+  bundle "check", env: project_env
+
+  # fix up git-sourced gems
+  properly_reinstall_git_and_path_sourced_gems
+  install_shared_gemfile
+
+  # Check that the final gemfile worked
+  block { log.info(log_key) { "" } }
+  bundle "check", env: env, cwd: File.dirname(shared_gemfile)
+end
diff --git a/omnibus/files/chef-appbundle/build-chef-appbundle.rb b/omnibus/files/chef-appbundle/build-chef-appbundle.rb
new file mode 100644
index 0000000000..eaf4904501
--- /dev/null
+++ b/omnibus/files/chef-appbundle/build-chef-appbundle.rb
@@ -0,0 +1,93 @@
+require_relative "../chef-gem/build-chef-gem"
+
+module BuildChefAppbundle
+  include BuildChefGem
+
+  def lockdown_gem(gem_name)
+    shared_gemfile = self.shared_gemfile
+
+    # Update the Gemfile to restrict to built versions so that bundle installs
+    # will do the right thing
+    block "Lock down the #{gem_name} gem" do
+      installed_path = shellout!("#{bundle_bin} show #{gem_name}", env: env, cwd: install_dir).stdout.chomp
+      installed_gemfile = File.join(installed_path, "Gemfile")
+
+      #
+      # Include the main distribution Gemfile in the gem's Gemfile
+      #
+      # NOTE: if this fails and the build retries, you will see this multiple
+      # times in the file.
+      #
+      distribution_gemfile = Pathname(shared_gemfile).relative_path_from(Pathname(installed_gemfile)).to_s
+      gemfile_text = <<-EOM.gsub(/^\s+/, "")
+        # Lock gems that are part of the distribution
+        distribution_gemfile = File.expand_path(#{distribution_gemfile.inspect}, __FILE__)
+        instance_eval(IO.read(distribution_gemfile), distribution_gemfile)
+      EOM
+      gemfile_text << IO.read(installed_gemfile)
+      create_file(installed_gemfile) { gemfile_text }
+
+      # Remove the gemfile.lock
+      remove_file("#{installed_gemfile}.lock") if File.exist?("#{installed_gemfile}.lock")
+
+      # If it's frozen, make it not be.
+      shellout!("#{bundle_bin} config --delete frozen")
+
+      # This could be changed to `bundle install` if we wanted to actually
+      # install extra deps out of their gemfile ...
+      shellout!("#{bundle_bin} lock", env: env, cwd: installed_path)
+      # bundle lock doesn't always tell us when it fails, so we have to check :/
+      unless File.exist?("#{installed_gemfile}.lock")
+        raise "bundle lock failed: no #{installed_gemfile}.lock created!"
+      end
+
+      # Ensure all the gems we need are actually installed (if the bundle adds
+      # something, we need to know about it so we can include it in the main
+      # solve).
+      # Save bundle config and modify to use --without development before checking
+      bundle_config = File.expand_path("../.bundle/config", installed_gemfile)
+      orig_config = IO.read(bundle_config) if File.exist?(bundle_config)
+      # "test", "changelog" and "guard" come from berkshelf, "maintenance" comes from chef
+      # "tools" and "integration" come from inspec
+      shellout!("#{bundle_bin} config --local without #{without_groups.join(":")}", env: env, cwd: installed_path)
+      shellout!("#{bundle_bin} config --local frozen 1")
+
+      shellout!("#{bundle_bin} check", env: env, cwd: installed_path)
+
+      # Restore bundle config
+      if orig_config
+        create_file(bundle_config) { orig_config }
+      else
+        remove_file bundle_config
+      end
+    end
+  end
+
+  # appbundle the gem, making /opt/chef/bin/<binary> do the superfast pinning
+  # thing.
+  #
+  # To protect the app from loading the wrong versions of things, it uses
+  # appbundler against the resulting file.
+  #
+  # Relocks the Gemfiles inside the specified gems (e.g. berkshelf, test-kitchen,
+  # chef) to use the distribution's chosen gems.
+  def appbundle_gem(gem_name)
+    # First lock the gemfile down.
+    lockdown_gem(gem_name)
+
+    shared_gemfile = self.shared_gemfile
+
+    # Ensure the main bin dir exists
+    bin_dir = File.join(install_dir, "bin")
+    mkdir(bin_dir)
+
+    block "Lock down the #{gem_name} gem" do
+      installed_path = shellout!("#{bundle_bin} show #{gem_name}", env: env, cwd: install_dir).stdout.chomp
+
+      # appbundle the gem
+      appbundler_args = [ installed_path, bin_dir, gem_name ]
+      appbundler_args = appbundler_args.map { |a| ::Shellwords.escape(a) }
+      shellout!("#{appbundler_bin} #{appbundler_args.join(" ")}", env: env, cwd: installed_path)
+    end
+  end
+end
diff --git a/omnibus/files/chef-gem/build-chef-gem.rb b/omnibus/files/chef-gem/build-chef-gem.rb
new file mode 100644
index 0000000000..701461b01e
--- /dev/null
+++ b/omnibus/files/chef-gem/build-chef-gem.rb
@@ -0,0 +1,123 @@
+require "shellwords"
+require "pathname"
+require "bundler"
+require_relative "../../../version_policy"
+
+# Common definitions and helpers (like compile environment and binary
+# locations) for all software definitions.
+module BuildChefGem
+  PLATFORM_FAMILY_FAMILIES = {
+    "linux" => %w{wrlinux debian fedora rhel suse gentoo slackware arch exherbo alpine},
+    "bsd" => %w{dragonflybsd freebsd netbsd openbsd},
+    "solaris" => %w{smartos omnios openindiana opensolaris solaris2 nextentacore},
+    "aix" => %w{aix},
+    "windows" => %w{windows},
+    "mac_os_x" => %w{mac_os_x},
+  }
+  def platform_family_families
+    PLATFORM_FAMILY_FAMILIES.keys
+  end
+
+  def platform_family_family
+    PLATFORM_FAMILY_FAMILIES.
+      select { |key, families| families.include?(Omnibus::Ohai["platform_family"]) }.
+      first[0]
+  end
+
+  def embedded_bin(binary)
+    windows_safe_path("#{install_dir}/embedded/bin/#{binary}")
+  end
+
+  def appbundler_bin
+    embedded_bin("appbundler")
+  end
+
+  def bundle_bin
+    embedded_bin("bundle")
+  end
+
+  def gem_bin
+    embedded_bin("gem")
+  end
+
+  def rake_bin
+    embedded_bin("rake")
+  end
+
+  def without_groups
+    # Add --without for every known OS except the one we're in.
+    exclude_os_groups = platform_family_families - [ platform_family_family ]
+    (INSTALL_WITHOUT_GROUPS + exclude_os_groups).map { |g| g.to_sym }
+  end
+
+  #
+  # Get the path to the top level shared Gemfile included by all individual
+  # Gemfiles
+  #
+  def shared_gemfile
+    File.join(install_dir, "Gemfile")
+  end
+
+  # A common env for building everything including nokogiri and dep-selector-libgecode
+  def env
+    env = with_standard_compiler_flags(with_embedded_path, bfd_flags: true)
+
+    # From dep-selector-libgecode
+    # On some RHEL-based systems, the default GCC that's installed is 4.1. We
+    # need to use 4.4, which is provided by the gcc44 and gcc44-c++ packages.
+    # These do not use the gcc binaries so we set the flags to point to the
+    # correct version here.
+    if File.exist?("/usr/bin/gcc44")
+      env["CC"]  = "gcc44"
+      env["CXX"] = "g++44"
+    end
+
+    # From dep-selector-libgecode
+    # Ruby DevKit ships with BSD Tar
+    env["PROG_TAR"] = "bsdtar" if windows?
+    env["ARFLAGS"] = "rv #{env["ARFLAGS"]}" if env["ARFLAGS"]
+
+    # Set up nokogiri environment and args
+    env["NOKOGIRI_USE_SYSTEM_LIBRARIES"] = "true"
+    env
+  end
+
+  #
+  # Install arguments for various gems (to be passed to `gem install` or set in
+  # `bundle config build.<gemname>`).
+  #
+  def all_install_args
+    @all_install_args = {
+      "nokogiri" => %W{
+        --use-system-libraries
+        --with-xml2-lib=#{Shellwords.escape("#{install_dir}/embedded/lib")}
+        --with-xml2-include=#{Shellwords.escape("#{install_dir}/embedded/include/libxml2")}
+        --with-xslt-lib=#{Shellwords.escape("#{install_dir}/embedded/lib")}
+        --with-xslt-include=#{Shellwords.escape("#{install_dir}/embedded/include/libxslt")}
+        --with-iconv-dir=#{Shellwords.escape("#{install_dir}/embedded")}
+        --with-zlib-dir=#{Shellwords.escape("#{install_dir}/embedded")}
+      }.join(" "),
+    }
+  end
+
+  # gem install arguments for a particular gem. "" if no special args.
+  def install_args_for(gem_name)
+    all_install_args[gem_name] || ""
+  end
+
+  # Give block all the variables
+  def block(*args, &block)
+    super do
+      extend BuildChefGem
+      instance_eval(&block)
+    end
+  end
+
+  # Give build all the variables
+  def build(*args, &block)
+    super do
+      extend BuildChefGem
+      instance_eval(&block)
+    end
+  end
+end
diff --git a/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb b/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb
new file mode 100644
index 0000000000..3022bf448e
--- /dev/null
+++ b/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb
@@ -0,0 +1,118 @@
+require "bundler"
+require "omnibus"
+require_relative "../build-chef-gem"
+require_relative "../../../../tasks/gemfile_util"
+
+module BuildChefGem
+  class GemInstallSoftwareDef
+    def self.define(software, software_filename)
+      new(software, software_filename).send(:define)
+    end
+
+    include BuildChefGem
+    include Omnibus::Logging
+
+    protected
+
+    def initialize(software, software_filename)
+      @software = software
+      @software_filename = software_filename
+    end
+
+    attr_reader :software, :software_filename
+
+    def define
+      software.name "#{File.basename(software_filename)[0..-4]}"
+      software.default_version gem_version
+
+      # If the source directory for building stuff changes, tell omnibus to
+      # de-cache us
+      software.source path: File.expand_path("../..", __FILE__)
+
+      # ruby and bundler and friends
+      software.dependency "ruby"
+      software.dependency "rubygems"
+
+      gem_name = self.gem_name
+      gem_version = self.gem_version
+      gem_metadata = self.gem_metadata
+      lockfile_path = self.lockfile_path
+
+      software.build do
+        extend BuildChefGem
+
+        if gem_version == "<skip>"
+          if gem_metadata
+            block do
+              log.info(log_key) { "#{gem_name} has source #{gem_metadata} in #{lockfile_path}. We only cache rubygems.org installs in omnibus to keep things simple. The chef step will build #{gem_name} ..." }
+            end
+          else
+            block do
+              log.info(log_key) { "#{gem_name} is not in the #{lockfile_path}. This can happen if your OS doesn't build it, or if chef no longer depends on it. Skipping ..." }
+            end
+          end
+        else
+          block do
+            log.info(log_key) { "Found version #{gem_version} of #{gem_name} in #{lockfile_path}. Building early to take advantage of omnibus caching ..." }
+          end
+          gem "install #{gem_name} -v #{gem_version} --no-doc --no-ri --ignore-dependencies --verbose -- #{install_args_for(gem_name)}", env: env
+        end
+      end
+    end
+
+    # Path above omnibus (where Gemfile is)
+    def root_path
+      File.expand_path("../../../../..", __FILE__)
+    end
+
+    def gemfile_path
+      File.join(root_path, "Gemfile")
+    end
+
+    def lockfile_path
+      "#{gemfile_path}.lock"
+    end
+
+    def gem_name
+      @gem_name ||= begin
+        # File must be named chef-<gemname>.rb
+        # Will look at chef/Gemfile.lock and install that version of the gem using "gem install"
+        # (and only that version)
+        if File.basename(software_filename) =~ /^chef-gem-(.+)\.rb$/
+          $1
+        else
+          raise "#{software_filename} must be named chef-<gemname>.rb to build a gem automatically"
+        end
+      end
+    end
+
+    def gem_metadata
+      @gem_metadata ||= begin
+        bundle = GemfileUtil::Bundle.parse(gemfile_path, lockfile_path)
+        result = bundle.gems[gem_name]
+        if result
+          if bundle.select_gems(without_groups: without_groups).include?(gem_name)
+            log.info(software.name) { "Using #{gem_name} version #{result[:version]} from #{gemfile_path}" }
+            result
+          else
+            log.info(software.name) { "#{gem_name} not loaded from #{gemfile_path} because it was only in groups #{without_groups.join(", ")}. Skipping ..." }
+            nil
+          end
+        else
+          log.info(software.name) { "#{gem_name} was not found in #{lockfile_path}. Skipping ..." }
+          nil
+        end
+      end
+    end
+
+    def gem_version
+      @gem_version ||= begin
+        if gem_metadata && URI(gem_metadata[:source]) == URI("https://rubygems.org/")
+          gem_metadata[:version]
+        else
+          "<skip>"
+        end
+      end
+    end
+  end
+end
diff --git a/omnibus/files/chef/build-chef.rb b/omnibus/files/chef/build-chef.rb
new file mode 100644
index 0000000000..e0e0d9928d
--- /dev/null
+++ b/omnibus/files/chef/build-chef.rb
@@ -0,0 +1,137 @@
+require "shellwords"
+require "pathname"
+require "bundler"
+require_relative "../chef-gem/build-chef-gem"
+require_relative "../../../version_policy"
+
+# We use this to break up the `build` method into readable parts
+module BuildChef
+  include BuildChefGem
+
+  def create_bundle_config(gemfile, without: without_groups, retries: nil, jobs: nil, frozen: nil)
+    bundle_config = File.expand_path("../.bundle/config", gemfile)
+
+    block "Put build config into #{bundle_config}: #{ { without: without, retries: retries, jobs: jobs, frozen: frozen } }" do
+      # bundle config build.nokogiri #{nokogiri_build_config} messes up the line,
+      # so we write it directly ourselves.
+      new_bundle_config = "---\n"
+      new_bundle_config << "BUNDLE_WITHOUT: #{Array(without).join(":")}\n" if without
+      new_bundle_config << "BUNDLE_RETRY: #{retries}\n" if retries
+      new_bundle_config << "BUNDLE_JOBS: #{jobs}\n" if jobs
+      new_bundle_config << "BUNDLE_FROZEN: '1'\n" if frozen
+      all_install_args.each do |gem_name, install_args|
+        new_bundle_config << "BUNDLE_BUILD__#{gem_name.upcase}: #{install_args}\n"
+      end
+      create_file(bundle_config) { new_bundle_config }
+    end
+  end
+
+  #
+  # Get the (possibly platform-specific) path to the Gemfile.
+  #
+  def project_gemfile
+    File.join(project_dir, "Gemfile")
+  end
+
+  #
+  # Some gems we installed don't end up in the `gem list` due to the fact that
+  # they have git sources (`gem 'chef', github: 'chef/chef'`) or paths (`gemspec`
+  # or `gem 'chef-config', path: 'chef-config'`). To get them in there, we need
+  # to go through these gems, run `rake install` from their top level, and
+  # then delete the git cached versions.
+  #
+  # Once we finish with all this, we update the Gemfile that will end up in the
+  # top-level install so that it doesn't have git or path references anymore.
+  #
+  def properly_reinstall_git_and_path_sourced_gems
+    # Emit blank line to separate different tasks
+    block { log.info(log_key) { "" } }
+    project_env = env.dup.merge("BUNDLE_GEMFILE" => project_gemfile)
+
+    # Reinstall git-sourced or path-sourced gems, and delete the originals
+    block "Reinstall git-sourced gems properly" do
+      # Grab info about the gem environment so we can make decisions
+      gemdir = shellout!("#{gem_bin} environment gemdir", env: env).stdout.chomp
+      gem_install_dir = File.join(gemdir, "gems")
+
+      # bundle list --paths gets us the list of gem install paths. Get the ones
+      # that are installed local (git and path sources like `gem :x, github: 'chef/x'`
+      # or `gem :x, path: '.'` or `gemspec`). To do this, we just detect which ones
+      # have properly-installed paths (in the `gems` directory that shows up when
+      # you run `gem list`).
+      locally_installed_gems = shellout!("#{bundle_bin} list --paths", env: project_env, cwd: project_dir).
+        stdout.lines.select { |gem_path| !gem_path.start_with?(gem_install_dir) }
+
+      # Install the gems for real using `rake install` in their directories
+      locally_installed_gems.each do |gem_path|
+        gem_path = gem_path.chomp
+        # We use the already-installed bundle to rake install, because (hopefully)
+        # just rake installing doesn't require anything special.
+        # Emit blank line to separate different tasks
+        log.info(log_key) { "" }
+        log.info(log_key) { "Properly installing git or path sourced gem #{gem_path} using rake install" }
+        shellout!("#{bundle_bin} exec #{rake_bin} install", env: project_env, cwd: gem_path)
+      end
+    end
+  end
+
+  def install_shared_gemfile
+    # Emit blank line to separate different tasks
+    block { log.info(log_key) { "" } }
+
+    shared_gemfile = self.shared_gemfile
+    project_env = env.dup.merge("BUNDLE_GEMFILE" => project_gemfile)
+
+    # Show the config for good measure
+    bundle "config", env: project_env
+
+    # Make `Gemfile` point to these by removing path and git sources and pinning versions.
+    block "Rewrite Gemfile using all properly-installed gems" do
+      gem_pins = ""
+      result = []
+      shellout!("#{bundle_bin} list", env: project_env).stdout.lines.map do |line|
+        if line =~ /^\s*\*\s*(\S+)\s+\((\S+).*\)\s*$/
+          name, version = $1, $2
+          # rubocop is an exception, since different projects disagree
+          next if GEMS_ALLOWED_TO_FLOAT.include?(name)
+          gem_pins << "gem #{name.inspect}, #{version.inspect}, override: true\n"
+        end
+      end
+
+      # Find the installed chef gem by looking for lib/chef.rb
+      chef_gem = File.expand_path("../..", shellout!("#{gem_bin} which chef", env: project_env).stdout.chomp)
+      # Figure out the path to gemfile_util from there
+      gemfile_util = Pathname.new(File.join(chef_gem, "tasks", "gemfile_util"))
+      gemfile_util = gemfile_util.relative_path_from(Pathname.new(shared_gemfile).dirname)
+
+      create_file(shared_gemfile) { <<-EOM }
+        # Meant to be included in component Gemfiles at the beginning with:
+        #
+        #     instance_eval(IO.read("#{install_dir}/Gemfile"), "#{install_dir}/Gemfile")
+        #
+        # Override any existing gems with our own.
+        require_relative "#{gemfile_util}"
+        extend GemfileUtil
+        #{gem_pins}
+      EOM
+    end
+
+    shared_gemfile_env = env.dup.merge("BUNDLE_GEMFILE" => shared_gemfile)
+
+    # Create a `Gemfile.lock` at the final location
+    bundle "lock", env: shared_gemfile_env
+
+    # Freeze the location's Gemfile.lock.
+    # TODO Windows cannot be frozen, because Bundler doesn't understand platform-specific
+    # versions. However, on Windows we have explicit version pins for most things, so
+    # we will *probably* get the exact versions of everything we want.
+    create_bundle_config(shared_gemfile, frozen: !windows?)
+
+    # Clear the now-unnecessary git caches, cached gems, and git-checked-out gems
+    block "Delete bundler git cache and git installs" do
+      gemdir = shellout!("#{gem_bin} environment gemdir", env: env).stdout.chomp
+      remove_file "#{gemdir}/cache"
+      remove_file "#{gemdir}/bundler"
+    end
+  end
+end
diff --git a/omnibus_overrides.rb b/omnibus_overrides.rb
new file mode 100644
index 0000000000..17d0dc4b89
--- /dev/null
+++ b/omnibus_overrides.rb
@@ -0,0 +1,18 @@
+# DO NOT EDIT. Generated by "rake dependencies". Edit version_policy.rb instead.
+override :rubygems, version: "2.6.3"
+override :bundler, version: "1.11.2"
+override "libffi", version: "3.2.1"
+override "libiconv", version: "1.14"
+override "liblzma", version: "5.2.2"
+override "libtool", version: "2.4.2"
+override "libxml2", version: "2.9.3"
+override "libxslt", version: "1.1.28"
+override "libyaml", version: "0.1.6"
+override "makedepend", version: "1.0.5"
+override "ncurses", version: "5.9"
+override "pkg-config-lite", version: "0.28-1"
+override "ruby", version: "2.1.8"
+override "ruby-windows-devkit-bash", version: "3.1.23-4-msys-1.0.18"
+override "util-macros", version: "1.19.0"
+override "xproto", version: "7.0.28"
+override "zlib", version: "1.2.8"
diff --git a/pedant.gemfile b/pedant.gemfile
deleted file mode 100644
index 3302bccfe1..0000000000
--- a/pedant.gemfile
+++ /dev/null
@@ -1,25 +0,0 @@
-source "https://rubygems.org"
-gemspec :name => "chef"
-
-# TODO figure out how to grab this stuff from the main Gemfile
-gem "activesupport", "< 4.0.0", :group => :compat_testing, :platform => "ruby"
-
-# We are pinning chef-zero to 4.2.x until ChefFS can deal
-# with V1 api calls or chef-zero supports both v0 and v1
-gem "chef-zero", "~> 4.2.3"
-
-group(:docgen) do
-  gem "tomlrb"
-  gem "yard"
-end
-
-group(:development, :test) do
-  gem "simplecov"
-  gem 'rack', "~> 1.5.1"
-
-  gem 'ruby-shadow', :platforms => :ruby unless RUBY_PLATFORM.downcase.match(/(aix|cygwin)/)
-end
-
-# If you want to load debugging tools into the bundle exec sandbox,
-# add these additional dependencies into chef/Gemfile.local
-eval(IO.read(__FILE__ + '.local'), binding) if File.exists?(__FILE__ + '.local')
diff --git a/tasks/bin/bundle-platform b/tasks/bin/bundle-platform
new file mode 100755
index 0000000000..7c77393cb1
--- /dev/null
+++ b/tasks/bin/bundle-platform
@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+platforms = ARGV.shift
+old_platforms = Gem.platforms
+Gem.platforms = platforms.split(" ").map { |p| Gem::Platform.new(p) }
+puts "bundle-platform set Gem.platforms to #{Gem.platforms.map { |p| p.to_s }} (was #{old_platforms.map { |p| p.to_s } })"
+
+# The rest of this is a normal bundler binstub
+require "pathname"
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../../Gemfile",
+  Pathname.new(__FILE__).realpath)
+
+require "rubygems"
+
+load Gem.bin_path("bundler", "bundle")
diff --git a/tasks/bin/bundle-platform.bat b/tasks/bin/bundle-platform.bat
new file mode 100644
index 0000000000..d193eb0c05
--- /dev/null
+++ b/tasks/bin/bundle-platform.bat
@@ -0,0 +1,2 @@
+@ECHO OFF
+ruby "%~dpn0" %*
diff --git a/tasks/bin/create-override-gemfile b/tasks/bin/create-override-gemfile
new file mode 100755
index 0000000000..b67da025d2
--- /dev/null
+++ b/tasks/bin/create-override-gemfile
@@ -0,0 +1,110 @@
+#!/usr/bin/env ruby
+
+require "rubygems"
+require "bundler"
+
+Bundler.with_clean_env do
+  require_relative "../gemfile_util"
+
+  options = {}
+  opts = OptionParser.new do |opts|
+    opts.banner = "Usage: create-override-gemfile [OPTIONS]"
+
+    opts.on("--gemfile GEMFILE", "The Gemfile to read (default: Gemfile).") { |path| options[:gemfile_path] = path }
+    opts.on("--lockfile GEMFILE", "The lockfile to read (default: <gemfile>.lock).") { |path| options[:lockfile_path] = path }
+
+    opts.on("--group GROUP", "Groups to include (whitelist).") do |group|
+      options[:groups] ||= []
+      options[:groups] << group.to_sym
+    end
+
+    opts.on("--without GROUP", "Groups to exclude.") do |group|
+      options[:without_groups] ||= []
+      options[:without_groups] << group.to_sym
+    end
+
+    opts.on("--gem GEM", "Gems to include regardless of groups.") do |name|
+      options[:gems] ||= []
+      options[:gems] << name
+    end
+
+    opts.on("--relative-to PATH", "A path to prepend to any relative paths in the Gemfile.") do |path|
+      unless Pathname.new(path).absolute?
+        puts opts
+        raise "--relative-to #{path} was not an absolute path!"
+      end
+      options[:relative_to] = path
+    end
+
+    opts.on("--[no-]copy-groups", "Whether to copy groups over from the original Gemfile or not (default: false).") { |val| options[:copy_groups] = val }
+
+    opts.on("--[no-]override", "Whether to emit override: true on each gem line (default: false).") { |val| options[:override] = val }
+
+    opts.on("-h", "--help", "Print this message.") do
+      puts opts
+      exit(0)
+    end
+  end
+
+  args = opts.parse(ARGV)
+
+  if args.size > 0
+    puts opts
+    raise "Invalid arguments #{args}"
+  end
+
+  def create_override_gemfile(gemfile_path: "Gemfile", lockfile_path: "#{gemfile_path}.lock", groups: nil, without_groups: nil, gems: [], copy_groups: false, relative_to: ".", override: false)
+    relative_to = Pathname.new(relative_to).realpath
+    # Select the gems we want
+    bundle = GemfileUtil::Bundle.parse(gemfile_path, lockfile_path)
+    gems_to_include = bundle.select_gems(groups: groups, without_groups: without_groups)
+    gems.each do |name|
+      raise "Requested gem #{name} is not in #{gemfile_path}.lock!" if !bundle.gems[name]
+      gems_to_include[name] ||= bundle.gems[name]
+      gems_to_include[name][:dependencies].each do |dep|
+        gems_to_include[name] ||= bundle.gems[dep]
+      end
+    end
+
+    # Add the gems to the Gemfile
+    gem_root = Pathname.new(gemfile_path).dirname.realpath
+    gems_to_include.sort_by { |name, options| options[:declared_groups].empty? ? 1 : 0 }.each do |name, options|
+      comment = nil
+      options = options.dup
+      version = options.delete(:version)
+      if copy_groups
+        # Some dependencies have no groups (are not in the Gemfile--just runtime
+        # dependencies). If we actually record that they have no groups, they
+        # will *always* be installed (or perhaps never). We only want them to
+        # install if their other deps do, so we mark them with the groups of the
+        # things that brought them in (the gems that depended on them). To do
+        # this, we just leave :groups intact.
+        if options[:declared_groups].empty?
+          options.delete(:declared_groups)
+          comment = " # Transitive dependency, not actually in original Gemfile"
+        else
+          # For other things, we want to copy the actual declared_groups--the
+          # ones that were in the Gemfile. We want the same --with and --without
+          # options to include and exclude them as worked with the original
+          # Gemfile.
+          options[:groups] = options.delete(:declared_groups)
+        end
+      else
+        options.delete(:groups)
+        options.delete(:declared_groups)
+      end
+      options.delete(:dependencies)
+      options.delete(:development_dependencies)
+      options[:override] = true if override
+      options[:path] = Pathname.new(options[:path]).expand_path(gem_root).relative_path_from(relative_to).to_s if options[:path]
+      line = "gem #{name.inspect}, #{version.inspect}"
+      options.each do |name, value|
+        line << ", #{name}: #{value.inspect}"
+      end
+      line << comment if comment
+      puts line
+    end
+  end
+
+  create_override_gemfile(options)
+end
diff --git a/tasks/bin/run_chef_tests b/tasks/bin/run_chef_tests
new file mode 100755
index 0000000000..567c6a9587
--- /dev/null
+++ b/tasks/bin/run_chef_tests
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Fail fast (e) and echo commands (vx)
+set -evx
+
+echo --color > .rspec
+echo -fp >> .rspec
+sudo sed -i -e 's/^Defaults\tsecure_path.*$//' /etc/sudoers;
+sudo -E $(which bundle) exec rake spec;
+bundle exec rake style;
+bundle exec bundle-audit check --update;
diff --git a/tasks/bin/run_external_test b/tasks/bin/run_external_test
new file mode 100755
index 0000000000..74f76d3229
--- /dev/null
+++ b/tasks/bin/run_external_test
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Fail fast (e) and echo commands (vx)
+set -evx
+
+# Arguments
+TEST_GEM=$1
+shift
+
+PROJECT_ROOT=$(pwd)
+PROJECT_BUNDLE_PATH=${BUNDLE_PATH:-$(grep BUNDLE_PATH: $PROJECT_ROOT/.bundle/config | cut -d' ' -f2-)}
+if [ -n "$PROJECT_BUNDLE_PATH" ]; then
+  PROJECT_BUNDLE_PATH=$PROJECT_ROOT/$PROJECT_BUNDLE_PATH
+fi
+
+TEST_GEM_ROOT=$(bundle show $TEST_GEM)
+
+# Make a copy of the original Gemfile and stitch in our Gemfile.lock
+TEST_GEMFILE=$TEST_GEM_ROOT/Gemfile
+MODIFIED_TEST_GEMFILE=$TEST_GEMFILE.externaltest
+cat <<EOM > $MODIFIED_TEST_GEMFILE
+require_relative "$PROJECT_ROOT/tasks/gemfile_util"
+GemfileUtil.include_locked_gemfile(self, "$PROJECT_ROOT/Gemfile", gems: ["$TEST_GEM"] + "$TEST_WITH_GEMS".split(/\s+/))
+$TEST_GEM_OVERRIDES
+EOM
+cat $TEST_GEMFILE >> $MODIFIED_TEST_GEMFILE
+if [ -f $TEST_GEMFILE.lock ]; then
+  cp $TEST_GEMFILE.lock $MODIFIED_TEST_GEMFILE.lock
+elif [ -f $MODIFIED_TEST_GEMFILE.lock ]; then
+  rm -f $MODIFIED_TEST_GEMFILE.lock
+fi
+
+# Run the bundle install
+cd $TEST_GEM_ROOT
+export BUNDLE_GEMFILE=$MODIFIED_TEST_GEMFILE
+# Don't read from the project .bundle/config, just our env vars
+export BUNDLE_IGNORE_CONFIG=true
+# Use the top level bundle cache so we don't have to reinstall their packages
+if [ -n "$PROJECT_BUNDLE_PATH" ]; then
+  export BUNDLE_PATH=$PROJECT_BUNDLE_PATH
+fi
+export BUNDLE_FROZEN=
+bundle install
+export BUNDLE_FROZEN=true
+
+bundle config
+bundle exec $@
diff --git a/tasks/bundle.rb b/tasks/bundle.rb
new file mode 100644
index 0000000000..9de4529d1a
--- /dev/null
+++ b/tasks/bundle.rb
@@ -0,0 +1,73 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "bundle_util"
+require_relative "../version_policy"
+require "fileutils"
+
+desc "Tasks to work with the main Gemfile and Gemfile.<platform>"
+namespace :bundle do
+  desc "Update Gemfile.lock and all Gemfile.<platform>.locks (or one or more gems via bundle:update gem1 gem2 ...)."
+  task :update, [:args] do |t, rake_args|
+    extend BundleUtil
+    args = rake_args[:args] || ""
+    with_bundle_unfrozen do
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating Gemfile.lock ..."
+      puts "-------------------------------------------------------------------"
+      bundle "install #{args}", delete_gemfile_lock: true
+      platforms.each do |platform|
+        bundle "lock", platform: platform
+      end
+    end
+  end
+
+  desc "Conservatively update Gemfile.lock and all Gemfile.<platform>.locks"
+  task :install, [:args] do |t, rake_args|
+    extend BundleUtil
+    args = rake_args[:args] || ""
+    with_bundle_unfrozen do
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating Gemfile.lock ..."
+      puts "-------------------------------------------------------------------"
+      bundle "install #{args}"
+      platforms.each do |platform|
+        bundle "lock", platform: platform
+      end
+    end
+  end
+end
+
+desc "Run bundle with arbitrary args against the given platform; e.g. rake bundle[show]. No platform to run against the main bundle; bundle[show,windows] to run the windows one; bundle[show,*] to run against all non-default platforms."
+task :bundle, [:args, :platform] do |t, rake_args|
+  extend BundleUtil
+  args = rake_args[:args] || ""
+  platform = rake_args[:platform]
+  with_bundle_unfrozen do
+    if platform == "*"
+      platforms.each do |platform|
+        bundle args, platform: platform
+      end
+    elsif platform
+      bundle args, platform: platform
+    else
+      bundle args
+    end
+  end
+end
diff --git a/tasks/bundle_util.rb b/tasks/bundle_util.rb
new file mode 100644
index 0000000000..a057db858a
--- /dev/null
+++ b/tasks/bundle_util.rb
@@ -0,0 +1,94 @@
+require "bundler"
+require "shellwords"
+
+module BundleUtil
+  PLATFORMS = { "windows" => %w{ruby x86-mingw32} }
+
+  def project_root
+    File.expand_path("../..", __FILE__)
+  end
+
+  def bundle_platform
+    File.join(project_root, "tasks", "bin", "bundle-platform")
+  end
+
+  # Parse the output of "bundle outdated" and get the list of gems that
+  # were outdated
+  def parse_bundle_outdated(bundle_outdated_output)
+    result = []
+    bundle_outdated_output.each_line do |line|
+      if line =~ /^\s*\* (.+) \(newest ([^,]+), installed ([^,)])*/
+        gem_name, newest_version, installed_version = $1, $2, $3
+        result << [ line, gem_name ]
+      end
+    end
+    result
+  end
+
+  def with_bundle_unfrozen(cwd: nil, leave_frozen: false)
+    bundle "config --delete frozen", cwd: cwd
+    begin
+      yield
+    ensure
+      bundle "config --local frozen 1", cwd: cwd unless leave_frozen
+    end
+  end
+
+  # Run bundle-platform with the given ruby platform(s)
+  def bundle(args, gemfile: nil, platform: nil, cwd: nil, extract_output: false, delete_gemfile_lock: false)
+    args = args.split(/\s+/)
+    if cwd
+      prefix = "[#{cwd}] "
+    end
+    cwd = File.expand_path(cwd || ".", project_root)
+    Bundler.with_clean_env do
+      Dir.chdir(cwd) do
+        gemfile ||= "Gemfile"
+        gemfile = File.expand_path(gemfile, cwd)
+        raise "No platform #{platform} (supported: #{PLATFORMS.keys.join(", ")})" if platform && !PLATFORMS[platform]
+
+        # First delete the gemfile.lock
+        if delete_gemfile_lock
+          if File.exist?("#{gemfile}.lock")
+            puts "Deleting #{gemfile}.lock ..."
+            File.delete("#{gemfile}.lock")
+          end
+        end
+
+        # Run the bundle command
+        ruby_platforms = platform ? PLATFORMS[platform].join(" ") : "ruby"
+        cmd = Shellwords.join([Gem.ruby, "-S", bundle_platform, ruby_platforms, *args])
+        puts "#{prefix}#{Shellwords.join(["bundle", *args])}#{platform ? " for #{platform} platform" : ""}:"
+        with_gemfile(gemfile) do
+          puts "#{prefix}BUNDLE_GEMFILE=#{gemfile}"
+          puts "#{prefix}> #{cmd}"
+          if extract_output
+            `#{cmd}`
+          else
+            unless system(bundle_platform, ruby_platforms, *args)
+              raise "#{bundle_platform} failed: exit code #{$?}"
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def with_gemfile(gemfile)
+    old_gemfile = ENV["BUNDLE_GEMFILE"]
+    ENV["BUNDLE_GEMFILE"] = gemfile
+    begin
+      yield
+    ensure
+      if old_gemfile
+        ENV["BUNDLE_GEMFILE"] = old_gemfile
+      else
+        ENV.delete("BUNDLE_GEMFILE")
+      end
+    end
+  end
+
+  def platforms
+    PLATFORMS.keys
+  end
+end
diff --git a/tasks/changelog.rb b/tasks/changelog.rb
new file mode 100644
index 0000000000..fda94764ae
--- /dev/null
+++ b/tasks/changelog.rb
@@ -0,0 +1,12 @@
+begin
+  require "github_changelog_generator/task"
+
+  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
+    config.future_release = Chef::VERSION
+    config.enhancement_labels = "enhancement,Enhancement,New Feature,Feature".split(",")
+    config.bug_labels = "bug,Bug,Improvement,Upstream Bug".split(",")
+    config.exclude_labels = "duplicate,question,invalid,wontfix,no_changelog,Exclude From Changelog,Question,Discussion".split(",")
+  end
+rescue LoadError
+  puts "github_changelog_generator is not available. gem install github_changelog_generator to generate changelogs"
+end
diff --git a/tasks/dependencies.rb b/tasks/dependencies.rb
new file mode 100644
index 0000000000..eb5b20d1bb
--- /dev/null
+++ b/tasks/dependencies.rb
@@ -0,0 +1,171 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "bundle_util"
+require_relative "bundle"
+require_relative "../version_policy"
+
+desc "Tasks to update and check dependencies"
+namespace :dependencies do
+  # Update all dependencies to the latest constraint-matching version
+  desc "Update all dependencies. dependencies:update[conservative] to update as little as possible."
+  task :update, [:conservative] => %w{
+                    dependencies:update_gemfile_lock
+                    dependencies:update_omnibus_overrides
+                    dependencies:update_omnibus_gemfile_lock
+                    dependencies:update_acceptance_gemfile_lock
+                    dependencies:update_kitchen_tests_gemfile_lock
+                    dependencies:update_kitchen_tests_berksfile_lock
+                  }
+
+  desc "Update Gemfile.lock and all Gemfile.<platform>.locks. update_gemfile_lock[conservative] to update as little as possible."
+  task :update_gemfile_lock, [:conservative] do |t, rake_args|
+    conservative = rake_args[:conservative]
+    if conservative
+      Rake::Task["bundle:install"].invoke
+    else
+      Rake::Task["bundle:update"].invoke
+    end
+  end
+
+  def gemfile_lock_task(task_name, dirs: [], other_platforms: true, leave_frozen: true)
+    dirs.each do |dir|
+      desc "Update #{dir}/Gemfile.lock. #{task_name}[conservative] to update as little as possible."
+      task task_name, [:conservative] do |t, rake_args|
+        extend BundleUtil
+        conservative = rake_args[:conservative]
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating #{dir}/Gemfile.lock#{conservative ? " (conservatively)" : ""} ..."
+        puts "-------------------------------------------------------------------"
+        with_bundle_unfrozen(cwd: dir, leave_frozen: leave_frozen) do
+          bundle "install", cwd: dir, delete_gemfile_lock: !conservative
+          if other_platforms
+            # Include all other supported platforms into the lockfile as well
+            platforms.each do |platform|
+              bundle "lock", cwd: dir, platform: platform
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def berksfile_lock_task(task_name, dirs: [])
+    dirs.each do |dir|
+      desc "Update #{dir}/Berksfile.lock. #{task_name}[conservative] to update as little as possible."
+      task task_name, [:conservative] do |t, rake_args|
+        extend BundleUtil
+        conservative = rake_args[:conservative]
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating #{dir}/Berksfile.lock#{conservative ? " (conservatively)" : ""} ..."
+        puts "-------------------------------------------------------------------"
+        if !conservative && File.exist?("#{project_root}/#{dir}/Berksfile.lock")
+          File.delete("#{project_root}/#{dir}/Berksfile.lock")
+        end
+        Dir.chdir("#{project_root}/#{dir}") do
+          Bundler.with_clean_env do
+            sh "bundle exec berks install"
+          end
+        end
+      end
+    end
+  end
+
+  gemfile_lock_task :update_omnibus_gemfile_lock, dirs: %w{omnibus}
+  gemfile_lock_task :update_acceptance_gemfile_lock, dirs: %w{acceptance},
+                                                     other_platforms: false, leave_frozen: false
+  gemfile_lock_task :update_kitchen_tests_gemfile_lock, dirs: %w{
+    kitchen-tests
+    kitchen-tests/test/integration/webapp/serverspec
+  }
+  berksfile_lock_task :update_kitchen_tests_berksfile_lock, dirs: %w{
+    kitchen-tests
+    kitchen-tests/cookbooks/audit_test
+  }
+  # kitchen-tests/cookbooks/webapp isn't solving right now ....
+
+  desc "Update omnibus overrides, including versions in version_policy.rb and latest version of gems: #{OMNIBUS_RUBYGEMS_AT_LATEST_VERSION.keys}. update_omnibus_overrides[conservative] does nothing."
+  task :update_omnibus_overrides, [:conservative] do |t, rake_args|
+    conservative = rake_args[:conservative]
+    unless conservative
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating omnibus_overrides.rb ..."
+      puts "-------------------------------------------------------------------"
+
+      # Generate the new overrides file
+      overrides = "# DO NOT EDIT. Generated by \"rake dependencies\". Edit version_policy.rb instead.\n"
+
+      # Replace the bundler and rubygems versions
+      OMNIBUS_RUBYGEMS_AT_LATEST_VERSION.each do |override_name, gem_name|
+        # Get the latest bundler version
+        puts "Running gem list -r #{gem_name} ..."
+        gem_list = `gem list -r #{gem_name}`
+        unless gem_list =~ /^#{gem_name}\s*\(([^)]*)\)$/
+          raise "gem list -r #{gem_name} failed with output:\n#{gem_list}"
+        end
+
+        # Emit it
+        puts "Latest version of #{gem_name} is #{$1}"
+        overrides << "override #{override_name.inspect}, version: #{$1.inspect}\n"
+      end
+
+      # Add explicit overrides
+      OMNIBUS_OVERRIDES.each do |override_name, version|
+        overrides << "override #{override_name.inspect}, version: #{version.inspect}\n"
+      end
+
+      # Write the file out (if changed)
+      overrides_path = File.expand_path("../../omnibus_overrides.rb", __FILE__)
+      if overrides != IO.read(overrides_path)
+        puts "Overrides changed!"
+        puts `git diff #{overrides_path}`
+        puts "Writing modified #{overrides_path} ..."
+        IO.write(overrides_path, overrides)
+      end
+    end
+  end
+
+  # Find out if we're using the latest gems we can (so we don't regress versions)
+  desc "Check for gems that are not at the latest released version, and report if anything not in ACCEPTABLE_OUTDATED_GEMS (version_policy.rb) is out of date."
+  task :check_outdated do
+    extend BundleUtil
+    puts ""
+    puts "-------------------------------------------------------------------"
+    puts "Checking for outdated gems ..."
+    puts "-------------------------------------------------------------------"
+    # TODO check for outdated windows gems too
+    with_bundle_unfrozen do
+      bundle_outdated = bundle("outdated", extract_output: true)
+      puts bundle_outdated
+      outdated_gems = parse_bundle_outdated(bundle_outdated).map { |line, gem_name| gem_name }
+      # Weed out the acceptable ones
+      outdated_gems = outdated_gems.reject { |gem_name| ACCEPTABLE_OUTDATED_GEMS.include?(gem_name) }
+      if outdated_gems.empty?
+        puts ""
+        puts "SUCCESS!"
+      else
+        raise "ERROR: outdated gems: #{outdated_gems.join(", ")}. Either fix them or add them to ACCEPTABLE_OUTDATED_GEMS in #{__FILE__}."
+      end
+    end
+  end
+end
+desc "Update all dependencies and check for outdated gems. Call dependencies[conservative] to update as little as possible."
+task :dependencies, [:conservative] => [ "dependencies:update", "dependencies:check_outdated" ]
+task :update, [:conservative] => [ "dependencies:update", "dependencies:check_outdated"]
diff --git a/tasks/external_tests.rb b/tasks/external_tests.rb
deleted file mode 100644
index a909ec2178..0000000000
--- a/tasks/external_tests.rb
+++ /dev/null
@@ -1,64 +0,0 @@
-require "tempfile"
-require "bundler"
-
-CURRENT_GEM_NAME = "chef"
-CURRENT_GEM_PATH = File.expand_path("../..", __FILE__)
-
-def bundle_exec_with_chef(test_gem, commands)
-  gem_path = Bundler.environment.specs[test_gem].first.full_gem_path
-  gemfile_path = File.join(gem_path, "Gemfile.#{CURRENT_GEM_NAME}-external-test")
-  gemfile = File.open(gemfile_path, "w")
-  begin
-    IO.read(File.join(gem_path, "Gemfile")).each_line do |line|
-      if line =~ /^\s*gemspec/
-        next
-      elsif line =~ /^\s*gem '#{CURRENT_GEM_NAME}'|\s*gem "#{CURRENT_GEM_NAME}"/
-        next
-      elsif line =~ /^\s*dev_gem\s*['"](.+)['"]\s*$/
-        line = "gem '#{$1}', github: 'poise/#{$1}'"
-      elsif line =~ /\s*gem\s*['"]#{test_gem}['"]/ # foodcritic      end
-        next
-      end
-      gemfile.puts(line)
-    end
-    gemfile.puts("gem #{CURRENT_GEM_NAME.inspect}, path: #{CURRENT_GEM_PATH.inspect}")
-    gemfile.puts("gemspec path: #{gem_path.inspect}")
-    gemfile.close
-    Dir.chdir(gem_path) do
-      Bundler.with_clean_env do
-        unless system({ "BUNDLE_GEMFILE" => gemfile_path, "RUBYOPT" => nil, "GEMFILE_MOD" => nil }, "bundle update")
-          raise "Error running bundle update of #{gemfile_path} in #{gem_path}: #{$?.exitstatus}\nGemfile:\n#{IO.read(gemfile_path)}"
-        end
-        Array(commands).each do |command|
-          unless system({ "BUNDLE_GEMFILE" => gemfile_path, "RUBYOPT" => nil, "GEMFILE_MOD" => nil }, "bundle exec #{command}")
-            raise "Error running bundle exec #{command} in #{gem_path} with BUNDLE_GEMFILE=#{gemfile_path}: #{$?.exitstatus}\nGemfile:\n#{IO.read(gemfile_path)}"
-          end
-        end
-      end
-    end
-  ensure
-    File.delete(gemfile_path) if File.exist?(gemfile_path)
-  end
-end
-
-EXTERNAL_PROJECTS = {
-  "chef-zero"             => [ "rake spec", "rake cheffs" ],
-  "cheffish"              => "rake spec",
-  "chef-provisioning"     => "rake spec",
-  "chef-provisioning-aws" => "rake spec",
-  "chef-sugar"            => "rake",
-  "foodcritic"            => "rake test",
-  "chefspec"              => "rake",
-  "chef-rewind"           => "rake spec",
-  "poise"                 => "rake spec",
-  "halite"                => "rake spec",
-  "knife-windows"         => "rake unit_spec",
-}
-
-task :external_specs => EXTERNAL_PROJECTS.keys.map { |g| :"#{g.sub("-", "_")}_spec" }
-
-EXTERNAL_PROJECTS.each do |test_gem, commands|
-  task :"#{test_gem.tr("-", "_")}_spec" do
-    bundle_exec_with_chef(test_gem, commands)
-  end
-end
diff --git a/tasks/gemfile_util.rb b/tasks/gemfile_util.rb
new file mode 100644
index 0000000000..e21299705a
--- /dev/null
+++ b/tasks/gemfile_util.rb
@@ -0,0 +1,390 @@
+require "rubygems"
+require "bundler"
+require "shellwords"
+require "set"
+
+module GemfileUtil
+  #
+  # Adds `override: true`, which allows your statement to override any other
+  # gem statement about the same gem in the Gemfile.
+  #
+  def gem(name, *args)
+    options = args[-1].is_a?(Hash) ? args[-1] : {}
+
+    # Unless we're finished with everything, ignore gems that are being overridden
+    unless overridden_gems == :finished
+      # If it's a path or override gem, it overrides whatever else is there.
+      if options[:path] || options[:override]
+        options.delete(:override)
+        warn_if_replacing(name, overridden_gems[name], args)
+        overridden_gems[name] = args
+        return
+
+      # If there's an override gem, and we're *not* an override gem, don't do anything
+      elsif overridden_gems[name]
+        warn_if_replacing(name, args, overridden_gems[name])
+        return
+      end
+    end
+
+    # Otherwise, add the gem normally
+    super
+  rescue
+    puts $!.backtrace
+    raise
+  end
+
+  def overridden_gems
+    @overridden_gems ||= {}
+  end
+
+  #
+  # Just before we finish the Gemfile, finish up the override gems
+  #
+  def to_definition(*args)
+    complete_overrides
+    super
+  end
+
+  def complete_overrides
+    to_override = overridden_gems
+    unless to_override == :finished
+      @overridden_gems = :finished
+      to_override.each do |name, args|
+        gem name, *args
+      end
+    end
+  end
+
+  #
+  # Include all gems in the locked gemfile.
+  #
+  # @param gemfile_path Path to the Gemfile to load (relative to your Gemfile)
+  # @param lockfile_path Path to the Gemfile to load (relative to your Gemfile).
+  #          Defaults to <gemfile_path>.lock.
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #          to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #          the results if all groups they belong to are ignored. This matches
+  #          bundler's `without` behavior.
+  # @param gems A list of gems to include above and beyond the given groups.
+  #          Gems in this list must be explicitly included in the Gemfile
+  #          with a `gem "gem_name", ...` line or they will be silently
+  #          ignored.
+  # @param copy_groups Whether to copy the groups over from the old lockfile to
+  #          the new. Use this when the new lockfile has the same convention for
+  #          groups as the old. Defaults to `false`.
+  #
+  def include_locked_gemfile(gemfile_path, lockfile_path = "#{gemfile_path}.lock", groups: nil, without_groups: nil, gems: [], copy_groups: false)
+    # Parse the desired lockfile
+    gemfile_path = Pathname.new(gemfile_path).expand_path(Bundler.default_gemfile.dirname).realpath
+    lockfile_path = Pathname.new(lockfile_path).expand_path(Bundler.default_gemfile.dirname).realpath
+
+    # Calculate relative_to
+    relative_to = Bundler.default_gemfile.dirname.realpath
+
+    # Call out to create-override-gemfile to read the Gemfile+Gemfile.lock (bundler does not work well if you do two things in one process)
+    create_override_gemfile_bin = File.expand_path("../bin/create-override-gemfile", __FILE__)
+    arguments = [
+      "--gemfile", gemfile_path,
+      "--lockfile", lockfile_path,
+      "--override"
+    ]
+    arguments += [ "--relative-to", relative_to ] if relative_to != "."
+    arguments += Array(groups).flat_map { |group| [ "--group", group ] }
+    arguments += Array(without_groups).flat_map { |without| [ "--without", without ] }
+    arguments += Array(gems).flat_map { |name| [ "--gem", name ] }
+    arguments << "--copy-groups" if copy_groups
+    cmd = Shellwords.join([ Gem.ruby, "-S", create_override_gemfile_bin, *arguments ])
+    output = nil
+    Bundler.ui.info("> #{cmd}")
+    Bundler.with_clean_env do
+      output = `#{cmd}`
+    end
+    instance_eval(output, cmd, 1)
+  end
+
+  #
+  # Include all gems in the locked gemfile.
+  #
+  # @param current_gemfile The Gemfile you are currently loading (`self`).
+  # @param gemfile_path Path to the Gemfile to load (relative to your Gemfile)
+  # @param lockfile_path Path to the Gemfile to load (relative to your Gemfile).
+  #          Defaults to <gemfile_path>.lock.
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #          to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #          the results if all groups they belong to are ignored. This matches
+  #          bundler's `without` behavior.
+  # @param gems A list of gems to include above and beyond the given groups.
+  #          Gems in this list must be explicitly included in the Gemfile
+  #          with a `gem "gem_name", ...` line or they will be silently
+  #          ignored.
+  # @param copy_groups Whether to copy the groups over from the old lockfile to
+  #          the new. Use this when the new lockfile has the same convention for
+  #          groups as the old. Defaults to `false`.
+  #
+  def self.include_locked_gemfile(current_gemfile, gemfile_path, lockfile_path = "#{gemfile_path}.lock", groups: nil, without_groups: nil, gems: [], copy_groups: false)
+    current_gemfile.instance_eval do
+      extend GemfileUtil
+      include_locked_gemfile(gemfile_path, lockfile_path, groups: groups, without_groups: without_groups, gems: gems, copy_groups: copy_groups)
+    end
+  end
+
+  def warn_if_replacing(name, old_args, new_args)
+    return if !old_args || !new_args
+    if args_to_dep(name, *old_args) =~ args_to_dep(name, *new_args)
+      Bundler.ui.debug "Replaced Gemfile dependency #{name} (#{old_args}) with (#{new_args})"
+    else
+      Bundler.ui.warn "Replaced Gemfile dependency #{name} (#{old_args}) with (#{new_args})"
+    end
+  end
+
+  def args_to_dep(name, *version, **options)
+    version = [">= 0"] if version.empty?
+    Bundler::Dependency.new(name, version, options)
+  end
+
+  #
+  # Reads a bundle, including a gemfile and lockfile.
+  #
+  # Does no validation, does not update the lockfile or its gems in any way.
+  #
+  class Bundle
+    #
+    # Parse the given gemfile/lockfile pair.
+    #
+    # @return [Bundle] The parsed bundle.
+    #
+    def self.parse(gemfile_path, lockfile_path = "#{gemfile_path}.lock")
+      result = new(gemfile_path, lockfile_path)
+      result.gems
+      result
+    end
+
+    #
+    # Create a new Bundle to parse the given gemfile/lockfile pair.
+    #
+    def initialize(gemfile_path, lockfile_path = "#{gemfile_path}.lock")
+      @gemfile_path = gemfile_path
+      @lockfile_path = lockfile_path
+    end
+
+    #
+    # The path to the Gemfile
+    #
+    attr_reader :gemfile_path
+
+    #
+    # The path to the Lockfile
+    #
+    attr_reader :lockfile_path
+
+    #
+    # The list of gems.
+    #
+    # @return [Hash<String, Hash>] The resulting gems, where key = gem_name, and the
+    #           hash has:
+    #           - version: version of the gem.
+    #           - source info (:source/:git/:ref/:path) from the lockfile
+    #           - dependencies: A list of gem names this gem has a runtime
+    #             dependency on. Dependencies are transitive: if A depends on B,
+    #             and B depends on C, then A has C in its :dependencies list.
+    #           - development_dependencies: - A list of gem names this gem has a
+    #             development dependency on. Dependencies are transitive: if A
+    #             depends on B, and B depends on C, then A has C in its
+    #             :development_dependencies list. development dependencies *include*
+    #             runtime dependencies.
+    #           - groups: The list of groups (symbols) this gem is in. Groups
+    #             are transitive: if A has a runtime dependency on B, and A is
+    #             in group X, then B is also in group X.
+    #           - declared_groups: The list of groups (symbols) this gem was
+    #             declared in the Gemfile.
+    #
+    def gems
+      @gems ||= begin
+        gems = locks.dup
+        gems.each do |name, g|
+          if gem_declarations.has_key?(name)
+            g[:declared_groups] = gem_declarations[name][:groups]
+          else
+            g[:declared_groups] = []
+          end
+          g[:groups] = g[:declared_groups].dup
+        end
+        # Transitivize groups (since dependencies are already transitive, this is easy)
+        gems.each do |name, g|
+          g[:dependencies].each do |dep|
+            gems[dep][:groups] |= gems[name][:declared_groups].dup
+          end
+        end
+        gems
+      end
+    end
+
+    #
+    # Get the gems (and their deps) in the given group.
+    #
+    # @param groups A list of groups to include (whitelist). If not passed (or set
+    #          to nil), all gems will be selected.
+    # @param without_groups A list of groups to ignore. Gems will be excluded from
+    #          the results if all groups they belong to are ignored.
+    #          This matches bundler's `without` behavior.
+    # @param gems A list of gems to include regardless of what groups are included.
+    #
+    # @return Hash[String, Hash] The resulting gems, where key = gem_name, and the
+    #           hash has:
+    #           - version: version of the gem.
+    #           - source info (:source/:git/:ref/:path) from the lockfile
+    #           - dependencies: A list of gem names this gem has a runtime
+    #             dependency on. Dependencies are transitive: if A depends on B,
+    #             and B depends on C, then A has C in its :dependencies list.
+    #           - development_dependencies: - A list of gem names this gem has a
+    #             development dependency on. Dependencies are transitive: if A
+    #             depends on B, and B depends on C, then A has C in its
+    #             :development_dependencies list. development dependencies
+    #             *include* runtime dependencies.
+    #           - groups: The list of groups (symbols) this gem is in. Groups
+    #             are transitive: if A has a runtime dependency on B, and A is
+    #             in group X, then B is also in group X.
+    #           - declared_groups: The list of groups (symbols) this gem was
+    #             declared in the Gemfile.
+    #
+    def select_gems(groups: nil, without_groups: nil)
+      # First, select the gems that match
+      result = {}
+      gems.each do |name, g|
+        dep_groups = g[:declared_groups] - [ :only_a_runtime_dependency_of_other_gems ]
+        dep_groups = dep_groups & groups if groups
+        dep_groups = dep_groups - without_groups if without_groups
+        if dep_groups.any?
+          result[name] ||= g
+          g[:dependencies].each do |dep|
+            result[dep] ||= gems[dep]
+          end
+        end
+      end
+      result
+    end
+
+    #
+    # Get all locks from the given lockfile.
+    #
+    # @return Hash[String, Hash] The resulting gems, where key = gem_name, and the
+    #           hash has:
+    #           - version: version of the gem.
+    #           - source info (:source/:git/:ref/:path)
+    #           - dependencies: A list of gem names this gem has a runtime
+    #             dependency on. Dependencies are transitive: if A depends on B,
+    #             and B depends on C, then A has C in its :dependencies list.
+    #           - development_dependencies: - A list of gem names this gem has a
+    #             development dependency on. Dependencies are transitive: if A
+    #             depends on B, and B depends on C, then A has C in its
+    #             :development_dependencies list. development dependencies *include*
+    #             runtime dependencies.
+    #
+    def locks
+      @locks ||= begin
+        # Grab all the specs from the lockfile
+        locks = {}
+        parsed_lockfile = Bundler::LockfileParser.new(IO.read(lockfile_path))
+        parsed_lockfile.specs.each do |spec|
+          # Never include bundler, it can't be bundled and doesn't put itself in
+          # the lockfile correctly anyway
+          next if spec.name == "bundler"
+          # Only the platform-specific locks for now (TODO make it possible to emit all locks)
+          next if spec.platform && spec.platform != Gem::Platform::RUBY
+          lock = lock_source_metadata(spec)
+          lock[:version] = spec.version.to_s
+          runtime = spec.dependencies.select { |dep| dep.type == :runtime }
+          lock[:dependencies] = Set.new(runtime.map { |dep| dep.name })
+          lock[:development_dependencies] = Set.new(spec.dependencies.map { |dep| dep.name })
+          lock[:dependencies].delete("bundler")
+          lock[:development_dependencies].delete("bundler")
+          locks[spec.name] = lock
+        end
+
+        # Transitivize the deps.
+        locks.each do |name, lock|
+          # Not all deps were brought over (platform-specific ones) so weed them out
+          lock[:dependencies] &= locks.keys
+          lock[:development_dependencies] &= locks.keys
+
+          lock[:dependencies] = transitive_dependencies(locks, name, :dependencies)
+          lock[:development_dependencies] = transitive_dependencies(locks, name, :development_dependencies)
+        end
+
+        locks
+      end
+    end
+
+    #
+    # Get all desired gems, sans dependencies, from the gemfile.
+    #
+    # @param gemfile Path to the Gemfile to load
+    #
+    # @return Hash<String, Hash> An array of hashes where key = gem name and value
+    #           has :groups (an array of symbols representing the groups the gem
+    #           is in). :groups are not transitive, since we don't know the
+    #           dependency tree yet.
+    #
+    def gem_declarations
+      @gem_declarations ||= begin
+        Bundler.with_clean_env do
+          # Set BUNDLE_GEMFILE to the new gemfile temporarily so all bundler's things work
+          # This works around some issues in bundler 1.11.2.
+          ENV["BUNDLE_GEMFILE"] = gemfile_path
+
+          parsed_gemfile = Bundler::Dsl.new
+          parsed_gemfile.eval_gemfile(gemfile_path)
+          parsed_gemfile.complete_overrides if parsed_gemfile.respond_to?(:complete_overrides)
+
+          result = {}
+          parsed_gemfile.dependencies.each do |dep|
+            groups = dep.groups.empty? ? [:default] : dep.groups
+            result[dep.name] = { groups: groups, platforms: dep.platforms }
+          end
+          result
+        end
+      end
+    end
+
+    private
+
+    #
+    # Given a bunch of locks (name -> { dependencies: [name,name] }) and a
+    # dependency name, add its dependencies to the result transitively.
+    #
+    def transitive_dependencies(locks, name, dep_key, result = Set.new)
+      locks[name][dep_key].each do |dep|
+        # Only ever add a dep once, so we don't infinitely recurse
+        if result.add?(dep)
+          transitive_dependencies(locks, dep, dep_key, result)
+        end
+      end
+      result
+    end
+
+    #
+    # Get source and version metadata for the given Bundler spec (coming from a lockfile).
+    #
+    # @return Hash { version: <version>, git: <git>, path: <path>, source: <source>, ref: <ref> }
+    #
+    def lock_source_metadata(spec)
+      # Copy source information from included Gemfile
+      result = {}
+      case spec.source
+      when Bundler::Source::Rubygems
+        result[:source] = spec.source.remotes.first.to_s
+      when Bundler::Source::Git
+        result[:git] = spec.source.uri.to_s
+        result[:ref] = spec.source.revision
+      when Bundler::Source::Path
+        result[:path] = spec.source.path.to_s
+      else
+        raise "Unknown source #{spec.source} for gem #{spec.name}"
+      end
+      result
+    end
+  end
+end
diff --git a/tasks/maintainers.rb b/tasks/maintainers.rb
index 535edda248..91742854bb 100644
--- a/tasks/maintainers.rb
+++ b/tasks/maintainers.rb
@@ -31,9 +31,10 @@ begin
   require "tomlrb"
   require "octokit"
   require "pp"
-  task :default => :generate
 
   namespace :maintainers do
+    task :default => :generate
+
     desc "Generate MarkDown version of MAINTAINERS file"
     task :generate do
       out = "<!-- This is a generated file. Please do not edit directly -->\n\n"
diff --git a/version_policy.rb b/version_policy.rb
new file mode 100644
index 0000000000..44b4af592e
--- /dev/null
+++ b/version_policy.rb
@@ -0,0 +1,111 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Explicit omnibus overrides.
+OMNIBUS_OVERRIDES = {
+  # Lower level library pins
+  ## according to comment in omnibus-sw, latest versions don't work on solaris
+  # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
+  "libffi" => "3.2.1",
+  "libiconv" => "1.14",
+  "liblzma" => "5.2.2",
+  ## according to comment in omnibus-sw, the very latest versions don't work on solaris
+  # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
+  "libtool" => "2.4.2",
+  "libxml2" => "2.9.3",
+  "libxslt" => "1.1.28",
+  "libyaml" => "0.1.6",
+  "makedepend" => "1.0.5",
+  "ncurses" => "5.9",
+  "pkg-config-lite" => "0.28-1",
+  "ruby" => "2.1.8",
+  # Leave dev-kit pinned to 4.5 on 32-bit, because 4.7 is 20MB larger and we don't want
+  # to unnecessarily make the client any fatter. (Since it's different between
+  # 32 and 64, we have to do it in the project file still.)
+  # "ruby-windows-devkit" => "4.5.2-20111229-1559",
+  "ruby-windows-devkit-bash" => "3.1.23-4-msys-1.0.18",
+  "util-macros" => "1.19.0",
+  "xproto" => "7.0.28",
+  "zlib" => "1.2.8",
+
+  ## These can float as they are frequently updated in a way that works for us
+  #override "cacerts" =>"???",
+  #override "openssl" =>"???",
+}
+
+#
+# rake dependencies:update_omnibus_overrides (tasks/dependencies.rb) reads this
+# and modifies omnibus_overrides.rb
+#
+# The left side is the software definition name, and the right side is the
+# name of the rubygem (gem list -re <rubygem name> gets us the latest version).
+#
+OMNIBUS_RUBYGEMS_AT_LATEST_VERSION = {
+  rubygems: "rubygems-update",
+  bundler: "bundler",
+}
+
+#
+# rake dependencies:check (tasks/dependencies.rb) uses this as a list of gems
+# that are allowed to be outdated according to `bundle updated`
+#
+# Once you decide that the list of outdated gems is OK, you can just
+# add gems to the output of bundle outdated here and we'll parse it to get the
+# list of outdated gems.
+#
+# We're starting with debt here, but don't want it to get worse.
+#
+ACCEPTABLE_OUTDATED_GEMS = %w{
+  activesupport
+  gherkin
+  github_changelog_generator
+  jwt
+  mini_portile2
+  slop
+}
+
+#
+# Some gems are part of our bundle (must be installed) but not important
+# enough to lock. We allow `bundle install` in test-kitchen, berks, etc.
+# to use their own versions of these.
+#
+# This mainly tells you which gems `chef verify` allows you to install and
+# run.
+#
+GEMS_ALLOWED_TO_FLOAT = [
+]
+
+#
+# The list of groups we install without: this drives both the `bundle install`
+# we do in chef-dk, and the `bundle check` we do to ensure installed gems don't
+# have extra deps hiding in their Gemfiles.
+#
+# NOTE: we DO install test, because there aren't many gems there, and it makes
+# our test phase a lot easier.
+#
+INSTALL_WITHOUT_GROUPS = %w{
+  changelog
+  compat_testing
+  development
+  docgen
+  guard
+  integration
+  maintenance
+  tools
+  travis
+  style
+}