Protect your gear from the trapdoor licensing in chef .

free.chef.diff

diff --git a/cust-cookbooks/all-datacenter-attributes/attributes/yum-lock.rb b/cust-cookbooks/all-datacenter-attributes/attributes/y\
um-lock.rb
new file mode 100644
index 0000000..30ae81a
--- /dev/null
+++ b/cust-cookbooks/all-datacenter-attributes/attributes/yum-lock.rb
@@ -0,0 +1,25 @@
+#
+# Cookbook Name:: all-datacenter-attributes
+# Recipe:: yum-lock
+#
+
+node
+  .run_state
+  .deep_merge!({ 'all-base' => {
+                   'yum-lock' => {
+
+                     '0:chef-14.12.9-1.el6.*' => ['platform_version:/^6/'],     # the last free chef
+                     '0:chef-14.11.21-1.el7.*' => ['platform_version:/^(7|8)/'], # the last free chef
+                     '0:chef-13.6.4-1.el5.*' => ['platform_version:/^5/'],      # the last free chef
+                     '0:chefdk-3.10.1-1.el7.*' => ['platform_version:/^(7|8)/'], # the last free chefdk
+
+                   }
+                     .tap{|x| Chef::Log.info "all-datacenter-attributes==yum-lock - candidate :#{x}:"}
+                     .select{|k,v| [*v].any?{|f| eval(f.split(':')[1]).match?( (node.read(f.split(':')[0])||'') ) }}
+                     .keys
+                     .inject([]){|config, x| config << x}      # looks better in original Klingon/hash
+                 }}
+                 .tap{|x| Chef::Log.info "all-datacenter-attributes==yum-lock - selected :#{x}:"}
+               )
diff --git a/cust-cookbooks/lin-base/recipes/yum-lock.rb b/cust-cookbooks/lin-base/recipes/yum-lock.rb
new file mode 100644
index 0000000..5cb6f04
--- /dev/null
+++ b/cust-cookbooks/lin-base/recipes/yum-lock.rb
@@ -0,0 +1,13 @@
+#
+# Cookbook Name:: lin-base
+# Recipe:: yum-lock
+#
+
+package case node['platform_version']
+        when /^5/; then %w(yum-versionlock)
+        else %w(yum-plugin-versionlock)
+        end
+
+file '/etc/yum/pluginconf.d/versionlock.list' do
+  content      (node.run_state.dig('all-base', 'yum-lock') || []).join('\n')
+end

Let me know if you don't have a good ::Hash.deep_merge!() . Mine sucks, but it's (apparently) serviceable.