Pin everything down with Gemfile.lock, add rake dependencies to update

25 files changed, 2125 insertions, 39 deletions

diff --git a/.bundle/config b/.bundle/config
new file mode 100644
index 0000000000..a559bc445a
--- /dev/null
+++ b/.bundle/config
@@ -0,0 +1,3 @@
+---
+BUNDLE_WITHOUT: omnibus_package
+BUNDLE_FROZEN: '1'
diff --git a/.gitignore b/.gitignore
index 732589b2e3..85f0bd6b21 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,32 +8,13 @@ tags
 .chef
 
 # You should check in your Gemfile.lock in applications, and not in gems
-# This also matches Berksfile.lock
-Gemfile.lock
-Berksfile.lock
 external_tests/*.lock
-acceptance/Gemfile.lock
-omnibus/Gemfile.lock
-/*.lock
 /Gemfile.local
 
-# Do not check in the .bundle directory, or any of the files inside it. Those
-# files are specific to each particular machine, and are used to persist
-# installation options between runs of the bundle install command.
-.bundle
-
 # ignore some common Bundler 'binstubs' directory names
 # http://gembundler.com/man/bundle-exec.1.html
 b/
 binstubs/
-bin
-!bin/chef-apply
-!bin/chef-client
-!bin/chef-service-manager
-!bin/chef-shell
-!bin/chef-solo
-!bin/chef-windows-service
-!bin/knife
 # RVM and RBENV ruby version files
 .rbenv-version
 .rvmrc
diff --git a/Gemfile b/Gemfile
index e39a50a586..cfa05118d1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,12 +2,25 @@ source "https://rubygems.org"
 gemspec name: "chef"
 
 gem "activesupport", "< 4.0.0", group: :compat_testing, platform: "ruby"
-
-gem "chef-config", path: "chef-config" if File.exist?(File.expand_path("../chef-config", __FILE__))
-
+gem "chef-config", path: File.expand_path("../chef-config", __FILE__) if File.exist?(File.expand_path("../chef-config", __FILE__))
 # Ensure that we can always install rake, regardless of gem groups
 gem "rake"
 
+group(:omnibus_package) do
+  gem "appbundler"
+  gem "rb-readline"
+  gem "nokogiri"
+end
+group(:omnibus_package, :development) do
+  gem "cheffish"
+end
+group(:omnibus_package, :pry) do
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "pry-stack_explorer"
+end
+
 group(:docgen) do
   gem "yard"
 end
@@ -20,26 +33,27 @@ group(:maintenance) do
   gem "netrc"
 end
 
-group(:pry) do
-  gem "pry"
-  gem "pry-byebug"
-  gem "pry-stack_explorer"
-end
-
-group(:ruby_prof) do
+# Everything except AIX
+group(:linux, :bsd, :mac_os_x, :solaris, :windows, :ruby_prof) do
   # may need to disable this in insolation on fussy builds like AIX, RHEL4, etc
   gem "ruby-prof"
 end
+# Everything except AIX and Windows
+group(:linux, :bsd, :mac_os_x, :solaris) do
+  gem "ruby-shadow"
+end
 
 group(:development, :test) do
   gem "simplecov"
-  gem "rack", "~> 1.5.1"
+  gem "rack"
 
   # for testing new chefstyle rules
   # gem 'chefstyle', github: 'chef/chefstyle'
   gem "chefstyle", git: "https://github.com/chef/chefstyle.git", branch: "master"
+end
 
-  gem "ruby-shadow", platforms: :ruby unless RUBY_PLATFORM.downcase =~ /(aix|cygwin)/
+group(:changelog) do
+  gem "github_changelog_generator", "1.11.3"
 end
 
 group(:travis) do
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000000..0cf56b3d92
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,287 @@
+GIT
+  remote: https://github.com/chef/chefstyle.git
+  revision: cc37808b7849fdcf49f04011626143940f83fe92
+  branch: master
+  specs:
+    chefstyle (0.3.1)
+      rubocop (= 0.39.0)
+
+GIT
+  remote: https://github.com/rubysec/bundler-audit.git
+  revision: 4e32fca89d75f0e249671431ff38aadc02bfb28b
+  ref: 4e32fca
+  specs:
+    bundler-audit (0.4.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
+
+PATH
+  remote: chef-config
+  specs:
+    chef-config (12.10.1)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+
+PATH
+  remote: .
+  specs:
+    chef (12.10.1)
+      bundler (>= 1.10)
+      chef-config (= 12.10.1)
+      chef-zero (~> 4.5)
+      diff-lcs (~> 1.2, >= 1.2.4)
+      erubis (~> 2.7)
+      ffi-yajl (~> 2.2)
+      highline (~> 1.6, >= 1.6.9)
+      mixlib-authentication (~> 1.4)
+      mixlib-cli (~> 1.4)
+      mixlib-log (~> 1.3)
+      mixlib-shellout (~> 2.0)
+      net-sftp (~> 2.1, >= 2.1.2)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-multi (~> 1.1)
+      ohai (>= 8.6.0.alpha.1, < 9)
+      plist (~> 3.2)
+      proxifier (~> 1.0)
+      rspec-core (~> 3.4)
+      rspec-expectations (~> 3.4)
+      rspec-mocks (~> 3.4)
+      rspec_junit_formatter (~> 0.2.0)
+      serverspec (~> 2.7)
+      specinfra (~> 2.10)
+      syslog-logger (~> 1.6)
+      uuidtools (~> 2.1.5)
+
+PATH
+  remote: chef-config
+  specs:
+    chef-config (12.9.40)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (3.2.22.2)
+      i18n (~> 0.6, >= 0.6.4)
+      multi_json (~> 1.0)
+    addressable (2.4.0)
+    appbundler (0.9.0)
+      mixlib-cli (~> 1.4)
+    ast (2.2.0)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.2)
+    byebug (8.2.4)
+    chef-zero (4.5.0)
+      ffi-yajl (~> 2.2)
+      hashie (>= 2.0, < 4.0)
+      mixlib-log (~> 1.3)
+      rack
+      uuidtools (~> 2.1)
+    cheffish (2.0.3)
+      chef-zero (~> 4.3)
+      compat_resource
+    childprocess (0.5.9)
+      ffi (~> 1.0, >= 1.0.11)
+    coderay (1.1.1)
+    colorize (0.7.7)
+    compat_resource (12.9.1)
+    debug_inspector (0.0.2)
+    descendants_tracker (0.0.4)
+      thread_safe (~> 0.3, >= 0.3.1)
+    diff-lcs (1.2.5)
+    docile (1.1.5)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10)
+    ffi-yajl (2.2.3)
+      libyajl2 (~> 1.2)
+    fuzzyurl (0.8.0)
+    github_api (0.13.1)
+      addressable (~> 2.4.0)
+      descendants_tracker (~> 0.0.4)
+      faraday (~> 0.8, < 0.10)
+      hashie (>= 3.4)
+      multi_json (>= 1.7.5, < 2.0)
+      oauth2
+    github_changelog_generator (1.11.3)
+      bundler (>= 1.7)
+      colorize (~> 0.7)
+      github_api (~> 0.12)
+      overcommit (>= 0.31)
+      rake (>= 10.0)
+      rspec (>= 3.2)
+      rubocop (>= 0.31)
+    hashie (3.4.3)
+    highline (1.7.8)
+    i18n (0.7.0)
+    iniparse (1.4.2)
+    ipaddress (0.8.3)
+    json (1.8.3)
+    jwt (1.5.1)
+    libyajl2 (1.2.0)
+    method_source (0.8.2)
+    mini_portile2 (2.0.0)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-cli (1.5.0)
+    mixlib-config (2.2.1)
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    multi_json (1.11.2)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-sftp (2.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    net-ssh-gateway (1.2.0)
+      net-ssh (>= 2.6.5)
+    net-ssh-multi (1.2.1)
+      net-ssh (>= 2.6.5)
+      net-ssh-gateway (>= 1.2.0)
+    net-telnet (0.1.1)
+    netrc (0.11.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    ohai (8.14.0)
+      chef-config (>= 12.5.0.alpha.1, < 13)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli
+      mixlib-config (~> 2.0)
+      mixlib-log
+      mixlib-shellout (~> 2.0)
+      plist (~> 3.1)
+      systemu (~> 2.6.4)
+      wmi-lite (~> 1.0)
+    overcommit (0.33.0)
+      childprocess (~> 0.5.8)
+      iniparse (~> 1.4)
+    parser (2.3.0.7)
+      ast (~> 2.2)
+    plist (3.2.0)
+    powerpack (0.1.1)
+    proxifier (1.0.3)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-byebug (3.3.0)
+      byebug (~> 8.0)
+      pry (~> 0.10)
+    pry-remote (0.1.8)
+      pry (~> 0.9)
+      slop (~> 3.0)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    rack (1.6.4)
+    rainbow (2.1.0)
+    rake (11.1.2)
+    rb-readline (0.5.3)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rspec_junit_formatter (0.2.3)
+      builder (< 4)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    rubocop (0.39.0)
+      parser (>= 2.3.0.7, < 3.0)
+      powerpack (~> 0.1)
+      rainbow (>= 1.99.1, < 3.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (~> 1.0, >= 1.0.1)
+    ruby-prof (0.15.9)
+    ruby-progressbar (1.7.5)
+    ruby-shadow (2.5.0)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    serverspec (2.31.1)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.53)
+    sfl (2.2)
+    simplecov (0.11.2)
+      docile (~> 1.1.0)
+      json (~> 1.8)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.0)
+    slop (3.6.0)
+    specinfra (2.56.1)
+      net-scp
+      net-ssh (>= 2.7, < 4.0)
+      net-telnet
+      sfl
+    syslog-logger (1.6.8)
+    systemu (2.6.5)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tomlrb (1.2.1)
+    unicode-display_width (1.0.3)
+    uuidtools (2.1.5)
+    wmi-lite (1.0.0)
+    yard (0.8.7.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activesupport (< 4.0.0)
+  appbundler
+  bundler-audit!
+  chef!
+  chef-config!
+  cheffish
+  chefstyle!
+  github_changelog_generator (= 1.11.3)
+  netrc
+  nokogiri
+  octokit
+  pry
+  pry-byebug
+  pry-remote
+  pry-stack_explorer
+  rack
+  rake
+  rb-readline
+  ruby-prof
+  ruby-shadow
+  simplecov
+  tomlrb
+  yard
+
+BUNDLED WITH
+   1.11.2
diff --git a/Gemfile.windows b/Gemfile.windows
new file mode 100644
index 0000000000..2387c6af4b
--- /dev/null
+++ b/Gemfile.windows
@@ -0,0 +1,34 @@
+#
+# We ensure everything in windows is pinned to the same version as "generic"
+# by reading the generic Gemfile.lock and pinning to that version in the Gemfile.
+#
+# This could *almost* be accomplished by simply copying the lockfile and doing a
+# `bundle install` to add any windows dependencies, but bundler can still update
+# existing versions in a couple of cases:
+#
+# 1. When the source has changed since the main lockfile was built.
+# 2. When Windows-specific dependencies constrain our solution.
+#
+# We do NOT allow windows gem versions to differ from non-windows, so that our
+# packages are consistent across operating systems.
+#
+# At the end of this process, this `Gemfile`:
+#
+# ```
+# gem 'chef', github: 'chef/chef'
+# gem 'berkshelf'
+# ```
+#
+# Is transformed to something like this:
+#
+# ```
+# gem 'chef', github: 'chef/chef', ref: '23049723984237948023'
+# gem 'berkshelf', '= 2.0.5'
+# gem 'ohai', '= 12.9.30' # implicit dependency of chef
+# ```
+#
+
+require_relative "tasks/gemfile_util"
+extend GemfileUtil
+generic_gemfile = File.expand_path("../Gemfile", __FILE__)
+include_locked_gemfile(generic_gemfile)
diff --git a/Gemfile.windows.lock b/Gemfile.windows.lock
new file mode 100644
index 0000000000..56081e80e0
--- /dev/null
+++ b/Gemfile.windows.lock
@@ -0,0 +1,390 @@
+GIT
+  remote: https://github.com/chef/chefstyle.git
+  revision: cc37808b7849fdcf49f04011626143940f83fe92
+  ref: cc37808b7849fdcf49f04011626143940f83fe92
+  specs:
+    chefstyle (0.3.1)
+      rubocop (= 0.39.0)
+
+GIT
+  remote: https://github.com/rubysec/bundler-audit.git
+  revision: 4e32fca89d75f0e249671431ff38aadc02bfb28b
+  ref: 4e32fca89d75f0e249671431ff38aadc02bfb28b
+  specs:
+    bundler-audit (0.4.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
+
+PATH
+  remote: chef-config
+  specs:
+    chef-config (12.10.1)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+
+PATH
+  remote: .
+  specs:
+    chef (12.10.1-universal-mingw32)
+      bundler (>= 1.10)
+      chef-config (= 12.10.1)
+      chef-zero (~> 4.5)
+      diff-lcs (~> 1.2, >= 1.2.4)
+      erubis (~> 2.7)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      highline (~> 1.6, >= 1.6.9)
+      mixlib-authentication (~> 1.4)
+      mixlib-cli (~> 1.4)
+      mixlib-log (~> 1.3)
+      mixlib-shellout (~> 2.0)
+      net-sftp (~> 2.1, >= 2.1.2)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-multi (~> 1.1)
+      ohai (>= 8.6.0.alpha.1, < 9)
+      plist (~> 3.2)
+      proxifier (~> 1.0)
+      rspec-core (~> 3.4)
+      rspec-expectations (~> 3.4)
+      rspec-mocks (~> 3.4)
+      rspec_junit_formatter (~> 0.2.0)
+      serverspec (~> 2.7)
+      specinfra (~> 2.10)
+      syslog-logger (~> 1.6)
+      uuidtools (~> 2.1.5)
+      win32-api (~> 1.5.3)
+      win32-dir (~> 0.5.0)
+      win32-event (~> 0.6.1)
+      win32-eventlog (= 0.6.3)
+      win32-mmap (~> 0.4.1)
+      win32-mutex (~> 0.4.2)
+      win32-process (~> 0.8.2)
+      win32-service (~> 0.8.7)
+      windows-api (~> 0.4.4)
+      wmi-lite (~> 1.0)
+
+PATH
+  remote: chef-config
+  specs:
+    chef-config (12.9.40)
+      fuzzyurl (~> 0.8.0)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.4.0)
+    appbundler (0.9.0)
+      mixlib-cli (~> 1.4)
+    ast (2.2.0)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.2)
+    byebug (8.2.4)
+    chef-zero (4.5.0)
+      ffi-yajl (~> 2.2)
+      hashie (>= 2.0, < 4.0)
+      mixlib-log (~> 1.3)
+      rack
+      uuidtools (~> 2.1)
+    cheffish (2.0.3)
+      chef-zero (~> 4.3)
+      compat_resource
+    childprocess (0.5.9)
+      ffi (~> 1.0, >= 1.0.11)
+    coderay (1.1.1)
+    colorize (0.7.7)
+    compat_resource (12.9.1)
+    debug_inspector (0.0.2)
+    descendants_tracker (0.0.4)
+      thread_safe (~> 0.3, >= 0.3.1)
+    diff-lcs (1.2.5)
+    docile (1.1.5)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10-x86-mingw32)
+    ffi-yajl (2.2.3)
+      libyajl2 (~> 1.2)
+    fuzzyurl (0.8.0)
+    github_api (0.13.1)
+      addressable (~> 2.4.0)
+      descendants_tracker (~> 0.0.4)
+      faraday (~> 0.8, < 0.10)
+      hashie (>= 3.4)
+      multi_json (>= 1.7.5, < 2.0)
+      oauth2
+    github_changelog_generator (1.11.3)
+      bundler (>= 1.7)
+      colorize (~> 0.7)
+      github_api (~> 0.12)
+      overcommit (>= 0.31)
+      rake (>= 10.0)
+      rspec (>= 3.2)
+      rubocop (>= 0.31)
+    hashie (3.4.3)
+    highline (1.7.8)
+    i18n (0.7.0)
+    iniparse (1.4.2)
+    ipaddress (0.8.3)
+    json (1.8.3)
+    jwt (1.5.1)
+    libyajl2 (1.2.0)
+    method_source (0.8.2)
+    mini_portile2 (2.0.0)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-cli (1.5.0)
+    mixlib-config (2.2.1)
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6-universal-mingw32)
+      win32-process (~> 0.8.2)
+      wmi-lite (~> 1.0)
+    multi_json (1.11.2)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-sftp (2.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    net-ssh-gateway (1.2.0)
+      net-ssh (>= 2.6.5)
+    net-ssh-multi (1.2.1)
+      net-ssh (>= 2.6.5)
+      net-ssh-gateway (>= 1.2.0)
+    net-telnet (0.1.1)
+    netrc (0.11.0)
+    nokogiri (1.6.7.2-x86-mingw32)
+      mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    ohai (8.14.0)
+      chef-config (>= 12.5.0.alpha.1, < 13)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli
+      mixlib-config (~> 2.0)
+      mixlib-log
+      mixlib-shellout (~> 2.0)
+      plist (~> 3.1)
+      systemu (~> 2.6.4)
+      wmi-lite (~> 1.0)
+    overcommit (0.33.0)
+      childprocess (~> 0.5.8)
+      iniparse (~> 1.4)
+    parser (2.3.0.7)
+      ast (~> 2.2)
+    plist (3.2.0)
+    powerpack (0.1.1)
+    proxifier (1.0.3)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-byebug (3.3.0)
+      byebug (~> 8.0)
+      pry (~> 0.10)
+    pry-remote (0.1.8)
+      pry (~> 0.9)
+      slop (~> 3.0)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    rack (1.6.4)
+    rainbow (2.1.0)
+    rake (11.1.2)
+    rb-readline (0.5.3)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rspec_junit_formatter (0.2.3)
+      builder (< 4)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    rubocop (0.39.0)
+      parser (>= 2.3.0.7, < 3.0)
+      powerpack (~> 0.1)
+      rainbow (>= 1.99.1, < 3.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (~> 1.0, >= 1.0.1)
+    ruby-prof (0.15.9)
+    ruby-progressbar (1.7.5)
+    ruby-shadow (2.5.0)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    serverspec (2.31.1)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.53)
+    sfl (2.2)
+    simplecov (0.11.2)
+      docile (~> 1.1.0)
+      json (~> 1.8)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.0)
+    slop (3.6.0)
+    specinfra (2.56.1)
+      net-scp
+      net-ssh (>= 2.7, < 4.0)
+      net-telnet
+      sfl
+    syslog-logger (1.6.8)
+    systemu (2.6.5)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tomlrb (1.2.1)
+    unicode-display_width (1.0.3)
+    uuidtools (2.1.5)
+    win32-api (1.5.3-universal-mingw32)
+    win32-dir (0.5.1)
+      ffi (>= 1.0.0)
+    win32-event (0.6.3)
+      win32-ipc (>= 0.6.0)
+    win32-eventlog (0.6.3)
+      ffi
+    win32-ipc (0.6.6)
+      ffi
+    win32-mmap (0.4.2)
+      ffi
+    win32-mutex (0.4.3)
+      win32-ipc (>= 0.6.0)
+    win32-process (0.8.3)
+      ffi (>= 1.0.0)
+    win32-service (0.8.7)
+      ffi
+    windows-api (0.4.4)
+      win32-api (>= 1.4.5)
+    wmi-lite (1.0.0)
+    yard (0.8.7.6)
+
+PLATFORMS
+  x86-mingw32
+
+DEPENDENCIES
+  activesupport (= 3.2.22.2)
+  addressable (= 2.4.0)
+  appbundler (= 0.9.0)
+  ast (= 2.2.0)
+  binding_of_caller (= 0.7.2)
+  builder (= 3.2.2)
+  bundler-audit!
+  byebug (= 8.2.4)
+  chef!
+  chef-config!
+  chef-zero (= 4.5.0)
+  cheffish (= 2.0.3)
+  chefstyle!
+  childprocess (= 0.5.9)
+  coderay (= 1.1.1)
+  colorize (= 0.7.7)
+  compat_resource (= 12.9.1)
+  debug_inspector (= 0.0.2)
+  descendants_tracker (= 0.0.4)
+  diff-lcs (= 1.2.5)
+  docile (= 1.1.5)
+  erubis (= 2.7.0)
+  faraday (= 0.9.2)
+  ffi (= 1.9.10)
+  ffi-yajl (= 2.2.3)
+  fuzzyurl (= 0.8.0)
+  github_api (= 0.13.1)
+  github_changelog_generator (= 1.11.3)
+  hashie (= 3.4.3)
+  highline (= 1.7.8)
+  i18n (= 0.7.0)
+  iniparse (= 1.4.2)
+  ipaddress (= 0.8.3)
+  json (= 1.8.3)
+  jwt (= 1.5.1)
+  libyajl2 (= 1.2.0)
+  method_source (= 0.8.2)
+  mini_portile2 (= 2.0.0)
+  mixlib-authentication (= 1.4.0)
+  mixlib-cli (= 1.5.0)
+  mixlib-config (= 2.2.1)
+  mixlib-log (= 1.6.0)
+  mixlib-shellout (= 2.2.6)
+  multi_json (= 1.11.2)
+  multi_xml (= 0.5.5)
+  multipart-post (= 2.0.0)
+  net-scp (= 1.2.1)
+  net-sftp (= 2.1.2)
+  net-ssh (= 3.1.1)
+  net-ssh-gateway (= 1.2.0)
+  net-ssh-multi (= 1.2.1)
+  net-telnet (= 0.1.1)
+  netrc (= 0.11.0)
+  nokogiri (= 1.6.7.2)
+  oauth2 (= 1.1.0)
+  octokit (= 4.3.0)
+  ohai (= 8.14.0)
+  overcommit (= 0.33.0)
+  parser (= 2.3.0.7)
+  plist (= 3.2.0)
+  powerpack (= 0.1.1)
+  proxifier (= 1.0.3)
+  pry (= 0.10.3)
+  pry-byebug (= 3.3.0)
+  pry-remote (= 0.1.8)
+  pry-stack_explorer (= 0.4.9.2)
+  rack (= 1.6.4)
+  rainbow (= 2.1.0)
+  rake (= 11.1.2)
+  rb-readline (= 0.5.3)
+  rspec (= 3.4.0)
+  rspec-core (= 3.4.4)
+  rspec-expectations (= 3.4.0)
+  rspec-its (= 1.2.0)
+  rspec-mocks (= 3.4.1)
+  rspec-support (= 3.4.1)
+  rspec_junit_formatter (= 0.2.3)
+  rubocop (= 0.39.0)
+  ruby-prof (= 0.15.9)
+  ruby-progressbar (= 1.7.5)
+  ruby-shadow (= 2.5.0)
+  sawyer (= 0.7.0)
+  serverspec (= 2.31.1)
+  sfl (= 2.2)
+  simplecov (= 0.11.2)
+  simplecov-html (= 0.10.0)
+  slop (= 3.6.0)
+  specinfra (= 2.56.1)
+  syslog-logger (= 1.6.8)
+  systemu (= 2.6.5)
+  thor (= 0.19.1)
+  thread_safe (= 0.3.5)
+  tomlrb (= 1.2.1)
+  unicode-display_width (= 1.0.3)
+  uuidtools (= 2.1.5)
+  wmi-lite (= 1.0.0)
+  yard (= 0.8.7.6)
+
+BUNDLED WITH
+   1.11.2
diff --git a/Rakefile b/Rakefile
index 772b2bca18..10eb4a38b5 100644
--- a/Rakefile
+++ b/Rakefile
@@ -27,11 +27,14 @@ require_relative "tasks/rspec"
 require_relative "tasks/external_tests"
 require_relative "tasks/maintainers"
 require_relative "tasks/cbgb"
+require_relative "tasks/dependencies"
 
 ChefConfig::PackageTask.new(File.expand_path("..", __FILE__), "Chef") do |package|
   package.component_paths = ["chef-config"]
   package.generate_version_class = true
 end
+# Add a conservative dependency update to version:bump (which was created by PackageTask)
+task "version:bump" => %w{version:bump_patch version:update dependencies:update[conservative]}
 
 task :pedant, :chef_zero_spec
 
diff --git a/acceptance/.gitignore b/acceptance/.gitignore
index 0d2aa76a44..c2ab70737d 100644
--- a/acceptance/.gitignore
+++ b/acceptance/.gitignore
@@ -1,2 +1 @@
-/Gemfile.lock
 .acceptance_logs
diff --git a/acceptance/Gemfile.lock b/acceptance/Gemfile.lock
new file mode 100644
index 0000000000..0ee47feb36
--- /dev/null
+++ b/acceptance/Gemfile.lock
@@ -0,0 +1,246 @@
+GIT
+  remote: git://github.com/chef/chef-acceptance.git
+  revision: 49458ec493dbd12588680eea9f2f9beb76463d09
+  specs:
+    chef-acceptance (0.2.0)
+      mixlib-shellout (~> 2.0)
+      thor (~> 0.19)
+
+GIT
+  remote: git://github.com/test-kitchen/kitchen-ec2.git
+  revision: 61458c354d71a4156263e7f8b33e51c6edcb5aa6
+  branch: jk/image-search-only
+  specs:
+    kitchen-ec2 (1.0.0.dev.0)
+      aws-sdk (~> 2)
+      excon
+      multi_json
+      retryable (~> 2.0)
+      test-kitchen (~> 1.4, >= 1.4.1)
+      ubuntu_ami (~> 0.4.1)
+
+GIT
+  remote: git://github.com/test-kitchen/kitchen-vagrant.git
+  revision: 67a5248070845f942c2e56359ba388f691079f6c
+  specs:
+    kitchen-vagrant (0.20.0)
+      test-kitchen (~> 1.4)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.4.0)
+    artifactory (2.3.2)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (4.3.2)
+      addressable (~> 2.3, >= 2.3.4)
+      berkshelf-api-client (~> 2.0, >= 2.0.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (= 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      minitar (~> 0.5, >= 0.5.4)
+      octokit (~> 4.0)
+      retryable (~> 2.0)
+      ridley (~> 4.5)
+      solve (~> 2.0)
+      thor (~> 0.19)
+    berkshelf-api-client (2.0.2)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.7.0)
+      ridley (~> 4.5)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    builder (3.2.2)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.8.1)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    cleanroom (1.0.0)
+    coderay (1.1.1)
+    diff-lcs (1.2.5)
+    docker-api (1.26.2)
+      excon (>= 0.38.0)
+      json
+    erubis (2.7.0)
+    excon (0.49.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    httpclient (2.7.1)
+    inspec (0.18.0)
+      json (~> 1.8)
+      method_source (~> 0.8)
+      pry (~> 0)
+      r-train (~> 0.10.4)
+      rainbow (~> 2)
+      rspec (~> 3.3)
+      rspec-its (~> 1.2)
+      rubyzip (~> 1.1)
+      thor (~> 0.19)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-inspec (0.12.5)
+      inspec (>= 0.14.1, < 1.0.0)
+      test-kitchen (~> 1.6)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    method_source (0.8.2)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.6)
+      artifactory (>= 2.3.0)
+      mixlib-shellout (>= 2.2.6)
+      mixlib-versioning (>= 1.1.0)
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-versioning (1.1.0)
+    molinillo (0.4.4)
+    multi_json (1.11.2)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    nori (2.6.0)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    r-train (0.10.4)
+      docker-api (~> 1.26.2)
+      json (~> 1.8)
+      mixlib-shellout (~> 2.1)
+      net-scp (~> 1.2)
+      net-ssh (>= 2.9, < 4.0)
+      winrm (~> 1.6)
+      winrm-fs (~> 0.3)
+    rainbow (2.1.0)
+    retryable (2.0.3)
+    ridley (4.5.0)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config (>= 12.5.0)
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.7)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rubyntlm (0.6.0)
+    rubyzip (1.2.0)
+    safe_yaml (1.0.4)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    slop (3.6.0)
+    solve (2.0.3)
+      molinillo (~> 0.4.2)
+      semverse (~> 1.1)
+    test-kitchen (1.7.2)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    ubuntu_ami (0.4.1)
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+    windows_chef_zero (2.0.0)
+      test-kitchen (>= 1.2.1)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
+    winrm-fs (0.4.1)
+      erubis (~> 2.7)
+      logging (>= 1.6.1, < 3.0)
+      rubyzip (~> 1.1)
+      winrm (~> 1.5)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  berkshelf
+  chef-acceptance!
+  inspec
+  kitchen-ec2!
+  kitchen-inspec
+  kitchen-vagrant!
+  test-kitchen
+  windows_chef_zero
+  winrm-fs
+
+BUNDLED WITH
+   1.11.2
diff --git a/acceptance/fips/test/integration/fips/serverspec/Gemfile.lock b/acceptance/fips/test/integration/fips/serverspec/Gemfile.lock
new file mode 100644
index 0000000000..44714c028b
--- /dev/null
+++ b/acceptance/fips/test/integration/fips/serverspec/Gemfile.lock
@@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    mixlib-shellout (2.2.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  mixlib-shellout
+
+BUNDLED WITH
+   1.11.2
diff --git a/chef.gemspec b/chef.gemspec
index e1055e01b5..59367b00f8 100644
--- a/chef.gemspec
+++ b/chef.gemspec
@@ -50,12 +50,6 @@ Gem::Specification.new do |s|
   # very deliberately avoiding putting a ceiling on this to avoid depsolver conflicts.
   s.add_dependency "bundler", ">= 1.10"
 
-  s.add_development_dependency "rack"
-  s.add_development_dependency "cheffish", ">= 1.1", "< 3.0"
-  s.add_development_dependency "github_changelog_generator", "1.11.3"
-
-  s.add_development_dependency "rake", "~> 10.1"
-
   s.bindir       = "bin"
   s.executables  = %w{ chef-client chef-solo knife chef-shell chef-apply }
 
diff --git a/kitchen-tests/Berksfile.lock b/kitchen-tests/Berksfile.lock
new file mode 100644
index 0000000000..b69d5daa73
--- /dev/null
+++ b/kitchen-tests/Berksfile.lock
@@ -0,0 +1,59 @@
+DEPENDENCIES
+  php (~> 1.5.0)
+  webapp
+    path: cookbooks/webapp
+
+GRAPH
+  apache2 (3.2.1)
+  apt (3.0.0)
+  aws (3.3.1)
+    ohai (>= 2.1.0)
+  build-essential (3.2.0)
+    seven_zip (>= 0.0.0)
+  chef-sugar (3.3.0)
+  chef_handler (1.3.0)
+  database (2.3.1)
+    aws (>= 0.0.0)
+    mysql (~> 5.0)
+    mysql-chef_gem (~> 0.0)
+    postgresql (>= 1.0.0)
+    xfs (>= 0.0.0)
+  iis (4.1.6)
+    windows (>= 1.34.6)
+  mysql (5.6.3)
+    yum-mysql-community (>= 0.0.0)
+  mysql-chef_gem (0.0.5)
+    build-essential (>= 0.0.0)
+    mysql (>= 0.0.0)
+  ohai (3.0.1)
+  openssl (4.4.0)
+    chef-sugar (>= 3.1.1)
+  php (1.5.0)
+    build-essential (>= 0.0.0)
+    iis (>= 0.0.0)
+    mysql (>= 0.0.0)
+    windows (>= 0.0.0)
+    xml (>= 0.0.0)
+    yum-epel (>= 0.0.0)
+  postgresql (4.0.4)
+    apt (>= 1.9.0)
+    build-essential (>= 0.0.0)
+    openssl (~> 4.0)
+  seven_zip (2.0.0)
+    windows (>= 1.2.2)
+  webapp (0.1.0)
+    apache2 (>= 0.0.0)
+    database (~> 2.3.1)
+    mysql (>= 0.0.0)
+    php (>= 0.0.0)
+  windows (1.39.2)
+    chef_handler (>= 0.0.0)
+  xfs (2.0.1)
+  xml (2.0.0)
+    build-essential (>= 0.0.0)
+    chef-sugar (>= 0.0.0)
+  yum (3.10.0)
+  yum-epel (0.6.6)
+    yum (~> 3.10.0)
+  yum-mysql-community (0.2.0)
+    yum (>= 3.2)
diff --git a/kitchen-tests/Gemfile.lock b/kitchen-tests/Gemfile.lock
new file mode 100644
index 0000000000..3c43b32a9f
--- /dev/null
+++ b/kitchen-tests/Gemfile.lock
@@ -0,0 +1,162 @@
+GIT
+  remote: git://github.com/test-kitchen/kitchen-ec2.git
+  revision: fec3f199a646980dc289ac6db9f90e9a9e4b0f6b
+  specs:
+    kitchen-ec2 (1.0.0)
+      aws-sdk (~> 2)
+      excon
+      multi_json
+      retryable (~> 2.0)
+      test-kitchen (~> 1.4, >= 1.4.1)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.4.0)
+    artifactory (2.3.2)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (4.3.2)
+      addressable (~> 2.3, >= 2.3.4)
+      berkshelf-api-client (~> 2.0, >= 2.0.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (= 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      minitar (~> 0.5, >= 0.5.4)
+      octokit (~> 4.0)
+      retryable (~> 2.0)
+      ridley (~> 4.5)
+      solve (~> 2.0)
+      thor (~> 0.19)
+    berkshelf-api-client (2.0.2)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.7.0)
+      ridley (~> 4.5)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.8.1)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    cleanroom (1.0.0)
+    diff-lcs (1.2.5)
+    erubis (2.7.0)
+    excon (0.49.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    httpclient (2.7.1)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-appbundle-updater (0.1.2)
+    kitchen-vagrant (0.20.0)
+      test-kitchen (~> 1.4)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.5)
+      artifactory (>= 2.3.0)
+      mixlib-shellout (>= 2.2.6)
+      mixlib-versioning (>= 1.1.0)
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-versioning (1.1.0)
+    molinillo (0.4.4)
+    multi_json (1.11.2)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    retryable (2.0.3)
+    ridley (4.5.0)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config (>= 12.5.0)
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.7)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    safe_yaml (1.0.4)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    solve (2.0.3)
+      molinillo (~> 0.4.2)
+      semverse (~> 1.1)
+    test-kitchen (1.7.2)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    vagrant-wrapper (2.0.3)
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  berkshelf
+  kitchen-appbundle-updater
+  kitchen-ec2!
+  kitchen-vagrant (~> 0.17)
+  test-kitchen (~> 1.4)
+  vagrant-wrapper
+
+BUNDLED WITH
+   1.11.2
diff --git a/kitchen-tests/cookbooks/audit_test/.gitignore b/kitchen-tests/cookbooks/audit_test/.gitignore
index ec2a890bd3..1e074046f0 100644
--- a/kitchen-tests/cookbooks/audit_test/.gitignore
+++ b/kitchen-tests/cookbooks/audit_test/.gitignore
@@ -1,5 +1,4 @@
 .vagrant
-Berksfile.lock
 *~
 *#
 .#*
diff --git a/kitchen-tests/cookbooks/audit_test/Berksfile.lock b/kitchen-tests/cookbooks/audit_test/Berksfile.lock
new file mode 100644
index 0000000000..ef9f28a3be
--- /dev/null
+++ b/kitchen-tests/cookbooks/audit_test/Berksfile.lock
@@ -0,0 +1,7 @@
+DEPENDENCIES
+  audit_test
+    path: .
+    metadata: true
+
+GRAPH
+  audit_test (0.1.0)
diff --git a/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock b/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock
new file mode 100644
index 0000000000..4a62dbc9ab
--- /dev/null
+++ b/kitchen-tests/test/integration/webapp/serverspec/Gemfile.lock
@@ -0,0 +1,17 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ffi (1.9.10)
+    ffi-yajl (1.4.0)
+      ffi (~> 1.5)
+      libyajl2 (~> 1.2)
+    libyajl2 (1.2.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  ffi-yajl (~> 1.1)
+
+BUNDLED WITH
+   1.11.2
diff --git a/omnibus/Berksfile.lock b/omnibus/Berksfile.lock
new file mode 100644
index 0000000000..93ed1a1f46
--- /dev/null
+++ b/omnibus/Berksfile.lock
@@ -0,0 +1,47 @@
+DEPENDENCIES
+  apt (~> 2.3)
+  freebsd (~> 0.1)
+  omnibus
+  yum-epel (~> 0.3)
+
+GRAPH
+  apt (2.9.2)
+  build-essential (3.2.0)
+    seven_zip (>= 0.0.0)
+  chef-sugar (3.3.0)
+  chef_handler (1.3.0)
+  dmg (2.3.0)
+  freebsd (0.6.0)
+  git (4.4.1)
+    build-essential (>= 0.0.0)
+    dmg (>= 0.0.0)
+    windows (>= 0.0.0)
+    yum-epel (>= 0.0.0)
+  homebrew (2.1.0)
+    build-essential (>= 2.1.2)
+  languages (0.2.6)
+    build-essential (>= 0.0.0)
+    chef-sugar (>= 0.0.0)
+    homebrew (>= 0.0.0)
+    remote_install (>= 0.0.0)
+  omnibus (3.3.0)
+    build-essential (>= 3.0.0)
+    chef-sugar (>= 3.2.0)
+    git (>= 0.0.0)
+    homebrew (>= 0.0.0)
+    languages (>= 0.0.0)
+    remote_install (>= 0.0.0)
+    windows (>= 0.0.0)
+    windows-sdk (>= 0.0.0)
+    wix (>= 0.0.0)
+  remote_install (1.0.2)
+  seven_zip (2.0.0)
+    windows (>= 1.2.2)
+  windows (1.39.2)
+    chef_handler (>= 0.0.0)
+  windows-sdk (1.0.2)
+  wix (2.0.2)
+    windows (>= 1.38.2)
+  yum (3.10.0)
+  yum-epel (0.6.6)
+    yum (~> 3.10.0)
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
new file mode 100644
index 0000000000..e9c711ed78
--- /dev/null
+++ b/omnibus/Gemfile.lock
@@ -0,0 +1,257 @@
+GIT
+  remote: https://github.com/chef/omnibus-software.git
+  revision: 8d611676c4458fa679cbc48e2111892ae7986cbf
+  specs:
+    omnibus-software (4.0.0)
+      omnibus (>= 5.2.0)
+
+GIT
+  remote: https://github.com/chef/omnibus.git
+  revision: e73722f46fbd5f302d9e1541aaae0b2f8be2110e
+  specs:
+    omnibus (5.3.0)
+      aws-sdk (~> 2)
+      chef-sugar (~> 3.3)
+      cleanroom (~> 1.0)
+      ffi-yajl (~> 2.2)
+      mixlib-shellout (~> 2.0)
+      mixlib-versioning
+      ohai (~> 8.0)
+      ruby-progressbar (~> 1.7)
+      thor (~> 0.18)
+
+GIT
+  remote: https://github.com/ksubrama/pedump.git
+  revision: b4319556e18c80d2cba064ffe57fe0dea549dfe2
+  branch: patch-1
+  specs:
+    pedump (0.5.0)
+      awesome_print
+      iostruct (>= 0.0.4)
+      multipart-post (~> 1.2)
+      progressbar
+      zhexdump (>= 0.0.2)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.3.8)
+    artifactory (2.3.2)
+    awesome_print (1.6.1)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    berkshelf (3.3.0)
+      addressable (~> 2.3.4)
+      berkshelf-api-client (~> 1.2)
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      cleanroom (~> 1.0)
+      faraday (~> 0.9.0)
+      httpclient (~> 2.6.0)
+      minitar (~> 0.5.4)
+      octokit (~> 3.0)
+      retryable (~> 2.0)
+      ridley (~> 4.0)
+      solve (~> 1.1)
+      thor (~> 0.19)
+    berkshelf-api-client (1.3.1)
+      faraday (~> 0.9.1)
+      httpclient (~> 2.6.0)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    buff-config (1.0.1)
+      buff-extensions (~> 1.0)
+      varia_model (~> 0.4)
+    buff-extensions (1.0.0)
+    buff-ignore (1.1.1)
+    buff-ruby_engine (0.1.0)
+    buff-shell_out (0.2.0)
+      buff-ruby_engine (~> 0.1.0)
+    builder (3.2.2)
+    byebug (8.2.4)
+    celluloid (0.16.0)
+      timers (~> 4.0.0)
+    celluloid-io (0.16.2)
+      celluloid (>= 0.16.0)
+      nio4r (>= 1.1.0)
+    chef-config (12.8.1)
+      mixlib-config (~> 2.0)
+      mixlib-shellout (~> 2.0)
+    chef-sugar (3.3.0)
+    cleanroom (1.0.0)
+    coderay (1.1.1)
+    debug_inspector (0.0.2)
+    dep-selector-libgecode (1.2.0)
+    dep_selector (1.0.3)
+      dep-selector-libgecode (~> 1.0)
+      ffi (~> 1.9)
+    diff-lcs (1.2.5)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    ffi (1.9.10)
+    ffi-yajl (2.2.3)
+      libyajl2 (~> 1.2)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    hashie (3.4.3)
+    hitimes (1.2.3)
+    httpclient (2.6.0.1)
+    iostruct (0.0.4)
+    ipaddress (0.8.3)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
+    json (1.8.3)
+    json_pure (1.8.3)
+    kitchen-vagrant (0.19.0)
+      test-kitchen (~> 1.4)
+    libyajl2 (1.2.0)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    method_source (0.8.2)
+    minitar (0.5.4)
+    mixlib-authentication (1.4.0)
+      mixlib-log
+      rspec-core (~> 3.2)
+      rspec-expectations (~> 3.2)
+      rspec-mocks (~> 3.2)
+    mixlib-cli (1.5.0)
+    mixlib-config (2.2.1)
+    mixlib-install (1.0.5)
+      artifactory (>= 2.3.0)
+      mixlib-shellout (>= 2.2.6)
+      mixlib-versioning (>= 1.1.0)
+    mixlib-log (1.6.0)
+    mixlib-shellout (2.2.6)
+    mixlib-versioning (1.1.0)
+    multi_json (1.11.2)
+    multipart-post (1.2.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (3.1.1)
+    nio4r (1.2.1)
+    nori (2.6.0)
+    octokit (3.8.0)
+      sawyer (~> 0.6.0, >= 0.5.3)
+    ohai (8.14.0)
+      chef-config (>= 12.5.0.alpha.1, < 13)
+      ffi (~> 1.9)
+      ffi-yajl (~> 2.2)
+      ipaddress
+      mixlib-cli
+      mixlib-config (~> 2.0)
+      mixlib-log
+      mixlib-shellout (~> 2.0)
+      plist (~> 3.1)
+      systemu (~> 2.6.4)
+      wmi-lite (~> 1.0)
+    plist (3.2.0)
+    progressbar (0.21.0)
+    pry (0.10.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-byebug (3.3.0)
+      byebug (~> 8.0)
+      pry (~> 0.10)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    retryable (2.0.3)
+    ridley (4.4.2)
+      addressable
+      buff-config (~> 1.0)
+      buff-extensions (~> 1.0)
+      buff-ignore (~> 1.1)
+      buff-shell_out (~> 0.1)
+      celluloid (~> 0.16.0)
+      celluloid-io (~> 0.16.1)
+      chef-config
+      erubis
+      faraday (~> 0.9.0)
+      hashie (>= 2.0.2, < 4.0.0)
+      httpclient (~> 2.6)
+      json (>= 1.7.7)
+      mixlib-authentication (>= 1.3.0)
+      retryable (~> 2.0)
+      semverse (~> 1.1)
+      varia_model (~> 0.4.0)
+    rspec-core (3.4.4)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-mocks (3.4.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    ruby-progressbar (1.7.5)
+    rubyntlm (0.6.0)
+    rubyzip (1.2.0)
+    safe_yaml (1.0.4)
+    sawyer (0.6.0)
+      addressable (~> 2.3.5)
+      faraday (~> 0.8, < 0.10)
+    semverse (1.2.1)
+    slop (3.6.0)
+    solve (1.2.1)
+      dep_selector (~> 1.0)
+      semverse (~> 1.1)
+    systemu (2.6.5)
+    test-kitchen (1.7.2)
+      mixlib-install (~> 1.0, >= 1.0.4)
+      mixlib-shellout (>= 1.2, < 3.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.9, < 4.0)
+      safe_yaml (~> 1.0)
+      thor (~> 0.18)
+    thor (0.19.1)
+    timers (4.0.4)
+      hitimes
+    varia_model (0.4.1)
+      buff-extensions (~> 1.0)
+      hashie (>= 2.0.2, < 4.0.0)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
+    winrm-fs (0.4.1)
+      erubis (~> 2.7)
+      logging (>= 1.6.1, < 3.0)
+      rubyzip (~> 1.1)
+      winrm (~> 1.5)
+    wmi-lite (1.0.0)
+    zhexdump (0.0.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  berkshelf (~> 3.0)
+  kitchen-vagrant (~> 0.19.0)
+  omnibus!
+  omnibus-software!
+  pedump!
+  pry
+  pry-byebug
+  pry-stack_explorer
+  test-kitchen (~> 1.7.1)
+  winrm-fs (~> 0.4.0)
+
+BUNDLED WITH
+   1.11.2
diff --git a/omnibus_overrides.rb b/omnibus_overrides.rb
new file mode 100644
index 0000000000..66056c0050
--- /dev/null
+++ b/omnibus_overrides.rb
@@ -0,0 +1,19 @@
+# Generated by "rake dependencies". Do not edit.
+override :rubygems, version: "2.6.3"
+override :bundler, version: "1.11.2"
+override "libffi", version: "3.2.1"
+override "libiconv", version: "1.14"
+override "liblzma", version: "5.2.2"
+override "libtool", version: "2.4.2"
+override "libxml2", version: "2.9.3"
+override "libxslt", version: "1.1.28"
+override "libyaml", version: "0.1.6"
+override "makedepend", version: "1.0.5"
+override "ncurses", version: "5.9"
+override "pkg-config-lite", version: "0.28-1"
+override "ruby", version: "2.1.8"
+override "ruby-windows-devkit", version: "4.5.2-20111229-1559"
+override "ruby-windows-devkit-bash", version: "3.1.23-4-msys-1.0.18"
+override "util-macros", version: "1.19.0"
+override "xproto", version: "7.0.28"
+override "zlib", version: "1.2.8"
diff --git a/tasks/bin/bundle-platform b/tasks/bin/bundle-platform
new file mode 100755
index 0000000000..7c77393cb1
--- /dev/null
+++ b/tasks/bin/bundle-platform
@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+platforms = ARGV.shift
+old_platforms = Gem.platforms
+Gem.platforms = platforms.split(" ").map { |p| Gem::Platform.new(p) }
+puts "bundle-platform set Gem.platforms to #{Gem.platforms.map { |p| p.to_s }} (was #{old_platforms.map { |p| p.to_s } })"
+
+# The rest of this is a normal bundler binstub
+require "pathname"
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../../Gemfile",
+  Pathname.new(__FILE__).realpath)
+
+require "rubygems"
+
+load Gem.bin_path("bundler", "bundle")
diff --git a/tasks/bundle.rb b/tasks/bundle.rb
new file mode 100644
index 0000000000..b0cec5f580
--- /dev/null
+++ b/tasks/bundle.rb
@@ -0,0 +1,80 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "bundle_util"
+require_relative "../version_policy"
+
+desc "Tasks to work with the main Gemfile and Gemfile.<platform>"
+namespace :bundle do
+  desc "Update Gemfile.lock and all Gemfile.<platform>.locks (or one or more gems via bundle:update gem1 gem2 ...)."
+  task :update, [:args] do |t, rake_args|
+    extend BundleUtil
+    args = rake_args[:args] || ""
+    with_bundle_unfrozen do
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating Gemfile.lock ..."
+      puts "-------------------------------------------------------------------"
+      bundle "install #{args}", delete_gemfile_lock: true
+      platforms.each do |platform|
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating Gemfile.#{platform}.lock ..."
+        puts "-------------------------------------------------------------------"
+        bundle "lock", gemfile: "Gemfile.#{platform}", platform: platform, delete_gemfile_lock: true
+      end
+    end
+  end
+
+  desc "Conservatively update Gemfile.lock and all Gemfile.<platform>.locks"
+  task :install, [:args] do |t, rake_args|
+    extend BundleUtil
+    args = rake_args[:args] || ""
+    with_bundle_unfrozen do
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating Gemfile.lock ..."
+      puts "-------------------------------------------------------------------"
+      bundle "install #{args}"
+      platforms.each do |platform|
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating Gemfile.#{platform}.lock (conservatively) ..."
+        puts "-------------------------------------------------------------------"
+        bundle "lock", gemfile: "Gemfile.#{platform}", platform: platform
+      end
+    end
+  end
+end
+
+desc "Run bundle with arbitrary args against the given platform; e.g. rake bundle[show]. No platform to run against the main bundle; bundle[show,windows] to run the windows one; bundle[show,*] to run against all non-default platforms."
+task :bundle, [:args, :platform] do |t, rake_args|
+  extend BundleUtil
+  args = rake_args[:args] || ""
+  platform = rake_args[:platform]
+  with_bundle_unfrozen do
+    if platform == "*"
+      platforms.each do |platform|
+        bundle args, platform: platform
+      end
+    elsif platform
+      bundle args, platform: platform
+    else
+      bundle args
+    end
+  end
+end
diff --git a/tasks/bundle_util.rb b/tasks/bundle_util.rb
new file mode 100644
index 0000000000..91ffa1f317
--- /dev/null
+++ b/tasks/bundle_util.rb
@@ -0,0 +1,93 @@
+require "shellwords"
+
+module BundleUtil
+  PLATFORMS = { "windows" => %w{ruby x86-mingw32} }
+
+  def project_root
+    File.expand_path("../..", __FILE__)
+  end
+
+  def bundle_platform
+    File.join(project_root, "tasks", "bin", "bundle-platform")
+  end
+
+  # Parse the output of "bundle outdated" and get the list of gems that
+  # were outdated
+  def parse_bundle_outdated(bundle_outdated_output)
+    result = []
+    bundle_outdated_output.each_line do |line|
+      if line =~ /^\s*\* (.+) \(newest ([^,]+), installed ([^,)])*/
+        gem_name, newest_version, installed_version = $1, $2, $3
+        result << [ line, gem_name ]
+      end
+    end
+    result
+  end
+
+  def with_bundle_unfrozen
+    bundle "config --delete frozen"
+    begin
+      yield
+    ensure
+      bundle "config --local frozen 1"
+    end
+  end
+
+  # Run bundle-platform with the given ruby platform(s)
+  def bundle(args, gemfile: nil, platform: nil, cwd: nil, extract_output: false, delete_gemfile_lock: false)
+    args = args.split(/\s+/)
+    if cwd
+      prefix = "[#{cwd}] "
+    end
+    cwd = File.expand_path(cwd || ".", project_root)
+    Bundler.with_clean_env do
+      Dir.chdir(cwd) do
+        gemfile ||= "Gemfile"
+        gemfile = File.expand_path(gemfile, cwd)
+        raise "No platform #{platform} (supported: #{PLATFORMS.keys.join(", ")})" if platform && !PLATFORMS[platform]
+
+        # First delete the gemfile.lock
+        if delete_gemfile_lock
+          if File.exist?("#{gemfile}.lock")
+            puts "Deleting #{gemfile}.lock ..."
+            File.delete("#{gemfile}.lock")
+          end
+        end
+
+        # Run the bundle command
+        ruby_platforms = platform ? PLATFORMS[platform].join(" ") : "ruby"
+        cmd = Shellwords.join([bundle_platform, ruby_platforms, *args])
+        puts "#{prefix}#{Shellwords.join(["bundle", *args])}#{platform ? " for #{platform} platform" : ""}:"
+        with_gemfile(gemfile) do
+          puts "#{prefix}BUNDLE_GEMFILE=#{gemfile}"
+          puts "#{prefix}> #{cmd}"
+          if extract_output
+            `#{cmd}`
+          else
+            unless system(bundle_platform, ruby_platforms, *args)
+              raise "#{bundle_platform} failed: exit code #{$?}"
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def with_gemfile(gemfile)
+    old_gemfile = ENV["BUNDLE_GEMFILE"]
+    ENV["BUNDLE_GEMFILE"] = gemfile
+    begin
+      yield
+    ensure
+      if old_gemfile
+        ENV["BUNDLE_GEMFILE"] = old_gemfile
+      else
+        ENV.delete("BUNDLE_GEMFILE")
+      end
+    end
+  end
+
+  def platforms
+    PLATFORMS.keys
+  end
+end
diff --git a/tasks/dependencies.rb b/tasks/dependencies.rb
new file mode 100644
index 0000000000..7955686963
--- /dev/null
+++ b/tasks/dependencies.rb
@@ -0,0 +1,164 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "bundle_util"
+require_relative "bundle"
+require_relative "../version_policy"
+
+desc "Tasks to update and check dependencies"
+namespace :dependencies do
+  # Update all dependencies to the latest constraint-matching version
+  desc "Update all dependencies. dependencies:update[conservative] to update as little as possible."
+  task :update, [:conservative] => %w{
+                    dependencies:update_gemfile_lock
+                    dependencies:update_omnibus_overrides
+                    dependencies:update_omnibus_gemfile_lock
+                    dependencies:update_acceptance_gemfile_lock
+                    dependencies:update_kitchen_tests_gemfile_lock
+                    dependencies:update_omnibus_berksfile_lock
+                    dependencies:update_kitchen_tests_berksfile_lock
+                  }
+
+  desc "Update Gemfile.lock and all Gemfile.<platform>.locks. update_gemfile_lock[conservative] to update as little as possible."
+  task :update_gemfile_lock, [:conservative] do |t, rake_args|
+    conservative = rake_args[:conservative]
+    if conservative
+      Rake::Task["bundle:install"].invoke
+    else
+      Rake::Task["bundle:update"].invoke
+    end
+  end
+
+  def gemfile_lock_task(task_name, dirs: [])
+    dirs.each do |dir|
+      desc "Update #{dir}/Gemfile.lock. #{task_name}[conservative] to update as little as possible."
+      task task_name, [:conservative] do |t, rake_args|
+        extend BundleUtil
+        conservative = rake_args[:conservative]
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating #{dir}/Gemfile.lock#{conservative ? " (conservatively)" : ""} ..."
+        puts "-------------------------------------------------------------------"
+        bundle "install", cwd: dir, delete_gemfile_lock: !conservative
+      end
+    end
+  end
+
+  def berksfile_lock_task(task_name, dirs: [])
+    dirs.each do |dir|
+      desc "Update #{dir}/Berksfile.lock. #{task_name}[conservative] to update as little as possible."
+      task task_name, [:conservative] do |t, rake_args|
+        extend BundleUtil
+        conservative = rake_args[:conservative]
+        puts ""
+        puts "-------------------------------------------------------------------"
+        puts "Updating #{dir}/Berksfile.lock#{conservative ? " (conservatively)" : ""} ..."
+        puts "-------------------------------------------------------------------"
+        if !conservative && File.exist?("#{project_root}/#{dir}/Berksfile.lock")
+          File.delete("#{project_root}/#{dir}/Berksfile.lock")
+        end
+        Dir.chdir("#{project_root}/#{dir}") do
+          Bundler.with_clean_env do
+            sh "bundle exec berks install"
+          end
+        end
+      end
+    end
+  end
+
+  gemfile_lock_task :update_omnibus_gemfile_lock, dirs: %w{omnibus}
+  berksfile_lock_task :update_omnibus_berksfile_lock, dirs: %w{omnibus}
+  gemfile_lock_task :update_acceptance_gemfile_lock, dirs: %w{
+    acceptance
+    acceptance/fips/test/integration/fips/serverspec
+  }
+  gemfile_lock_task :update_kitchen_tests_gemfile_lock, dirs: %w{
+    kitchen-tests
+    kitchen-tests/test/integration/webapp/serverspec
+  }
+  berksfile_lock_task :update_kitchen_tests_berksfile_lock, dirs: %w{
+    kitchen-tests
+    kitchen-tests/cookbooks/audit_test
+  }
+  # kitchen-tests/cookbooks/webapp isn't solving right now ....
+
+  desc "Update omnibus overrides, including versions in version_policy.rb and latest version of gems: #{OMNIBUS_RUBYGEMS_AT_LATEST_VERSION.keys}. update_omnibus_overrides[conservative] does nothing."
+  task :update_omnibus_overrides, [:conservative] do |t, rake_args|
+    conservative = rake_args[:conservative]
+    unless conservative
+      puts ""
+      puts "-------------------------------------------------------------------"
+      puts "Updating omnibus_overrides.rb ..."
+      puts "-------------------------------------------------------------------"
+
+      # Generate the new overrides file
+      overrides = "# Generated by \"rake dependencies\". Do not edit.\n"
+
+      # Replace the bundler and rubygems versions
+      OMNIBUS_RUBYGEMS_AT_LATEST_VERSION.each do |override_name, gem_name|
+        # Get the latest bundler version
+        puts "Running gem list -re #{gem_name} ..."
+        gem_list = `gem list -re #{gem_name}`
+        unless gem_list =~ /^#{gem_name}\s*\(([^)]*)\)$/
+          raise "gem list -re #{gem_name} failed with output:\n#{gem_list}"
+        end
+
+        # Emit it
+        puts "Latest version of #{gem_name} is #{$1}"
+        overrides << "override #{override_name.inspect}, version: #{$1.inspect}\n"
+      end
+
+      # Add explicit overrides
+      OMNIBUS_OVERRIDES.each do |override_name, version|
+        overrides << "override #{override_name.inspect}, version: #{version.inspect}\n"
+      end
+
+      # Write the file out (if changed)
+      overrides_path = File.expand_path("../../omnibus_overrides.rb", __FILE__)
+      if overrides != IO.read(overrides_path)
+        puts "Overrides changed!"
+        puts `git diff #{overrides_path}`
+        puts "Writing modified #{overrides_path} ..."
+        IO.write(overrides_path, overrides)
+      end
+    end
+  end
+
+  # Find out if we're using the latest gems we can (so we don't regress versions)
+  desc "Check for gems that are not at the latest released version, and report if anything not in ACCEPTABLE_OUTDATED_GEMS (version_policy.rb) is out of date."
+  task :check_outdated do
+    puts ""
+    puts "-------------------------------------------------------------------"
+    puts "Checking for outdated gems ..."
+    puts "-------------------------------------------------------------------"
+    # TODO check for outdated windows gems too
+    bundle_outdated = bundle("outdated", extract_output: true)
+    puts bundle_outdated
+    outdated_gems = parse_bundle_outdated(bundle_outdated).map { |line, gem_name| gem_name }
+    # Weed out the acceptable ones
+    outdated_gems = outdated_gems.reject { |gem_name| ACCEPTABLE_OUTDATED_GEMS.include?(gem_name) }
+    if outdated_gems.empty?
+      puts ""
+      puts "SUCCESS!"
+    else
+      raise "ERROR: outdated gems: #{outdated_gems.join(", ")}. Either fix them or add them to ACCEPTABLE_OUTDATED_GEMS in #{__FILE__}."
+    end
+  end
+end
+desc "Update all dependencies and check for outdated gems. Call dependencies[conservative] to update as little as possible."
+task :dependencies, [:conservative] => [ "dependencies:update", "dependencies:check_outdated" ]
+task :update, [:conservative] => [ "dependencies:update", "dependencies:check_outdated"]
diff --git a/tasks/gemfile_util.rb b/tasks/gemfile_util.rb
new file mode 100644
index 0000000000..60d1e2ff31
--- /dev/null
+++ b/tasks/gemfile_util.rb
@@ -0,0 +1,99 @@
+require "bundler"
+
+module GemfileUtil
+  #
+  # Given a set of dependencies with groups in them, and a resolved set of
+  # gemspecs (with dependency info in them), creates a full set of specs
+  # with group information on it. If A is in groups x and y, and A depends on
+  # B and C, then B and C are also in groups x and y.
+  #
+  class GemGroups < Hash
+    def initialize(resolved)
+      @resolved = resolved
+    end
+    attr_reader :resolved
+
+    def add_dependency(dep)
+      add_gem_groups(dep.name, dep.groups)
+    end
+
+    private
+
+    def add_gem_groups(name, groups)
+      self[name] ||= []
+      difference = groups - self[name]
+      unless difference.empty?
+        self[name] += difference
+        spec = resolved.find { |spec| spec.name == name }
+        if spec
+          spec.dependencies.each do |spec|
+            add_gem_groups(spec.name, difference)
+          end
+        end
+      end
+    end
+  end
+
+  def calculate_dependents(spec_set)
+    dependents = {}
+    spec_set.each do |spec|
+      dependents[spec] ||= []
+    end
+    spec_set.each do |spec|
+      spec.dependencies.each do |dep|
+        puts "#{dep.class} -> #{spec.class}"
+        dependents[dep] << spec
+      end
+    end
+    dependents
+  end
+
+  def include_locked_gemfile(gemfile)
+    #
+    # Read the gemfile and inject its locks as first-class dependencies
+    #
+    current_source = nil
+    bundle = Bundler::Definition.build(gemfile, "#{gemfile}.lock", nil)
+
+    # Go through and create the actual gemfile from the given locks and
+    # groups.
+    bundle.resolve.sort_by { |spec| spec.name }.each do |spec|
+      # bundler can't be installed by bundler so don't pin it.
+      next if spec.name == "bundler"
+      dep = bundle.dependencies.find { |d| d.name == spec.name }
+      gem_metadata = ""
+      if dep
+        gem_metadata << ", groups: #{dep.groups.inspect}" if dep.groups != [:default]
+        gem_metadata << ", platforms: #{dep.platforms.inspect}" if dep.platforms && !dep.platforms.empty?
+      end
+      case spec.source
+      when Bundler::Source::Rubygems
+        if current_source
+          if current_source != spec.source
+            raise "Gem #{spec.name} has source #{spec.source}, but other gems have #{current_source}. Multiple rubygems sources are not supported."
+          end
+        else
+          current_source = spec.source
+          add_gemfile_line("source #{spec.source.remotes.first.to_s.inspect}", __LINE__)
+        end
+        add_gemfile_line("gem #{spec.name.inspect}, #{spec.version.to_s.inspect}#{gem_metadata}", __LINE__)
+      when Bundler::Source::Git
+        add_gemfile_line("gem #{spec.name.inspect}, git: #{spec.source.uri.to_s.inspect}, ref: #{spec.source.revision.inspect}#{gem_metadata}", __LINE__)
+      when Bundler::Source::Path
+        add_gemfile_line("gem #{spec.name.inspect}, path: #{spec.source.path.to_s.inspect}#{gem_metadata}", __LINE__)
+      else
+        raise "Unknown source #{spec.source} for gem #{spec.name}"
+      end
+    end
+  rescue
+    puts $!
+    puts $!.backtrace
+    raise
+  end
+
+  private
+
+  def add_gemfile_line(line, lineno)
+    instance_eval(line, __FILE__, lineno)
+  end
+end
diff --git a/version_policy.rb b/version_policy.rb
new file mode 100644
index 0000000000..fd60fbd644
--- /dev/null
+++ b/version_policy.rb
@@ -0,0 +1,104 @@
+#
+# Copyright:: Copyright (c) 2016 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Explicit omnibus overrides.
+OMNIBUS_OVERRIDES = {
+  # Lower level library pins
+  ## according to comment in omnibus-sw, latest versions don't work on solaris
+  # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
+  "libffi" => "3.2.1",
+  "libiconv" => "1.14",
+  "liblzma" => "5.2.2",
+  ## according to comment in omnibus-sw, the very latest versions don't work on solaris
+  # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
+  "libtool" => "2.4.2",
+  "libxml2" => "2.9.3",
+  "libxslt" => "1.1.28",
+  "libyaml" => "0.1.6",
+  "makedepend" => "1.0.5",
+  "ncurses" => "5.9",
+  "pkg-config-lite" => "0.28-1",
+  "ruby" => "2.1.8",
+  # Leave dev-kit pinned to 4.5 because 4.7 is 20MB larger and we don't want
+  # to unnecessarily make the client any fatter.
+  "ruby-windows-devkit" => "4.5.2-20111229-1559",
+  "ruby-windows-devkit-bash" => "3.1.23-4-msys-1.0.18",
+  "util-macros" => "1.19.0",
+  "xproto" => "7.0.28",
+  "zlib" => "1.2.8",
+
+  ## These can float as they are frequently updated in a way that works for us
+  #override "cacerts" =>"???",
+  #override "openssl" =>"???",
+}
+
+#
+# rake dependencies:update_omnibus_overrides (tasks/dependencies.rb) reads this
+# and modifies omnibus_overrides.rb
+#
+# The left side is the software definition name, and the right side is the
+# name of the rubygem (gem list -re <rubygem name> gets us the latest version).
+#
+OMNIBUS_RUBYGEMS_AT_LATEST_VERSION = {
+  rubygems: "rubygems-update",
+  bundler: "bundler",
+}
+
+#
+# rake dependencies:check (tasks/dependencies.rb) uses this as a list of gems
+# that are allowed to be outdated according to `bundle updated`
+#
+# Once you decide that the list of outdated gems is OK, you can just
+# add gems to the output of bundle outdated here and we'll parse it to get the
+# list of outdated gems.
+#
+# We're starting with debt here, but don't want it to get worse.
+#
+ACCEPTABLE_OUTDATED_GEMS = %w{
+  activesupport
+  github_changelog_generator
+}
+
+#
+# Some gems are part of our bundle (must be installed) but not important
+# enough to lock. We allow `bundle install` in test-kitchen, berks, etc.
+# to use their own versions of these.
+#
+# This mainly tells you which gems `chef verify` allows you to install and
+# run.
+#
+GEMS_ALLOWED_TO_FLOAT = [
+]
+
+#
+# The list of groups we install without: this drives both the `bundle install`
+# we do in chef-dk, and the `bundle check` we do to ensure installed gems don't
+# have extra deps hiding in their Gemfiles.
+#
+INSTALL_WITHOUT_GROUPS = %w{
+  development
+  test
+  guard
+  maintenance
+  tools
+  integration
+  changelog
+  compat_testing
+  docgen
+  ruby_prof
+  travis
+}