chef 18.11.11 → 19.1.164

data/lib/chef/resource/chef_client_config.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,131 +21,82 @@ class Chef
   class Resource
     class ChefClientConfig < Chef::Resource
 
-      provides :chef_client_config
-
-      DIRECTORY_SPEC_DEFAULTS = {
-        config: { mode: "0750", inherits: :auto },
-        client_d: { mode: "0750", inherits: :auto },
-        logs: { mode: "0755", inherits: :auto },
-        cache: { mode: "0750", inherits: :auto },
-        backups: { mode: "0750", inherits: :auto },
-      }.freeze
+      provides :chef_client_config, target_mode: true
+      target_mode support: :full
 
       description "Use the **chef_client_config** resource to create a client.rb file in the #{ChefUtils::Dist::Infra::PRODUCT} configuration directory. See the [client.rb docs](https://docs.chef.io/config_rb_client/) for more details on options available in the client.rb configuration file."
       introduced "16.6"
       examples <<~DOC
-        **Bare minimum #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
+      **Bare minimum #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
 
-        The absolute minimum configuration necessary for a node to communicate with the #{ChefUtils::Dist::Server::PRODUCT} is the URL of the #{ChefUtils::Dist::Server::PRODUCT}. All other configuration options either have values at the server side (Policyfiles, Roles, Environments, etc) or have default values determined at client startup.
+      The absolute minimum configuration necessary for a node to communicate with the #{ChefUtils::Dist::Server::PRODUCT} is the URL of the #{ChefUtils::Dist::Server::PRODUCT}. All other configuration options either have values at the server side (Policyfiles, Roles, Environments, etc) or have default values determined at client startup.
 
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-        end
-        ```
-
-        **More complex #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
-
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          log_level :info
-          log_location :syslog
-          http_proxy 'proxy.example.dmz'
-          https_proxy 'proxy.example.dmz'
-          no_proxy %w(internal.example.dmz)
-        end
-        ```
-
-        **Adding additional config content to the client.rb**:
-
-        This resource aims to provide common configuration options. Some configuration options are missing and some users may want to use arbitrary Ruby code within their configuration. For this we offer an `additional_config` property that can be used to add any configuration or code to the bottom of the `client.rb` file. Also keep in mind that within the configuration directory is a `client.d` directory where you can put additional `.rb` files containing configuration options. These can be created using `file` or `template` resources within your cookbooks as necessary.
-
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          additional_config <<~CONFIG
-            # Extra config code to safely load a gem into the client run.
-            # Since the config is Ruby you can run any Ruby code you want via the client.rb.
-            # It's a great way to break things, so be careful
-            begin
-              require 'aws-sdk'
-            rescue LoadError
-              Chef::Log.warn "Failed to load aws-sdk."
-            end
-          CONFIG
-        end
-        ```
-
-        **Setup two report handlers in the client.rb**:
-
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          report_handlers [
-            {
-              'class' => 'ReportHandler1Class',
-              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
-            },
-            {
-              'class' => 'ReportHandler2Class',
-              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
-            },
-          ]
-        end
-        ```
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+      end
+      ```
+
+      **More complex #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
+
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        log_level :info
+        log_location :syslog
+        http_proxy 'proxy.example.dmz'
+        https_proxy 'proxy.example.dmz'
+        no_proxy %w(internal.example.dmz)
+      end
+      ```
+
+      **Adding additional config content to the client.rb**:
+
+      This resource aims to provide common configuration options. Some configuration options are missing and some users may want to use arbitrary Ruby code within their configuration. For this we offer an `additional_config` property that can be used to add any configuration or code to the bottom of the `client.rb` file. Also keep in mind that within the configuration directory is a `client.d` directory where you can put additional `.rb` files containing configuration options. These can be created using `file` or `template` resources within your cookbooks as necessary.
+
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        additional_config <<~CONFIG
+          # Extra config code to safely load a gem into the client run.
+          # Since the config is Ruby you can run any Ruby code you want via the client.rb.
+          # It's a great way to break things, so be careful
+          begin
+            require 'aws-sdk'
+          rescue LoadError
+            Chef::Log.warn "Failed to load aws-sdk."
+          end
+        CONFIG
+      end
+      ```
 
-        **Report directly to the [Chef Automate data collector endpoint](/automate/data_collection/#configure-chef-infra-client-to-use-the-data-collector-endpoint-in-chef-automate).**
+      **Setup two report handlers in the client.rb**:
 
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          data_collector_server_url 'https://automate.example.dmz'
-          data_collector_token 'TEST_TOKEN_TEST'
-        end
-        ```
-
-        **Set Linux directory ownership and modes**:
-
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          user 'root'
-          group 'root'
-          file_cache_path '/var/chef/cache'
-          file_backup_path '/var/chef/backups'
-          log_location '/var/log/chef/client.log'
-          directory_specs(
-            config: { owner: 'root', group: 'root', mode: '0700' },
-            client_d: { owner: 'root', group: 'root', mode: '0700' },
-            logs: { owner: 'root', group: 'root', mode: '0750' },
-            cache: { owner: 'root', group: 'root', mode: '0750' },
-            backups: { owner: 'root', group: 'root', mode: '0750' }
-          )
-        end
-        ```
-
-        **Set Windows directory inheritance and rights**:
-
-        ```ruby
-        chef_client_config 'Create client.rb' do
-          chef_server_url 'https://chef.example.dmz'
-          config_directory 'C:/chef'
-          file_cache_path 'C:/chef/cache'
-          file_backup_path 'C:/chef/backups'
-          log_location 'C:/chef/log/client.log'
-          directory_specs(
-            config: {
-              owner: 'Administrators',
-              inherits: false,
-              rights: {
-                'Administrators' => :full_control,
-                'SYSTEM' => :full_control,
-              },
-            }
-          )
-        end
-        ```
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        report_handlers [
+          {
+           'class' => 'ReportHandler1Class',
+           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+          },
+          {
+           'class' => 'ReportHandler2Class',
+           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+          },
+        ]
+      end
+      ```
+
+      **Report directly to the [Chef Automate data collector endpoint](/automate/data_collection/#configure-chef-infra-client-to-use-the-data-collector-endpoint-in-chef-automate).**
+
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        data_collector_server_url 'https://automate.example.dmz'
+        data_collector_token 'TEST_TOKEN_TEST'
+      end
+      ```
       DOC
 
       # @todo policy_file or policy_group being set requires the other to be set so enforce that.
@@ -191,10 +142,10 @@ class Chef
         equal_to: %i{verify_none verify_peer},
         coerce: proc { |x| string_to_symbol(x) },
         description: <<~DESC
-          Set the verify mode for HTTPS requests.
+        Set the verify mode for HTTPS requests.
 
-          * Use :verify_none for no validation of SSL certificates.
-          * Use :verify_peer for validation of all SSL certificates, including the #{ChefUtils::Dist::Server::PRODUCT} connections, S3 connections, and any HTTPS remote_file resource URLs used in #{ChefUtils::Dist::Infra::PRODUCT} runs. This is the recommended setting.
+        * Use :verify_none for no validation of SSL certificates.
+        * Use :verify_peer for validation of all SSL certificates, including the #{ChefUtils::Dist::Server::PRODUCT} connections, S3 connections, and any HTTPS remote_file resource URLs used in #{ChefUtils::Dist::Infra::PRODUCT} runs. This is the recommended setting.
         DESC
 
       property :formatters, Array,
@@ -224,7 +175,7 @@ class Chef
         description: "The proxy server to use for HTTPS connections."
 
       property :ftp_proxy, String,
-        description: "The proxy server to use for FTP connections."
+      description: "The proxy server to use for FTP connections."
 
       property :no_proxy, [String, Array],
         description: "A comma-separated list or an array of URLs that do not need a proxy.",
@@ -304,83 +255,21 @@ class Chef
         description: "The data collector token to interact with the data collector server URL (Automate). Note: If possible, use Chef Infra Server to do all data collection reporting, as this removes the need to distribute tokens to individual nodes.",
         introduced: "17.8"
 
-      property :directory_specs, Hash,
-        description: <<~DESC,
-          Permission overrides for Chef-managed directories.
-          This must be a hash of hashes: top-level keys are directory names, values are per-directory option hashes.
-
-          Use this property like:
-            directory_specs(
-              config: { owner: "root", group: "root", mode: "0700" },
-              client_d: { owner: "root", group: "root", mode: "0700" },
-              logs: { owner: "root", group: "root", mode: "0700" },
-              cache: { owner: "root", group: "root", mode: "0700" },
-              backups: { owner: "root", group: "root", mode: "0700" }
-            )
-
-          Directory keys: :config, :client_d, :logs, :cache, :backups
-          Override keys: :owner, :group, :mode, :rights, :inherits (:rights and :inherits are Windows-only)
-        DESC
-        callbacks: {
-          "keys must be one of :config, :client_d, :logs, :cache, :backups" => lambda { |v|
-            valid_keys = %i{config client_d logs cache backups}
-            v.keys.all? { |k| valid_keys.include?(k) }
-          },
-          "values must be a hash with keys only from :owner, :group, :mode, :rights, :inherits" => lambda { |v|
-            valid_inner_keys = %i{owner group mode rights inherits}
-            v.values.all? { |value| value.is_a?(Hash) && value.keys.all? { |k| valid_inner_keys.include?(k) } }
-          },
-        },
-        default: DIRECTORY_SPEC_DEFAULTS,
-        coerce: proc { |v|
-          DIRECTORY_SPEC_DEFAULTS.merge(v) do |_key, base, override|
-            override.is_a?(Hash) ? base.merge(override) : override
-          end
-        }
-
-      property :client_rb_mode, String,
-        description: "The mode to set on the client.rb file that is written out by this resource (e.g., 0600).",
-        default: "0640"
-
       action :create, description: "Create a client.rb config file and folders for configuring #{ChefUtils::Dist::Infra::PRODUCT}." do
-        # The logs directory is derived from log_location, which may be a symbol
-        # or a stream name (STDOUT/STDERR) rather than a file path. Only raise if
-        # the user customized logs specs but log_location is not a usable file path.
-        if new_resource.directory_specs[:logs] != DIRECTORY_SPEC_DEFAULTS[:logs] && log_directory.nil?
-          raise ArgumentError, "Invalid directory_specs: logs requires :logs (file path)"
-        end
-
-        # Build path map for each managed directory. For cache and backups, fall
-        # back to ChefConfig defaults when not explicitly set so that directory_specs
-        # overrides are applied even if the user didn't configure a custom path in client.rb.
-        spec_paths = {
-          config: new_resource.config_directory,
-          client_d: ::File.join(new_resource.config_directory, "client.d"),
-          logs: log_directory,
-          cache: new_resource.file_cache_path || ChefConfig::Config.file_cache_path,
-          backups: new_resource.file_backup_path || ChefConfig::Config.file_backup_path,
-        }
-
-        # Build directory specs based on user input and defaults
-        specs = {}
-        new_resource.directory_specs.each do |key, overrides|
-          path = spec_paths[key]
-          next if path.nil?
-
-          specs[key] = DirectorySpec.new(
-            path: path,
-            owner: overrides[:owner] || new_resource.user,
-            group: overrides[:group] || new_resource.group,
-            mode: overrides[:mode],
-            rights: overrides[:rights],
-            inherits: overrides[:inherits]
-          )
-        end
-
-        # Converge directories
-        specs.each_value do |spec|
-          directory spec.path do
-            spec.apply(self)
+        [
+          new_resource.config_directory,
+          (::File.dirname(new_resource.log_location) if new_resource.log_location.is_a?(String) && !%w{STDOUT STDERR}.include?(new_resource.log_location) && !new_resource.log_location.empty?),
+          new_resource.file_backup_path,
+          new_resource.file_cache_path,
+          ::File.join(new_resource.config_directory, "client.d"),
+          (::File.dirname(new_resource.pid_file) unless new_resource.pid_file.nil?),
+        ].compact.each do |dir_path|
+
+          directory dir_path do
+            user new_resource.user unless new_resource.user.nil?
+            group new_resource.group unless new_resource.group.nil?
+            mode dir_path == ::File.dirname(new_resource.log_location.to_s) ? "0755" : "0750"
+            recursive true
           end
         end
 
@@ -421,7 +310,7 @@ class Chef
             data_collector_server_url: new_resource.data_collector_server_url,
             data_collector_token: new_resource.data_collector_token
           )
-          mode new_resource.client_rb_mode
+          mode "0640"
           action :create
         end
       end
@@ -445,60 +334,6 @@ class Chef
             "#{handler["class"]}.new(#{handler["arguments"].join(",")})"
           end
         end
-
-        # A helper class to encapsulate directory spec data and application logic for both *nix and Windows.
-        # This allows us to keep the logic for how to apply permissions to directories in one place and makes it easier to test.
-        class DirectorySpec
-          attr_reader :path, :owner, :group, :mode, :rights, :inherits
-
-          def initialize(path:, owner: nil, group: nil, mode: nil, rights: nil, inherits: :auto)
-            @path   = path
-            @owner  = owner
-            @group  = group
-            @mode   = mode
-            @rights = rights
-            @inherits = inherits
-          end
-
-          def windows?
-            Chef::Platform.windows?
-          end
-
-          def apply(resource)
-            resource.recursive true
-
-            if windows?
-              if rights && !rights.empty?
-                resource.inherits(inherits == :auto ? false : inherits)
-
-                rights.each do |principal, permission|
-                  resource.rights(permission, principal)
-                end
-              else
-                # Ensure defaults can restore inherited ACL behavior after custom rights were applied.
-                resource.inherits(inherits == :auto ? true : inherits)
-                resource.mode(mode) if mode
-              end
-
-              resource.owner(owner) if owner
-            else
-              resource.owner(owner) if owner
-              resource.group(group) if group
-              resource.mode(mode) if mode
-            end
-          end
-        end
-
-        # A helper method to determine the directory to apply log permissions to based on the log_location property.
-        # If log_location is a file path, this returns the directory containing that file.
-        # If log_location is not a file path (e.g., it's a symbol for syslog or win_evt, or it's STDOUT/STDERR),
-        # this returns nil since there is no directory to apply permissions to.
-        def log_directory
-          return unless new_resource.log_location.is_a?(String)
-          return if %w{STDOUT STDERR}.include?(new_resource.log_location)
-
-          ::File.dirname(new_resource.log_location)
-        end
       end
     end
   end

data/lib/chef/resource/chef_client_cron.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ require_relative "../resource"
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 require_relative "helpers/cron_validations"
 require "digest/md5" unless defined?(Digest::MD5)
+require_relative "helpers/path_helpers"
 
 class Chef
   class Resource
@@ -28,31 +29,32 @@ class Chef
       description "Use the **chef_client_cron** resource to setup the #{ChefUtils::Dist::Infra::PRODUCT} to run as a cron job. This resource will also create the specified log directory if it doesn't already exist."
       introduced "16.0"
       examples <<~DOC
-        **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
+      **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
 
-        ```ruby
-        chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a cron job'
-        ```
+      ```ruby
+      chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a cron job'
+      ```
 
-        **Run #{ChefUtils::Dist::Infra::PRODUCT} twice a day**:
+      **Run #{ChefUtils::Dist::Infra::PRODUCT} twice a day**:
 
-        ```ruby
-        chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 12 hours' do
-          minute 0
-          hour '0,12'
-        end
-        ```
+      ```ruby
+      chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 12 hours' do
+        minute 0
+        hour '0,12'
+      end
+      ```
 
-        **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
+      **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
 
-        ```ruby
-        chef_client_cron 'Run an override recipe' do
-          daemon_options ['--override-runlist mycorp_base::default']
-        end
-        ```
+      ```ruby
+      chef_client_cron 'Run an override recipe' do
+        daemon_options ['--override-runlist mycorp_base::default']
+      end
+      ```
       DOC
 
       extend Chef::ResourceHelpers::CronValidations
+      extend Chef::ResourceHelpers::PathHelpers
 
       property :job_name, String,
         default: ChefUtils::Dist::Infra::CLIENT,
@@ -126,7 +128,7 @@ class Chef
         description: "Append to the log file instead of overwriting the log file on each run."
 
       property :chef_binary_path, String,
-        default: "/opt/#{ChefUtils::Dist::Infra::DIR_SUFFIX}/bin/#{ChefUtils::Dist::Infra::CLIENT}",
+        default: lazy { Chef::ResourceHelpers::PathHelpers.chef_client_hab_binary_path },
         description: "The path to the #{ChefUtils::Dist::Infra::CLIENT} binary."
 
       property :daemon_options, Array,

data/lib/chef/resource/chef_client_hab_ca_cert.rb

@@ -0,0 +1,141 @@
+#
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "pathname"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+
+class Chef
+  class Resource
+    class ChefClientHabCaCert < Chef::Resource
+
+      provides :chef_client_hab_ca_cert
+
+      description "Use the **chef_client_hab_ca_cert** resource to add certificates to habitat #{ChefUtils::Dist::Infra::PRODUCT}'s CA bundle. This allows the #{ChefUtils::Dist::Infra::PRODUCT} to communicate with internal encrypted resources without errors. To make sure these CA certs take effect the `ssl_ca_file` should be configured to point to the CA Cert file path of `core/cacerts` habitat package."
+      introduced "19.1"
+      examples <<~DOC
+      **Trust a self signed certificate**:
+
+      ```ruby
+      chef_client_hab_ca_cert 'self-signed.badssl.com' do
+        certificate <<~CERT
+        -----BEGIN CERTIFICATE-----
+        MIIDeTCCAmGgAwIBAgIJAPziuikCTox4MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
+        BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+        c2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0x
+        OTEwMDkyMzQxNTJaFw0yMTEwMDgyMzQxNTJaMGIxCzAJBgNVBAYTAlVTMRMwEQYD
+        VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQK
+        DAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEB
+        BQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2
+        PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMW
+        hyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3A
+        xPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqve
+        ww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SY
+        QCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0T
+        BAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZI
+        hvcNAQELBQADggEBAGlwCdbPxflZfYOaukZGCaxYK6gpincX4Lla4Ui2WdeQxE95
+        w7fChXvP3YkE3UYUE7mupZ0eg4ZILr/A0e7JQDsgIu/SRTUE0domCKgPZ8v99k3A
+        vka4LpLK51jHJJK7EFgo3ca2nldd97GM0MU41xHFk8qaK1tWJkfrrfcGwDJ4GQPI
+        iLlm6i0yHq1Qg1RypAXJy5dTlRXlCLd8ufWhhiwW0W75Va5AEnJuqpQrKwl3KQVe
+        wGj67WWRgLfSr+4QG1mNvCZb2CkjZWmxkGPuoP40/y7Yu5OFqxP5tAjj4YixCYTW
+        EVA0pmzIzgBg+JIe3PdRy27T0asgQW/F4TY61Yk=
+        -----END CERTIFICATE-----
+        CERT
+      end
+      ```
+      DOC
+
+      property :cert_name, String, name_property: true,
+        description: "The name to use for the certificate. If not provided the name of the resource block will be used instead."
+
+      property :certificate, String, required: true,
+        description: "The text of the certificate file including the BEGIN/END comment lines."
+
+      action :add, description: "Add a local certificate to habitat based #{ChefUtils::Dist::Infra::PRODUCT}'s CA bundle." do
+        return if cert_installed? new_resource.certificate
+
+        converge_by("Add new CA bundle #{new_resource.cert_name} to #{ca_cert_path}") do
+          ::File.open(ca_cert_path, "a") do |f|
+            f.puts "\nCert Bundle - #{new_resource.cert_name}"
+            f.puts "==========================="
+            f.puts new_resource.certificate
+          end
+        end
+      end
+
+      action_class do
+        #
+        # The path to the string on disk
+        #
+        # @return [String]
+        #
+        def ca_cert_path
+          return @ca_cert_path if @ca_cert_path
+
+          @ca_cert_path = ::File.join(hab_cacerts_pkg_path, "ssl", "certs", "cacert.pem")
+          Chef::Log.debug "Determined CA cert path: #{@ca_cert_path}"
+          @ca_cert_path
+        end
+
+        private
+
+        # The fully qualified ident of the cacerts package.
+        #
+        # @api private
+        #
+        def hab_cacerts_pkg_path
+          return @hab_cacerts_pkg_path if @hab_cacerts_pkg_path
+
+          # Find the current running version of chef to get THAT version's cacerts package.
+          current_chef_path = Chef::ResourceHelpers::PathHelpers.chef_client_hab_package_binary_path
+          current_hab_path = Chef::ResourceHelpers::PathHelpers.hab_executable_binary_path
+
+          # Extract package ident from path: /hab/pkgs/chef/chef-infra-client/VERSION/RELEASE/bin/chef-client
+          # or: C:\hab\pkgs\chef\chef-infra-client\VERSION\RELEASE\bin\chef-client.exe
+          # Result should be: chef/chef-infra-client/VERSION/RELEASE
+          package_ident = ::File.join(Pathname.new(current_chef_path).each_filename.to_a[2..5])
+
+          ca_pkg = shell_out("#{current_hab_path} pkg dependencies #{package_ident}")
+          if ca_pkg.error?
+            raise "Failed to determine CA Certs for the #{ChefUtils::Dist::Infra::PRODUCT}'s habitat package"
+          end
+
+          hab_cacerts_pkg = ca_pkg.stdout.scan(%r{core/cacerts.*$}).flatten.first
+
+          if hab_cacerts_pkg.nil?
+            raise "Unable to find 'core/cacerts' package in dependencies. Failed to determine CA Certs."
+          end
+
+          ca_path = shell_out("#{current_hab_path} pkg path #{hab_cacerts_pkg}")
+          if ca_path.error?
+            raise "Unable to find path for the 'core/cacerts' habitat package."
+          end
+
+          path = ca_path.stdout.lines.first
+
+          @hab_cacerts_pkg_path = path.strip
+          Chef::Log.debug "Determined cacerts package path: #{@hab_cacerts_pkg_path}"
+          @hab_cacerts_pkg_path
+        end # hab_cacerts_pkg_path
+
+        def cert_installed?(certificate)
+          chef_cacert_pem = ::File.read(ca_cert_path)
+          chef_cacert_pem.include?(certificate)
+        end
+
+      end # action_class
+    end
+  end
+end

data/lib/chef/resource/chef_client_launchd.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 require_relative "../resource"
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+require_relative "helpers/path_helpers"
+
 class Chef
   class Resource
     class ChefClientLaunchd < Chef::Resource
@@ -43,6 +45,8 @@ class Chef
         ```
       DOC
 
+      extend Chef::ResourceHelpers::PathHelpers
+
       property :user, String,
         description: "The name of the user that #{ChefUtils::Dist::Infra::PRODUCT} runs as.",
         default: "root"
@@ -81,7 +85,7 @@ class Chef
 
       property :chef_binary_path, String,
         description: "The path to the #{ChefUtils::Dist::Infra::CLIENT} binary.",
-        default: "/opt/#{ChefUtils::Dist::Infra::DIR_SUFFIX}/bin/#{ChefUtils::Dist::Infra::CLIENT}"
+        default: lazy { Chef::ResourceHelpers::PathHelpers.chef_client_hab_binary_path }
 
       property :daemon_options, Array,
         description: "An array of options to pass to the #{ChefUtils::Dist::Infra::CLIENT} command.",