Create a rule for "execute resource used to install packages"

[jtimberman]

In a similar idea to FC040 and FC041, I think a rule used to identify when an execute or script block is used to run commands for installing packages would be useful:

• dpkg
• rpm
• yum
• apt-get/aptitude

[jaymzh]

This is still a good idea.

[tas50]

I'd support this sort of rule, but we'd have to make sure to be pretty cautious in how it would be implemented since there's a lot of operations with those tools that don't involve installing/removing packages. We'd want to make sure to run any solution against all cookbooks on Supermarket to check for false positives.

[jaymzh]

that's what # ~FCXXX comments are for! :)

heh, no but seriously, trying to eliminate false-positives if fine for the catchable stuff... but there's actually very little.

(yum|apt) list avail? There's APIs for that in Chef.

(yum|apt) search? wtf

yum-shell - I want this to give you a lint warning, holy hell.

The more legitimate things are mostly in other commands like 'createrepo' and such.

I'm sure there's some legitimate stuff we should try to not warn on, and I'm all for running it over common stuff in supermarket, but we shouldn't hold up good rules because there might be some valid use case. There' TONS of lint rules for which there might be valid use cases.

[tas50]

Moved over to Cookstyle in chef/cookstyle#257