Merge branch 'master' of github.com:chef/chef into windows_security_policy

53 files changed, 252 insertions, 301 deletions

diff --git a/.expeditor/cleanup_orphaned_test_resources.sh b/.expeditor/cleanup_orphaned_test_resources.sh
deleted file mode 100755
index ccf1c7473a..0000000000
--- a/.expeditor/cleanup_orphaned_test_resources.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-echo "--- Setting up Azure credentials"
-export VAULT_UTIL_SECRETS="{\"ARM_TENANT_ID\":{\"account\":\"azure/engineering-dev-test\",\"field\":\"tenant_id\"},\"ARM_CLIENT_ID\":{\"account\":\"azure/engineering-dev-test\",\"field\":\"client_id\"},\"ARM_CLIENT_SECRET\":{\"account\":\"azure/engineering-dev-test\",\"field\":\"client_secret\"}}"
-. <(vault-util fetch-secret-env)
-
-# this allows time for the new service-principal to become available
-sleep 10
-
-az login --service-principal --tenant "$ARM_TENANT_ID" --username "$ARM_CLIENT_ID" --password "$ARM_CLIENT_SECRET"
-
-echo "--- Deleting Azure kitchen-end-to-end-windows-10 resource groups"
-az group list --query "[?starts_with(name, 'kitchen-end-to-end-windows-10-')].name" --output tsv | xargs -n1 -t -I% az group delete -y --no-wait --name "%"
diff --git a/.expeditor/config.yml b/.expeditor/config.yml
index 3323d1f470..090a31808a 100644
--- a/.expeditor/config.yml
+++ b/.expeditor/config.yml
@@ -25,10 +25,7 @@ docker_images:
 
 pipelines:
   - verify:
-      definition: .expeditor/verify_public.pipeline.yml
       public: true
-  - verify/private:
-      definition: .expeditor/verify_private.pipeline.yml
   - verify/habitat:
       description: >
         A temporary pipeline to verify the habitat plans. Performs a local build,
@@ -69,11 +66,6 @@ github:
     - chef-14:
         version_constraint: 14*
 
-schedules:
-  - name: cleanup_orphaned_test_resources
-    description: Cleanup orphaned test resources
-    cronline: "0 1 * * *" # every day at 1am
-
 changelog:
   rollup_header: Changes not yet released to stable
 
@@ -101,10 +93,6 @@ merge_actions:
       only_if: built_in:bump_version
 
 subscriptions:
-  - workload: schedule_triggered:{{agent_id}}:cleanup_orphaned_test_resources:*
-    actions:
-      - bash:.expeditor/cleanup_orphaned_test_resources.sh
-
   # the omnibus/docker/gem chain
   - workload: artifact_published:unstable:chef:{{version_constraint}}
     actions:
diff --git a/.expeditor/verify_public.pipeline.yml b/.expeditor/verify.pipeline.yml
index 7d016140cd..60142e9928 100644
--- a/.expeditor/verify_public.pipeline.yml
+++ b/.expeditor/verify.pipeline.yml
@@ -291,7 +291,7 @@ steps:
   # EXTERNAL GEM TESTING
 #########################################################################
 
-- label: "chef-sugar gem :ruby: 2.6"
+- label: "chef-sugar gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
@@ -299,9 +299,9 @@ steps:
   expeditor:
     executor:
       docker:
-        image: rubydistros/ubuntu-18.04:2.6
+        image: rubydistros/ubuntu-18.04:2.7
 
-- label: "chef-zero gem :ruby: 2.6"
+- label: "chef-zero gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
@@ -309,12 +309,12 @@ steps:
   expeditor:
     executor:
       docker:
-        image: rubydistros/ubuntu-18.04:2.6
+        image: rubydistros/ubuntu-18.04:2.7
         environment:
           - PEDANT_OPTS=--skip-oc_id
           - CHEF_FS=true
 
-- label: "cheffish gem :ruby: 2.6"
+- label: "cheffish gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
@@ -324,7 +324,7 @@ steps:
       docker:
         image: rubydistros/ubuntu-18.04:2.6
 
-- label: "chefspec gem :ruby: 2.6"
+- label: "chefspec gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
@@ -332,9 +332,9 @@ steps:
   expeditor:
     executor:
       docker:
-        image: rubydistros/ubuntu-18.04:2.6
+        image: rubydistros/ubuntu-18.04:2.7
 
-- label: "knife-windows gem :ruby: 2.6"
+- label: "knife-windows gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
@@ -342,20 +342,19 @@ steps:
   expeditor:
     executor:
       docker:
-        image: rubydistros/ubuntu-18.04:2.6
+        image: rubydistros/ubuntu-18.04:2.7
 
-- label: "berkshelf gem :ruby: 2.6"
+- label: "berkshelf gem :ruby: 2.7"
   commands:
     - /workdir/scripts/bk_tests/bk_container_prep.sh
     - apt-get update -y
     - apt-get install -y graphviz
-    - gem install bundler -v 1.17.3 # necessary for berks Gemfile.lock for now
     - bundle install --jobs=3 --retry=3 --path=vendor/bundle --without omnibus_package docgen
     - bundle exec tasks/bin/run_external_test berkshelf/berkshelf master rake
   expeditor:
     executor:
       docker:
-        image: rubydistros/ubuntu-18.04:2.6
+        image: rubydistros/ubuntu-18.04:2.7
 
 #########################################################################
   # START TEST KITCHEN ONLY
diff --git a/.expeditor/verify_private.pipeline.yml b/.expeditor/verify_private.pipeline.yml
deleted file mode 100644
index 5d62c77ae3..0000000000
--- a/.expeditor/verify_private.pipeline.yml
+++ /dev/null
@@ -1,41 +0,0 @@
----
-expeditor:
-  cached_folders:
-    - vendor
-  defaults:
-    buildkite:
-      retry:
-        automatic:
-          limit: 1
-      timeout_in_minutes: 30
-
-steps:
-
-#########################################################################
-  # START TEST KITCHEN ONLY
-#########################################################################
-
-- label: "Kitchen Tests Windows 10"
-  commands:
-    - scripts/bk_tests/bk_linux_exec.sh
-    - cd kitchen-tests
-    - /opt/omnibus-toolchain/bin/bundle exec kitchen test end-to-end-windows-10
-  artifact_paths:
-    - $PWD/.kitchen/logs/kitchen.log
-  env:
-      KITCHEN_YAML: kitchen.azure.yml
-  expeditor:
-    executor:
-      linux:
-        privileged: true
-        single-use: true
-    secrets:
-      AZURE_TENANT_ID:
-        account: azure/engineering-dev-test
-        field: tenant_id
-      AZURE_CLIENT_ID:
-        account: azure/engineering-dev-test
-        field: client_id
-      AZURE_CLIENT_SECRET:
-        account: azure/engineering-dev-test
-        field: client_secret
diff --git a/CHANGELOG.md b/CHANGELOG.md
index daa5baa233..74b8746ea5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,15 +1,23 @@
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 16.2.56 -->
-## [v16.2.56](https://github.com/chef/chef/tree/v16.2.56) (2020-06-24)
+<!-- latest_release unreleased -->
+## Unreleased
 
 #### Merged Pull Requests
-- consume powershell shim DLLs from hab package [#10022](https://github.com/chef/chef/pull/10022) ([mwrock](https://github.com/mwrock))
+- Remove Azure private verify pipeline [#10019](https://github.com/chef/chef/pull/10019) ([christopher-snapp](https://github.com/christopher-snapp))
 <!-- latest_release -->
 
 <!-- release_rollup since=16.2.50 -->
 ### Changes not yet released to stable
 
 #### Merged Pull Requests
+- Remove Azure private verify pipeline [#10019](https://github.com/chef/chef/pull/10019) ([christopher-snapp](https://github.com/christopher-snapp)) <!-- 16.2.63 -->
+- Update ffi-libarchive for windows fixes / pin the dep [#10072](https://github.com/chef/chef/pull/10072) ([tas50](https://github.com/tas50)) <!-- 16.2.63 -->
+- fix habitat based windows service tests [#10070](https://github.com/chef/chef/pull/10070) ([mwrock](https://github.com/mwrock)) <!-- 16.2.62 -->
+- Update the windows_user_privilege resource to have a `:clear` action [#10063](https://github.com/chef/chef/pull/10063) ([chef-davin](https://github.com/chef-davin)) <!-- 16.2.61 -->
+- specs: Remove more methods defined on the top-level scope [#10060](https://github.com/chef/chef/pull/10060) ([phiggins](https://github.com/phiggins)) <!-- 16.2.60 -->
+- Bump the external tests to 2.7 [#10062](https://github.com/chef/chef/pull/10062) ([lamont-granquist](https://github.com/lamont-granquist)) <!-- 16.2.59 -->
+- Bump train-core to 3.3.4 [#10067](https://github.com/chef/chef/pull/10067) ([chef-expeditor[bot]](https://github.com/chef-expeditor[bot])) <!-- 16.2.58 -->
+- Fixed broken chef-apply with -j [#10066](https://github.com/chef/chef/pull/10066) ([komazarari](https://github.com/komazarari)) <!-- 16.2.57 -->
 - consume powershell shim DLLs from hab package [#10022](https://github.com/chef/chef/pull/10022) ([mwrock](https://github.com/mwrock)) <!-- 16.2.56 -->
 - Inline some constants to prevent redefenition warnings in tests. [#10047](https://github.com/chef/chef/pull/10047) ([phiggins](https://github.com/phiggins)) <!-- 16.2.55 -->
 - Bump diff-lcs to get bugfix. [#10057](https://github.com/chef/chef/pull/10057) ([phiggins](https://github.com/phiggins)) <!-- 16.2.54 -->
diff --git a/Gemfile.lock b/Gemfile.lock
index 9d1ce3cf1c..6c904f775b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,10 +1,10 @@
 GIT
   remote: https://github.com/chef/chefstyle.git
-  revision: 309b638d8434b8a98f7c54329947ea11c8373ef4
+  revision: d8d6cc3aa61b8ba9611be452f43618f5a6138ade
   branch: master
   specs:
-    chefstyle (1.1.1)
-      rubocop (= 0.85.1)
+    chefstyle (1.1.2)
+      rubocop (= 0.86.0)
 
 GIT
   remote: https://github.com/chef/ohai.git
@@ -28,19 +28,19 @@ GIT
 PATH
   remote: .
   specs:
-    chef (16.2.56)
+    chef (16.2.63)
       addressable
       bcrypt_pbkdf (= 1.1.0.rc1)
       bundler (>= 1.10)
-      chef-config (= 16.2.56)
-      chef-utils (= 16.2.56)
+      chef-config (= 16.2.63)
+      chef-utils (= 16.2.63)
       chef-vault
       chef-zero (>= 14.0.11)
       diff-lcs (~> 1.2, >= 1.2.4)
       ed25519 (~> 1.2)
       erubis (~> 2.7)
       ffi (>= 1.9.25)
-      ffi-libarchive
+      ffi-libarchive (~> 1.0, >= 1.0.3)
       ffi-yajl (~> 2.2)
       highline (>= 1.6.9, < 3)
       iniparse (~> 1.4)
@@ -62,19 +62,19 @@ PATH
       train-winrm (>= 0.2.5)
       tty-screen (~> 0.6)
       uuidtools (~> 2.1.5)
-    chef (16.2.56-universal-mingw32)
+    chef (16.2.63-universal-mingw32)
       addressable
       bcrypt_pbkdf (= 1.1.0.rc1)
       bundler (>= 1.10)
-      chef-config (= 16.2.56)
-      chef-utils (= 16.2.56)
+      chef-config (= 16.2.63)
+      chef-utils (= 16.2.63)
       chef-vault
       chef-zero (>= 14.0.11)
       diff-lcs (~> 1.2, >= 1.2.4)
       ed25519 (~> 1.2)
       erubis (~> 2.7)
       ffi (>= 1.9.25)
-      ffi-libarchive
+      ffi-libarchive (~> 1.0, >= 1.0.3)
       ffi-yajl (~> 2.2)
       highline (>= 1.6.9, < 3)
       iniparse (~> 1.4)
@@ -112,15 +112,15 @@ PATH
 PATH
   remote: chef-bin
   specs:
-    chef-bin (16.2.56)
-      chef (= 16.2.56)
+    chef-bin (16.2.63)
+      chef (= 16.2.63)
 
 PATH
   remote: chef-config
   specs:
-    chef-config (16.2.56)
+    chef-config (16.2.63)
       addressable
-      chef-utils (= 16.2.56)
+      chef-utils (= 16.2.63)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
@@ -129,7 +129,7 @@ PATH
 PATH
   remote: chef-utils
   specs:
-    chef-utils (16.2.56)
+    chef-utils (16.2.63)
 
 GEM
   remote: https://rubygems.org/
@@ -180,7 +180,7 @@ GEM
     ffi (1.13.1)
     ffi (1.13.1-x64-mingw32)
     ffi (1.13.1-x86-mingw32)
-    ffi-libarchive (1.0.0)
+    ffi-libarchive (1.0.3)
       ffi (~> 1.0)
     ffi-win32-extensions (1.0.3)
       ffi
@@ -318,13 +318,13 @@ GEM
     rspec_junit_formatter (0.2.3)
       builder (< 4)
       rspec-core (>= 2, < 4, != 2.12.0)
-    rubocop (0.85.1)
+    rubocop (0.86.0)
       parallel (~> 1.10)
       parser (>= 2.7.0.1)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.7)
       rexml
-      rubocop-ast (>= 0.0.3)
+      rubocop-ast (>= 0.0.3, < 1.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 2.0)
     rubocop-ast (0.0.3)
@@ -353,7 +353,7 @@ GEM
     tins (1.25.0)
       sync
     tomlrb (1.2.9)
-    train-core (3.3.1)
+    train-core (3.3.4)
       addressable (~> 2.5)
       ffi (!= 1.13.0)
       json (>= 1.8, < 3.0)
diff --git a/VERSION b/VERSION
index fd167d1e60..09affc43dc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-16.2.56
\ No newline at end of file
+16.2.63
\ No newline at end of file
diff --git a/chef-bin/lib/chef-bin/version.rb b/chef-bin/lib/chef-bin/version.rb
index 1085441bf4..63fbfdd952 100644
--- a/chef-bin/lib/chef-bin/version.rb
+++ b/chef-bin/lib/chef-bin/version.rb
@@ -21,7 +21,7 @@
 
 module ChefBin
   CHEFBIN_ROOT = File.expand_path("../..", __FILE__)
-  VERSION = "16.2.56".freeze
+  VERSION = "16.2.63".freeze
 end
 
 #
diff --git a/chef-config/lib/chef-config/version.rb b/chef-config/lib/chef-config/version.rb
index eafe665a32..023b16aa79 100644
--- a/chef-config/lib/chef-config/version.rb
+++ b/chef-config/lib/chef-config/version.rb
@@ -15,5 +15,5 @@
 
 module ChefConfig
   CHEFCONFIG_ROOT = File.expand_path("../..", __FILE__)
-  VERSION = "16.2.56".freeze
+  VERSION = "16.2.63".freeze
 end
diff --git a/chef-utils/lib/chef-utils/version.rb b/chef-utils/lib/chef-utils/version.rb
index ac03c19eae..5155a2959a 100644
--- a/chef-utils/lib/chef-utils/version.rb
+++ b/chef-utils/lib/chef-utils/version.rb
@@ -15,5 +15,5 @@
 
 module ChefUtils
   CHEFUTILS_ROOT = File.expand_path("../..", __FILE__)
-  VERSION = "16.2.56".freeze
+  VERSION = "16.2.63".freeze
 end
diff --git a/chef.gemspec b/chef.gemspec
index 69644f0fb5..b2fc6cf5e3 100644
--- a/chef.gemspec
+++ b/chef.gemspec
@@ -40,7 +40,7 @@ Gem::Specification.new do |s|
   s.add_dependency "pastel" # knife ui.color
   s.add_dependency "erubis", "~> 2.7"
   s.add_dependency "diff-lcs", "~> 1.2", ">= 1.2.4"
-  s.add_dependency "ffi-libarchive"
+  s.add_dependency "ffi-libarchive", "~> 1.0", ">= 1.0.3"
   s.add_dependency "chef-zero", ">= 14.0.11"
   s.add_dependency "chef-vault"
 
diff --git a/habitat/tests/spec.ps1 b/habitat/tests/spec.ps1
index ab1656b221..0229ac487f 100644
--- a/habitat/tests/spec.ps1
+++ b/habitat/tests/spec.ps1
@@ -10,6 +10,13 @@ $chef_gem_root = (hab pkg exec $PackageIdentifier gem.cmd which chef | Split-Pat
 try {
     Push-Location $chef_gem_root
     $env:PATH = "C:\hab\bin;$env:PATH"
+
+    # Put chef's GEM_PATH in the machine environment so that the windows service
+    # tests will be able to consume the win32-service gem
+    $pkgEnv = hab pkg env $PackageIdentifier
+    $gemPath = $pkgEnv | Where-Object { $_.StartsWith("`$env:GEM_PATH=") }
+    SETX GEM_PATH $($gemPath.Split("=")[1]) /m
+
     hab pkg binlink --force $PackageIdentifier
     /hab/bin/rspec --format progress --tag ~executables --tag ~choco_installed spec/functional
     if (-not $?) { throw "functional testing failed"}
diff --git a/lib/chef/application/apply.rb b/lib/chef/application/apply.rb
index 4ed2d2a1f2..c8c0c0eaf6 100644
--- a/lib/chef/application/apply.rb
+++ b/lib/chef/application/apply.rb
@@ -21,6 +21,7 @@ require_relative "../../chef"
 require_relative "../application"
 require_relative "../client"
 require_relative "../config"
+require_relative "../config_fetcher"
 require_relative "../log"
 require "fileutils" unless defined?(FileUtils)
 require "tempfile" unless defined?(Tempfile)
diff --git a/lib/chef/resource/windows_user_privilege.rb b/lib/chef/resource/windows_user_privilege.rb
index aeff7ad468..c6d7a16346 100644
--- a/lib/chef/resource/windows_user_privilege.rb
+++ b/lib/chef/resource/windows_user_privilege.rb
@@ -112,6 +112,15 @@ class Chef
         action         :remove
       end
       ```
+
+      **Clear all users from the SeDenyNetworkLogonRight Privilege**:
+
+      ```ruby
+      windows_user_privilege 'Allow any user the Network Logon right' do
+        privilege      'SeDenyNetworkLogonRight'
+        action         :clear
+      end
+      ```
       DOC
 
       property :principal, String,
@@ -132,8 +141,8 @@ class Chef
          }
 
       load_current_value do |new_resource|
-        unless new_resource.principal.nil?
-          privilege Chef::ReservedNames::Win32::Security.get_account_right(new_resource.principal) unless new_resource.action.include?(:set)
+        if new_resource.principal && (new_resource.action.include?(:add) || new_resource.action.include?(:remove))
+          privilege Chef::ReservedNames::Win32::Security.get_account_right(new_resource.principal)
         end
       end
 
@@ -180,6 +189,20 @@ class Chef
         end
       end
 
+      action :clear do
+        new_resource.privilege.each do |privilege|
+          accounts = Chef::ReservedNames::Win32::Security.get_account_with_user_rights(privilege)
+
+          # comparing the existing accounts for privilege with users
+          # Removing only accounts which is not matching with users in new_resource
+          accounts.each do |account|
+            converge_by("removing user '#{account}' from privilege #{privilege}") do
+              Chef::ReservedNames::Win32::Security.remove_account_right(account, privilege)
+            end
+          end
+        end
+      end
+
       action :remove do
         curr_res_privilege = current_resource.privilege
         missing_res_privileges = (new_resource.privilege - curr_res_privilege)
diff --git a/lib/chef/version.rb b/lib/chef/version.rb
index 42ef2513bd..400854b777 100644
--- a/lib/chef/version.rb
+++ b/lib/chef/version.rb
@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("../..", __FILE__)
-  VERSION = Chef::VersionString.new("16.2.56")
+  VERSION = Chef::VersionString.new("16.2.63")
 end
 
 #
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
index 87bf6688c3..c37f90dc97 100644
--- a/omnibus/Gemfile.lock
+++ b/omnibus/Gemfile.lock
@@ -18,7 +18,7 @@ GIT
 
 GIT
   remote: https://github.com/chef/omnibus-software
-  revision: 86a1c7ebb859161385676e3bfe537e13ba680f59
+  revision: 2cf96c6c07de7d05ded6b45a0531feb10ae7cd9e
   branch: master
   specs:
     omnibus-software (4.0.0)
@@ -32,26 +32,26 @@ GEM
     artifactory (3.0.15)
     awesome_print (1.8.0)
     aws-eventstream (1.1.0)
-    aws-partitions (1.329.0)
-    aws-sdk-core (3.100.0)
+    aws-partitions (1.335.0)
+    aws-sdk-core (3.102.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-kms (1.34.1)
+    aws-sdk-kms (1.35.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.68.1)
-      aws-sdk-core (~> 3, >= 3.99.0)
+    aws-sdk-s3 (1.71.1)
+      aws-sdk-core (~> 3, >= 3.102.1)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.1.4)
-      aws-eventstream (~> 1.0, >= 1.0.2)
+    aws-sigv4 (1.2.1)
+      aws-eventstream (~> 1, >= 1.0.2)
     bcrypt_pbkdf (1.1.0.rc1)
     bcrypt_pbkdf (1.1.0.rc1-x64-mingw32)
     bcrypt_pbkdf (1.1.0.rc1-x86-mingw32)
-    berkshelf (7.0.10)
-      chef (>= 13.6.52)
+    berkshelf (7.1.0)
+      chef (>= 15.7.32)
       chef-config
       cleanroom (~> 1.0)
       concurrent-ruby (~> 1.0)
@@ -64,18 +64,18 @@ GEM
       solve (~> 4.0)
       thor (>= 0.20)
     builder (3.2.4)
-    chef (16.1.16)
+    chef (16.2.50)
       addressable
       bcrypt_pbkdf (= 1.1.0.rc1)
       bundler (>= 1.10)
-      chef-config (= 16.1.16)
-      chef-utils (= 16.1.16)
+      chef-config (= 16.2.50)
+      chef-utils (= 16.2.50)
       chef-vault
       chef-zero (>= 14.0.11)
       diff-lcs (~> 1.2, >= 1.2.4)
       ed25519 (~> 1.2)
       erubis (~> 2.7)
-      ffi (~> 1.9, >= 1.9.25)
+      ffi (>= 1.9.25)
       ffi-libarchive
       ffi-yajl (~> 2.2)
       highline (>= 1.6.9, < 3)
@@ -86,8 +86,8 @@ GEM
       mixlib-cli (>= 2.1.1, < 3.0)
       mixlib-log (>= 2.0.3, < 4.0)
       mixlib-shellout (>= 3.0.3, < 4.0)
-      net-sftp (~> 2.1, >= 2.1.2)
-      net-ssh (>= 4.2, < 6)
+      net-sftp (>= 2.1.2, < 4.0)
+      net-ssh (>= 4.2, < 7)
       net-ssh-multi (~> 1.2, >= 1.2.1)
       ohai (~> 16.0)
       pastel
@@ -98,18 +98,18 @@ GEM
       train-winrm (>= 0.2.5)
       tty-screen (~> 0.6)
       uuidtools (~> 2.1.5)
-    chef (16.1.16-universal-mingw32)
+    chef (16.2.50-universal-mingw32)
       addressable
       bcrypt_pbkdf (= 1.1.0.rc1)
       bundler (>= 1.10)
-      chef-config (= 16.1.16)
-      chef-utils (= 16.1.16)
+      chef-config (= 16.2.50)
+      chef-utils (= 16.2.50)
       chef-vault
       chef-zero (>= 14.0.11)
       diff-lcs (~> 1.2, >= 1.2.4)
       ed25519 (~> 1.2)
       erubis (~> 2.7)
-      ffi (~> 1.9, >= 1.9.25)
+      ffi (>= 1.9.25)
       ffi-libarchive
       ffi-yajl (~> 2.2)
       highline (>= 1.6.9, < 3)
@@ -121,8 +121,8 @@ GEM
       mixlib-cli (>= 2.1.1, < 3.0)
       mixlib-log (>= 2.0.3, < 4.0)
       mixlib-shellout (>= 3.0.3, < 4.0)
-      net-sftp (~> 2.1, >= 2.1.2)
-      net-ssh (>= 4.2, < 6)
+      net-sftp (>= 2.1.2, < 4.0)
+      net-ssh (>= 4.2, < 7)
       net-ssh-multi (~> 1.2, >= 1.2.1)
       ohai (~> 16.0)
       pastel
@@ -145,15 +145,15 @@ GEM
       win32-taskscheduler (~> 2.0)
       wmi-lite (~> 1.0)
     chef-cleanroom (1.0.2)
-    chef-config (16.1.16)
+    chef-config (16.2.50)
       addressable
-      chef-utils (= 16.1.16)
+      chef-utils (= 16.2.50)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
       tomlrb (~> 1.2)
     chef-sugar (5.1.9)
-    chef-utils (16.1.16)
+    chef-utils (16.2.50)
     chef-vault (4.0.1)
     chef-zero (15.0.0)
       ffi-yajl (~> 2.2)
@@ -164,7 +164,7 @@ GEM
     citrus (3.0.2)
     cleanroom (1.0.0)
     concurrent-ruby (1.1.6)
-    diff-lcs (1.3)
+    diff-lcs (1.4.2)
     ed25519 (1.2.4)
     equatable (0.6.1)
     erubi (1.9.0)
@@ -174,7 +174,7 @@ GEM
     ffi (1.13.1)
     ffi (1.13.1-x64-mingw32)
     ffi (1.13.1-x86-mingw32)
-    ffi-libarchive (1.0.0)
+    ffi-libarchive (1.0.3)
       ffi (~> 1.0)
     ffi-win32-extensions (1.0.3)
       ffi
@@ -191,7 +191,7 @@ GEM
     iniparse (1.5.0)
     iostruct (0.0.4)
     ipaddress (0.8.3)
-    iso8601 (0.12.1)
+    iso8601 (0.12.2)
     jmespath (1.4.0)
     json (2.3.0)
     kitchen-vagrant (1.6.1)
@@ -235,9 +235,9 @@ GEM
     necromancer (0.5.1)
     net-scp (3.0.0)
       net-ssh (>= 2.6.5, < 7.0.0)
-    net-sftp (2.1.2)
-      net-ssh (>= 2.6.5)
-    net-ssh (5.2.0)
+    net-sftp (3.0.0)
+      net-ssh (>= 5.0.0, < 7.0.0)
+    net-ssh (6.1.0)
     net-ssh-gateway (2.0.0)
       net-ssh (>= 4.0.0)
     net-ssh-multi (1.2.1)
@@ -247,7 +247,7 @@ GEM
     octokit (4.18.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
-    ohai (16.1.1)
+    ohai (16.2.1)
       chef-config (>= 12.8, < 17)
       chef-utils (>= 16.0, < 17)
       ffi (~> 1.9)
@@ -312,7 +312,7 @@ GEM
     toml-rb (2.0.1)
       citrus (~> 3.0, > 3.0)
     tomlrb (1.3.0)
-    train-core (3.3.1)
+    train-core (3.3.4)
       addressable (~> 2.5)
       ffi (!= 1.13.0)
       json (>= 1.8, < 3.0)
diff --git a/spec/functional/knife/configure_spec.rb b/spec/functional/knife/configure_spec.rb
index 78e2e801bc..8f2a5b4d6e 100644
--- a/spec/functional/knife/configure_spec.rb
+++ b/spec/functional/knife/configure_spec.rb
@@ -21,7 +21,7 @@ require "spec_helper"
 require "chef/knife/configure"
 
 describe "knife configure" do
-  let (:ohai) do
+  let(:ohai) do
     OHAI_SYSTEM
   end
 
diff --git a/spec/functional/resource/bash_spec.rb b/spec/functional/resource/bash_spec.rb
index acebc312ee..bc61bbd579 100644
--- a/spec/functional/resource/bash_spec.rb
+++ b/spec/functional/resource/bash_spec.rb
@@ -28,7 +28,7 @@ describe Chef::Resource::Bash, :unix_only do
   end
 
   describe "when setting the command property" do
-    let (:command) { "wizard racket" }
+    let(:command) { "wizard racket" }
 
     it "should raise an exception when trying to set the command" do
       expect { resource.command command }.to raise_error(Chef::Exceptions::Script)
diff --git a/spec/functional/resource/insserv_spec.rb b/spec/functional/resource/insserv_spec.rb
index 6d66516bab..51ea064f32 100644
--- a/spec/functional/resource/insserv_spec.rb
+++ b/spec/functional/resource/insserv_spec.rb
@@ -65,7 +65,7 @@ describe Chef::Resource::Service, :requires_root, :opensuse do
     provider
   end
 
-  let (:service_name) { "Chef::Util::PathHelper.escape_glob_dir(current_resource.service_name)" }
+  let(:service_name) { "Chef::Util::PathHelper.escape_glob_dir(current_resource.service_name)" }
 
   let(:current_resource) do
     provider.load_current_resource
diff --git a/spec/functional/resource/powershell_script_spec.rb b/spec/functional/resource/powershell_script_spec.rb
index b74cfc6116..5e8a00fd4d 100644
--- a/spec/functional/resource/powershell_script_spec.rb
+++ b/spec/functional/resource/powershell_script_spec.rb
@@ -23,8 +23,8 @@ describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
 
   include_context Chef::Resource::WindowsScript
 
-  let (:architecture_command) { "echo $env:PROCESSOR_ARCHITECTURE" }
-  let (:output_command) { " | out-file -encoding ASCII " }
+  let(:architecture_command) { "echo $env:PROCESSOR_ARCHITECTURE" }
+  let(:output_command) { " | out-file -encoding ASCII " }
 
   it_behaves_like "a Windows script running on Windows"
 
@@ -68,8 +68,8 @@ describe Chef::Resource::WindowsScript::PowershellScript, :windows_only do
       end
     end
 
-    let (:negative_exit_status) { -27 }
-    let (:unsigned_exit_status) { (-negative_exit_status ^ 65535) + 1 }
+    let(:negative_exit_status) { -27 }
+    let(:unsigned_exit_status) { (-negative_exit_status ^ 65535) + 1 }
     it "returns the exit status -27 as a signed integer or an unsigned 16-bit 2's complement value of 65509 for a powershell script that exits with -27" do
 
       # Versions of PowerShell prior to 4.0 return a 16-bit unsigned value --
diff --git a/spec/functional/resource/remote_file_spec.rb b/spec/functional/resource/remote_file_spec.rb
index a5ae59d876..f4a3d5346d 100644
--- a/spec/functional/resource/remote_file_spec.rb
+++ b/spec/functional/resource/remote_file_spec.rb
@@ -229,8 +229,8 @@ describe Chef::Resource::RemoteFile do
           end
 
           context "when the resource is accessed using an alternate user's identity with no access to the file" do
-            let (:windows_nonadmin_user) { "chefremfile1" }
-            let (:windows_nonadmin_user_password) { "j82ajfxK3;2Xe1" }
+            let(:windows_nonadmin_user) { "chefremfile1" }
+            let(:windows_nonadmin_user_password) { "j82ajfxK3;2Xe1" }
             include_context "a non-admin Windows user"
 
             before do
@@ -246,8 +246,8 @@ describe Chef::Resource::RemoteFile do
         end
 
         context "when the the file is only accessible as a specific alternate identity" do
-          let (:windows_nonadmin_user) { "chefremfile2" }
-          let (:windows_nonadmin_user_password) { "j82ajfxK3;2Xe2" }
+          let(:windows_nonadmin_user) { "chefremfile2" }
+          let(:windows_nonadmin_user_password) { "j82ajfxK3;2Xe2" }
           include_context "a non-admin Windows user"
 
           before do
@@ -279,8 +279,8 @@ describe Chef::Resource::RemoteFile do
           end
 
           context "when the resource is accessed using an alternate user's identity with no access to the file" do
-            let (:windows_nonadmin_user) { "chefremfile3" }
-            let (:windows_nonadmin_user_password) { "j82ajfxK3;2Xe3" }
+            let(:windows_nonadmin_user) { "chefremfile3" }
+            let(:windows_nonadmin_user_password) { "j82ajfxK3;2Xe3" }
             include_context "a non-admin Windows user"
 
             let(:remote_user) { windows_nonadmin_user_qualified }
diff --git a/spec/functional/win32/crypto_spec.rb b/spec/functional/win32/crypto_spec.rb
index c120132217..b0f2d3af5d 100644
--- a/spec/functional/win32/crypto_spec.rb
+++ b/spec/functional/win32/crypto_spec.rb
@@ -32,7 +32,7 @@ describe "Chef::ReservedNames::Win32::Crypto", :windows_only do
       @run_context = Chef::RunContext.new(new_node, {}, events)
     end
 
-    let (:plaintext) { "p@assword" }
+    let(:plaintext) { "p@assword" }
 
     it "can be decrypted by powershell" do
       encrypted = Chef::ReservedNames::Win32::Crypto.encrypt(plaintext)
diff --git a/spec/integration/knife/cookbook_upload_spec.rb b/spec/integration/knife/cookbook_upload_spec.rb
index d8077ac2c6..79a9efbfb7 100644
--- a/spec/integration/knife/cookbook_upload_spec.rb
+++ b/spec/integration/knife/cookbook_upload_spec.rb
@@ -25,7 +25,7 @@ describe "knife cookbook upload", :workstation do
 
   include_context "default config options"
 
-  let (:cb_dir) { "#{@repository_dir}/cookbooks" }
+  let(:cb_dir) { "#{@repository_dir}/cookbooks" }
 
   when_the_chef_server "is empty" do
     when_the_repository "has a cookbook" do
diff --git a/spec/integration/knife/data_bag_from_file_spec.rb b/spec/integration/knife/data_bag_from_file_spec.rb
index ee5757bebd..93801226d0 100644
--- a/spec/integration/knife/data_bag_from_file_spec.rb
+++ b/spec/integration/knife/data_bag_from_file_spec.rb
@@ -24,7 +24,7 @@ describe "knife data bag from file", :workstation do
 
   include_context "default config options"
 
-  let (:db_dir) { "#{@repository_dir}/data_bags" }
+  let(:db_dir) { "#{@repository_dir}/data_bags" }
 
   when_the_chef_server "has an empty data bag" do
     before do
diff --git a/spec/integration/knife/environment_from_file_spec.rb b/spec/integration/knife/environment_from_file_spec.rb
index 2eafa5a935..f9d35f4d47 100644
--- a/spec/integration/knife/environment_from_file_spec.rb
+++ b/spec/integration/knife/environment_from_file_spec.rb
@@ -24,7 +24,7 @@ describe "knife environment from file", :workstation do
 
   # include_context "default config options"
 
-  let (:env_dir) { "#{@repository_dir}/environments" }
+  let(:env_dir) { "#{@repository_dir}/environments" }
 
   when_the_chef_server "is empty" do
     when_the_repository "has some environments" do
diff --git a/spec/integration/knife/node_from_file_spec.rb b/spec/integration/knife/node_from_file_spec.rb
index c3ecaf4af8..6f7e0780f0 100644
--- a/spec/integration/knife/node_from_file_spec.rb
+++ b/spec/integration/knife/node_from_file_spec.rb
@@ -24,7 +24,7 @@ describe "knife node from file", :workstation do
 
   # include_context "default config options"
 
-  let (:node_dir) { "#{@repository_dir}/nodes" }
+  let(:node_dir) { "#{@repository_dir}/nodes" }
 
   when_the_chef_server "is empty" do
     when_the_repository "has some nodes" do
diff --git a/spec/integration/knife/role_from_file_spec.rb b/spec/integration/knife/role_from_file_spec.rb
index 395528937a..4a2912935c 100644
--- a/spec/integration/knife/role_from_file_spec.rb
+++ b/spec/integration/knife/role_from_file_spec.rb
@@ -24,7 +24,7 @@ describe "knife role from file", :workstation do
 
   # include_context "default config options"
 
-  let (:role_dir) { "#{@repository_dir}/roles" }
+  let(:role_dir) { "#{@repository_dir}/roles" }
 
   when_the_chef_server "is empty" do
     when_the_repository "has some roles" do
diff --git a/spec/integration/recipes/resource_load_spec.rb b/spec/integration/recipes/resource_load_spec.rb
index 52a108a766..dec482f5c9 100644
--- a/spec/integration/recipes/resource_load_spec.rb
+++ b/spec/integration/recipes/resource_load_spec.rb
@@ -119,10 +119,10 @@ describe "Resource.load_current_value" do
       end
     end
 
-    let (:subresource_name) do
+    let(:subresource_name) do
       :"load_current_value_subresource_dsl#{Namer.current_index}"
     end
-    let (:subresource_class) do
+    let(:subresource_class) do
       r = Class.new(resource_class) do
         property :y, default: lazy { "default_y #{Namer.incrementing_value}" }
       end
diff --git a/spec/support/shared/functional/securable_resource.rb b/spec/support/shared/functional/securable_resource.rb
index 23e95732c9..7bbd7d1666 100644
--- a/spec/support/shared/functional/securable_resource.rb
+++ b/spec/support/shared/functional/securable_resource.rb
@@ -135,7 +135,7 @@ shared_context "use Windows permissions", :windows_only do
     }
   end
 
-  let (:write_flag) { 3 }
+  let(:write_flag) { 3 }
 
   RSpec::Matchers.define :have_expected_properties do |mask, type, flags|
     match do |ace|
diff --git a/spec/support/shared/functional/windows_script.rb b/spec/support/shared/functional/windows_script.rb
index 7747524d03..3ccb7b6e37 100644
--- a/spec/support/shared/functional/windows_script.rb
+++ b/spec/support/shared/functional/windows_script.rb
@@ -91,7 +91,7 @@ shared_context Chef::Resource::WindowsScript do
       end
 
       context "when the guard's architecture is specified as 64-bit" do
-        let (:guard_architecture) { :x86_64 }
+        let(:guard_architecture) { :x86_64 }
         it "executes a 64-bit guard", :windows64_only do
           resource.only_if resource_guard_command, architecture: guard_architecture
           resource.run_action(:run)
@@ -100,7 +100,7 @@ shared_context Chef::Resource::WindowsScript do
       end
 
       context "when the guard's architecture is specified as 32-bit" do
-        let (:guard_architecture) { :i386 }
+        let(:guard_architecture) { :i386 }
         it "executes a 32-bit guard" do
           resource.only_if resource_guard_command, architecture: guard_architecture
           resource.run_action(:run)
diff --git a/spec/unit/chef_fs/config_spec.rb b/spec/unit/chef_fs/config_spec.rb
index 4f112070d8..848e789d3c 100644
--- a/spec/unit/chef_fs/config_spec.rb
+++ b/spec/unit/chef_fs/config_spec.rb
@@ -203,8 +203,8 @@ describe Chef::ChefFS::Config do
         })
       end
 
-      let (:path) { "/roles/foo.json" }
-      let (:entry) { Entry.new(path) }
+      let(:path) { "/roles/foo.json" }
+      let(:entry) { Entry.new(path) }
 
       it "returns the entry's path if the cwd isn't in the config" do
         cfg = Chef::ChefFS::Config.new(config, "/my_repo/cookbooks")
diff --git a/spec/unit/chef_fs/diff_spec.rb b/spec/unit/chef_fs/diff_spec.rb
index 29c25e2823..88cd6540e5 100644
--- a/spec/unit/chef_fs/diff_spec.rb
+++ b/spec/unit/chef_fs/diff_spec.rb
@@ -20,18 +20,18 @@ require "spec_helper"
 require "chef/chef_fs/file_pattern"
 require "chef/chef_fs/command_line"
 
-# Removes the date stamp from the diff and replaces it with ' DATE'
-# example match: "/dev/null\t2012-10-16 16:15:54.000000000 +0000"
-# windows match: "--- /dev/null\tTue Oct 16 18:04:34 2012"
-# https://rubular.com/r/5JdtZDqWnZhB9J
-def remove_os_differences(diff)
-  diff = diff.gsub(/([+-]{3}.*)\t.*/, '\1 DATE')
-  diff.gsub(/^@@ -\d(,\d)? \+-?\d(,-?\d)? @@/, "CONTEXT_LINE_NUMBERS")
-end
-
 describe "diff", uses_diff: true do
   include FileSystemSupport
 
+  # Removes the date stamp from the diff and replaces it with ' DATE'
+  # example match: "/dev/null\t2012-10-16 16:15:54.000000000 +0000"
+  # windows match: "--- /dev/null\tTue Oct 16 18:04:34 2012"
+  # https://rubular.com/r/5JdtZDqWnZhB9J
+  def remove_os_differences(diff)
+    diff = diff.gsub(/([+-]{3}.*)\t.*/, '\1 DATE')
+    diff.gsub(/^@@ -\d(,\d)? \+-?\d(,-?\d)? @@/, "CONTEXT_LINE_NUMBERS")
+  end
+
   context "with two filesystems with all types of difference" do
     let(:a) do
       memory_fs("a", {
diff --git a/spec/unit/decorator_spec.rb b/spec/unit/decorator_spec.rb
index d9527b4a0d..e88708bea7 100644
--- a/spec/unit/decorator_spec.rb
+++ b/spec/unit/decorator_spec.rb
@@ -18,37 +18,37 @@
 
 require "spec_helper"
 
-def impersonates_a(klass)
-  it "#is_a?(#{klass}) is true" do
-    expect(decorator.is_a?(klass)).to be true
-  end
+describe Chef::Decorator do
+  def self.impersonates_a(klass)
+    it "#is_a?(#{klass}) is true" do
+      expect(decorator.is_a?(klass)).to be true
+    end
 
-  it "#is_a?(Chef::Decorator) is true" do
-    expect(decorator.is_a?(Chef::Decorator)).to be true
-  end
+    it "#is_a?(Chef::Decorator) is true" do
+      expect(decorator.is_a?(Chef::Decorator)).to be true
+    end
 
-  it "#kind_of?(#{klass}) is true" do
-    expect(decorator.is_a?(klass)).to be true
-  end
+    it "#kind_of?(#{klass}) is true" do
+      expect(decorator.is_a?(klass)).to be true
+    end
 
-  it "#kind_of?(Chef::Decorator) is true" do
-    expect(decorator.is_a?(Chef::Decorator)).to be true
-  end
+    it "#kind_of?(Chef::Decorator) is true" do
+      expect(decorator.is_a?(Chef::Decorator)).to be true
+    end
 
-  it "#instance_of?(#{klass}) is false" do
-    expect(decorator.instance_of?(klass)).to be false
-  end
+    it "#instance_of?(#{klass}) is false" do
+      expect(decorator.instance_of?(klass)).to be false
+    end
 
-  it "#instance_of?(Chef::Decorator) is true" do
-    expect(decorator.instance_of?(Chef::Decorator)).to be true
-  end
+    it "#instance_of?(Chef::Decorator) is true" do
+      expect(decorator.instance_of?(Chef::Decorator)).to be true
+    end
 
-  it "#class is Chef::Decorator" do
-    expect(decorator.class).to eql(Chef::Decorator)
+    it "#class is Chef::Decorator" do
+      expect(decorator.class).to eql(Chef::Decorator)
+    end
   end
-end
 
-describe Chef::Decorator do
   let(:obj) {}
   let(:decorator) { Chef::Decorator.new(obj) }
 
diff --git a/spec/unit/guard_interpreter_spec.rb b/spec/unit/guard_interpreter_spec.rb
index 85850b14a4..82bdb58483 100644
--- a/spec/unit/guard_interpreter_spec.rb
+++ b/spec/unit/guard_interpreter_spec.rb
@@ -20,7 +20,7 @@ require "spec_helper"
 
 describe Chef::GuardInterpreter do
   describe "#for_resource" do
-    let (:resource) { Chef::Resource.new("foo") }
+    let(:resource) { Chef::Resource.new("foo") }
 
     it "returns a DefaultGuardInterpreter if the resource has guard_interpreter set to :default" do
       resource.guard_interpreter :default
diff --git a/spec/unit/http/api_versions_spec.rb b/spec/unit/http/api_versions_spec.rb
index af0fd16e5e..774e435c41 100644
--- a/spec/unit/http/api_versions_spec.rb
+++ b/spec/unit/http/api_versions_spec.rb
@@ -72,7 +72,7 @@ describe Chef::HTTP::APIVersions do
   end
 
   context "with an unacceptable api version" do
-    let (:return_value) { "406" }
+    let(:return_value) { "406" }
     it "resets the list of supported versions" do
       Chef::ServerAPIVersions.instance.set_versions({ "min_version" => 1, "max_version" => 3 })
       run_api_version_handler
diff --git a/spec/unit/knife/cookbook_download_spec.rb b/spec/unit/knife/cookbook_download_spec.rb
index 78dd20e2d2..2d1d70cb51 100644
--- a/spec/unit/knife/cookbook_download_spec.rb
+++ b/spec/unit/knife/cookbook_download_spec.rb
@@ -83,7 +83,7 @@ describe Chef::Knife::CookbookDownload do
         }
       end
 
-      let (:cookbook) do
+      let(:cookbook) do
         cb = Chef::CookbookVersion.new("foobar")
         cb.version = "1.0.0"
         cb.manifest = manifest_data
@@ -91,7 +91,7 @@ describe Chef::Knife::CookbookDownload do
       end
 
       describe "and no version" do
-        let (:manifest_data) { { all_files: [] } }
+        let(:manifest_data) { { all_files: [] } }
         it "should determine which version to download" do
           expect(@knife).to receive(:determine_version).and_return("1.0.0")
           expect(File).to receive(:exists?).with("/var/tmp/chef/foobar-1.0.0").and_return(false)
diff --git a/spec/unit/knife/cookbook_show_spec.rb b/spec/unit/knife/cookbook_show_spec.rb
index 794447c4eb..defc243de3 100644
--- a/spec/unit/knife/cookbook_show_spec.rb
+++ b/spec/unit/knife/cookbook_show_spec.rb
@@ -27,24 +27,24 @@ describe Chef::Knife::CookbookShow do
     allow(Chef::CookbookVersion).to receive(:load).and_return(cb)
   end
 
-  let (:knife) do
+  let(:knife) do
     knife = Chef::Knife::CookbookShow.new
     knife.config = {}
     knife.name_args = [ "cookbook_name" ]
     knife
   end
 
-  let (:cb) do
+  let(:cb) do
     cb = Chef::CookbookVersion.new("cookbook_name")
     cb.manifest = manifest
     cb
   end
 
-  let (:rest) { double(Chef::ServerAPI) }
+  let(:rest) { double(Chef::ServerAPI) }
 
-  let (:content) { "Example recipe text" }
+  let(:content) { "Example recipe text" }
 
-  let (:manifest) do
+  let(:manifest) do
     {
       "all_files" => [
         {
@@ -68,7 +68,7 @@ describe Chef::Knife::CookbookShow do
     end
 
     describe "with 1 argument: versions" do
-      let (:response) do
+      let(:response) do
         {
           "cookbook_name" => {
             "url" => "http://url/cookbooks/cookbook_name",
diff --git a/spec/unit/knife/data_bag_edit_spec.rb b/spec/unit/knife/data_bag_edit_spec.rb
index e09abaea60..6ebcaf4945 100644
--- a/spec/unit/knife/data_bag_edit_spec.rb
+++ b/spec/unit/knife/data_bag_edit_spec.rb
@@ -95,7 +95,7 @@ describe Chef::Knife::DataBagEdit do
       let(:is_encrypted?) { true }
       let(:db) { Chef::DataBagItem.from_hash(enc_raw_hash) }
       # If the data bag is encrypted, it gets passed to `edit` as a hash.  Otherwise, it gets passed as a DataBag
-      let (:data_to_edit) { raw_hash }
+      let(:data_to_edit) { raw_hash }
 
       before(:each) do
         expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
diff --git a/spec/unit/mixin/powershell_type_coercions_spec.rb b/spec/unit/mixin/powershell_type_coercions_spec.rb
index 2aafcbac23..7eebfd2348 100644
--- a/spec/unit/mixin/powershell_type_coercions_spec.rb
+++ b/spec/unit/mixin/powershell_type_coercions_spec.rb
@@ -25,7 +25,7 @@ class Chef::PSTypeTester
 end
 
 describe Chef::Mixin::PowershellTypeCoercions do
-  let (:test_class) { Chef::PSTypeTester.new }
+  let(:test_class) { Chef::PSTypeTester.new }
 
   describe "#translate_type" do
     it "single quotes a string" do
diff --git a/spec/unit/mixin/subclass_directive_spec.rb b/spec/unit/mixin/subclass_directive_spec.rb
index 65e9306e0f..f7732cc51b 100644
--- a/spec/unit/mixin/subclass_directive_spec.rb
+++ b/spec/unit/mixin/subclass_directive_spec.rb
@@ -31,9 +31,9 @@ class ChildWithoutDirective < SubclassDirectiveParent
 end
 
 describe Chef::Mixin::Uris do
-  let (:child) { SubclassDirectiveChild.new }
+  let(:child) { SubclassDirectiveChild.new }
 
-  let (:other_child) { ChildWithoutDirective.new }
+  let(:other_child) { ChildWithoutDirective.new }
 
   it "the child instance has the directive set" do
     expect(child.behave_differently?).to be true
diff --git a/spec/unit/mixin/unformatter_spec.rb b/spec/unit/mixin/unformatter_spec.rb
index 9498e7f81e..a2fc69000b 100644
--- a/spec/unit/mixin/unformatter_spec.rb
+++ b/spec/unit/mixin/unformatter_spec.rb
@@ -27,8 +27,8 @@ class Chef::UnformatterTest
 end
 
 describe Chef::Mixin::Unformatter do
-  let (:unformatter) { Chef::UnformatterTest.new }
-  let (:message) { "Test Message" }
+  let(:unformatter) { Chef::UnformatterTest.new }
+  let(:message) { "Test Message" }
 
   describe "#write" do
     context "with a timestamp" do
diff --git a/spec/unit/mixin/uris_spec.rb b/spec/unit/mixin/uris_spec.rb
index 567da86899..b8b500cb38 100644
--- a/spec/unit/mixin/uris_spec.rb
+++ b/spec/unit/mixin/uris_spec.rb
@@ -24,7 +24,7 @@ class Chef::UrisTest
 end
 
 describe Chef::Mixin::Uris do
-  let (:uris) { Chef::UrisTest.new }
+  let(:uris) { Chef::UrisTest.new }
 
   describe "#uri_scheme?" do
     it "matches 'scheme://foo.com'" do
diff --git a/spec/unit/provider/cron/unix_spec.rb b/spec/unit/provider/cron/unix_spec.rb
index c8ef82e37a..e5bb436bea 100644
--- a/spec/unit/provider/cron/unix_spec.rb
+++ b/spec/unit/provider/cron/unix_spec.rb
@@ -93,7 +93,7 @@ describe Chef::Provider::Cron::Unix do
     end
 
     context "when any other error occurs" do
-      let (:exitstatus) { 2 }
+      let(:exitstatus) { 2 }
 
       it "should raise an exception if another error occurs" do
         expect do
diff --git a/spec/unit/provider/dsc_resource_spec.rb b/spec/unit/provider/dsc_resource_spec.rb
index f2030a52c9..8613ce4af4 100644
--- a/spec/unit/provider/dsc_resource_spec.rb
+++ b/spec/unit/provider/dsc_resource_spec.rb
@@ -20,15 +20,21 @@ require "chef"
 require "spec_helper"
 
 describe Chef::Provider::DscResource do
-  let (:events) { Chef::EventDispatch::Dispatcher.new }
-  let (:run_context) { Chef::RunContext.new(node, {}, events) }
-  let (:resource) { Chef::Resource::DscResource.new("dscresource", run_context) }
-  let (:provider) do
+  let(:events) { Chef::EventDispatch::Dispatcher.new }
+  let(:run_context) { Chef::RunContext.new(node, {}, events) }
+  let(:resource) { Chef::Resource::DscResource.new("dscresource", run_context) }
+  let(:provider) do
     Chef::Provider::DscResource.new(resource, run_context)
   end
 
+  let(:node) do
+    node = Chef::Node.new
+    node.automatic[:languages][:powershell][:version] = "5.0.10586.0"
+    node
+  end
+
   context "when PowerShell does not support Invoke-DscResource" do
-    let (:node) do
+    let(:node) do
       node = Chef::Node.new
       node.automatic[:languages][:powershell][:version] = "4.0"
       node
@@ -45,7 +51,7 @@ describe Chef::Provider::DscResource do
 
     context "when RefreshMode is not set to Disabled" do
       context "and the WMF 5 is a preview release" do
-        let (:node) do
+        let(:node) do
           node = Chef::Node.new
           node.automatic[:languages][:powershell][:version] = "5.0.10018.0"
           node
@@ -58,7 +64,7 @@ describe Chef::Provider::DscResource do
         end
       end
       context "and the WMF is 5 RTM or newer" do
-        let (:node) do
+        let(:node) do
           node = Chef::Node.new
           node.automatic[:languages][:powershell][:version] = "5.0.10586.0"
           node
@@ -74,15 +80,15 @@ describe Chef::Provider::DscResource do
   end
 
   context "when the LCM supports Invoke-DscResource" do
-    let (:node) do
+    let(:node) do
       node = Chef::Node.new
       node.automatic[:languages][:powershell][:version] = "5.0.10018.0"
       node
     end
-    let (:resource_result) { double("CmdletResult", return_value: { "InDesiredState" => true }, stream: "description") }
-    let (:invoke_dsc_resource) { double("cmdlet", run!: resource_result) }
-    let (:store) { double("ResourceStore", find: resource_records) }
-    let (:resource_records) { [] }
+    let(:resource_result) { double("CmdletResult", return_value: { "InDesiredState" => true }, stream: "description") }
+    let(:invoke_dsc_resource) { double("cmdlet", run!: resource_result) }
+    let(:store) { double("ResourceStore", find: resource_records) }
+    let(:resource_records) { [] }
 
     before do
       allow(Chef::Util::DSC::ResourceStore).to receive(:instance).and_return(store)
@@ -124,7 +130,7 @@ describe Chef::Provider::DscResource do
     end
 
     context "resource name cannot be found" do
-      let (:resource_records) { [] }
+      let(:resource_records) { [] }
 
       it "raises ResourceNotFound" do
         expect { provider.run_action(:run) }.to raise_error(Chef::Exceptions::ResourceNotFound)
@@ -133,7 +139,7 @@ describe Chef::Provider::DscResource do
 
     context "resource name is found" do
       context "no module name for resource found" do
-        let (:resource_records) { [{}] }
+        let(:resource_records) { [{}] }
 
         it "returns the default dsc resource module" do
           expect(Chef::Util::Powershell::Cmdlet).to receive(:new) do |node, cmdlet, format|
@@ -144,7 +150,7 @@ describe Chef::Provider::DscResource do
       end
 
       context "a module name for resource is found" do
-        let (:resource_records) { [{ "Module" => { "Name" => "ModuleName" } }] }
+        let(:resource_records) { [{ "Module" => { "Name" => "ModuleName" } }] }
 
         it "returns the default dsc resource module" do
           expect(Chef::Util::Powershell::Cmdlet).to receive(:new) do |node, cmdlet, format|
@@ -155,7 +161,7 @@ describe Chef::Provider::DscResource do
       end
 
       context "multiple resource are found" do
-        let (:resource_records) do
+        let(:resource_records) do
           [
           { "Module" => { "Name" => "ModuleName1", "Version" => "1.0.0.0" } },
           { "Module" => { "Name" => "ModuleName1", "Version" => "2.0.0.0" } },
@@ -170,10 +176,6 @@ describe Chef::Provider::DscResource do
   end
 
   describe "define_resource_requirements" do
-    let (:node) do
-      set_node_object
-    end
-
     context "module usage is valid" do
       before do
         allow(provider).to receive(:module_usage_valid?).and_return(true)
@@ -208,10 +210,6 @@ describe Chef::Provider::DscResource do
   end
 
   describe "module_usage_valid?" do
-    let (:node) do
-      set_node_object
-    end
-
     context "module_name and module_version both are not provided" do
       before do
         provider.instance_variable_set(:@module_name, nil)
@@ -262,10 +260,6 @@ describe Chef::Provider::DscResource do
   end
 
   describe "module_info_object" do
-    let (:node) do
-      set_node_object
-    end
-
     context "module_version is not given" do
       before do
         provider.instance_variable_set(:@module_version, nil)
@@ -292,10 +286,6 @@ describe Chef::Provider::DscResource do
   end
 
   describe "invoke_resource" do
-    let (:node) do
-      set_node_object
-    end
-
     let(:cmdlet) { double(run!: nil) }
 
     before(:each) do
@@ -338,9 +328,3 @@ describe Chef::Provider::DscResource do
     end
   end
 end
-
-def set_node_object
-  node = Chef::Node.new
-  node.automatic[:languages][:powershell][:version] = "5.0.10586.0"
-  node
-end
diff --git a/spec/unit/provider/dsc_script_spec.rb b/spec/unit/provider/dsc_script_spec.rb
index 520f784ced..f0a63e0a5b 100644
--- a/spec/unit/provider/dsc_script_spec.rb
+++ b/spec/unit/provider/dsc_script_spec.rb
@@ -23,15 +23,15 @@ require "spec_helper"
 
 describe Chef::Provider::DscScript do
   context "when DSC is available" do
-    let (:node) do
+    let(:node) do
       node = Chef::Node.new
       node.automatic[:languages][:powershell][:version] = "4.0"
       node
     end
-    let (:events) { Chef::EventDispatch::Dispatcher.new }
-    let (:run_context) { Chef::RunContext.new(node, {}, events) }
-    let (:resource) { Chef::Resource::DscScript.new("script", run_context) }
-    let (:provider) do
+    let(:events) { Chef::EventDispatch::Dispatcher.new }
+    let(:run_context) { Chef::RunContext.new(node, {}, events) }
+    let(:resource) { Chef::Resource::DscScript.new("script", run_context) }
+    let(:provider) do
       Chef::Provider::DscScript.new(resource, run_context)
     end
 
@@ -145,11 +145,11 @@ describe Chef::Provider::DscScript do
   end
 
   context "when Dsc is not available" do
-    let (:node) { Chef::Node.new }
-    let (:events) { Chef::EventDispatch::Dispatcher.new }
-    let (:run_context) { Chef::RunContext.new(node, {}, events) }
-    let (:resource) { Chef::Resource::DscScript.new("script", run_context) }
-    let (:provider) { Chef::Provider::DscScript.new(resource, run_context) }
+    let(:node) { Chef::Node.new }
+    let(:events) { Chef::EventDispatch::Dispatcher.new }
+    let(:run_context) { Chef::RunContext.new(node, {}, events) }
+    let(:resource) { Chef::Resource::DscScript.new("script", run_context) }
+    let(:provider) { Chef::Provider::DscScript.new(resource, run_context) }
 
     describe "action_run" do
       ["1.0", "2.0", "3.0"].each do |version|
diff --git a/spec/unit/provider/git_spec.rb b/spec/unit/provider/git_spec.rb
index 078e6109dc..21af554111 100644
--- a/spec/unit/provider/git_spec.rb
+++ b/spec/unit/provider/git_spec.rb
@@ -293,7 +293,7 @@ describe Chef::Provider::Git do
       end
     end
     context "with a timeout set" do
-      let (:seconds) { 10 }
+      let(:seconds) { 10 }
       before { @resource.timeout(seconds) }
       it "clones a repo with amended git options" do
         expect(@provider).to receive(:shell_out!).with(expected_cmd, default_options.merge(timeout: seconds))
@@ -301,7 +301,7 @@ describe Chef::Provider::Git do
       end
     end
     context "with a specific home" do
-      let (:override_home) do
+      let(:override_home) do
         { "HOME" => "/home/masterNinja" }
       end
       let(:overrided_options) do
@@ -337,7 +337,7 @@ describe Chef::Provider::Git do
       allow(Etc).to receive(:getpwuid).and_return(double("Struct::Passwd", name: @resource.user, dir: "/home/deployNinja"))
     end
     context "with a specific home" do
-      let (:override_home) do
+      let(:override_home) do
         { "HOME" => "/home/masterNinja" }
       end
       let(:overrided_options) do
diff --git a/spec/unit/provider/package/openbsd_spec.rb b/spec/unit/provider/package/openbsd_spec.rb
index dee49534c3..154e5ba333 100644
--- a/spec/unit/provider/package/openbsd_spec.rb
+++ b/spec/unit/provider/package/openbsd_spec.rb
@@ -27,7 +27,7 @@ describe Chef::Provider::Package::Openbsd do
     node
   end
 
-  let (:provider) do
+  let(:provider) do
     events = Chef::EventDispatch::Dispatcher.new
     run_context = Chef::RunContext.new(node, {}, events)
     Chef::Provider::Package::Openbsd.new(new_resource, run_context)
diff --git a/spec/unit/provider/package/pacman_spec.rb b/spec/unit/provider/package/pacman_spec.rb
index 2e2a3f7763..e44df52e42 100644
--- a/spec/unit/provider/package/pacman_spec.rb
+++ b/spec/unit/provider/package/pacman_spec.rb
@@ -17,13 +17,6 @@
 #
 require "spec_helper"
 
-def create_provider_for(name)
-  @new_resource = Chef::Resource::Package.new(name)
-  provider = Chef::Provider::Package::Pacman.new(@new_resource, @run_context)
-  allow(provider).to receive(:shell_out_compacted).and_return(@status)
-  provider
-end
-
 RSpec.shared_examples "current_resource" do |pkg, version, candidate|
   let(:current_resource) { @provider.load_current_resource }
   before(:each) do
@@ -45,11 +38,23 @@ RSpec.shared_examples "current_resource" do |pkg, version, candidate|
 end
 
 describe Chef::Provider::Package::Pacman do
+  def create_provider_for(name)
+    new_resource = Chef::Resource::Package.new(name)
+    run_context = Chef::RunContext.new(Chef::Node.new, {}, Chef::EventDispatch::Dispatcher.new)
+    provider = Chef::Provider::Package::Pacman.new(new_resource, run_context)
+
+    pacman_out = <<~PACMAN_OUT
+      extra nano 3.450-1
+      extra emacs 0.12.0-1 [installed]
+      core sed 3.234-2 [installed: 3.234-1]
+    PACMAN_OUT
+
+    allow(provider).to receive(:shell_out_compacted).and_return(double(stdout: pacman_out, exitstatus: 0))
+    provider
+  end
+
   before(:each) do
-    @node = Chef::Node.new
-    @events = Chef::EventDispatch::Dispatcher.new
-    @run_context = Chef::RunContext.new(@node, {}, @events)
-    @pacman_conf = <<~PACMAN_CONF
+    pacman_conf = <<~PACMAN_CONF
       [options]
       HoldPkg      = pacman glibc
       Architecture = auto
@@ -68,15 +73,7 @@ describe Chef::Provider::Package::Pacman do
     PACMAN_CONF
 
     allow(::File).to receive(:exist?).with("/etc/pacman.conf").and_return(true)
-    allow(::File).to receive(:read).with("/etc/pacman.conf").and_return(@pacman_conf)
-
-    pacman_out = <<~PACMAN_OUT
-      extra nano 3.450-1
-      extra emacs 0.12.0-1 [installed]
-      core sed 3.234-2 [installed: 3.234-1]
-    PACMAN_OUT
-    @status = double(stdout: pacman_out, exitstatus: 0)
-
+    allow(::File).to receive(:read).with("/etc/pacman.conf").and_return(pacman_conf)
   end
 
   describe "loading the current resource" do
diff --git a/spec/unit/provider/package/windows/registry_uninstall_entry_spec.rb b/spec/unit/provider/package/windows/registry_uninstall_entry_spec.rb
index 803f3271df..9ce1151285 100644
--- a/spec/unit/provider/package/windows/registry_uninstall_entry_spec.rb
+++ b/spec/unit/provider/package/windows/registry_uninstall_entry_spec.rb
@@ -8,7 +8,7 @@ describe Chef::Provider::Package::Windows::RegistryUninstallEntry do
 
   describe "when QuietUninstallString key not present" do
     let(:quiet_uninstall_string) { nil }
-    let (:quiet_uninstall_string_key) { Chef::Provider::Package::Windows::RegistryUninstallEntry.quiet_uninstall_string_key?(quiet_uninstall_string, hkey, key, entry).uninstall_string }
+    let(:quiet_uninstall_string_key) { Chef::Provider::Package::Windows::RegistryUninstallEntry.quiet_uninstall_string_key?(quiet_uninstall_string, hkey, key, entry).uninstall_string }
     it "returns UninstallString key value" do
       expect(quiet_uninstall_string_key).to eql "UninstallStringPath"
     end
@@ -16,14 +16,14 @@ describe Chef::Provider::Package::Windows::RegistryUninstallEntry do
 
   describe "when QuietUninstallString key present" do
     let(:quiet_uninstall_string) { "QuietUninstallString" }
-    let (:quiet_uninstall_string_key) { Chef::Provider::Package::Windows::RegistryUninstallEntry.quiet_uninstall_string_key?(quiet_uninstall_string, hkey, key, entry).uninstall_string }
+    let(:quiet_uninstall_string_key) { Chef::Provider::Package::Windows::RegistryUninstallEntry.quiet_uninstall_string_key?(quiet_uninstall_string, hkey, key, entry).uninstall_string }
     it "returns QuietUninstallString key value" do
       expect(quiet_uninstall_string_key).to eql "QuietUninstallStringPath"
     end
   end
 
   describe ".find_entries", :windows_only do
-    let (:registry_uninstall_entry) { Chef::Provider::Package::Windows::RegistryUninstallEntry }
+    let(:registry_uninstall_entry) { Chef::Provider::Package::Windows::RegistryUninstallEntry }
     before(:each) do
       allow_any_instance_of(::Win32::Registry).to receive(:open).and_return("::Win32::Registry::HKEY_CURRENT_USER")
     end
diff --git a/spec/unit/provider/user/dscl_spec.rb b/spec/unit/provider/user/dscl_spec.rb
index d72d7e8c8e..5652ae6868 100644
--- a/spec/unit/provider/user/dscl_spec.rb
+++ b/spec/unit/provider/user/dscl_spec.rb
@@ -30,7 +30,7 @@ describe Chef::Provider::User::Dscl do
   let(:salt) { nil }
   let(:iterations) { nil }
 
-  let (:events) { Chef::EventDispatch::Dispatcher.new }
+  let(:events) { Chef::EventDispatch::Dispatcher.new }
 
   let(:node) do
     Chef::Node.new.tap do |node|
@@ -39,7 +39,7 @@ describe Chef::Provider::User::Dscl do
     end
   end
 
-  let (:run_context) { Chef::RunContext.new(node, {}, events) }
+  let(:run_context) { Chef::RunContext.new(node, {}, events) }
 
   let(:new_resource) do
     r = Chef::Resource::User::DsclUser.new("toor", run_context)
diff --git a/spec/unit/util/backup_spec.rb b/spec/unit/util/backup_spec.rb
index c956b31e4e..1db64d3029 100644
--- a/spec/unit/util/backup_spec.rb
+++ b/spec/unit/util/backup_spec.rb
@@ -21,7 +21,7 @@ require "tmpdir"
 
 describe Chef::Util::Backup do
 
-  let (:tempfile) do
+  let(:tempfile) do
     Tempfile.new("chef-util-backup-spec-test")
   end
 
diff --git a/spec/unit/util/powershell/ps_credential_spec.rb b/spec/unit/util/powershell/ps_credential_spec.rb
index 1434580f01..73abe41de8 100644
--- a/spec/unit/util/powershell/ps_credential_spec.rb
+++ b/spec/unit/util/powershell/ps_credential_spec.rb
@@ -20,8 +20,8 @@ require "chef"
 require "chef/util/powershell/ps_credential"
 
 describe Chef::Util::Powershell::PSCredential do
-  let (:username) { "foo" }
-  let (:password) { "ThIsIsThEpAsSwOrD" }
+  let(:username) { "foo" }
+  let(:password) { "ThIsIsThEpAsSwOrD" }
 
   context "when username and password are provided" do
     let(:ps_credential) { Chef::Util::Powershell::PSCredential.new(username, password) }
diff --git a/spec/unit/util/selinux_spec.rb b/spec/unit/util/selinux_spec.rb
index 2b73981934..2a4b26b2b6 100644
--- a/spec/unit/util/selinux_spec.rb
+++ b/spec/unit/util/selinux_spec.rb
@@ -114,7 +114,7 @@ describe Chef::Util::Selinux do
   end
 
   describe "when restorecon binary exists on the system" do
-    let (:path) { "/path/to/awesome directory" }
+    let(:path) { "/path/to/awesome directory" }
 
     before do
       @restorecon_enabled_path = File.join("/sbin", "restorecon")