update nokogiri and dependencies

11 files changed, 61 insertions, 62 deletions

diff --git a/.travis.yml b/.travis.yml
index d7c2f7ec4c..b81c538737 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -59,9 +59,7 @@ matrix:
   - env:
       AUDIT_CHECK: 1
     rvm: 2.1
-    # TODO stop ignoring nokogiri CVE when we update to 1.6.8
-    # script: bundle exec bundle-audit check --update
-    script: bundle exec bundle-audit check --update --ignore CVE-2015-8806
+    script: bundle exec bundle-audit check --update
     # also remove integration / external tests
     bundler_args: --without changelog development docgen guard integration maintenance omnibus_package tools aix bsd mac_os_x solaris windows --frozen
   #
diff --git a/Gemfile b/Gemfile
index 91a49678af..e2f4555af1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -20,7 +20,6 @@ gem "cheffish"
 group(:omnibus_package) do
   gem "appbundler"
   gem "rb-readline"
-  gem "nokogiri", "= 1.6.7.2"
 end
 
 group(:omnibus_package, :pry) do
diff --git a/Gemfile.lock b/Gemfile.lock
index 5934071ce6..0d33c8a817 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -215,7 +215,7 @@ GEM
     mime-types (3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
-    mini_portile2 (2.0.0)
+    mini_portile2 (2.1.0)
     mixlib-authentication (1.4.1)
       mixlib-log
     mixlib-cli (1.6.0)
@@ -245,10 +245,12 @@ GEM
       net-ssh-gateway (>= 1.2.0)
     net-telnet (0.1.1)
     netrc (0.11.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    nokogiri (1.6.7.2-x86-mingw32)
-      mini_portile2 (~> 2.0.0.rc2)
+    nokogiri (1.6.8)
+      mini_portile2 (~> 2.1.0)
+      pkg-config (~> 1.1.7)
+    nokogiri (1.6.8-x86-mingw32)
+      mini_portile2 (~> 2.1.0)
+      pkg-config (~> 1.1.7)
     nori (2.6.0)
     oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
@@ -272,6 +274,7 @@ GEM
       wmi-lite (~> 1.0)
     parser (2.3.1.2)
       ast (~> 2.2)
+    pkg-config (1.1.7)
     plist (3.2.0)
     poise (2.7.1)
       halite (~> 1.0)
@@ -412,7 +415,6 @@ DEPENDENCIES
   halite
   knife-windows
   netrc
-  nokogiri (= 1.6.7.2)
   octokit
   poise
   pry
diff --git a/omnibus/.kitchen.yml b/omnibus/.kitchen.yml
index ed060a8ef8..a14d3498de 100644
--- a/omnibus/.kitchen.yml
+++ b/omnibus/.kitchen.yml
@@ -11,7 +11,7 @@ driver:
     cpus: 4
     memory: 4096
   synced_folders:
-    - ['..', '/home/vagrant/chef']
+    - ['../..', '/vagrant/code']
     - ['../../omnibus', '/home/vagrant/omnibus']
     - ['../../omnibus-software', '/home/vagrant/omnibus-software']
 
@@ -25,10 +25,11 @@ provisioner:
     vagrant:
       this_key_exists_so_we_have_a_vagrant_key: true
     omnibus:
-      build_user:          vagrant
-      build_user_group:    vagrant
+      build_user: vagrant
+      build_user_group: vagrant
       build_user_password: vagrant
-  chef_omnibus_install_options: -P angrychef
+  product_name: angrychef
+  product_version: latest
   chef_omnibus_root: /opt/angrychef
 
 platforms:
diff --git a/omnibus/Gemfile b/omnibus/Gemfile
index ef1dec354d..3e19adfb39 100644
--- a/omnibus/Gemfile
+++ b/omnibus/Gemfile
@@ -13,10 +13,10 @@ gem "pedump", git: "https://github.com/ksubrama/pedump.git", branch: "patch-1"
 # by running `bundle install --without development` to speed up build times.
 group :development do
   # Use Berkshelf for resolving cookbook dependencies
-  gem "berkshelf", "~> 3.0"
+  gem "berkshelf", "~> 4.0"
 
   # Use Test Kitchen with Vagrant for converging the build environment
-  gem "test-kitchen",    "~> 1.7.1"
+  gem "test-kitchen",    "~> 1.9"
   gem "kitchen-vagrant", "~> 0.19.0"
   gem "winrm-fs", "~> 0.4.0"
   gem "pry"
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
index 0b2b7b9ce5..39f5dbba9d 100644
--- a/omnibus/Gemfile.lock
+++ b/omnibus/Gemfile.lock
@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/chef/omnibus-software.git
-  revision: 931d8a331bd8397729735867d394560c151dcca9
+  revision: cb6f0afa1cd334f25aece7deeef3a9454cecc0e7
   specs:
     omnibus-software (4.0.0)
       omnibus (>= 5.2.0)
@@ -35,7 +35,7 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.3.8)
+    addressable (2.4.0)
     artifactory (2.3.2)
     awesome_print (1.7.0)
     aws-sdk (2.3.14)
@@ -44,26 +44,27 @@ GEM
       jmespath (~> 1.0)
     aws-sdk-resources (2.3.14)
       aws-sdk-core (= 2.3.14)
-    berkshelf (3.3.0)
-      addressable (~> 2.3.4)
-      berkshelf-api-client (~> 1.2)
+    berkshelf (4.3.3)
+      addressable (~> 2.3, >= 2.3.4)
+      berkshelf-api-client (~> 2.0, >= 2.0.2)
       buff-config (~> 1.0)
       buff-extensions (~> 1.0)
       buff-shell_out (~> 0.1)
-      celluloid (~> 0.16.0)
+      celluloid (= 0.16.0)
       celluloid-io (~> 0.16.1)
       cleanroom (~> 1.0)
-      faraday (~> 0.9.0)
-      httpclient (~> 2.6.0)
-      minitar (~> 0.5.4)
-      octokit (~> 3.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      minitar (~> 0.5, >= 0.5.4)
+      octokit (~> 4.0)
       retryable (~> 2.0)
-      ridley (~> 4.0)
-      solve (~> 1.1)
+      ridley (~> 4.5)
+      solve (~> 2.0)
       thor (~> 0.19)
-    berkshelf-api-client (1.3.1)
+    berkshelf-api-client (2.0.2)
       faraday (~> 0.9.1)
-      httpclient (~> 2.6.0)
+      httpclient (~> 2.7.0)
+      ridley (~> 4.5)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
     buff-config (1.0.1)
@@ -89,10 +90,6 @@ GEM
     cleanroom (1.0.0)
     coderay (1.1.1)
     debug_inspector (0.0.2)
-    dep-selector-libgecode (1.2.0)
-    dep_selector (1.0.3)
-      dep-selector-libgecode (~> 1.0)
-      ffi (~> 1.9)
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
@@ -108,7 +105,7 @@ GEM
     hashie (3.4.4)
     hitimes (1.2.4)
     hitimes (1.2.4-x86-mingw32)
-    httpclient (2.6.0.1)
+    httpclient (2.7.2)
     iostruct (0.0.4)
     ipaddress (0.8.3)
     jmespath (1.2.4)
@@ -128,7 +125,7 @@ GEM
       mixlib-log
     mixlib-cli (1.6.0)
     mixlib-config (2.2.1)
-    mixlib-install (1.0.13)
+    mixlib-install (1.0.12)
       artifactory
       mixlib-shellout
       mixlib-versioning
@@ -138,6 +135,7 @@ GEM
       win32-process (~> 0.8.2)
       wmi-lite (~> 1.0)
     mixlib-versioning (1.1.0)
+    molinillo (0.4.5)
     multi_json (1.12.1)
     multipart-post (1.2.0)
     net-scp (1.2.1)
@@ -145,9 +143,9 @@ GEM
     net-ssh (3.1.1)
     nio4r (1.2.1)
     nori (2.6.0)
-    octokit (3.8.0)
-      sawyer (~> 0.6.0, >= 0.5.3)
-    ohai (8.16.0)
+    octokit (4.3.0)
+      sawyer (~> 0.7.0, >= 0.5.3)
+    ohai (8.17.0)
       chef-config (>= 12.5.0.alpha.1, < 13)
       ffi (~> 1.9)
       ffi-yajl (~> 2.2)
@@ -172,7 +170,7 @@ GEM
       binding_of_caller (>= 0.7)
       pry (>= 0.9.11)
     retryable (2.0.3)
-    ridley (4.4.2)
+    ridley (4.5.1)
       addressable
       buff-config (~> 1.0)
       buff-extensions (~> 1.0)
@@ -180,11 +178,11 @@ GEM
       buff-shell_out (~> 0.1)
       celluloid (~> 0.16.0)
       celluloid-io (~> 0.16.1)
-      chef-config
+      chef-config (>= 12.5.0)
       erubis
       faraday (~> 0.9.0)
       hashie (>= 2.0.2, < 4.0.0)
-      httpclient (~> 2.6)
+      httpclient (~> 2.7)
       json (>= 1.7.7)
       mixlib-authentication (>= 1.3.0)
       retryable (~> 2.0)
@@ -194,16 +192,16 @@ GEM
     rubyntlm (0.6.0)
     rubyzip (1.2.0)
     safe_yaml (1.0.4)
-    sawyer (0.6.0)
-      addressable (~> 2.3.5)
+    sawyer (0.7.0)
+      addressable (>= 2.3.5, < 2.5)
       faraday (~> 0.8, < 0.10)
     semverse (1.2.1)
     slop (3.6.0)
-    solve (1.2.1)
-      dep_selector (~> 1.0)
+    solve (2.0.3)
+      molinillo (~> 0.4.2)
       semverse (~> 1.1)
     systemu (2.6.5)
-    test-kitchen (1.7.3)
+    test-kitchen (1.9.2)
       mixlib-install (~> 1.0, >= 1.0.4)
       mixlib-shellout (>= 1.2, < 3.0)
       net-scp (~> 1.1)
@@ -239,7 +237,7 @@ PLATFORMS
   x86-mingw32
 
 DEPENDENCIES
-  berkshelf (~> 3.0)
+  berkshelf (~> 4.0)
   kitchen-vagrant (~> 0.19.0)
   omnibus!
   omnibus-software!
@@ -247,7 +245,7 @@ DEPENDENCIES
   pry
   pry-byebug
   pry-stack_explorer
-  test-kitchen (~> 1.7.1)
+  test-kitchen (~> 1.9)
   winrm-fs (~> 0.4.0)
 
 BUNDLED WITH
diff --git a/omnibus/config/software/chef-gem-nokogiri.rb b/omnibus/config/software/chef-gem-nokogiri.rb
index 8bf7100d5b..a25a47d341 100644
--- a/omnibus/config/software/chef-gem-nokogiri.rb
+++ b/omnibus/config/software/chef-gem-nokogiri.rb
@@ -8,4 +8,5 @@ BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
 license "MIT"
 license_file "https://github.com/ruby-prof/ruby-prof/blob/master/LICENSE"
 
+dependency "chef-gem-pkg-config"
 dependency "chef-gem-mini_portile2"
diff --git a/omnibus/config/software/chef-gem-pkg-config.rb b/omnibus/config/software/chef-gem-pkg-config.rb
new file mode 100644
index 0000000000..9c6e6fa695
--- /dev/null
+++ b/omnibus/config/software/chef-gem-pkg-config.rb
@@ -0,0 +1,9 @@
+# gem installs this gem from the version specified in chef's Gemfile.lock
+# so we can take advantage of omnibus's caching. Just duplicate this file and
+# add the new software def to chef software def if you want to separate
+# another gem's installation.
+require_relative "../../files/chef-gem/build-chef-gem/gem-install-software-def"
+BuildChefGem::GemInstallSoftwareDef.define(self, __FILE__)
+
+license "LGPL-2.1"
+license_file "https://github.com/ruby-gnome2/pkg-config/blob/master/LGPL-2.1"
diff --git a/omnibus/config/software/chef.rb b/omnibus/config/software/chef.rb
index 49db136e94..c6ced7e566 100644
--- a/omnibus/config/software/chef.rb
+++ b/omnibus/config/software/chef.rb
@@ -69,13 +69,6 @@ build do
   block { log.info(log_key) { "" } }
   bundle "install --verbose", env: project_env
 
-  # For whatever reason, nokogiri software def deletes this (rather small) directory
-  block { log.info(log_key) { "" } }
-  block "Remove mini_portile test dir" do
-    mini_portile = shellout!("#{bundle_bin} show mini_portile").stdout.chomp
-    remove_directory File.join(mini_portile, "test")
-  end
-
   # Check that it worked
   block { log.info(log_key) { "" } }
   bundle "check", env: project_env
diff --git a/omnibus_overrides.rb b/omnibus_overrides.rb
index 2f22da0511..7771e805e3 100644
--- a/omnibus_overrides.rb
+++ b/omnibus_overrides.rb
@@ -5,8 +5,8 @@ override "libffi", version: "3.2.1"
 override "libiconv", version: "1.14"
 override "liblzma", version: "5.2.2"
 override "libtool", version: "2.4.2"
-override "libxml2", version: "2.9.3"
-override "libxslt", version: "1.1.28"
+override "libxml2", version: "2.9.4"
+override "libxslt", version: "1.1.29"
 override "libyaml", version: "0.1.6"
 override "makedepend", version: "1.0.5"
 override "ncurses", version: "5.9"
diff --git a/version_policy.rb b/version_policy.rb
index 128b52d0ba..b8bead7bef 100644
--- a/version_policy.rb
+++ b/version_policy.rb
@@ -26,8 +26,8 @@ OMNIBUS_OVERRIDES = {
   ## according to comment in omnibus-sw, the very latest versions don't work on solaris
   # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
   "libtool" => "2.4.2",
-  "libxml2" => "2.9.3",
-  "libxslt" => "1.1.28",
+  "libxml2" => "2.9.4",
+  "libxslt" => "1.1.29",
   "libyaml" => "0.1.6",
   "makedepend" => "1.0.5",
   "ncurses" => "5.9",
@@ -73,7 +73,6 @@ OMNIBUS_RUBYGEMS_AT_LATEST_VERSION = {
 # slop - expected to disappear with new pry release
 # stove - halite pins to ~> 3.2 in 1.2.1
 # rubocop - chef-style pins to 0.39.0 in 0.3.1
-# TODO remove nokogiri when we can update to 1.6.8
 #
 ACCEPTABLE_OUTDATED_GEMS = %w{
   gherkin
@@ -82,7 +81,6 @@ ACCEPTABLE_OUTDATED_GEMS = %w{
   slop
   stove
   rubocop
-  nokogiri
 }
 
 #