Adding a sudoers file in chef fails at verification - ruby

Question

goal
I'm trying to add/edit a sudoers file in Chef.
After a lot of serach (and broken sudoers) I found this question and the answer seemed to be exactly what I am after.
My cookbook
So in my chef I added the following visudo cookbook:
The recipe: ~/chef-repo/cookbook/visudo/recipes/allowUpgrade.rb
template '/etc/sudoers.d/allowUpgrade' do
cookbook 'visudo'
source 'allowUpgrade.erb'
owner'root'
group 'root'
mode '0440'
verify "visudo -c -f %{path}"
end
My template: ~/chef-repo/cookbooks/visudo/templates/allowUpgrade.erb
username ALL=(ALL) NOPASSWD: /usr/local/bin/upgrade
Template and verification works manually
When I put this line/file there manually using
sudo nano /etc/sudoers.d/allowUpgrade
(I know one shouldn't) and then verify it using
visudo -c -f /etc/sudoers.d/allowUpgrade
I get
/etc/sudoers.d/allowUpgrade: parsed OK
and it works meaning I can run
sudo upgrade
without beeing prompted for the sudo password.
Verification fails running Chef
However it is not working using Chef. I'm trying it first on the local machine using
sudo chef-client -z --runlist 'recipe[visudo::allowUpgrade]'
But I get this error
Error executing action `create` on resource 'template[/etc/sudoers.d/allowUpgrade]'
Chef::Exceptions::ValidationFailed
Why is the verification failing in chef? What am I doing wrong?
Here the complete error message
Recipe: visudo::allowUpgrade
* template[/etc/sudoers.d/allowUpgrade] action create[2017-12-07T08:24:50+01:00] INFO: Processing template[/etc/sudoers.d/allowUpgrade] action create (visudo:: allowUpgrade line 7)
================================================================================
Error executing action `create` on resource 'template[/etc/sudoers.d/allowUpgrade]'
================================================================================
Chef::Exceptions::ValidationFailed
----------------------------------
Proposed content for /etc/sudoers.d/allowUpgrade failed verification #<Chef::Resource::File::Verification:0x0000000004070c48>
Resource Declaration:
---------------------
# In /home/username/chef-repo/.chef/local-mode-cache/cache/cookbooks/visudo/recipes/allowUpgrade.rb
7: template '/etc/sudoers.d/allowUpgrade' do
8: owner'root'
9: group 'root'
10: mode '0440'
11: source 'allowUpgrade.erb'
12: verify 'visudo -c -f %{path}'
13: end
Compiled Resource:
------------------
# Declared in /home/username/chef-repo/.chef/local-mode-cache/cache/cookbooks/visudo/recipes/allowUpgrade.rb:7:in `from_file'
template("/etc/sudoers.d/allowUpgrade") do
action [:create]
default_guard_interpreter :default
source "allowUpgrade.erb"
declared_type :template
cookbook_name "visudo"
recipe_name "allowUpgrade"
owner "root"
group "root"
mode "0440"
verifications [#<Chef::Resource::File::Verification:0x0000000004070c48 #command_opts={},
#command="visudo -c -f %{path}", #block=nil, #parent_resource=<template[/etc/sudoers.d/allowUpgrade]
#name: "/etc/sudoers.d/allowUpgrade" #before: nil #params: {}
#provider: nil #allowed_actions: [:nothing, :create, :delete, :touch, :create_if_missing]
#action: [:create] #updated: false #updated_by_last_action: false
#source_line: "/home/username/chef-repo/.chef/local-mode-cache/cache/cookbooks/visudo/recipes/allowUpgrade.rb:7:in `from_file'"
#guard_interpreter: nil #default_guard_interpreter: :default
#elapsed_time: 0 #source: "allowUpgrade.erb" #cookbook: nil
#local: false #variables: {} #inline_helper_blocks: {}
#inline_helper_modules: [] #helper_modules: [] #declared_type: :template
#cookbook_name: "visudo" #recipe_name: "allowUpgrade" #owner: "root" #group: "root" #mode: "0440"
#verifications: [...] #path: "/etc/sudoers.d/allowUpgrade">>]
path "/etc/sudoers.d/allowUpgrade"
end
Update:
When I leave the verification out and just do
template '/etc/sudoers.d/allowUpgrade' do
cookbook 'visudo'
source 'allowUpgrade.erb'
owner 'root'
group 'root'
mode '0440'
verify { 1 == 1 }
end
The sudo is broken! In recovery mode and the root console I checked and it looks just the same as when I insert it manually (what works fine)?!

Answer 1

Thanks to the help of Tensibai here in the comments and the hint to lineendings I could finally solve this problem.
Indeed the issue was lineendings as noted in this ancient Issue
I generated the cookbooks, recipes and templates on an Ubuntu Server 16.04 but do all m editing on the repository in Brackets.io on Windows.
This made template (and other) files have CRLF instead of LF lineendings because Brackets seems to use automatically the lineendings of the OS it is running on. This ofcourse made the /etc/sudoers.d/allowUpgrade file brake the sudoers because it has to end in a new line.
After some research I found this was an old known Issue and could be solved by the Plug-In Newline.
After installing this Plug-In indeed I could see that the file had CRLF lineendings.
I switched it to LF thanks to the Plug-In by clicking on the CRLF. Now my cookbook runs as expected and I'm able to run
sudo upgrade
without beeng prompted for the password - meaning it works.