{"action":"created","issue":{"url":"https://api.github.com/repos/chef/chef/issues/3040","labels_url":"https://api.github.com/repos/chef/chef/issues/3040/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef/issues/3040/comments","events_url":"https://api.github.com/repos/chef/chef/issues/3040/events","html_url":"https://github.com/chef/chef/issues/3040","id":60140366,"number":3040,"title":"Package resource should require version field to be a hash when installing multiple packages","user":{"login":"charlesjohnson","id":541978,"avatar_url":"https://avatars.githubusercontent.com/u/541978?v=3","gravatar_id":"","url":"https://api.github.com/users/charlesjohnson","html_url":"https://github.com/charlesjohnson","followers_url":"https://api.github.com/users/charlesjohnson/followers","following_url":"https://api.github.com/users/charlesjohnson/following{/other_user}","gists_url":"https://api.github.com/users/charlesjohnson/gists{/gist_id}","starred_url":"https://api.github.com/users/charlesjohnson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/charlesjohnson/subscriptions","organizations_url":"https://api.github.com/users/charlesjohnson/orgs","repos_url":"https://api.github.com/users/charlesjohnson/repos","events_url":"https://api.github.com/users/charlesjohnson/events{/privacy}","received_events_url":"https://api.github.com/users/charlesjohnson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chef/chef/labels/Delight%20Blockers","name":"Delight Blockers","color":"eb6420"},{"url":"https://api.github.com/repos/chef/chef/labels/Enhancement","name":"Enhancement","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-03-06T18:35:57Z","updated_at":"2015-03-06T18:41:45Z","closed_at":null,"body":"As first raised by @mfischer-zd on the mailing list:\r\n\r\nChef 12.1 introduces the ability to install multiple packages simultaneously via the package resource, using the following syntax:\r\n\r\nWhen using the new multi-package installation feature of the package resource introduced in Chef 12.1, multiple packages can be installed to yum & apt providers at once via this syntax:\r\n\r\n```\r\npackage ['package1', 'package2']\r\n```\r\n\r\nHowever, to specify the versions of these packages, an array of versions must also be supplied, like so:\r\n\r\n```\r\npackage [\"foo\", \"bar\"] do\r\n  version [\"1.0.0\", \"2.1.7\"]\r\nend\r\n```\r\n\r\nThis implementation requires that users keep the indices of multiple arrays in sync by hand, which is a clear anti-pattern. A single off-by-one error on either array index could have catastrophic unintended consequences, changing the installed versions of many packages simultaneously.\r\n\r\nInstead, when installing multiple packages, the version field should be required to be a hash of package names and versions, and the package_name attribute should be ignored.\r\n\r\nExample:\r\n```\r\npackage 'package_batch' do\r\n  version { \"foo\" => \"1.0.0\", \"bar\", => \"2.1.7\" }\r\nend\r\n```\r\n\r\nOne flaw I see in this approach that could lead to unexpected behavior, occurs when an array of packages is provided in the package_name attribute, while a hash is supplied in the version attribute. For instance:\r\n```\r\npackage ['package1', 'package2'] do\r\n  version { \"foo\" => \"1.0.0\", \"bar\", => \"2.1.7\", \"baz\", => \"1.21.0\" }\r\nend\r\n```\r\n\r\nTo deal with the case when an array is detected in the package_name attribute and a hash is detected in the version attribute, chef should return a warning explaining that the package_name attribute has been ignored because a hash was detected in the version attribute.\r\n"},"comment":{"url":"https://api.github.com/repos/chef/chef/issues/comments/77611896","html_url":"https://github.com/chef/chef/issues/3040#issuecomment-77611896","issue_url":"https://api.github.com/repos/chef/chef/issues/3040","id":77611896,"user":{"login":"mfischer-zd","id":984199,"avatar_url":"https://avatars.githubusercontent.com/u/984199?v=3","gravatar_id":"","url":"https://api.github.com/users/mfischer-zd","html_url":"https://github.com/mfischer-zd","followers_url":"https://api.github.com/users/mfischer-zd/followers","following_url":"https://api.github.com/users/mfischer-zd/following{/other_user}","gists_url":"https://api.github.com/users/mfischer-zd/gists{/gist_id}","starred_url":"https://api.github.com/users/mfischer-zd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfischer-zd/subscriptions","organizations_url":"https://api.github.com/users/mfischer-zd/orgs","repos_url":"https://api.github.com/users/mfischer-zd/repos","events_url":"https://api.github.com/users/mfischer-zd/events{/privacy}","received_events_url":"https://api.github.com/users/mfischer-zd/received_events","type":"User","site_admin":false},"created_at":"2015-03-06T18:41:45Z","updated_at":"2015-03-06T18:41:45Z","body":"Another issue with the new syntax is that it introduces the concept of something other than a String as a resource name, which makes me wonder how the resource can be notified.  (Perhaps this isn't a big deal with packages, as I'm not sure you'd want to notify them, but the pattern is novel and undocumented.)  And it has changed to allow an Array as a name, but not a Hash.\r\n\r\nGiven all the ambiguities in behavior this can cause, I'm wondering if a new resource class should be created to handle multi-package installations instead of trying to jury-rig it into the legacy package resource class.\r\n"}}