diff --git a/.bundle/config b/.bundle/config
index a559bc445ad..7544be9dd70 100644
--- a/.bundle/config
+++ b/.bundle/config
@@ -1,3 +1,2 @@
 ---
-BUNDLE_WITHOUT: omnibus_package
 BUNDLE_FROZEN: '1'
diff --git a/.travis.yml b/.travis.yml
index e93d6ce246c..7d630f154f5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,28 +1,22 @@
 language: ruby
+sudo: false
 cache: bundler
 
-sudo: false
 # Early warning system to catch if Rubygems breaks something
 before_install:
-  - gem update --system
-  - gem install bundler
+  - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+  - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+  - rm -f .bundle/config
+
+bundler_args: --without docgen maintenance omnibus_package aix bsd solaris windows --frozen
 
+# do not run expensive spec tests on PRs, only on branches
 branches:
   only:
   - master
   - 10-stable
   - 11-stable
 
-# do not run expensive spec tests on PRs, only on branches
-script: "
-set -e;
-echo '--color\n-fp' > .rspec;
-sudo sed -i -e 's/^Defaults\tsecure_path.*$//' /etc/sudoers;
-sudo -E $(which bundle) exec rake spec;
-bundle exec rake style;
-bundle exec bundle-audit check --update;
-"
-
 env:
   global:
     - FORCE_FFI_YAJL=ext
@@ -31,109 +25,133 @@ matrix:
   include:
   - rvm: 2.1
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without docgen maintenance integration aix bsd solaris windows --frozen
   - rvm: 2.2
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without docgen maintenance integration aix bsd solaris windows --frozen
   - rvm: 2.3.0
     sudo: true
-    bundler_args: --without server docgen maintenance
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without docgen maintenance integration aix bsd solaris windows --frozen
   - rvm: rbx
     sudo: true
-    bundler_args: --without server docgen maintenance ruby_prof pry
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-zero', github: 'chef/chef-zero'\""
-    script: bundle exec rake chef_zero_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'cheffish', github: 'chef/cheffish'\""
-    script: bundle exec rake cheffish_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-provisioning', github: 'chef/chef-provisioning'\""
-    script: bundle exec rake chef_provisioning_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-provisioning-aws', github: 'chef/chef-provisioning-aws'\""
-    script: bundle exec rake chef_provisioning_aws_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chefspec'\""
-    script: bundle exec rake chefspec_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'chef-sugar'\""
-    script: bundle exec rake chef_sugar_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'knife-windows', github: 'chef/knife-windows'\""
-    script: bundle exec rake knife_windows_spec
-  # Requires vagrant
-  # - rvm: 2.2
-  #   cache:
-  #   env: "GEMFILE_MOD=\"gem 'chef-rewind'\""
-  #   script: bundle exec rake chef_rewind_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'foodcritic', github: 'acrmp/foodcritic', branch: 'v5.0.0'\""
-    script: bundle exec rake foodcritic_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'halite', github: 'poise/halite'\""
-    script: bundle exec rake halite_spec
-  - rvm: 2.2
-    env: "GEMFILE_MOD=\"gem 'poise', github: 'poise/poise'\""
-    script: bundle exec rake poise_spec
+    script: tasks/bin/run_chef_tests
+    bundler_args: --without docgen maintenance integration aix bsd solaris windows --frozen
+  #
+  # External tests
+  #
+  - env:
+      TEST_GEM: chef-provisioning
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+    rvm: 2.2
+  - env:
+      TEST_GEM: chef-provisioning-aws
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+    rvm: 2.2
+# requires vagrant
+#  - env: TEST_GEM=chef-rewind
+#    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+#    bundler_args: --without development
+#    rvm: 2.2
+  - env:
+      TEST_GEM: chef-sugar
+    script: tasks/bin/run_external_test $TEST_GEM rake
+    rvm: 2.2
+  - env:
+      - TEST_GEM: chef-zero
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec" "rake cheffs"
+    rvm: 2.2
+  - env:
+      TEST_GEM: cheffish
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+    rvm: 2.2
+  - env:
+      TEST_GEM: chefspec
+    # The chefspec tests + bundler cache + "gem update --system" interact badly :/
+    # (Cucumber doesn't start.)
+    before_install:
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+      - bundle config --local without server:docgen:maintenance:omnibus_package:development:ruby_prof:pry
+    script: tasks/bin/run_external_test $TEST_GEM rake
+    rvm: 2.2.0
+  - env:
+      TEST_GEM: foodcritic
+    script: tasks/bin/run_external_test $TEST_GEM "rake test"
+    rvm: 2.2
+  - env:
+      TEST_GEM: halite
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+    rvm: 2.2
+  - env:
+      TEST_GEM: knife-windows
+    script: tasks/bin/run_external_test $TEST_GEM "rake unit_spec"
+    rvm: 2.2
+  - env:
+      TEST_GEM: poise
+    script: tasks/bin/run_external_test $TEST_GEM "rake spec"
+    rvm: 2.2
+  #
   ### START TEST KITCHEN ONLY ###
+  #
   - rvm: 2.2
     gemfile: kitchen-tests/Gemfile
     before_install:
-    - gem update --system
-    - gem install bundler
-    - echo -n $DO_KEY_CHUNK_{0..30} >> ~/.ssh/id_aws.base64
-    - cat ~/.ssh/id_aws.base64 | tr -d ' ' | base64 --decode > ~/.ssh/id_aws.pem
+      - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
+      - echo -n $DO_KEY_CHUNK_{0..30} >> ~/.ssh/id_aws.base64
+      - cat ~/.ssh/id_aws.base64 | tr -d ' ' | base64 --decode > ~/.ssh/id_aws.pem
     before_script:
-    - cd kitchen-tests
+      - cd kitchen-tests
     script:
-# FIXME: we should fix centos-6 against AWS and then enable it here
-    - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen test ubuntu; fi
+      # FIXME: we should fix centos-6 against AWS and then enable it here
+      - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen test ubuntu; fi
     after_failure:
-    - cat .kitchen/logs/kitchen.log
+      - cat .kitchen/logs/kitchen.log
     after_script:
-    - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen destroy ubuntu; fi
+      - if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then bundle exec kitchen destroy ubuntu; fi
     env:
-    - KITCHEN_YAML=.kitchen.travis.yml
-    - EC2_SSH_KEY_PATH=~/.ssh/id_aws.pem
-    - secure: VAauyVnAMWhqvnhJOJ/tCDn3XAdWqzbWiDVQPNBkqtm2SBIvhmZl2hlrusvw6YLU31Prdf8fSFhOSysVQQs/rJYrmD/1BfV79p6M7cGXYZ0nGWwldF81N296lyFoZLyrqtmG4G0cx3Pw2ojADFgFe+B5eTGlqJFD+z371g4RF/Y=
-    - secure: A+qtUF2LPJGkUAdvt04AwZMt69rzaeTyR0/1XEOAuntBKKXSCzddUzr5ePDc9QQ/57AWywKxhVLpnxk3QzKN7r7zerDxyIJBgklNDpNAKkeQjP3T6FpaKEIN9ROcpPtsM6FJ5Agb+bEQoRJF7s+ampO3wLV3XpTiWNuWkcAhv9A=
-    - secure: J8JIg15trrPgc8X/1DsaUWDQCdDWTvN/AorXzZ/ReudHS6G/KpoynZ5lTmKjlgFiFNE/TGMDv486pStGtIcarTKTuIEmNADdEWlAVH7bxclpayMjtppVuapRCkZWccs5gz5CJyhX7yhQCFTYoqVox9Y4qHGCluF3oqCcPRtCOOw=
-    - secure: NJYn0blTMwIoFxZlsoMWK8hPO/fi45rgWOqEImnjvSRk++5WL+GgjLBgLvEi7wCMkBijhIMWtnva60ojd4MrxeS7evrmGRjJKXnPuSKEsrGbArZPskBjCAcg+3PlnQQUkFf6hvbGD3HZlJtcbs4hrx8tbDT2Ie7bmQfqpsawKY4=
-    - secure: FipoX1VzZkzPUP6Gxd05DEva7cX6xKK2Wdq+Y18nNkyW2afPLXCNl5kCsNrgvbqAzbjKaP2M8+b0zwKjrFzNebqmmx1RRfZUJWUkNRF1EgE+tHytmMZW6tNcQlTlvA0KqXi4Dt6SIQ0l/DhwwNKZ80jmpiyYi/ErxIXzbVgVtYA=
-    - secure: T2MbE9twIkdaor796/lDioCgb2+FP3G8lXq+lIqnjaL22WMP8yKtkjNo8ggSlvQZE7MAQHqi5LISw5MU2MI6ImTU50/pgdWreM5Cx37WWYqntcbJ0Sz7v396KGJzeqbDql1fGolHDlykfi+OJzzbIGC8cjz7iAD2RUZU95wEC5s=
-    - secure: hWEQInvuanQavFCE3m6/q9BjNEFZQmLc94EWnBKTMiwUAdYgQQMLohN7K1Gc8irxYKp86F+P+XWE4lfDZNK3sqmxyk51TtT2EfmKWs+jSLq4+NBYQwXCpRELC5Irpm0GRCYthhsQSuarpVWss/0s0o7iJQaHxrSPcQiwDouIpwU=
-    - secure: OllJUaR/WUu+H0FIjU7vQxU10JT4d+/FZuTqnX6ZTcXN3dXCirnabYp/j+r5OBY3QeOojOyzGfHUWYEUGH/PTxcxYjrohtFTWht9N9x+SxfX2fLqieH/kRKyDmIidsY8qKChf/LD9f+SwpXRXND/PctKhNR4C5BH57fGUEqE9FU=
-    - secure: KgKnGtM4e+cVYfLn78eTWJ1q4ORv128abB72QBc/xiSh0rvxSIojVKZCXmRetQPXIl7NoIzU2IyjR1ABEZ+vA83PayTEsOr2KDRDgolSIgZSSiDFt4U2phQsxl4fX7wFv/jWlbxM2fysKBSIRAF57CwBjGhLjmpUO+5PdoR7N2s=
-    - secure: IgOx4STauKnJWENQGcn2iBp32XcNd2anNR0Fua0ugjudu1+CV+IxcIhI8ohOfZEXyVK4MGTF8uXWrYtoiwyExG4mTXqpRWJCgIkncqiWlfT+8BoAGWxCQhUYub3MaNZANPgebKPJhTPQ8OwNz09gPMNkewRfAqNF05eb8FU2kGA=
-    - secure: CPXP6g3c1FH4Zm4U19XaPvq9nnyNsQCXRkxiPcGqsJZsGG2QMgzPQyjiAuPqnWxxZHit/6NgzUszJC+skSgcTzDTeD6rOA0Wcxtbr/Un4RRxRnTcRc6mSEZqSu9RbAZMYur/mSQ9HDHnjFe1ok85He4s9jM1iFdgjtg1ToelEmA=
-    - secure: fp9pzNe09PIyZ/8NjbMPGW1zdG3Q/KhJ+stUKqA+FRopAMX/Hh24gFIVJhFOmfr4Vhn0J8sF7RsFaR1mdzcPewliOzKxknWhGEGMcG9LFCZcv+vVK0Fxs4nUzCRtaXUt08FpsRofG0iBvfapZ7YBhK7lslqGVI+fxCd3ZXmayG8=
-    - secure: NT/6qcecxmuKYOnw1Atc6hsyJlfB6XI2Z1lg7dE0PhlEVW2EpkckHjAc+5hgg8Zt7TifYm2qDQWJwblwPP0mMj3ra4ZIMaZAiG2kzQoZ5kthqwjAV9fatZvrDXi+jd9wBF2hPyiCokAQiTLmKTYjzY2FBqPO3VDLWdf9qZqRmxw=
-    - secure: MjIWyfquKANh/YeoyHGksdvAUQ4wc2tBCQmq1QcRhKwb7Sy6wcDk1nujDmnGE7HFpZUS6CyoZF7AMzJGFkCzrChpsLQYUP4hc7VjkXOLzi90vJUl+ANq7KPOmxC0MjKpgeHqCysRbTYbUsnJZfbbZbIZjCAjY0YCY2pGniXpvQc=
-    - secure: AsZLOiFrHkGsY6jp2ShI5kYz78V6PEUyizgtPCWTgevTRGWpdCq9csIEoqUBY+vMUxmQPC6IY4fwHkrRCbv/rJyhwRl/Rnwa3aw8bdD+YD17IxnpXKGXXUyXdTZmF7HzAkVgStehL+qWZ3x9TBdExIV37KVgrVw/b+S0QqBUlQo=
-    - secure: jwEnSquLreMM1M6N3gGpgTGHd8VtjBUTLDdkrokhiH1jHLpz7Hmr6xeajhZws+2sLtLiB7hYi6WsZBE5VcymBoObh9MeodO9Ve5/1z06lFmx1DyYV6euyo9WUkU2WpoVfu8k7O+eAvyrXXZVqm8Oz1p7Isb6Bh5+fJH2H8rhed4=
-    - secure: HOAK620U6mlS11XK+JtXTBk26Tt2vWO4shA/6Zit/y0/kAz7JnbXtup7FSysXliBoSv4YsxA6IbgZ8V0tuIXj+q7EcqtHMmQhqzMJG5jRKVhtGiFIhDmwmxJvdfIvwtZOO3mMk0OspLz24sWp8wCciYZMPj0hZJR04R9aWEO3cE=
-    - secure: DfTRP74UWWxA460XfLoJFgRLwoKbHWNIueL6qr982AnuAxeZFofsxCqxSxcSJmu67TxuPc+b201+BmanHKYmSauGS31t0F4QXk7lCTaT/x38mAPsWvMFkY8HEl56JhmzEp2hAKDB/t0/HItwmvxT1vd5WvNRSSojEVzChftV/zE=
-    - secure: JoCWsJzTgj+epgzmgbvV7/bdAPHwUGXZA7Jdvv9vIJ5lCo6h9WwCw6/KCvH+bHtrT/RfZmUmxouCxJCLKwts1ZrMmedTIXpMrQJo/YgWRp7ziFnLyZ8jG8bD7rep3ngq1x/cRGc3cZvYN6IK3GS6C27OviYLFsTw74AUnWTaFSo=
-    - secure: iXfl0WnAnfKurZUrMeV1yOoFiiZ+MKx/Zj6ZVP2++A9EOxxIxb/fS/gIOzSjBQwzrR+fJVHIlX0g42CiBKDQWUvIl5I8kZCVIP6AHa1jyzlmZE9lqSlojz3k5RPS7pW6nIX+z1NHMvtb3e5xeLv8y4J5kwZErqZ+YDJmBRtPxPU=
-    - secure: RhAW5kABDPB3GWKD+NCg05Kcd92F/+kg+0icXXN166DWQYUut3MLrSY80xNzkz5nXTI9EFU4fUqlKLDiF/kelr0Zp/zpCQAB54o4cu5FkZz0Bgs9k7yUdCRyz6Vt2ChV5cYI4JTn9bMaeXEaGlOjP1iE51rYT6KO6kKlwsEnjUc=
-    - secure: jy/3fC+UtrDcE/X6/IxkyT2SrYMKkiEMP1ht4d5mxvNA0Xxn43E16c6FNP0JWPpWRGRIP38vnQRB4yOPU9BXvRmmswVL9Ge4e/6flJvKwD5Rlqb2dfaGaHRYV9v8Nkdzl2FvZ9eBH5KHxgG19gCG6L3RXP/+zYwrr4AQdm0fpfw=
-    - secure: RYEwBWYVXRTEdUWhQxdWXo6tldlVx8pha9zB0rgafcUQxaatAefnRc4X4HXTQnqr2n9TZ2TQGpM8vte/wr6Pjc85VZbimWGzgrvn0kg4MwPR8ZYiEM5qQ/pUpj4+93rpA91PhCGvZoZTqOrXHm4kMPuKro5I6qA4BFUXuANeC/s=
-    - secure: gHSicpqkqcZT04QurSgszrAiI6HOCw1DBlfIIi9KAJj7mG5GijD/4AQ6HCmcRMbCDJ0nUuvm/kckASnRtF5+3xvIJnuoyyEfCZWxt1lhK2UbS87VU+pVdws/VzwpisXuKsh3H0uT8DDVkWPH/ZWDgfVa74eYDEHiQFjo+2xx5ZA=
-    - secure: Q42bco3JXEpyVbL2akiOsaCHnAagAFIb3TF6H5qJfaLLqmGs/XrrgxliNaVMfWVSwPT2wpQvg9UGF9x37No9bZBv33DgYcWExmXb/lvGPpkctX37+FTMzECQHxOuUbYPQA7ZEuJ4AA7bwgpMISUeSyz5XXz44KcXIrZK2GWH+X4=
-    - secure: hugd8NVukJc3redDvlOt6zhaqa63XLNMp/eIIlNllW8VfQ6CJ1P7KJPwgxH24sDyrw7rLzOkBl6R4kaVWsCLCFp+NE6yFFHl9wDkSdLC1OX1DMrJnDsogwUqqe+jX8dxePSy26MSTfG8eo9/NxN9uXr+tKaHoi6G7BRXDHtQ8dQ=
-    - secure: TRkW9pIuIYHXJmPlDYoddxIp2M2W2f7qBGNJKEMB5xrOezES7w9XTg2eQXrD8jBO+fUUmMnAaDAXZuU58nMysPXx3vhtZKncg8w5CyuXJk2P8nkdPh0u5nmRhEpWrLKtLwJrX48xmJhNQvQqDAyL5c9WUzlWJ4WJFgoP5IDWmLc=
-    - secure: QHuMdtFCvttiIOx6iS+lH4bKXZMwsgVQ6FPsUW5zJ7uw6mAEWKEil9xNk4aYV9FywinwUs4fnFlnIW/Gj1gLkUjm4DtxdmRZIlRXIbgsNch6H916TCPg4Q2oPsW2nVdXPjW/2jhkfLUiSnuhL+ylami1NF8Up7vokXknh/jFNZU=
-    - secure: GTfrUVmMQSxho3Ia4Y1ONqKvVMD34GHF2/TJb8UdQV7iH+nVxVXpy3nWaCXa9ri7lRzMefkoVLy0gKK13YoVd7w3d2S3/IfNakC85XfN6VuOzK/FDkA0WoPrgKjcQ64I+3dQ6cgrMWWTieKwRZy+Ve24iRbnN055Hk+VRMu6OGw=
-    - secure: SOMYGVfHLkHsH6koxpw68YQ4ydEo6YXPhHbrYGQbehUbFa6+OZzBcAJRJbKjyhD2AZRvNr2jB8XnjYKvVyDGQRpkWhGYZ7CpHqINpDsqKBsbiMe3/+KmKQqS+UKxNGefquoOvyQ1N8Xy77dkWYokRtGMEuR12RkZLonxiDW8Qyg=
-    - secure: bSsDg+dJnPFdFiC/tbb61HdLh/Q0z2RVVAReT1wvV1BN4fN4NydvkUGbQmyFNyyunLulEs+X0oFma9L0497nUlTnan8UOg9sIleTSybPX6E9xSKKCItH1GgDw8bM9Igez5OOrrePBD3altVrH+FmGx0dlTQgM/KZMN50BJ79cXw=
+      - KITCHEN_YAML=.kitchen.travis.yml
+      - EC2_SSH_KEY_PATH=~/.ssh/id_aws.pem
+      - secure: VAauyVnAMWhqvnhJOJ/tCDn3XAdWqzbWiDVQPNBkqtm2SBIvhmZl2hlrusvw6YLU31Prdf8fSFhOSysVQQs/rJYrmD/1BfV79p6M7cGXYZ0nGWwldF81N296lyFoZLyrqtmG4G0cx3Pw2ojADFgFe+B5eTGlqJFD+z371g4RF/Y=
+      - secure: A+qtUF2LPJGkUAdvt04AwZMt69rzaeTyR0/1XEOAuntBKKXSCzddUzr5ePDc9QQ/57AWywKxhVLpnxk3QzKN7r7zerDxyIJBgklNDpNAKkeQjP3T6FpaKEIN9ROcpPtsM6FJ5Agb+bEQoRJF7s+ampO3wLV3XpTiWNuWkcAhv9A=
+      - secure: J8JIg15trrPgc8X/1DsaUWDQCdDWTvN/AorXzZ/ReudHS6G/KpoynZ5lTmKjlgFiFNE/TGMDv486pStGtIcarTKTuIEmNADdEWlAVH7bxclpayMjtppVuapRCkZWccs5gz5CJyhX7yhQCFTYoqVox9Y4qHGCluF3oqCcPRtCOOw=
+      - secure: NJYn0blTMwIoFxZlsoMWK8hPO/fi45rgWOqEImnjvSRk++5WL+GgjLBgLvEi7wCMkBijhIMWtnva60ojd4MrxeS7evrmGRjJKXnPuSKEsrGbArZPskBjCAcg+3PlnQQUkFf6hvbGD3HZlJtcbs4hrx8tbDT2Ie7bmQfqpsawKY4=
+      - secure: FipoX1VzZkzPUP6Gxd05DEva7cX6xKK2Wdq+Y18nNkyW2afPLXCNl5kCsNrgvbqAzbjKaP2M8+b0zwKjrFzNebqmmx1RRfZUJWUkNRF1EgE+tHytmMZW6tNcQlTlvA0KqXi4Dt6SIQ0l/DhwwNKZ80jmpiyYi/ErxIXzbVgVtYA=
+      - secure: T2MbE9twIkdaor796/lDioCgb2+FP3G8lXq+lIqnjaL22WMP8yKtkjNo8ggSlvQZE7MAQHqi5LISw5MU2MI6ImTU50/pgdWreM5Cx37WWYqntcbJ0Sz7v396KGJzeqbDql1fGolHDlykfi+OJzzbIGC8cjz7iAD2RUZU95wEC5s=
+      - secure: hWEQInvuanQavFCE3m6/q9BjNEFZQmLc94EWnBKTMiwUAdYgQQMLohN7K1Gc8irxYKp86F+P+XWE4lfDZNK3sqmxyk51TtT2EfmKWs+jSLq4+NBYQwXCpRELC5Irpm0GRCYthhsQSuarpVWss/0s0o7iJQaHxrSPcQiwDouIpwU=
+      - secure: OllJUaR/WUu+H0FIjU7vQxU10JT4d+/FZuTqnX6ZTcXN3dXCirnabYp/j+r5OBY3QeOojOyzGfHUWYEUGH/PTxcxYjrohtFTWht9N9x+SxfX2fLqieH/kRKyDmIidsY8qKChf/LD9f+SwpXRXND/PctKhNR4C5BH57fGUEqE9FU=
+      - secure: KgKnGtM4e+cVYfLn78eTWJ1q4ORv128abB72QBc/xiSh0rvxSIojVKZCXmRetQPXIl7NoIzU2IyjR1ABEZ+vA83PayTEsOr2KDRDgolSIgZSSiDFt4U2phQsxl4fX7wFv/jWlbxM2fysKBSIRAF57CwBjGhLjmpUO+5PdoR7N2s=
+      - secure: IgOx4STauKnJWENQGcn2iBp32XcNd2anNR0Fua0ugjudu1+CV+IxcIhI8ohOfZEXyVK4MGTF8uXWrYtoiwyExG4mTXqpRWJCgIkncqiWlfT+8BoAGWxCQhUYub3MaNZANPgebKPJhTPQ8OwNz09gPMNkewRfAqNF05eb8FU2kGA=
+      - secure: CPXP6g3c1FH4Zm4U19XaPvq9nnyNsQCXRkxiPcGqsJZsGG2QMgzPQyjiAuPqnWxxZHit/6NgzUszJC+skSgcTzDTeD6rOA0Wcxtbr/Un4RRxRnTcRc6mSEZqSu9RbAZMYur/mSQ9HDHnjFe1ok85He4s9jM1iFdgjtg1ToelEmA=
+      - secure: fp9pzNe09PIyZ/8NjbMPGW1zdG3Q/KhJ+stUKqA+FRopAMX/Hh24gFIVJhFOmfr4Vhn0J8sF7RsFaR1mdzcPewliOzKxknWhGEGMcG9LFCZcv+vVK0Fxs4nUzCRtaXUt08FpsRofG0iBvfapZ7YBhK7lslqGVI+fxCd3ZXmayG8=
+      - secure: NT/6qcecxmuKYOnw1Atc6hsyJlfB6XI2Z1lg7dE0PhlEVW2EpkckHjAc+5hgg8Zt7TifYm2qDQWJwblwPP0mMj3ra4ZIMaZAiG2kzQoZ5kthqwjAV9fatZvrDXi+jd9wBF2hPyiCokAQiTLmKTYjzY2FBqPO3VDLWdf9qZqRmxw=
+      - secure: MjIWyfquKANh/YeoyHGksdvAUQ4wc2tBCQmq1QcRhKwb7Sy6wcDk1nujDmnGE7HFpZUS6CyoZF7AMzJGFkCzrChpsLQYUP4hc7VjkXOLzi90vJUl+ANq7KPOmxC0MjKpgeHqCysRbTYbUsnJZfbbZbIZjCAjY0YCY2pGniXpvQc=
+      - secure: AsZLOiFrHkGsY6jp2ShI5kYz78V6PEUyizgtPCWTgevTRGWpdCq9csIEoqUBY+vMUxmQPC6IY4fwHkrRCbv/rJyhwRl/Rnwa3aw8bdD+YD17IxnpXKGXXUyXdTZmF7HzAkVgStehL+qWZ3x9TBdExIV37KVgrVw/b+S0QqBUlQo=
+      - secure: jwEnSquLreMM1M6N3gGpgTGHd8VtjBUTLDdkrokhiH1jHLpz7Hmr6xeajhZws+2sLtLiB7hYi6WsZBE5VcymBoObh9MeodO9Ve5/1z06lFmx1DyYV6euyo9WUkU2WpoVfu8k7O+eAvyrXXZVqm8Oz1p7Isb6Bh5+fJH2H8rhed4=
+      - secure: HOAK620U6mlS11XK+JtXTBk26Tt2vWO4shA/6Zit/y0/kAz7JnbXtup7FSysXliBoSv4YsxA6IbgZ8V0tuIXj+q7EcqtHMmQhqzMJG5jRKVhtGiFIhDmwmxJvdfIvwtZOO3mMk0OspLz24sWp8wCciYZMPj0hZJR04R9aWEO3cE=
+      - secure: DfTRP74UWWxA460XfLoJFgRLwoKbHWNIueL6qr982AnuAxeZFofsxCqxSxcSJmu67TxuPc+b201+BmanHKYmSauGS31t0F4QXk7lCTaT/x38mAPsWvMFkY8HEl56JhmzEp2hAKDB/t0/HItwmvxT1vd5WvNRSSojEVzChftV/zE=
+      - secure: JoCWsJzTgj+epgzmgbvV7/bdAPHwUGXZA7Jdvv9vIJ5lCo6h9WwCw6/KCvH+bHtrT/RfZmUmxouCxJCLKwts1ZrMmedTIXpMrQJo/YgWRp7ziFnLyZ8jG8bD7rep3ngq1x/cRGc3cZvYN6IK3GS6C27OviYLFsTw74AUnWTaFSo=
+      - secure: iXfl0WnAnfKurZUrMeV1yOoFiiZ+MKx/Zj6ZVP2++A9EOxxIxb/fS/gIOzSjBQwzrR+fJVHIlX0g42CiBKDQWUvIl5I8kZCVIP6AHa1jyzlmZE9lqSlojz3k5RPS7pW6nIX+z1NHMvtb3e5xeLv8y4J5kwZErqZ+YDJmBRtPxPU=
+      - secure: RhAW5kABDPB3GWKD+NCg05Kcd92F/+kg+0icXXN166DWQYUut3MLrSY80xNzkz5nXTI9EFU4fUqlKLDiF/kelr0Zp/zpCQAB54o4cu5FkZz0Bgs9k7yUdCRyz6Vt2ChV5cYI4JTn9bMaeXEaGlOjP1iE51rYT6KO6kKlwsEnjUc=
+      - secure: jy/3fC+UtrDcE/X6/IxkyT2SrYMKkiEMP1ht4d5mxvNA0Xxn43E16c6FNP0JWPpWRGRIP38vnQRB4yOPU9BXvRmmswVL9Ge4e/6flJvKwD5Rlqb2dfaGaHRYV9v8Nkdzl2FvZ9eBH5KHxgG19gCG6L3RXP/+zYwrr4AQdm0fpfw=
+      - secure: RYEwBWYVXRTEdUWhQxdWXo6tldlVx8pha9zB0rgafcUQxaatAefnRc4X4HXTQnqr2n9TZ2TQGpM8vte/wr6Pjc85VZbimWGzgrvn0kg4MwPR8ZYiEM5qQ/pUpj4+93rpA91PhCGvZoZTqOrXHm4kMPuKro5I6qA4BFUXuANeC/s=
+      - secure: gHSicpqkqcZT04QurSgszrAiI6HOCw1DBlfIIi9KAJj7mG5GijD/4AQ6HCmcRMbCDJ0nUuvm/kckASnRtF5+3xvIJnuoyyEfCZWxt1lhK2UbS87VU+pVdws/VzwpisXuKsh3H0uT8DDVkWPH/ZWDgfVa74eYDEHiQFjo+2xx5ZA=
+      - secure: Q42bco3JXEpyVbL2akiOsaCHnAagAFIb3TF6H5qJfaLLqmGs/XrrgxliNaVMfWVSwPT2wpQvg9UGF9x37No9bZBv33DgYcWExmXb/lvGPpkctX37+FTMzECQHxOuUbYPQA7ZEuJ4AA7bwgpMISUeSyz5XXz44KcXIrZK2GWH+X4=
+      - secure: hugd8NVukJc3redDvlOt6zhaqa63XLNMp/eIIlNllW8VfQ6CJ1P7KJPwgxH24sDyrw7rLzOkBl6R4kaVWsCLCFp+NE6yFFHl9wDkSdLC1OX1DMrJnDsogwUqqe+jX8dxePSy26MSTfG8eo9/NxN9uXr+tKaHoi6G7BRXDHtQ8dQ=
+      - secure: TRkW9pIuIYHXJmPlDYoddxIp2M2W2f7qBGNJKEMB5xrOezES7w9XTg2eQXrD8jBO+fUUmMnAaDAXZuU58nMysPXx3vhtZKncg8w5CyuXJk2P8nkdPh0u5nmRhEpWrLKtLwJrX48xmJhNQvQqDAyL5c9WUzlWJ4WJFgoP5IDWmLc=
+      - secure: QHuMdtFCvttiIOx6iS+lH4bKXZMwsgVQ6FPsUW5zJ7uw6mAEWKEil9xNk4aYV9FywinwUs4fnFlnIW/Gj1gLkUjm4DtxdmRZIlRXIbgsNch6H916TCPg4Q2oPsW2nVdXPjW/2jhkfLUiSnuhL+ylami1NF8Up7vokXknh/jFNZU=
+      - secure: GTfrUVmMQSxho3Ia4Y1ONqKvVMD34GHF2/TJb8UdQV7iH+nVxVXpy3nWaCXa9ri7lRzMefkoVLy0gKK13YoVd7w3d2S3/IfNakC85XfN6VuOzK/FDkA0WoPrgKjcQ64I+3dQ6cgrMWWTieKwRZy+Ve24iRbnN055Hk+VRMu6OGw=
+      - secure: SOMYGVfHLkHsH6koxpw68YQ4ydEo6YXPhHbrYGQbehUbFa6+OZzBcAJRJbKjyhD2AZRvNr2jB8XnjYKvVyDGQRpkWhGYZ7CpHqINpDsqKBsbiMe3/+KmKQqS+UKxNGefquoOvyQ1N8Xy77dkWYokRtGMEuR12RkZLonxiDW8Qyg=
+      - secure: bSsDg+dJnPFdFiC/tbb61HdLh/Q0z2RVVAReT1wvV1BN4fN4NydvkUGbQmyFNyyunLulEs+X0oFma9L0497nUlTnan8UOg9sIleTSybPX6E9xSKKCItH1GgDw8bM9Igez5OOrrePBD3altVrH+FmGx0dlTQgM/KZMN50BJ79cXw=
     ### END TEST KITCHEN ONLY ###
   - rvm: 2.2
     sudo: required
     dist: trusty
     before_install:
-      - gem update --system
-      - gem install bundler
+      - gem update --system $(grep rubygems omnibus_overrides.rb | cut -d'"' -f2)
+      - gem install bundler -v $(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
       - sudo apt-get update
       - sudo apt-get -y install squid3 git curl
     env:
@@ -149,9 +167,6 @@ matrix:
       - sudo cat /var/log/squid3/access.log
 
   allow_failures:
-    - rvm: 2.2
-      env: "GEMFILE_MOD=\"gem 'poise', github: 'poise/poise'\""
-      script: bundle exec rake poise_spec
     - rvm: 2.3.0
     - rvm: rbx
 
diff --git a/Gemfile b/Gemfile
index 79589ea9037..ca6354d1072 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,28 +1,40 @@
+# This buys us the ability to be included in other Gemfiles
+require_relative "tasks/gemfile_util"
+extend GemfileUtil
+
 source "https://rubygems.org"
-# path is needed because when we attempt to load this gemspec to look at it from
-# another bundle, it will expand the path relative to the other bundle rather than
-# this file.
-gemspec path: File.dirname(__FILE__), name: "chef"
+gemspec name: "chef"
 
 gem "activesupport", "< 4.0.0", group: :compat_testing, platform: "ruby"
 gem "chef-config", path: File.expand_path("../chef-config", __FILE__) if File.exist?(File.expand_path("../chef-config", __FILE__))
 # Ensure that we can always install rake, regardless of gem groups
 gem "rake"
+gem "bundler"
+gem "cheffish"
 
 group(:omnibus_package) do
   gem "appbundler"
   gem "rb-readline"
   gem "nokogiri"
 end
-group(:omnibus_package, :development) do
-  gem "cheffish"
-end
 group(:omnibus_package, :pry) do
   gem "pry"
   gem "pry-byebug"
   gem "pry-remote"
   gem "pry-stack_explorer"
 end
+# These are used for external tests
+group(:integration) do
+  gem "chef-provisioning"
+  gem "chef-provisioning-aws"
+  gem "chef-rewind"
+  gem "chef-sugar"
+  gem "chefspec"
+  gem "halite"
+  gem "poise", git: "https://github.com/poise/poise" # until released poise's tests succeed against chef master
+  gem "knife-windows"
+  gem "foodcritic"
+end
 
 group(:docgen) do
   gem "yard"
diff --git a/Gemfile.lock b/Gemfile.lock
index 0cf56b3d924..9c30299306f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -6,6 +6,13 @@ GIT
     chefstyle (0.3.1)
       rubocop (= 0.39.0)
 
+GIT
+  remote: https://github.com/poise/poise
+  revision: a76980685a92283c08f5b2e4526ae1f08f87de79
+  specs:
+    poise (2.6.2.pre)
+      halite (~> 1.0)
+
 GIT
   remote: https://github.com/rubysec/bundler-audit.git
   revision: 4e32fca89d75f0e249671431ff38aadc02bfb28b
@@ -15,20 +22,12 @@ GIT
       bundler (~> 1.2)
       thor (~> 0.18)
 
-PATH
-  remote: chef-config
-  specs:
-    chef-config (12.10.1)
-      fuzzyurl (~> 0.8.0)
-      mixlib-config (~> 2.0)
-      mixlib-shellout (~> 2.0)
-
 PATH
   remote: .
   specs:
-    chef (12.10.1)
+    chef (12.10.4)
       bundler (>= 1.10)
-      chef-config (= 12.10.1)
+      chef-config (= 12.10.4)
       chef-zero (~> 4.5)
       diff-lcs (~> 1.2, >= 1.2.4)
       erubis (~> 2.7)
@@ -56,7 +55,7 @@ PATH
 PATH
   remote: chef-config
   specs:
-    chef-config (12.9.40)
+    chef-config (12.10.4)
       fuzzyurl (~> 0.8.0)
       mixlib-config (~> 2.0)
       mixlib-shellout (~> 2.0)
@@ -70,25 +69,60 @@ GEM
     addressable (2.4.0)
     appbundler (0.9.0)
       mixlib-cli (~> 1.4)
+    artifactory (2.3.2)
     ast (2.2.0)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    aws-sdk-v1 (1.66.0)
+      json (~> 1.4)
+      nokogiri (>= 1.4.4)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
     builder (3.2.2)
     byebug (8.2.4)
-    chef-zero (4.5.0)
+    chef-api (0.5.0)
+      logify (~> 0.1)
+      mime-types
+    chef-provisioning (1.7.0)
+      cheffish (>= 1.3.1, < 3.0)
+      inifile (>= 2.0.2)
+      mixlib-install (~> 1.0)
+      net-scp (~> 1.0)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-gateway (~> 1.2.0)
+      winrm (~> 1.3)
+    chef-provisioning-aws (1.9.0)
+      aws-sdk (>= 2.1.26, < 3.0)
+      aws-sdk-v1 (>= 1.59.0)
+      chef-provisioning (~> 1.4)
+      retryable (~> 2.0, >= 2.0.1)
+      ubuntu_ami (~> 0.4, >= 0.4.1)
+    chef-rewind (0.0.9)
+    chef-sugar (3.3.0)
+    chef-zero (4.6.1)
       ffi-yajl (~> 2.2)
       hashie (>= 2.0, < 4.0)
       mixlib-log (~> 1.3)
       rack
       uuidtools (~> 2.1)
-    cheffish (2.0.3)
+    cheffish (2.0.4)
       chef-zero (~> 4.3)
       compat_resource
+    chefspec (4.6.1)
+      chef (>= 11.14)
+      fauxhai (~> 3.2)
+      rspec (~> 3.0)
     childprocess (0.5.9)
       ffi (~> 1.0, >= 1.0.11)
     coderay (1.1.1)
     colorize (0.7.7)
     compat_resource (12.9.1)
+    cucumber-core (1.4.0)
+      gherkin (~> 3.2.0)
     debug_inspector (0.0.2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -97,10 +131,21 @@ GEM
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
+    fauxhai (3.3.0)
+      net-ssh
     ffi (1.9.10)
     ffi-yajl (2.2.3)
       libyajl2 (~> 1.2)
+    foodcritic (6.1.1)
+      cucumber-core (>= 1.3)
+      erubis
+      nokogiri (>= 1.5, < 2.0)
+      rake
+      rufus-lru (~> 1.0)
+      treetop (~> 1.4)
+      yajl-ruby (~> 1.1)
     fuzzyurl (0.8.0)
+    gherkin (3.2.0)
     github_api (0.13.1)
       addressable (~> 2.4.0)
       descendants_tracker (~> 0.0.4)
@@ -116,15 +161,39 @@ GEM
       rake (>= 10.0)
       rspec (>= 3.2)
       rubocop (>= 0.31)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    halite (1.2.1)
+      bundler
+      chef (~> 12.0)
+      stove (~> 3.2, >= 3.2.3)
+      thor
     hashie (3.4.3)
     highline (1.7.8)
+    httpclient (2.7.1)
     i18n (0.7.0)
+    inifile (3.0.0)
     iniparse (1.4.2)
     ipaddress (0.8.3)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
     json (1.8.3)
+    json_pure (1.8.3)
     jwt (1.5.1)
+    knife-windows (1.4.0)
+      winrm (~> 1.7)
     libyajl2 (1.2.0)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    logify (0.2.0)
     method_source (0.8.2)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
     mixlib-authentication (1.4.0)
       mixlib-log
@@ -133,8 +202,13 @@ GEM
       rspec-mocks (~> 3.2)
     mixlib-cli (1.5.0)
     mixlib-config (2.2.1)
+    mixlib-install (1.0.6)
+      artifactory (>= 2.3.0)
+      mixlib-shellout (>= 2.2.6)
+      mixlib-versioning (>= 1.1.0)
     mixlib-log (1.6.0)
     mixlib-shellout (2.2.6)
+    mixlib-versioning (1.1.0)
     multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
@@ -152,6 +226,7 @@ GEM
     netrc (0.11.0)
     nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
+    nori (2.6.0)
     oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
       jwt (~> 1.0, < 1.5.2)
@@ -178,6 +253,7 @@ GEM
     parser (2.3.0.7)
       ast (~> 2.2)
     plist (3.2.0)
+    polyglot (0.3.5)
     powerpack (0.1.1)
     proxifier (1.0.3)
     pry (0.10.3)
@@ -197,6 +273,7 @@ GEM
     rainbow (2.1.0)
     rake (11.1.2)
     rb-readline (0.5.3)
+    retryable (2.0.3)
     rspec (3.4.0)
       rspec-core (~> 3.4.0)
       rspec-expectations (~> 3.4.0)
@@ -225,6 +302,8 @@ GEM
     ruby-prof (0.15.9)
     ruby-progressbar (1.7.5)
     ruby-shadow (2.5.0)
+    rubyntlm (0.6.0)
+    rufus-lru (1.0.5)
     sawyer (0.7.0)
       addressable (>= 2.3.5, < 2.5)
       faraday (~> 0.8, < 0.10)
@@ -245,14 +324,29 @@ GEM
       net-ssh (>= 2.7, < 4.0)
       net-telnet
       sfl
+    stove (3.2.8)
+      chef-api (~> 0.5)
+      logify (~> 0.2)
     syslog-logger (1.6.8)
     systemu (2.6.5)
     thor (0.19.1)
     thread_safe (0.3.5)
     tomlrb (1.2.1)
+    treetop (1.6.5)
+      polyglot (~> 0.3)
+    ubuntu_ami (0.4.1)
     unicode-display_width (1.0.3)
     uuidtools (2.1.5)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
     wmi-lite (1.0.0)
+    yajl-ruby (1.2.1)
     yard (0.8.7.6)
 
 PLATFORMS
@@ -261,15 +355,25 @@ PLATFORMS
 DEPENDENCIES
   activesupport (< 4.0.0)
   appbundler
+  bundler
   bundler-audit!
   chef!
   chef-config!
+  chef-provisioning
+  chef-provisioning-aws
+  chef-rewind
+  chef-sugar
   cheffish
+  chefspec
   chefstyle!
+  foodcritic
   github_changelog_generator (= 1.11.3)
+  halite
+  knife-windows
   netrc
   nokogiri
   octokit
+  poise!
   pry
   pry-byebug
   pry-remote
diff --git a/Gemfile.windows b/Gemfile.windows
index 2387c6af4b0..cf7b6efdb04 100644
--- a/Gemfile.windows
+++ b/Gemfile.windows
@@ -29,6 +29,4 @@
 #
 
 require_relative "tasks/gemfile_util"
-extend GemfileUtil
-generic_gemfile = File.expand_path("../Gemfile", __FILE__)
-include_locked_gemfile(generic_gemfile)
+GemfileUtil.include_locked_gemfile(self, "Gemfile", without_groups: [ :linux, :solaris, :aix ])
diff --git a/Gemfile.windows.lock b/Gemfile.windows.lock
index 56081e80e0e..79c946b30a7 100644
--- a/Gemfile.windows.lock
+++ b/Gemfile.windows.lock
@@ -6,6 +6,14 @@ GIT
     chefstyle (0.3.1)
       rubocop (= 0.39.0)
 
+GIT
+  remote: https://github.com/poise/poise
+  revision: a76980685a92283c08f5b2e4526ae1f08f87de79
+  ref: a76980685a92283c08f5b2e4526ae1f08f87de79
+  specs:
+    poise (2.6.2.pre)
+      halite (~> 1.0)
+
 GIT
   remote: https://github.com/rubysec/bundler-audit.git
   revision: 4e32fca89d75f0e249671431ff38aadc02bfb28b
@@ -18,7 +26,7 @@ GIT
 PATH
   remote: chef-config
   specs:
-    chef-config (12.10.1)
+    chef-config (12.10.4)
       fuzzyurl (~> 0.8.0)
       mixlib-config (~> 2.0)
       mixlib-shellout (~> 2.0)
@@ -26,9 +34,9 @@ PATH
 PATH
   remote: .
   specs:
-    chef (12.10.1-universal-mingw32)
+    chef (12.10.4-universal-mingw32)
       bundler (>= 1.10)
-      chef-config (= 12.10.1)
+      chef-config (= 12.10.4)
       chef-zero (~> 4.5)
       diff-lcs (~> 1.2, >= 1.2.4)
       erubis (~> 2.7)
@@ -64,39 +72,69 @@ PATH
       windows-api (~> 0.4.4)
       wmi-lite (~> 1.0)
 
-PATH
-  remote: chef-config
-  specs:
-    chef-config (12.9.40)
-      fuzzyurl (~> 0.8.0)
-      mixlib-config (~> 2.0)
-      mixlib-shellout (~> 2.0)
-
 GEM
   remote: https://rubygems.org/
   specs:
+    activesupport (3.2.22.2)
+      i18n (~> 0.6, >= 0.6.4)
+      multi_json (~> 1.0)
     addressable (2.4.0)
     appbundler (0.9.0)
       mixlib-cli (~> 1.4)
+    artifactory (2.3.2)
     ast (2.2.0)
+    aws-sdk (2.2.34)
+      aws-sdk-resources (= 2.2.34)
+    aws-sdk-core (2.2.34)
+      jmespath (~> 1.0)
+    aws-sdk-resources (2.2.34)
+      aws-sdk-core (= 2.2.34)
+    aws-sdk-v1 (1.66.0)
+      json (~> 1.4)
+      nokogiri (>= 1.4.4)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
     builder (3.2.2)
     byebug (8.2.4)
-    chef-zero (4.5.0)
+    chef-api (0.5.0)
+      logify (~> 0.1)
+      mime-types
+    chef-provisioning (1.7.0)
+      cheffish (>= 1.3.1, < 3.0)
+      inifile (>= 2.0.2)
+      mixlib-install (~> 1.0)
+      net-scp (~> 1.0)
+      net-ssh (>= 2.9, < 4.0)
+      net-ssh-gateway (~> 1.2.0)
+      winrm (~> 1.3)
+    chef-provisioning-aws (1.9.0)
+      aws-sdk (>= 2.1.26, < 3.0)
+      aws-sdk-v1 (>= 1.59.0)
+      chef-provisioning (~> 1.4)
+      retryable (~> 2.0, >= 2.0.1)
+      ubuntu_ami (~> 0.4, >= 0.4.1)
+    chef-rewind (0.0.9)
+    chef-sugar (3.3.0)
+    chef-zero (4.6.1)
       ffi-yajl (~> 2.2)
       hashie (>= 2.0, < 4.0)
       mixlib-log (~> 1.3)
       rack
       uuidtools (~> 2.1)
-    cheffish (2.0.3)
+    cheffish (2.0.4)
       chef-zero (~> 4.3)
       compat_resource
+    chefspec (4.6.1)
+      chef (>= 11.14)
+      fauxhai (~> 3.2)
+      rspec (~> 3.0)
     childprocess (0.5.9)
       ffi (~> 1.0, >= 1.0.11)
     coderay (1.1.1)
     colorize (0.7.7)
     compat_resource (12.9.1)
+    cucumber-core (1.4.0)
+      gherkin (~> 3.2.0)
     debug_inspector (0.0.2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -105,10 +143,21 @@ GEM
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
+    fauxhai (3.3.0)
+      net-ssh
     ffi (1.9.10-x86-mingw32)
     ffi-yajl (2.2.3)
       libyajl2 (~> 1.2)
+    foodcritic (6.1.1)
+      cucumber-core (>= 1.3)
+      erubis
+      nokogiri (>= 1.5, < 2.0)
+      rake
+      rufus-lru (~> 1.0)
+      treetop (~> 1.4)
+      yajl-ruby (~> 1.1)
     fuzzyurl (0.8.0)
+    gherkin (3.2.0)
     github_api (0.13.1)
       addressable (~> 2.4.0)
       descendants_tracker (~> 0.0.4)
@@ -124,15 +173,39 @@ GEM
       rake (>= 10.0)
       rspec (>= 3.2)
       rubocop (>= 0.31)
+    gssapi (1.2.0)
+      ffi (>= 1.0.1)
+    gyoku (1.3.1)
+      builder (>= 2.1.2)
+    halite (1.2.1)
+      bundler
+      chef (~> 12.0)
+      stove (~> 3.2, >= 3.2.3)
+      thor
     hashie (3.4.3)
     highline (1.7.8)
+    httpclient (2.7.1)
     i18n (0.7.0)
+    inifile (3.0.0)
     iniparse (1.4.2)
     ipaddress (0.8.3)
+    jmespath (1.2.4)
+      json_pure (>= 1.8.1)
     json (1.8.3)
+    json_pure (1.8.3)
     jwt (1.5.1)
+    knife-windows (1.4.0)
+      winrm (~> 1.7)
     libyajl2 (1.2.0)
+    little-plugger (1.1.4)
+    logging (2.1.0)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    logify (0.2.0)
     method_source (0.8.2)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
     mixlib-authentication (1.4.0)
       mixlib-log
@@ -141,10 +214,15 @@ GEM
       rspec-mocks (~> 3.2)
     mixlib-cli (1.5.0)
     mixlib-config (2.2.1)
+    mixlib-install (1.0.6)
+      artifactory (>= 2.3.0)
+      mixlib-shellout (>= 2.2.6)
+      mixlib-versioning (>= 1.1.0)
     mixlib-log (1.6.0)
     mixlib-shellout (2.2.6-universal-mingw32)
       win32-process (~> 0.8.2)
       wmi-lite (~> 1.0)
+    mixlib-versioning (1.1.0)
     multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
@@ -162,6 +240,7 @@ GEM
     netrc (0.11.0)
     nokogiri (1.6.7.2-x86-mingw32)
       mini_portile2 (~> 2.0.0.rc2)
+    nori (2.6.0)
     oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
       jwt (~> 1.0, < 1.5.2)
@@ -188,6 +267,7 @@ GEM
     parser (2.3.0.7)
       ast (~> 2.2)
     plist (3.2.0)
+    polyglot (0.3.5)
     powerpack (0.1.1)
     proxifier (1.0.3)
     pry (0.10.3)
@@ -207,6 +287,7 @@ GEM
     rainbow (2.1.0)
     rake (11.1.2)
     rb-readline (0.5.3)
+    retryable (2.0.3)
     rspec (3.4.0)
       rspec-core (~> 3.4.0)
       rspec-expectations (~> 3.4.0)
@@ -235,6 +316,8 @@ GEM
     ruby-prof (0.15.9)
     ruby-progressbar (1.7.5)
     ruby-shadow (2.5.0)
+    rubyntlm (0.6.0)
+    rufus-lru (1.0.5)
     sawyer (0.7.0)
       addressable (>= 2.3.5, < 2.5)
       faraday (~> 0.8, < 0.10)
@@ -255,11 +338,17 @@ GEM
       net-ssh (>= 2.7, < 4.0)
       net-telnet
       sfl
+    stove (3.2.8)
+      chef-api (~> 0.5)
+      logify (~> 0.2)
     syslog-logger (1.6.8)
     systemu (2.6.5)
     thor (0.19.1)
     thread_safe (0.3.5)
     tomlrb (1.2.1)
+    treetop (1.6.5)
+      polyglot (~> 0.3)
+    ubuntu_ami (0.4.1)
     unicode-display_width (1.0.3)
     uuidtools (2.1.5)
     win32-api (1.5.3-universal-mingw32)
@@ -281,110 +370,160 @@ GEM
       ffi
     windows-api (0.4.4)
       win32-api (>= 1.4.5)
+    winrm (1.7.3)
+      builder (>= 2.1.2)
+      gssapi (~> 1.2)
+      gyoku (~> 1.0)
+      httpclient (~> 2.2, >= 2.2.0.2)
+      logging (>= 1.6.1, < 3.0)
+      nori (~> 2.0)
+      rubyntlm (~> 0.6.0)
     wmi-lite (1.0.0)
+    yajl-ruby (1.2.1)
     yard (0.8.7.6)
 
 PLATFORMS
   x86-mingw32
 
 DEPENDENCIES
-  activesupport (= 3.2.22.2)
-  addressable (= 2.4.0)
-  appbundler (= 0.9.0)
-  ast (= 2.2.0)
-  binding_of_caller (= 0.7.2)
-  builder (= 3.2.2)
+  activesupport (= 3.2.22.2)!
+  addressable (= 2.4.0)!
+  appbundler (= 0.9.0)!
+  artifactory (= 2.3.2)!
+  ast (= 2.2.0)!
+  aws-sdk (= 2.2.34)!
+  aws-sdk-core (= 2.2.34)!
+  aws-sdk-resources (= 2.2.34)!
+  aws-sdk-v1 (= 1.66.0)!
+  binding_of_caller (= 0.7.2)!
+  builder (= 3.2.2)!
   bundler-audit!
-  byebug (= 8.2.4)
+  byebug (= 8.2.4)!
   chef!
+  chef-api (= 0.5.0)!
   chef-config!
-  chef-zero (= 4.5.0)
-  cheffish (= 2.0.3)
+  chef-provisioning (= 1.7.0)!
+  chef-provisioning-aws (= 1.9.0)!
+  chef-rewind (= 0.0.9)!
+  chef-sugar (= 3.3.0)!
+  chef-zero (= 4.6.1)!
+  cheffish (= 2.0.4)!
+  chefspec (= 4.6.1)!
   chefstyle!
-  childprocess (= 0.5.9)
-  coderay (= 1.1.1)
-  colorize (= 0.7.7)
-  compat_resource (= 12.9.1)
-  debug_inspector (= 0.0.2)
-  descendants_tracker (= 0.0.4)
-  diff-lcs (= 1.2.5)
-  docile (= 1.1.5)
-  erubis (= 2.7.0)
-  faraday (= 0.9.2)
-  ffi (= 1.9.10)
-  ffi-yajl (= 2.2.3)
-  fuzzyurl (= 0.8.0)
-  github_api (= 0.13.1)
-  github_changelog_generator (= 1.11.3)
-  hashie (= 3.4.3)
-  highline (= 1.7.8)
-  i18n (= 0.7.0)
-  iniparse (= 1.4.2)
-  ipaddress (= 0.8.3)
-  json (= 1.8.3)
-  jwt (= 1.5.1)
-  libyajl2 (= 1.2.0)
-  method_source (= 0.8.2)
-  mini_portile2 (= 2.0.0)
-  mixlib-authentication (= 1.4.0)
-  mixlib-cli (= 1.5.0)
-  mixlib-config (= 2.2.1)
-  mixlib-log (= 1.6.0)
-  mixlib-shellout (= 2.2.6)
-  multi_json (= 1.11.2)
-  multi_xml (= 0.5.5)
-  multipart-post (= 2.0.0)
-  net-scp (= 1.2.1)
-  net-sftp (= 2.1.2)
-  net-ssh (= 3.1.1)
-  net-ssh-gateway (= 1.2.0)
-  net-ssh-multi (= 1.2.1)
-  net-telnet (= 0.1.1)
-  netrc (= 0.11.0)
-  nokogiri (= 1.6.7.2)
-  oauth2 (= 1.1.0)
-  octokit (= 4.3.0)
-  ohai (= 8.14.0)
-  overcommit (= 0.33.0)
-  parser (= 2.3.0.7)
-  plist (= 3.2.0)
-  powerpack (= 0.1.1)
-  proxifier (= 1.0.3)
-  pry (= 0.10.3)
-  pry-byebug (= 3.3.0)
-  pry-remote (= 0.1.8)
-  pry-stack_explorer (= 0.4.9.2)
-  rack (= 1.6.4)
-  rainbow (= 2.1.0)
-  rake (= 11.1.2)
-  rb-readline (= 0.5.3)
-  rspec (= 3.4.0)
-  rspec-core (= 3.4.4)
-  rspec-expectations (= 3.4.0)
-  rspec-its (= 1.2.0)
-  rspec-mocks (= 3.4.1)
-  rspec-support (= 3.4.1)
-  rspec_junit_formatter (= 0.2.3)
-  rubocop (= 0.39.0)
-  ruby-prof (= 0.15.9)
-  ruby-progressbar (= 1.7.5)
-  ruby-shadow (= 2.5.0)
-  sawyer (= 0.7.0)
-  serverspec (= 2.31.1)
-  sfl (= 2.2)
-  simplecov (= 0.11.2)
-  simplecov-html (= 0.10.0)
-  slop (= 3.6.0)
-  specinfra (= 2.56.1)
-  syslog-logger (= 1.6.8)
-  systemu (= 2.6.5)
-  thor (= 0.19.1)
-  thread_safe (= 0.3.5)
-  tomlrb (= 1.2.1)
-  unicode-display_width (= 1.0.3)
-  uuidtools (= 2.1.5)
-  wmi-lite (= 1.0.0)
-  yard (= 0.8.7.6)
+  childprocess (= 0.5.9)!
+  coderay (= 1.1.1)!
+  colorize (= 0.7.7)!
+  compat_resource (= 12.9.1)!
+  cucumber-core (= 1.4.0)!
+  debug_inspector (= 0.0.2)!
+  descendants_tracker (= 0.0.4)!
+  diff-lcs (= 1.2.5)!
+  docile (= 1.1.5)!
+  erubis (= 2.7.0)!
+  faraday (= 0.9.2)!
+  fauxhai (= 3.3.0)!
+  ffi (= 1.9.10)!
+  ffi-yajl (= 2.2.3)!
+  foodcritic (= 6.1.1)!
+  fuzzyurl (= 0.8.0)!
+  gherkin (= 3.2.0)!
+  github_api (= 0.13.1)!
+  github_changelog_generator (= 1.11.3)!
+  gssapi (= 1.2.0)!
+  gyoku (= 1.3.1)!
+  halite (= 1.2.1)!
+  hashie (= 3.4.3)!
+  highline (= 1.7.8)!
+  httpclient (= 2.7.1)!
+  i18n (= 0.7.0)!
+  inifile (= 3.0.0)!
+  iniparse (= 1.4.2)!
+  ipaddress (= 0.8.3)!
+  jmespath (= 1.2.4)!
+  json (= 1.8.3)!
+  json_pure (= 1.8.3)!
+  jwt (= 1.5.1)!
+  knife-windows (= 1.4.0)!
+  libyajl2 (= 1.2.0)!
+  little-plugger (= 1.1.4)!
+  logging (= 2.1.0)!
+  logify (= 0.2.0)!
+  method_source (= 0.8.2)!
+  mime-types (= 3.0)!
+  mime-types-data (= 3.2016.0221)!
+  mini_portile2 (= 2.0.0)!
+  mixlib-authentication (= 1.4.0)!
+  mixlib-cli (= 1.5.0)!
+  mixlib-config (= 2.2.1)!
+  mixlib-install (= 1.0.6)!
+  mixlib-log (= 1.6.0)!
+  mixlib-shellout (= 2.2.6)!
+  mixlib-versioning (= 1.1.0)!
+  multi_json (= 1.11.2)!
+  multi_xml (= 0.5.5)!
+  multipart-post (= 2.0.0)!
+  net-scp (= 1.2.1)!
+  net-sftp (= 2.1.2)!
+  net-ssh (= 3.1.1)!
+  net-ssh-gateway (= 1.2.0)!
+  net-ssh-multi (= 1.2.1)!
+  net-telnet (= 0.1.1)!
+  netrc (= 0.11.0)!
+  nokogiri (= 1.6.7.2)!
+  nori (= 2.6.0)!
+  oauth2 (= 1.1.0)!
+  octokit (= 4.3.0)!
+  ohai (= 8.14.0)!
+  overcommit (= 0.33.0)!
+  parser (= 2.3.0.7)!
+  plist (= 3.2.0)!
+  poise!
+  polyglot (= 0.3.5)!
+  powerpack (= 0.1.1)!
+  proxifier (= 1.0.3)!
+  pry (= 0.10.3)!
+  pry-byebug (= 3.3.0)!
+  pry-remote (= 0.1.8)!
+  pry-stack_explorer (= 0.4.9.2)!
+  rack (= 1.6.4)!
+  rainbow (= 2.1.0)!
+  rake (= 11.1.2)!
+  rb-readline (= 0.5.3)!
+  retryable (= 2.0.3)!
+  rspec (= 3.4.0)!
+  rspec-core (= 3.4.4)!
+  rspec-expectations (= 3.4.0)!
+  rspec-its (= 1.2.0)!
+  rspec-mocks (= 3.4.1)!
+  rspec-support (= 3.4.1)!
+  rspec_junit_formatter (= 0.2.3)!
+  rubocop (= 0.39.0)!
+  ruby-prof (= 0.15.9)!
+  ruby-progressbar (= 1.7.5)!
+  ruby-shadow (= 2.5.0)!
+  rubyntlm (= 0.6.0)!
+  rufus-lru (= 1.0.5)!
+  sawyer (= 0.7.0)!
+  serverspec (= 2.31.1)!
+  sfl (= 2.2)!
+  simplecov (= 0.11.2)!
+  simplecov-html (= 0.10.0)!
+  slop (= 3.6.0)!
+  specinfra (= 2.56.1)!
+  stove (= 3.2.8)!
+  syslog-logger (= 1.6.8)!
+  systemu (= 2.6.5)!
+  thor (= 0.19.1)!
+  thread_safe (= 0.3.5)!
+  tomlrb (= 1.2.1)!
+  treetop (= 1.6.5)!
+  ubuntu_ami (= 0.4.1)!
+  unicode-display_width (= 1.0.3)!
+  uuidtools (= 2.1.5)!
+  winrm (= 1.7.3)!
+  wmi-lite (= 1.0.0)!
+  yajl-ruby (= 1.2.1)!
+  yard (= 0.8.7.6)!
 
 BUNDLED WITH
    1.11.2
diff --git a/Rakefile b/Rakefile
index 10eb4a38b54..e930c75460f 100644
--- a/Rakefile
+++ b/Rakefile
@@ -24,10 +24,10 @@ require "chef/version"
 require "chef-config/package_task"
 require "rdoc/task"
 require_relative "tasks/rspec"
-require_relative "tasks/external_tests"
 require_relative "tasks/maintainers"
 require_relative "tasks/cbgb"
 require_relative "tasks/dependencies"
+require_relative "tasks/changelog"
 
 ChefConfig::PackageTask.new(File.expand_path("..", __FILE__), "Chef") do |package|
   package.component_paths = ["chef-config"]
@@ -75,16 +75,3 @@ begin
 rescue LoadError
   puts "yard is not available. (sudo) gem install yard to generate yard documentation."
 end
-
-begin
-  require "github_changelog_generator/task"
-
-  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
-    config.future_release = Chef::VERSION
-    config.enhancement_labels = "enhancement,Enhancement,New Feature,Feature".split(",")
-    config.bug_labels = "bug,Bug,Improvement,Upstream Bug".split(",")
-    config.exclude_labels = "duplicate,question,invalid,wontfix,no_changelog,Exclude From Changelog,Question,Discussion".split(",")
-  end
-rescue LoadError
-  puts "github_changelog_generator is not available. gem install github_changelog_generator to generate changelogs"
-end
diff --git a/acceptance/Gemfile.lock b/acceptance/Gemfile.lock
index 0ee47feb360..618acb42f8d 100644
--- a/acceptance/Gemfile.lock
+++ b/acceptance/Gemfile.lock
@@ -72,7 +72,8 @@ GEM
     celluloid-io (0.16.2)
       celluloid (>= 0.16.0)
       nio4r (>= 1.1.0)
-    chef-config (12.8.1)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
       mixlib-config (~> 2.0)
       mixlib-shellout (~> 2.0)
     cleanroom (1.0.0)
@@ -86,6 +87,7 @@ GEM
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.10)
+    fuzzyurl (0.8.0)
     gssapi (1.2.0)
       ffi (>= 1.0.1)
     gyoku (1.3.1)
@@ -198,7 +200,7 @@ GEM
     solve (2.0.3)
       molinillo (~> 0.4.2)
       semverse (~> 1.1)
-    test-kitchen (1.7.2)
+    test-kitchen (1.7.3)
       mixlib-install (~> 1.0, >= 1.0.4)
       mixlib-shellout (>= 1.2, < 3.0)
       net-scp (~> 1.1)
@@ -222,7 +224,7 @@ GEM
       logging (>= 1.6.1, < 3.0)
       nori (~> 2.0)
       rubyntlm (~> 0.6.0)
-    winrm-fs (0.4.1)
+    winrm-fs (0.4.2)
       erubis (~> 2.7)
       logging (>= 1.6.1, < 3.0)
       rubyzip (~> 1.1)
diff --git a/appveyor.yml b/appveyor.yml
index d6459b6b967..5a240591312 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -23,13 +23,16 @@ install:
   - SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
   - echo %PATH%
   - ruby --version
+  - gem update --system || gem update --system || gem update --system
   - gem install bundler --quiet --no-ri --no-rdoc || gem install bundler --quiet --no-ri --no-rdoc || gem install bundler --quiet --no-ri --no-rdoc
-  - gem install rubygems-pkg/rubygems-update-2.4.6.gem
   - update_rubygems
   - gem --version
   - bundler --version
+  - SET BUNDLE_GEMFILE=Gemfile.windows
 
 build_script:
+  - bundle config --local frozen 1
+  - bundle config --local without docgen:maintenance:omnibus_package:integration:aix:bsd:linux:solaris
   - bundle install || bundle install || bundle install
 
 test_script:
diff --git a/kitchen-tests/Berksfile.lock b/kitchen-tests/Berksfile.lock
index b69d5daa737..dcdafe06f3f 100644
--- a/kitchen-tests/Berksfile.lock
+++ b/kitchen-tests/Berksfile.lock
@@ -4,9 +4,9 @@ DEPENDENCIES
     path: cookbooks/webapp
 
 GRAPH
-  apache2 (3.2.1)
+  apache2 (3.2.2)
   apt (3.0.0)
-  aws (3.3.1)
+  aws (3.3.2)
     ohai (>= 2.1.0)
   build-essential (3.2.0)
     seven_zip (>= 0.0.0)
diff --git a/kitchen-tests/Gemfile.lock b/kitchen-tests/Gemfile.lock
index 3c43b32a9fd..0fad64e53dc 100644
--- a/kitchen-tests/Gemfile.lock
+++ b/kitchen-tests/Gemfile.lock
@@ -54,7 +54,8 @@ GEM
     celluloid-io (0.16.2)
       celluloid (>= 0.16.0)
       nio4r (>= 1.1.0)
-    chef-config (12.8.1)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
       mixlib-config (~> 2.0)
       mixlib-shellout (~> 2.0)
     cleanroom (1.0.0)
@@ -63,6 +64,7 @@ GEM
     excon (0.49.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
+    fuzzyurl (0.8.0)
     hashie (3.4.3)
     hitimes (1.2.3)
     httpclient (2.7.1)
@@ -80,7 +82,7 @@ GEM
       rspec-expectations (~> 3.2)
       rspec-mocks (~> 3.2)
     mixlib-config (2.2.1)
-    mixlib-install (1.0.5)
+    mixlib-install (1.0.6)
       artifactory (>= 2.3.0)
       mixlib-shellout (>= 2.2.6)
       mixlib-versioning (>= 1.1.0)
@@ -132,7 +134,7 @@ GEM
     solve (2.0.3)
       molinillo (~> 0.4.2)
       semverse (~> 1.1)
-    test-kitchen (1.7.2)
+    test-kitchen (1.7.3)
       mixlib-install (~> 1.0, >= 1.0.4)
       mixlib-shellout (>= 1.2, < 3.0)
       net-scp (~> 1.1)
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
index e9c711ed787..7e92537e3cb 100644
--- a/omnibus/Gemfile.lock
+++ b/omnibus/Gemfile.lock
@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/chef/omnibus-software.git
-  revision: 8d611676c4458fa679cbc48e2111892ae7986cbf
+  revision: 6127be3af79941c32419228cbd9e63c4f061d76b
   specs:
     omnibus-software (4.0.0)
       omnibus (>= 5.2.0)
@@ -81,7 +81,8 @@ GEM
     celluloid-io (0.16.2)
       celluloid (>= 0.16.0)
       nio4r (>= 1.1.0)
-    chef-config (12.8.1)
+    chef-config (12.9.38)
+      fuzzyurl (~> 0.8.0)
       mixlib-config (~> 2.0)
       mixlib-shellout (~> 2.0)
     chef-sugar (3.3.0)
@@ -99,6 +100,7 @@ GEM
     ffi (1.9.10)
     ffi-yajl (2.2.3)
       libyajl2 (~> 1.2)
+    fuzzyurl (0.8.0)
     gssapi (1.2.0)
       ffi (>= 1.0.1)
     gyoku (1.3.1)
@@ -128,7 +130,7 @@ GEM
       rspec-mocks (~> 3.2)
     mixlib-cli (1.5.0)
     mixlib-config (2.2.1)
-    mixlib-install (1.0.5)
+    mixlib-install (1.0.6)
       artifactory (>= 2.3.0)
       mixlib-shellout (>= 2.2.6)
       mixlib-versioning (>= 1.1.0)
@@ -209,7 +211,7 @@ GEM
       dep_selector (~> 1.0)
       semverse (~> 1.1)
     systemu (2.6.5)
-    test-kitchen (1.7.2)
+    test-kitchen (1.7.3)
       mixlib-install (~> 1.0, >= 1.0.4)
       mixlib-shellout (>= 1.2, < 3.0)
       net-scp (~> 1.1)
@@ -230,7 +232,7 @@ GEM
       logging (>= 1.6.1, < 3.0)
       nori (~> 2.0)
       rubyntlm (~> 0.6.0)
-    winrm-fs (0.4.1)
+    winrm-fs (0.4.2)
       erubis (~> 2.7)
       logging (>= 1.6.1, < 3.0)
       rubyzip (~> 1.1)
diff --git a/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb b/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb
index 5992ae80579..ee096b8ed93 100644
--- a/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb
+++ b/omnibus/files/chef-gem/build-chef-gem/gem-install-software-def.rb
@@ -1,6 +1,7 @@
 require "bundler"
 require "omnibus"
 require_relative "../build-chef-gem"
+require_relative "../../../../tasks/gemfile_util"
 
 module BuildChefGem
   class GemInstallSoftwareDef
@@ -34,16 +35,16 @@ def define
 
       gem_name = self.gem_name
       gem_version = self.gem_version
-      gemspec = self.gemspec
+      gem_metadata = self.gem_metadata
       lockfile_path = self.lockfile_path
 
       software.build do
         extend BuildChefGem
 
         if gem_version == "<skip>"
-          if gemspec
+          if gem_metadata
             block do
-              log.info(log_key) { "#{gem_name} has source #{gemspec.source.name} in #{lockfile_path}. We only cache rubygems.org installs in omnibus to keep things simple. The chef step will build #{gem_name} ..." }
+              log.info(log_key) { "#{gem_name} has source #{gem_metadata} in #{lockfile_path}. We only cache rubygems.org installs in omnibus to keep things simple. The chef step will build #{gem_name} ..." }
             end
           else
             block do
@@ -95,34 +96,26 @@ def gem_name
       end
     end
 
-    def gemspec
-      @gemspec ||= begin
-        old_frozen = Bundler.settings[:frozen]
-        Bundler.settings[:frozen] = true
-        begin
-          bundle = Bundler::Definition.build(gemfile_path, lockfile_path, nil)
-          dependencies = bundle.dependencies.select { |d| (d.groups - without_groups).any? }
-          # This is sacrilege: figure out a way we can grab the list of dependencies *without*
-          # requiring everything to be installed or calling private methods ...
-          gemspec = bundle.resolve.for(bundle.send(:expand_dependencies, dependencies)).find { |s| s.name == gem_name }
-          if gemspec
-            log.info(software.name) { "Using #{gem_name} version #{gemspec.version} from #{gemfile_path}" }
-          elsif bundle.resolve.find { |s| s.name == gem_name }
-            log.info(software.name) { "#{gem_name} not loaded from #{gemfile_path}, skipping" }
-          else
-            raise "#{gem_name} not found in #{gemfile_path} or #{lockfile_path}"
-          end
-          gemspec
-        ensure
-          Bundler.settings[:frozen] = old_frozen
+    def gem_metadata
+      @gem_metadata ||= begin
+        selected = GemfileUtil.select_gems(gemfile_path, without_groups: without_groups)
+        result = GemfileUtil.locked_gems(lockfile_path, selected)[gem_name]
+        if result
+          log.info(software.name) { "Using #{gem_name} version #{result[:version]} from #{gemfile_path}" }
+          result
+        elsif GemfileUtil.locked_gems(lockfile_path, GemfileUtil.select_gems(gemfile_path))[gem_name]
+          log.info(software.name) { "#{gem_name} not loaded from #{gemfile_path} because it was only in groups #{without_groups.join(", ")}, skipping" }
+          nil
+        else
+          raise "#{gem_name} not found in #{gemfile_path} or #{lockfile_path}"
         end
       end
     end
 
     def gem_version
       @gem_version ||= begin
-        if gemspec && gemspec.source.name == "rubygems repository https://rubygems.org/"
-          gemspec.version.to_s
+        if gem_metadata && URI(gem_metadata[:source]) == URI("https://rubygems.org/")
+          gem_metadata[:version]
         else
           "<skip>"
         end
diff --git a/omnibus/files/chef/build-chef.rb b/omnibus/files/chef/build-chef.rb
index d3e68d4e8aa..21bd6c22501 100644
--- a/omnibus/files/chef/build-chef.rb
+++ b/omnibus/files/chef/build-chef.rb
@@ -108,22 +108,24 @@ def install_shared_gemfile
           name, version = $1, $2
           # rubocop is an exception, since different projects disagree
           next if GEMS_ALLOWED_TO_FLOAT.include?(name)
-          gem_pins << "override_gem #{name.inspect}, #{version.inspect}\n"
+          gem_pins << "gem #{name.inspect}, #{version.inspect}, override: true\n"
         end
       end
 
+      # Find the installed chef gem by looking for lib/chef.rb
+      chef_gem = File.expand_path("../..", shellout!("#{gem_bin} which chef").stdout.chomp)
+      # Figure out the path to gemfile_util from there
+      gemfile_util = Pathname.new(File.join(chef_gem, "tasks", "gemfile_util"))
+      gemfile_util = gemfile_util.relative_path_from(Pathname.new(shared_gemfile).dirname)
+
       create_file(shared_gemfile) { <<-EOM }
-        # Meant to be included in component Gemfiles at the end with:
+        # Meant to be included in component Gemfiles at the beginning with:
         #
         #     instance_eval(IO.read("#{install_dir}/Gemfile"), "#{install_dir}/Gemfile")
         #
         # Override any existing gems with our own.
-        def override_gem(name, *args, &block)
-          # If the Gemfile re-specifies something in our lockfile, ignore it.
-          current = dependencies.find { |dep| dep.name == name }
-          dependencies.delete(current) if current
-          gem(name, *args, &block)
-        end
+        require_relative "#{gemfile_util}"
+        extend GemfileUtil
         #{gem_pins}
       EOM
     end
diff --git a/tasks/bin/run_chef_tests b/tasks/bin/run_chef_tests
new file mode 100755
index 00000000000..567c6a95870
--- /dev/null
+++ b/tasks/bin/run_chef_tests
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Fail fast (e) and echo commands (vx)
+set -evx
+
+echo --color > .rspec
+echo -fp >> .rspec
+sudo sed -i -e 's/^Defaults\tsecure_path.*$//' /etc/sudoers;
+sudo -E $(which bundle) exec rake spec;
+bundle exec rake style;
+bundle exec bundle-audit check --update;
diff --git a/tasks/bin/run_external_test b/tasks/bin/run_external_test
new file mode 100755
index 00000000000..f1cefb91383
--- /dev/null
+++ b/tasks/bin/run_external_test
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+# Fail fast (e) and echo commands (vx)
+set -evx
+
+# Arguments
+TEST_GEM=$1
+shift
+
+PROJECT_ROOT=$(pwd)
+PROJECT_BUNDLE_PATH=${BUNDLE_PATH:-$(grep BUNDLE_PATH: $PROJECT_ROOT/.bundle/config | cut -d' ' -f2-)}
+if [ -n "$PROJECT_BUNDLE_PATH" ]; then
+  PROJECT_BUNDLE_PATH=$PROJECT_ROOT/$PROJECT_BUNDLE_PATH
+fi
+
+TEST_GEM_ROOT=$(bundle show $TEST_GEM)
+
+# Make a copy of the original Gemfile and stitch in our Gemfile.lock
+TEST_GEMFILE=$TEST_GEM_ROOT/Gemfile
+MODIFIED_TEST_GEMFILE=$TEST_GEMFILE.externaltest
+cat <<EOM > $MODIFIED_TEST_GEMFILE
+require_relative "$PROJECT_ROOT/tasks/gemfile_util"
+GemfileUtil.include_locked_gemfile(self, "$PROJECT_ROOT/Gemfile", groups: [:default], gems: ["$TEST_GEM"] + "$TEST_WITH_GEMS".split(/\s+/))
+$TEST_GEM_OVERRIDES
+EOM
+cat $TEST_GEMFILE >> $MODIFIED_TEST_GEMFILE
+if [ -f $TEST_GEMFILE.lock ]; then
+  cp $TEST_GEMFILE.lock $MODIFIED_TEST_GEMFILE.lock
+elif [ -f $MODIFIED_TEST_GEMFILE.lock ]; then
+  rm -f $MODIFIED_TEST_GEMFILE.lock
+fi
+
+# Run the bundle install
+cd $TEST_GEM_ROOT
+export BUNDLE_GEMFILE=$MODIFIED_TEST_GEMFILE
+# Don't read from the project .bundle/config, just our env vars
+export BUNDLE_IGNORE_CONFIG=true
+# Use the top level bundle cache so we don't have to reinstall their packages
+if [ -n "$PROJECT_BUNDLE_PATH" ]; then
+  export BUNDLE_PATH=$PROJECT_BUNDLE_PATH
+  export BUNDLE_DISABLE_SHARED_GEMS=1
+  export BUNDLE_NO_PRUNE=true
+fi
+export BUNDLE_FROZEN=
+bundle install
+export BUNDLE_FROZEN=true
+
+bundle config
+
+# Iterate through the remaining arguments as commands
+while test ${#} -gt 0; do
+  bundle exec $1
+  shift
+done
diff --git a/tasks/changelog.rb b/tasks/changelog.rb
new file mode 100644
index 00000000000..fda94764aeb
--- /dev/null
+++ b/tasks/changelog.rb
@@ -0,0 +1,12 @@
+begin
+  require "github_changelog_generator/task"
+
+  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
+    config.future_release = Chef::VERSION
+    config.enhancement_labels = "enhancement,Enhancement,New Feature,Feature".split(",")
+    config.bug_labels = "bug,Bug,Improvement,Upstream Bug".split(",")
+    config.exclude_labels = "duplicate,question,invalid,wontfix,no_changelog,Exclude From Changelog,Question,Discussion".split(",")
+  end
+rescue LoadError
+  puts "github_changelog_generator is not available. gem install github_changelog_generator to generate changelogs"
+end
diff --git a/tasks/dependencies.rb b/tasks/dependencies.rb
index 79556869636..b2eabffb098 100644
--- a/tasks/dependencies.rb
+++ b/tasks/dependencies.rb
@@ -111,10 +111,10 @@ def berksfile_lock_task(task_name, dirs: [])
       # Replace the bundler and rubygems versions
       OMNIBUS_RUBYGEMS_AT_LATEST_VERSION.each do |override_name, gem_name|
         # Get the latest bundler version
-        puts "Running gem list -re #{gem_name} ..."
-        gem_list = `gem list -re #{gem_name}`
+        puts "Running gem list -r #{gem_name} ..."
+        gem_list = `gem list -r #{gem_name}`
         unless gem_list =~ /^#{gem_name}\s*\(([^)]*)\)$/
-          raise "gem list -re #{gem_name} failed with output:\n#{gem_list}"
+          raise "gem list -r #{gem_name} failed with output:\n#{gem_list}"
         end
 
         # Emit it
@@ -141,6 +141,7 @@ def berksfile_lock_task(task_name, dirs: [])
   # Find out if we're using the latest gems we can (so we don't regress versions)
   desc "Check for gems that are not at the latest released version, and report if anything not in ACCEPTABLE_OUTDATED_GEMS (version_policy.rb) is out of date."
   task :check_outdated do
+    extend BundleUtil
     puts ""
     puts "-------------------------------------------------------------------"
     puts "Checking for outdated gems ..."
diff --git a/tasks/external_tests.rb b/tasks/external_tests.rb
deleted file mode 100644
index a909ec21787..00000000000
--- a/tasks/external_tests.rb
+++ /dev/null
@@ -1,64 +0,0 @@
-require "tempfile"
-require "bundler"
-
-CURRENT_GEM_NAME = "chef"
-CURRENT_GEM_PATH = File.expand_path("../..", __FILE__)
-
-def bundle_exec_with_chef(test_gem, commands)
-  gem_path = Bundler.environment.specs[test_gem].first.full_gem_path
-  gemfile_path = File.join(gem_path, "Gemfile.#{CURRENT_GEM_NAME}-external-test")
-  gemfile = File.open(gemfile_path, "w")
-  begin
-    IO.read(File.join(gem_path, "Gemfile")).each_line do |line|
-      if line =~ /^\s*gemspec/
-        next
-      elsif line =~ /^\s*gem '#{CURRENT_GEM_NAME}'|\s*gem "#{CURRENT_GEM_NAME}"/
-        next
-      elsif line =~ /^\s*dev_gem\s*['"](.+)['"]\s*$/
-        line = "gem '#{$1}', github: 'poise/#{$1}'"
-      elsif line =~ /\s*gem\s*['"]#{test_gem}['"]/ # foodcritic      end
-        next
-      end
-      gemfile.puts(line)
-    end
-    gemfile.puts("gem #{CURRENT_GEM_NAME.inspect}, path: #{CURRENT_GEM_PATH.inspect}")
-    gemfile.puts("gemspec path: #{gem_path.inspect}")
-    gemfile.close
-    Dir.chdir(gem_path) do
-      Bundler.with_clean_env do
-        unless system({ "BUNDLE_GEMFILE" => gemfile_path, "RUBYOPT" => nil, "GEMFILE_MOD" => nil }, "bundle update")
-          raise "Error running bundle update of #{gemfile_path} in #{gem_path}: #{$?.exitstatus}\nGemfile:\n#{IO.read(gemfile_path)}"
-        end
-        Array(commands).each do |command|
-          unless system({ "BUNDLE_GEMFILE" => gemfile_path, "RUBYOPT" => nil, "GEMFILE_MOD" => nil }, "bundle exec #{command}")
-            raise "Error running bundle exec #{command} in #{gem_path} with BUNDLE_GEMFILE=#{gemfile_path}: #{$?.exitstatus}\nGemfile:\n#{IO.read(gemfile_path)}"
-          end
-        end
-      end
-    end
-  ensure
-    File.delete(gemfile_path) if File.exist?(gemfile_path)
-  end
-end
-
-EXTERNAL_PROJECTS = {
-  "chef-zero"             => [ "rake spec", "rake cheffs" ],
-  "cheffish"              => "rake spec",
-  "chef-provisioning"     => "rake spec",
-  "chef-provisioning-aws" => "rake spec",
-  "chef-sugar"            => "rake",
-  "foodcritic"            => "rake test",
-  "chefspec"              => "rake",
-  "chef-rewind"           => "rake spec",
-  "poise"                 => "rake spec",
-  "halite"                => "rake spec",
-  "knife-windows"         => "rake unit_spec",
-}
-
-task :external_specs => EXTERNAL_PROJECTS.keys.map { |g| :"#{g.sub("-", "_")}_spec" }
-
-EXTERNAL_PROJECTS.each do |test_gem, commands|
-  task :"#{test_gem.tr("-", "_")}_spec" do
-    bundle_exec_with_chef(test_gem, commands)
-  end
-end
diff --git a/tasks/gemfile_util.rb b/tasks/gemfile_util.rb
index 60d1e2ff31e..96dfcd78a21 100644
--- a/tasks/gemfile_util.rb
+++ b/tasks/gemfile_util.rb
@@ -1,99 +1,218 @@
 require "bundler"
+require "set"
 
 module GemfileUtil
   #
-  # Given a set of dependencies with groups in them, and a resolved set of
-  # gemspecs (with dependency info in them), creates a full set of specs
-  # with group information on it. If A is in groups x and y, and A depends on
-  # B and C, then B and C are also in groups x and y.
+  # Adds `override: true`, which allows your statement to override any other
+  # gem statement about the same gem in the Gemfile.
   #
-  class GemGroups < Hash
-    def initialize(resolved)
-      @resolved = resolved
-    end
-    attr_reader :resolved
+  def gem(name, *args)
+    Bundler.ui.debug "gem #{name}, #{args.join(", ")}"
+    current_dep = dependencies.find { |dep| dep.name == name }
 
-    def add_dependency(dep)
-      add_gem_groups(dep.name, dep.groups)
+    # Set path to absolute in case this is an included Gemfile in bundler 1.11.2 and below
+    options = args[-1].is_a?(Hash) ? args[-1] : {}
+    if options[:path]
+      # path sourced gems are assumed to be overrides.
+      options[:override] = true
+      # options[:path] = File.expand_path(options[:path], Bundler.default_gemfile.dirname)
     end
-
-    private
-
-    def add_gem_groups(name, groups)
-      self[name] ||= []
-      difference = groups - self[name]
-      unless difference.empty?
-        self[name] += difference
-        spec = resolved.find { |spec| spec.name == name }
-        if spec
-          spec.dependencies.each do |spec|
-            add_gem_groups(spec.name, difference)
-          end
+    # Handle override
+    if options[:override]
+      override = true
+      options.delete(:override)
+      if current_dep
+        dependencies.delete(current_dep)
+      end
+    else
+      # If an override gem already exists, and we're not an override gem,
+      # ignore this gem in favor of the override (but warn if they don't match)
+      if overridden_gems.include?(name)
+        args.pop if args[-1].is_a?(Hash)
+        version = args || [">=0"]
+        desired_dep = Bundler::Dependency.new(name, version, options.dup)
+        if desired_dep =~ current_dep
+          Bundler.ui.debug "Replaced Gemfile dependency #{desired_dep} (#{desired_dep.source}) with override gem #{current_dep} (#{current_dep.source})"
+        else
+          Bundler.ui.warn "Replaced Gemfile dependency #{desired_dep} (#{desired_dep.source}) with incompatible override gem #{current_dep} (#{current_dep.source})"
         end
+        return
       end
     end
+
+    # Add the gem normally
+    super
+
+    overridden_gems << name if override
+
+    # Emit a warning if we're replacing a dep that doesn't match
+    if current_dep && override
+      added_dep = dependencies.find { |dep| dep.name == name }
+      if added_dep =~ current_dep
+        Bundler.ui.debug "Replaced Gemfile dependency #{current_dep} (#{current_dep.source}) with override gem #{added_dep} (#{added_dep.source})"
+      else
+        Bundler.ui.warn "Replaced Gemfile dependency #{current_dep} (#{current_dep.source}) with incompatible override gem #{added_dep} (#{added_dep.source})"
+      end
+    end
+  end
+
+  def overridden_gems
+    @overridden_gems ||= Set.new
   end
 
-  def calculate_dependents(spec_set)
-    dependents = {}
-    spec_set.each do |spec|
-      dependents[spec] ||= []
+  #
+  # Include all gems in the locked gemfile.
+  #
+  # @param gemfile Path to the Gemfile to load (relative to your Gemfile)
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #               to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #                       the results if all groups they belong to are ignored.
+  #                       This matches bundler's `without` behavior.
+  # @param gems A list of gems to include above and beyond the given groups.
+  #             Gems in this list must be explicitly included in the Gemfile
+  #             with a `gem "gem_name", ...` line or they will be silently
+  #             ignored.
+  #
+  def include_locked_gemfile(gemfile, groups: nil, without_groups: nil, gems: [])
+    gemfile = File.expand_path(gemfile, Bundler.default_gemfile.dirname)
+    gems = Set.new(gems) + GemfileUtil.select_gems(gemfile, groups: nil, without_groups: nil)
+    specs = GemfileUtil.locked_gems("#{gemfile}.lock", gems)
+    specs.each do |name, version: nil, **options|
+      options = options.merge(override: true)
+      Bundler.ui.debug("Adding gem #{name}, #{version}, #{options} from #{gemfile}")
+      gem name, version, options
     end
-    spec_set.each do |spec|
-      spec.dependencies.each do |dep|
-        puts "#{dep.class} -> #{spec.class}"
-        dependents[dep] << spec
-      end
+  rescue
+    puts "ERROR: #{$!}"
+    puts $!.backtrace
+    raise
+  end
+
+  #
+  # Include all gems in the locked gemfile.
+  #
+  # @param current_gemfile The Gemfile you are currently loading (`self`).
+  # @param gemfile Path to the Gemfile to load (relative to your Gemfile)
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #               to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #                       the results if all groups they belong to are ignored.
+  #                       This matches bundler's `without` behavior.
+  # @param gems A list of gems to include above and beyond the given groups.
+  #             Gems in this list must be explicitly included in the Gemfile
+  #             with a `gem "gem_name", ...` line or they will be silently
+  #             ignored.
+  #
+  def self.include_locked_gemfile(current_gemfile, gemfile, groups: nil, without_groups: nil, gems: [])
+    current_gemfile.instance_eval do
+      extend GemfileUtil
+      include_locked_gemfile(gemfile, groups: groups, without_groups: without_groups, gems: [])
     end
-    dependents
   end
 
-  def include_locked_gemfile(gemfile)
-    #
-    # Read the gemfile and inject its locks as first-class dependencies
-    #
-    current_source = nil
-    bundle = Bundler::Definition.build(gemfile, "#{gemfile}.lock", nil)
-
-    # Go through and create the actual gemfile from the given locks and
-    # groups.
-    bundle.resolve.sort_by { |spec| spec.name }.each do |spec|
-      # bundler can't be installed by bundler so don't pin it.
-      next if spec.name == "bundler"
-      dep = bundle.dependencies.find { |d| d.name == spec.name }
-      gem_metadata = ""
-      if dep
-        gem_metadata << ", groups: #{dep.groups.inspect}" if dep.groups != [:default]
-        gem_metadata << ", platforms: #{dep.platforms.inspect}" if dep.platforms && !dep.platforms.empty?
+  #
+  # Select the desired gems, sans dependencies, from the gemfile.
+  #
+  # @param gemfile Path to the Gemfile to load
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #               to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #                       the results if all groups they belong to are ignored.
+  #                       This matches bundler's `without` behavior.
+  #
+  # @return An array of strings with the names of the given gems.
+  #
+  def self.select_gems(gemfile, groups: nil, without_groups: nil)
+    Bundler.with_clean_env do
+      # Set BUNDLE_GEMFILE to the new gemfile temporarily so all bundler's things work
+      # This works around some issues in bundler 1.11.2.
+      ENV["BUNDLE_GEMFILE"] = gemfile
+
+      parsed_gemfile = Bundler::Dsl.new
+      parsed_gemfile.eval_gemfile(gemfile)
+      deps = parsed_gemfile.dependencies.select do |dep|
+        dep_groups = dep.groups
+        dep_groups = dep_groups & groups if groups
+        dep_groups = dep_groups - without_groups if without_groups
+        dep_groups.any?
       end
-      case spec.source
-      when Bundler::Source::Rubygems
-        if current_source
-          if current_source != spec.source
-            raise "Gem #{spec.name} has source #{spec.source}, but other gems have #{current_source}. Multiple rubygems sources are not supported."
+      deps.map { |dep| dep.name }
+    end
+  end
+
+  #
+  # Get all gems in the locked gemfile that start from the given gem set.
+  #
+  # @param lockfile Path to the Gemfile to load
+  # @param groups A list of groups to include (whitelist). If not passed (or set
+  #               to nil), all gems will be selected.
+  # @param without_groups A list of groups to ignore. Gems will be excluded from
+  #                       the results if all groups they belong to are ignored.
+  #                       This matches bundler's `without` behavior.
+  # @param gems A list of gems to include above and beyond the given groups.
+  #             Gems in this list must be explicitly included in the Gemfile
+  #             with a `gem "gem_name", ...` line or they will be silently
+  #             ignored.
+  # @param include_development_deps Whether to include development dependencies
+  #                                 or runtime only.
+  #
+  # @return Hash[String, Hash] A hash from gem_name ->  { version: <version>, source: <source>, git: <git>, path: <path>, ref: <ref> }
+  #
+  def self.locked_gems(lockfile, gems, include_development_deps: false)
+    # Grab all the specs from the lockfile
+    parsed_lockfile = Bundler::LockfileParser.new(IO.read(lockfile))
+    specs = {}
+    parsed_lockfile.specs.each { |s| specs[s.name] = s }
+
+    # Select the desired gems, as well as their dependencies
+    to_process = Array(gems)
+    results = {}
+    while to_process.any?
+      gem_name = to_process.pop
+      next if gem_name == "bundler" # can't be bundled. Messes things up. Stop it.
+      # Only process each gem once
+      unless results.has_key?(gem_name)
+        spec = specs[gem_name]
+        unless spec
+          raise "Gem #{gem_name.inspect} was requested but was not in #{lockfile}! Gems in lockfile: #{specs.keys}"
+        end
+        results[gem_name] = gem_metadata(spec, lockfile)
+        spec.dependencies.each do |dep|
+          if dep.type == :runtime || include_development_deps
+            to_process << dep.name
           end
-        else
-          current_source = spec.source
-          add_gemfile_line("source #{spec.source.remotes.first.to_s.inspect}", __LINE__)
         end
-        add_gemfile_line("gem #{spec.name.inspect}, #{spec.version.to_s.inspect}#{gem_metadata}", __LINE__)
-      when Bundler::Source::Git
-        add_gemfile_line("gem #{spec.name.inspect}, git: #{spec.source.uri.to_s.inspect}, ref: #{spec.source.revision.inspect}#{gem_metadata}", __LINE__)
-      when Bundler::Source::Path
-        add_gemfile_line("gem #{spec.name.inspect}, path: #{spec.source.path.to_s.inspect}#{gem_metadata}", __LINE__)
-      else
-        raise "Unknown source #{spec.source} for gem #{spec.name}"
       end
     end
-  rescue
-    puts $!
-    puts $!.backtrace
-    raise
+
+    results
   end
 
   private
 
-  def add_gemfile_line(line, lineno)
-    instance_eval(line, __FILE__, lineno)
+  #
+  # Get metadata for the given Bundler spec (coming from a lockfile).
+  #
+  # @return Hash { version: <version>, git: <git>, path: <path>, source: <source>, ref: <ref> }
+  #
+  def self.gem_metadata(spec, lockfile)
+    # Copy source information from included Gemfile
+    result = {}
+    case spec.source
+    when Bundler::Source::Rubygems
+      result[:source] = spec.source.remotes.first.to_s
+      result[:version] = spec.version.to_s
+    when Bundler::Source::Git
+      result[:git] = spec.source.uri.to_s
+      result[:ref] = spec.source.revision
+    when Bundler::Source::Path
+      # Path is relative to the lockfile (if it's relative at all)
+      result[:path] = File.expand_path(spec.source.path.to_s, File.dirname(lockfile))
+    else
+      raise "Unknown source #{spec.source} for gem #{spec.name}"
+    end
+    result
   end
+
 end
diff --git a/tasks/maintainers.rb b/tasks/maintainers.rb
index 535edda2485..91742854bb2 100644
--- a/tasks/maintainers.rb
+++ b/tasks/maintainers.rb
@@ -31,9 +31,10 @@
   require "tomlrb"
   require "octokit"
   require "pp"
-  task :default => :generate
 
   namespace :maintainers do
+    task :default => :generate
+
     desc "Generate MarkDown version of MAINTAINERS file"
     task :generate do
       out = "<!-- This is a generated file. Please do not edit directly -->\n\n"