chef 18.10.17 → 18.11.11

data/lib/chef/provider/package/dnf/python_helper.rb

@@ -1,5 +1,8 @@
+#!/usr/bin/env python3
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Copyright:: Copyright (c) 2026 Meta Platforms, Inc.
+# Copyright:: Copyright (c) 2026 Phil Dibowitz
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -41,10 +44,10 @@ class Chef
 
           def dnf_command
             # platform-python is used for system tools on RHEL 8 and is installed under /usr/libexec
+            py_cmd = "try:\n    import libdnf5\nexcept ImportError:\n    import dnf"
             @dnf_command ||= begin
-                               cmd = which("platform-python", "python", "python3", "python2", "python2.7", extra_path: "/usr/libexec") do |f|
-                                 shell_out("#{f} -c 'import dnf'").exitstatus == 0
-                               end
+                               executables = where("platform-python", "python", "python3", "python2", "python2.7", extra_path: "/usr/libexec")
+                               cmd = executables.find { |f| shell_out("#{f} -c '#{py_cmd}'").exitstatus == 0 }
                                raise Chef::Exceptions::Package, "cannot find dnf libraries, you may need to use yum_package" unless cmd
 
                                "#{cmd} #{DNF_HELPER}"

data/lib/chef/provider/package/dnf.rb

@@ -1,5 +1,7 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Copyright:: Copyright (c) 2026 Meta Platforms, Inc.
+# Copyright:: Copyright (c) 2026 Phil Dibowitz
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -62,6 +64,13 @@ class Chef
           @python_helper ||= PythonHelper.instance
         end
 
+        def dnf5?
+          @dnf5 ||= begin
+            dnf_version = shell_out!("dnf --version").stdout
+            dnf_version =~ /dnf5/i
+          end
+        end
+
         def load_current_resource
           flushcache if new_resource.flush_cache[:before]
 
@@ -138,14 +147,19 @@ class Chef
         # NB: the dnf_package provider manages individual single packages, please do not submit issues or PRs to try to add wildcard
         # support to lock / unlock.  The best solution is to write an execute resource which does a not_if `dnf versionlock | grep '^pattern`` kind of approach
         def lock_package(names, versions)
-          dnf("-d0", "-e0", "-y", options, "versionlock", "add", resolved_package_lock_names(names))
+          default_opts = dnf5? ? [] : %w{-d0 -e0}
+          dnf(default_opts, options, "versionlock", "add", resolved_package_lock_names(names))
         end
 
         # NB: the dnf_package provider manages individual single packages, please do not submit issues or PRs to try to add wildcard
         # support to lock / unlock.  The best solution is to write an execute resource which does a only_if `dnf versionlock | grep '^pattern`` kind of approach
         def unlock_package(names, versions)
-          # dnf versionlock delete on rhel6 needs the glob nonsense in the following command
-          dnf("-d0", "-e0", "-y", options, "versionlock", "delete", resolved_package_lock_names(names).map { |n| "*:#{n}-*" })
+          if dnf5?
+            dnf("-y", options, "versionlock", "delete", resolved_package_lock_names(names))
+          else
+            # dnf versionlock delete on rhel6 needs the glob nonsense in the following command
+            dnf("-d0", "-e0", "-y", options, "versionlock", "delete", resolved_package_lock_names(names).map { |n| "*:#{n}-*" })
+          end
         end
 
         private
@@ -167,8 +181,13 @@ class Chef
           @locked_packages ||=
             begin
               locked = dnf("versionlock", "list")
-              locked.stdout.each_line.map do |line|
-                line.sub(/-[^-]*-[^-]*$/, "").split(":").last.strip
+              if dnf5?
+                locked.stdout.each_line.select { |x| x.start_with?("Package name:") }
+                  .map { |line| line.split(": ").last.strip }
+              else
+                locked.stdout.each_line.map do |line|
+                  line.sub(/-[^-]*-[^-]*$/, "").split(":").last.strip
+                end
               end
             end
         end

data/lib/chef/provider/package/yum.rb

@@ -38,7 +38,7 @@ class Chef
         use_package_name_for_source
         use_magic_version
 
-        provides :package, platform_family: "fedora_derived"
+        provides :package, platform_family: %w{fedora rhel amazon}
 
         provides :yum_package
 

data/lib/chef/resource/_rest_resource.rb

@@ -174,13 +174,15 @@ action_class do
   end
 
   def rest_url_collection
-    current_resource.class.rest_api_collection
+    endpoint = current_resource.class.rest_api_endpoint || ""
+    "#{endpoint}#{current_resource.class.rest_api_collection}"
   end
 
   # Resource document URL after RFC 6570 template evaluation via properties substitution
   def rest_url_document
+    endpoint = current_resource.class.rest_api_endpoint || ""
     template = ::Addressable::Template.new(current_resource.class.rest_api_document)
-    template.expand(property_map).to_s
+    "#{endpoint}#{template.expand(property_map)}"
   end
 
   # Convenience method for conditional requires

data/lib/chef/resource/archive_file.rb

@@ -172,9 +172,16 @@ class Chef
 
         if new_resource.owner || new_resource.group
           converge_by("set owner of files extracted in #{new_resource.destination} to #{new_resource.owner}:#{new_resource.group}") do
-            archive = Archive::Reader.open_filename(new_resource.path, nil, strip_components: new_resource.strip_components)
-            archive.each_entry do |e|
-              FileUtils.chown(new_resource.owner, new_resource.group, "#{new_resource.destination}/#{e.pathname}")
+            dest_realpath = ::File.expand_path(new_resource.destination)
+            Archive::Reader.open_filename(new_resource.path, nil, strip_components: new_resource.strip_components) do |archive|
+              archive.each_entry do |e|
+                # Validate path is within destination before chown-ing.
+                # Use expand_path for security check, original string for the chown call.
+                chown_path_expanded = ::File.expand_path("#{new_resource.destination}/#{e.pathname}")
+                next unless chown_path_expanded.start_with?(dest_realpath + ::File::SEPARATOR) || chown_path_expanded == dest_realpath
+
+                FileUtils.chown(new_resource.owner, new_resource.group, "#{new_resource.destination}/#{e.pathname}")
+              end
             end
           end
         end
@@ -211,16 +218,23 @@ class Chef
         # @return [Boolean]
         def archive_differs_from_disk?(src, dest)
           modified = false
-          archive = Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components)
+          dest_realpath = ::File.expand_path(dest)
           Chef::Log.trace("Beginning the comparison of file mtime between contents of #{src} and #{dest}")
-          archive.each_entry do |e|
-            pathname = ::File.expand_path(e.pathname, dest)
-            if ::File.exist?(pathname)
-              Chef::Log.trace("#{pathname} mtime is #{::File.mtime(pathname)} and archive is #{e.mtime}")
-              modified = true unless ::File.mtime(pathname) == e.mtime
-            else
-              Chef::Log.trace("#{pathname} doesn't exist on disk, but exists in the archive")
-              modified = true
+          Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
+            archive.each_entry do |e|
+              pathname = ::File.expand_path(e.pathname, dest_realpath)
+              # Skip archive entries that resolve outside the destination directory.
+              # A traversal entry (e.g. "../escaped") must not influence the mtime
+              # comparison and must never trigger extraction.
+              next unless pathname.start_with?(dest_realpath + ::File::SEPARATOR) || pathname == dest_realpath
+
+              if ::File.exist?(pathname)
+                Chef::Log.trace("#{pathname} mtime is #{::File.mtime(pathname)} and archive is #{e.mtime}")
+                modified = true unless ::File.mtime(pathname) == e.mtime
+              else
+                Chef::Log.trace("#{pathname} doesn't exist on disk, but exists in the archive")
+                modified = true
+              end
             end
           end
           modified
@@ -235,15 +249,35 @@ class Chef
         # @return [void]
         def extract(src, dest, options = [])
           converge_by("extract #{src} to #{dest}") do
-            flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|)
+            user_flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|).to_i
+            # Always apply libarchive security flags to prevent path traversal.
+            # These are not user-overridable hence directly added here
+            # instead of options array. NODOTDOT blocks "../" sequences,
+            # NOABSOLUTEPATHS blocks absolute-path entries, SECURE_SYMLINKS prevents
+            # symlink attacks. Combined with the check below in archive.each_entry
+            # they safeguard against Zip Slip / CWE-22 attacks.
+            security_flags = Archive::EXTRACT_SECURE_NODOTDOT |
+              Archive::EXTRACT_SECURE_NOABSOLUTEPATHS |
+              Archive::EXTRACT_SECURE_SYMLINKS
+            all_flags = user_flags | security_flags
+            dest_realpath = ::File.expand_path(dest)
 
             Dir.chdir(dest) do
-              archive = Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components)
-
-              archive.each_entry do |e|
-                archive.extract(e, flags.to_i)
+              Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
+                archive.each_entry do |e|
+                  # reject any entry whose resolved path
+                  # falls outside the destination directory before calling into libarchive.
+                  entry_realpath = ::File.expand_path(e.pathname, dest_realpath)
+                  unless entry_realpath.start_with?(dest_realpath + ::File::SEPARATOR) || entry_realpath == dest_realpath
+                    raise Chef::Exceptions::ValidationFailed,
+                      "Refusing to extract archive entry #{e.pathname.inspect}: resolved path " \
+                      "#{entry_realpath.inspect} is outside destination #{dest_realpath.inspect}. " \
+                      "This archive may contain a path traversal attack."
+                  end
+
+                  archive.extract(e, all_flags)
+                end
               end
-              archive.close
             end
           end
         end

data/lib/chef/resource/chef_client_config.rb

@@ -23,6 +23,14 @@ class Chef
 
       provides :chef_client_config
 
+      DIRECTORY_SPEC_DEFAULTS = {
+        config: { mode: "0750", inherits: :auto },
+        client_d: { mode: "0750", inherits: :auto },
+        logs: { mode: "0755", inherits: :auto },
+        cache: { mode: "0750", inherits: :auto },
+        backups: { mode: "0750", inherits: :auto },
+      }.freeze
+
       description "Use the **chef_client_config** resource to create a client.rb file in the #{ChefUtils::Dist::Infra::PRODUCT} configuration directory. See the [client.rb docs](https://docs.chef.io/config_rb_client/) for more details on options available in the client.rb configuration file."
       introduced "16.6"
       examples <<~DOC
@@ -76,12 +84,12 @@ class Chef
           chef_server_url 'https://chef.example.dmz'
           report_handlers [
             {
-             'class' => 'ReportHandler1Class',
-             'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+              'class' => 'ReportHandler1Class',
+              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
             },
             {
-             'class' => 'ReportHandler2Class',
-             'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+              'class' => 'ReportHandler2Class',
+              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
             },
           ]
         end
@@ -96,6 +104,48 @@ class Chef
           data_collector_token 'TEST_TOKEN_TEST'
         end
         ```
+
+        **Set Linux directory ownership and modes**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          user 'root'
+          group 'root'
+          file_cache_path '/var/chef/cache'
+          file_backup_path '/var/chef/backups'
+          log_location '/var/log/chef/client.log'
+          directory_specs(
+            config: { owner: 'root', group: 'root', mode: '0700' },
+            client_d: { owner: 'root', group: 'root', mode: '0700' },
+            logs: { owner: 'root', group: 'root', mode: '0750' },
+            cache: { owner: 'root', group: 'root', mode: '0750' },
+            backups: { owner: 'root', group: 'root', mode: '0750' }
+          )
+        end
+        ```
+
+        **Set Windows directory inheritance and rights**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          config_directory 'C:/chef'
+          file_cache_path 'C:/chef/cache'
+          file_backup_path 'C:/chef/backups'
+          log_location 'C:/chef/log/client.log'
+          directory_specs(
+            config: {
+              owner: 'Administrators',
+              inherits: false,
+              rights: {
+                'Administrators' => :full_control,
+                'SYSTEM' => :full_control,
+              },
+            }
+          )
+        end
+        ```
       DOC
 
       # @todo policy_file or policy_group being set requires the other to be set so enforce that.
@@ -254,21 +304,83 @@ class Chef
         description: "The data collector token to interact with the data collector server URL (Automate). Note: If possible, use Chef Infra Server to do all data collection reporting, as this removes the need to distribute tokens to individual nodes.",
         introduced: "17.8"
 
+      property :directory_specs, Hash,
+        description: <<~DESC,
+          Permission overrides for Chef-managed directories.
+          This must be a hash of hashes: top-level keys are directory names, values are per-directory option hashes.
+
+          Use this property like:
+            directory_specs(
+              config: { owner: "root", group: "root", mode: "0700" },
+              client_d: { owner: "root", group: "root", mode: "0700" },
+              logs: { owner: "root", group: "root", mode: "0700" },
+              cache: { owner: "root", group: "root", mode: "0700" },
+              backups: { owner: "root", group: "root", mode: "0700" }
+            )
+
+          Directory keys: :config, :client_d, :logs, :cache, :backups
+          Override keys: :owner, :group, :mode, :rights, :inherits (:rights and :inherits are Windows-only)
+        DESC
+        callbacks: {
+          "keys must be one of :config, :client_d, :logs, :cache, :backups" => lambda { |v|
+            valid_keys = %i{config client_d logs cache backups}
+            v.keys.all? { |k| valid_keys.include?(k) }
+          },
+          "values must be a hash with keys only from :owner, :group, :mode, :rights, :inherits" => lambda { |v|
+            valid_inner_keys = %i{owner group mode rights inherits}
+            v.values.all? { |value| value.is_a?(Hash) && value.keys.all? { |k| valid_inner_keys.include?(k) } }
+          },
+        },
+        default: DIRECTORY_SPEC_DEFAULTS,
+        coerce: proc { |v|
+          DIRECTORY_SPEC_DEFAULTS.merge(v) do |_key, base, override|
+            override.is_a?(Hash) ? base.merge(override) : override
+          end
+        }
+
+      property :client_rb_mode, String,
+        description: "The mode to set on the client.rb file that is written out by this resource (e.g., 0600).",
+        default: "0640"
+
       action :create, description: "Create a client.rb config file and folders for configuring #{ChefUtils::Dist::Infra::PRODUCT}." do
-        [
-          new_resource.config_directory,
-          (::File.dirname(new_resource.log_location) if new_resource.log_location.is_a?(String) && !%w{STDOUT STDERR}.include?(new_resource.log_location) && !new_resource.log_location.empty?),
-          new_resource.file_backup_path,
-          new_resource.file_cache_path,
-          ::File.join(new_resource.config_directory, "client.d"),
-          (::File.dirname(new_resource.pid_file) unless new_resource.pid_file.nil?),
-        ].compact.each do |dir_path|
-
-          directory dir_path do
-            user new_resource.user unless new_resource.user.nil?
-            group new_resource.group unless new_resource.group.nil?
-            mode dir_path == ::File.dirname(new_resource.log_location.to_s) ? "0755" : "0750"
-            recursive true
+        # The logs directory is derived from log_location, which may be a symbol
+        # or a stream name (STDOUT/STDERR) rather than a file path. Only raise if
+        # the user customized logs specs but log_location is not a usable file path.
+        if new_resource.directory_specs[:logs] != DIRECTORY_SPEC_DEFAULTS[:logs] && log_directory.nil?
+          raise ArgumentError, "Invalid directory_specs: logs requires :logs (file path)"
+        end
+
+        # Build path map for each managed directory. For cache and backups, fall
+        # back to ChefConfig defaults when not explicitly set so that directory_specs
+        # overrides are applied even if the user didn't configure a custom path in client.rb.
+        spec_paths = {
+          config: new_resource.config_directory,
+          client_d: ::File.join(new_resource.config_directory, "client.d"),
+          logs: log_directory,
+          cache: new_resource.file_cache_path || ChefConfig::Config.file_cache_path,
+          backups: new_resource.file_backup_path || ChefConfig::Config.file_backup_path,
+        }
+
+        # Build directory specs based on user input and defaults
+        specs = {}
+        new_resource.directory_specs.each do |key, overrides|
+          path = spec_paths[key]
+          next if path.nil?
+
+          specs[key] = DirectorySpec.new(
+            path: path,
+            owner: overrides[:owner] || new_resource.user,
+            group: overrides[:group] || new_resource.group,
+            mode: overrides[:mode],
+            rights: overrides[:rights],
+            inherits: overrides[:inherits]
+          )
+        end
+
+        # Converge directories
+        specs.each_value do |spec|
+          directory spec.path do
+            spec.apply(self)
           end
         end
 
@@ -309,7 +421,7 @@ class Chef
             data_collector_server_url: new_resource.data_collector_server_url,
             data_collector_token: new_resource.data_collector_token
           )
-          mode "0640"
+          mode new_resource.client_rb_mode
           action :create
         end
       end
@@ -333,6 +445,60 @@ class Chef
             "#{handler["class"]}.new(#{handler["arguments"].join(",")})"
           end
         end
+
+        # A helper class to encapsulate directory spec data and application logic for both *nix and Windows.
+        # This allows us to keep the logic for how to apply permissions to directories in one place and makes it easier to test.
+        class DirectorySpec
+          attr_reader :path, :owner, :group, :mode, :rights, :inherits
+
+          def initialize(path:, owner: nil, group: nil, mode: nil, rights: nil, inherits: :auto)
+            @path   = path
+            @owner  = owner
+            @group  = group
+            @mode   = mode
+            @rights = rights
+            @inherits = inherits
+          end
+
+          def windows?
+            Chef::Platform.windows?
+          end
+
+          def apply(resource)
+            resource.recursive true
+
+            if windows?
+              if rights && !rights.empty?
+                resource.inherits(inherits == :auto ? false : inherits)
+
+                rights.each do |principal, permission|
+                  resource.rights(permission, principal)
+                end
+              else
+                # Ensure defaults can restore inherited ACL behavior after custom rights were applied.
+                resource.inherits(inherits == :auto ? true : inherits)
+                resource.mode(mode) if mode
+              end
+
+              resource.owner(owner) if owner
+            else
+              resource.owner(owner) if owner
+              resource.group(group) if group
+              resource.mode(mode) if mode
+            end
+          end
+        end
+
+        # A helper method to determine the directory to apply log permissions to based on the log_location property.
+        # If log_location is a file path, this returns the directory containing that file.
+        # If log_location is not a file path (e.g., it's a symbol for syslog or win_evt, or it's STDOUT/STDERR),
+        # this returns nil since there is no directory to apply permissions to.
+        def log_directory
+          return unless new_resource.log_location.is_a?(String)
+          return if %w{STDOUT STDERR}.include?(new_resource.log_location)
+
+          ::File.dirname(new_resource.log_location)
+        end
       end
     end
   end

data/lib/chef/resource/chef_vault_secret.rb

@@ -65,7 +65,7 @@ class Chef
       property :search, String, default: "*:*", desired_state: false,
         description: "Search query that would match the same used for the clients, gets stored as a field in the item."
 
-      property :raw_data, [Hash, Mash], default: {},
+      property :raw_data, [Hash, Mash], default: {}, sensitive: true,
         description: "The raw data, as a Ruby Hash, that will be stored in the item."
 
       property :environment, [String, NilClass], desired_state: false,

data/lib/chef/resource/chocolatey_installer.rb

@@ -1,3 +1,6 @@
+require "cgi" unless defined?(CGI)
+require "uri" unless defined?(URI)
+
 class Chef
   class Resource
     class ChocolateyInstaller < Chef::Resource
@@ -70,7 +73,7 @@ class Chef
       property :proxy_user, String,
         description: "The username to use to build a proxy credential with. Will be consumed by the proxy_credential property if both this property and proxy_password are set"
 
-      property :proxy_password, String,
+      property :proxy_password, String, sensitive: true,
         description: "The password to use to build a proxy credential with. Will be consumed by the proxy_credential property if both this property and proxy_user are set"
 
       load_current_value do
@@ -91,6 +94,25 @@ class Chef
         Gem::Version.new(get_choco_version)
       end
 
+      def download_url_path
+        return download_url if download_url.match?(%r{^[a-zA-Z]:[\\/]}) || download_url.start_with?("\\\\")
+
+        ::URI.parse(download_url).path
+      rescue URI::InvalidURIError
+        download_url
+      end
+
+      def download_url_script?
+        ::File.extname(download_url_path).casecmp(".ps1") == 0
+      end
+
+      def download_destination
+        filename = ::File.basename(::CGI.unescape(download_url_path.to_s))
+        filename = "chocolatey.nupkg" if filename.empty? || ["/", "\\", "."].include?(filename)
+
+        Chef::Util::PathHelper.join(ChefConfig::Config.etc_chef_dir(windows: true), filename)
+      end
+
       def define_resource_requirements
         requirements.assert(:install, :upgrade).each do |a|
           a.assertion do
@@ -133,16 +155,14 @@ class Chef
           if new_resource.download_url
             Chef::Log.info("Using custom download URL for Chocolatey installation: #{new_resource.download_url}")
             # If it's a PowerShell script, execute it directly (original behavior)
-            if new_resource.download_url.downcase.end_with?(".ps1")
+            if download_url_script?
               powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('#{new_resource.download_url}'))").error!
             else
               # Assume it's a direct link to a nupkg or other file and handle accordingly
-              chef_dir = ChefConfig::Config.etc_chef_dir(windows: true)
+              destination = download_destination
 
-              # Let PowerShell handle the filename - it will use the server's suggested filename
-              # from Content-Disposition header, or fall back to the URL path
-              powershell_exec("Invoke-WebRequest '#{new_resource.download_url}' -OutFile '#{chef_dir}'").error!
-              Chef::Log.info("Downloaded file from #{new_resource.download_url} to #{chef_dir}")
+              powershell_exec("Invoke-WebRequest '#{new_resource.download_url}' -OutFile '#{destination}'").error!
+              Chef::Log.info("Downloaded file from #{new_resource.download_url} to #{destination}")
             end
           else
             powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))").error!
@@ -151,11 +171,9 @@ class Chef
       end
 
       action :upgrade, description: "Upgrades the Chocolatey package manager" do
-        if new_resource.chocolatey_version
-          proposed_version = Gem::Version.new(new_resource.chocolatey_version)
-        else
-          proposed_version = nil
-        end
+        proposed_version = if new_resource.chocolatey_version
+                             Gem::Version.new(new_resource.chocolatey_version)
+                           end
 
         if new_resource.download_url
           powershell_exec("Set-Item -path env:ChocolateyDownloadUrl -Value #{new_resource.download_url}")
@@ -193,7 +211,7 @@ class Chef
       end
 
       action :uninstall, description: "Uninstall Chocolatey package manager" do
-        path = "c:\\programdata\\chocolatey\\bin"
+        path = 'c:\\programdata\\chocolatey\\bin'
         if File.exists?(path)
           converge_by("Uninstall Choco") do
             powershell_code = <<~CODE

data/lib/chef/resource/chocolatey_package.rb

@@ -59,7 +59,7 @@ class Chef
         introduced: "15.3",
         description: "The username to authenticate feeds."
 
-      property :password, String,
+      property :password, String, sensitive: true,
         introduced: "15.3",
         description: "The password to authenticate to the source."
 

data/lib/chef/resource/habitat/habitat_package.rb

@@ -106,7 +106,7 @@ class Chef
       property :channel, String, default: "stable",
         description: "The release channel to install your package from."
 
-      property :auth_token, String,
+      property :auth_token, String, sensitive: true,
         description: "Auth token for installing a package from a private organization on Habitat builder."
 
       property :binlink, [true, false, :force], default: false,

data/lib/chef/resource/habitat/habitat_sup.rb

@@ -129,10 +129,10 @@ class Chef
       property :auto_update, [true, false], default: false,
         description: "Passes `--auto-update`. This will set the Habitat supervisor to automatically update itself any time a stable version has been released."
 
-      property :auth_token, String,
+      property :auth_token, String, sensitive: true,
         description: "Auth token for accessing a private organization on bldr. This value is templated into the appropriate service file."
 
-      property :gateway_auth_token, String,
+      property :gateway_auth_token, String, sensitive: true,
         description: "Auth token for accessing the supervisor's HTTP gateway. This value is templated into the appropriate service file."
 
       property :update_condition, String,

data/lib/chef/resource/habitat_config.rb

@@ -53,7 +53,7 @@ class Chef
       property :remote_sup_http, String, default: "127.0.0.1:9631", desired_state: false,
         description: "Address for remote supervisor http port. Used to pull existing."
 
-      property :gateway_auth_token, String, desired_state: false,
+      property :gateway_auth_token, String, sensitive: true, desired_state: false,
         description: "Auth token for accessing the remote supervisor's http port."
 
       property :user, String, desired_state: false,

data/lib/chef/resource/habitat_service.rb

@@ -118,7 +118,7 @@ class Chef
       property :remote_sup_http, String, default: "127.0.0.1:9631", desired_state: false,
         description: "IP address and port used to communicate with the remote supervisor. If this value is invalid, the resource will update the supervisor configuration each time #{ChefUtils::Dist::Server::PRODUCT} runs."
 
-      property :gateway_auth_token, String, desired_state: false,
+      property :gateway_auth_token, String, sensitive: true, desired_state: false,
         description: "Auth token for accessing the remote supervisor's http port."
 
       property :update_condition, [Symbol, String], equal_to: [:latest, "latest", :'track-channel', "track-channel"], default: :latest, coerce: proc { |s| s.is_a?(String) ? s.to_sym : s },

data/lib/chef/resource/openssl_ec_private_key.rb

@@ -60,7 +60,7 @@ class Chef
         description: "The desired curve of the generated key (if key_type is equal to 'ec'). Run openssl ecparam -list_curves to see available options.",
         default: "prime256v1"
 
-      property :key_pass, String,
+      property :key_pass, String, sensitive: true,
         description: "The desired passphrase for the key."
 
       property :key_cipher, String,

data/lib/chef/resource/openssl_ec_public_key.rb

@@ -56,10 +56,10 @@ class Chef
       property :private_key_path, String,
         description: "The path to the private key file."
 
-      property :private_key_content, String,
+      property :private_key_content, String, sensitive: true,
         description: "The content of the private key including new lines. This property is used in place of private_key_path in instances where you want to avoid having to first write the private key to disk"
 
-      property :private_key_pass, String,
+      property :private_key_pass, String, sensitive: true,
         description: "The passphrase of the provided private key."
 
       property :owner, [String, Integer],

data/lib/chef/resource/openssl_rsa_private_key.rb

@@ -59,7 +59,7 @@ class Chef
         description: "The desired bit length of the generated key.",
         default: 2048
 
-      property :key_pass, String,
+      property :key_pass, String, sensitive: true,
         description: "The desired passphrase for the key."
 
       property :key_cipher, String,