chef 19.3.15 → 19.4.46

data/lib/chef/resource/archive_dll_locator.rb

@@ -0,0 +1,70 @@
+#
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "open3" unless defined?(Open3)
+
+class Chef
+  class Resource
+    # Locates archive.dll for a Habitat-packaged Chef on Windows. Sources are
+    # tried from most to least authoritative so that a stray or older libarchive
+    # package on the machine is only used when nothing more specific exists:
+    #   1. RUBY_DLL_PATH (set by the Habitat plan)
+    #   2. the hab CLI (`hab pkg path core/libarchive`)
+    #   3. a search of the hab root derived from the location of chef itself
+    module ArchiveDllLocator
+      DLL_NAME = "archive.dll".freeze
+
+      def self.find(source_file: __FILE__, env: ::ENV)
+        from_ruby_dll_path(env) || from_hab_cli || from_hab_root_search(source_file)
+      end
+
+      def self.from_ruby_dll_path(env = ::ENV)
+        env["RUBY_DLL_PATH"].to_s.split(::File::PATH_SEPARATOR).each do |dir|
+          next if dir.empty?
+
+          candidate = ::File.join(dir.tr("\\", "/"), DLL_NAME)
+          return candidate if ::File.exist?(candidate)
+        end
+        nil
+      end
+
+      def self.from_hab_cli
+        stdout, stderr, status = Open3.capture3("hab pkg path core/libarchive")
+        unless status.success?
+          Chef::Log.debug("Failed to determine Habitat libarchive path: #{stderr}")
+          return nil
+        end
+
+        candidate = ::File.join(stdout.strip.tr("\\", "/"), "bin", DLL_NAME)
+        return candidate if ::File.exist?(candidate)
+
+        Chef::Log.debug("#{DLL_NAME} not found in Habitat path: #{candidate}")
+        nil
+      rescue SystemCallError => e
+        Chef::Log.debug("hab CLI not available to locate libarchive: #{e.message}")
+        nil
+      end
+
+      def self.from_hab_root_search(source_file)
+        hab_root = source_file.tr("\\", "/")[%r{\A(.*?/hab)/pkgs/}, 1]
+        return nil unless hab_root
+
+        ::Dir.glob("#{hab_root}/pkgs/core/libarchive/*/*/bin/#{DLL_NAME}").max
+      end
+    end
+  end
+end

data/lib/chef/resource/archive_file.rb

@@ -20,6 +20,7 @@
 
 require_relative "../resource"
 require "fileutils" unless defined?(FileUtils)
+
 begin
   # The explicit call to FFI::DynamicLibrary.open was added to address an issue specific to the Habitat packaging of Chef Infra Client on windows.
   # In the Habitat environment, the libarchive library (archive.dll) is installed in a non-standard location that is not included
@@ -37,34 +38,29 @@ begin
   # This code dynamically determines the path to archive.dll using the Habitat CLI (`hab pkg path core/libarchive`) and explicitly
   # loads the library using FFI::DynamicLibrary.open. This ensures that the library is correctly loaded in the Habitat environment.
   #
-  # Note: This logic is gated by a check for Habitat-specific environment variables (HAB_CACHE_SRC_PATH or HAB_PKG_PATH) to ensure
-  # that it is only applied in Habitat runs. For other environments (e.g., Omnibus, plain gem installations, or git checkouts),
-  # the default behavior of FFI is sufficient, as the libraries are installed in standard locations or embedded paths that are
-  # included in the default search paths.
-  if RUBY_PLATFORM.match?(/mswin|mingw|windows/) && (ENV["HAB_CACHE_SRC_PATH"] || ENV["HAB_PKG_PATH"])
+  # Note: This logic is gated by a check that we are running from a Habitat package
+  # path to ensure it is only applied in Habitat runs. For other environments
+  # (e.g., Omnibus, plain gem installations, or git checkouts), the default behavior
+  # of FFI is sufficient, as the libraries are installed in standard locations or
+  # embedded paths that are included in the default search paths.
+  # Detect Habitat runtime environment reliably. HAB_CACHE_SRC_PATH is only set
+  # during `hab pkg build` (studio), not at runtime. HAB_PKG_PATH is also not
+  # guaranteed at runtime. Checking __FILE__ is reliable: when chef-client runs
+  # from a Hab package via `hab pkg exec`, this file's path always contains
+  # "hab/pkgs".
+  if RUBY_PLATFORM.match?(/mswin|mingw|windows/) && __FILE__.match?(%r{hab[/\\]pkgs})
     require "ffi" unless defined?(FFI)
-    require "open3" unless defined?(Open3)
-    # Dynamically determine the path to the core/libarchive package
-    stdout, stderr, status = Open3.capture3("hab pkg path core/libarchive")
-    unless status.success?
-      Chef::Log.debug("Failed to determine Habitat libarchive path: #{stderr}")
-      return
-    end
+    require_relative "archive_dll_locator"
 
-    habitat_libarchive_path = File.join(stdout.strip.tr("\\", "/"), "bin")
-    unless Dir.exist?(habitat_libarchive_path)
-      Chef::Log.debug("Habitat libarchive path not found: #{habitat_libarchive_path}")
-      return
-    end
+    # Search order: RUBY_DLL_PATH, then the hab CLI, then a search of the hab root.
+    archive_dll_path = Chef::Resource::ArchiveDllLocator.find(source_file: __FILE__)
 
-    archive_dll_path = File.join(habitat_libarchive_path, "archive.dll")
-    unless File.exist?(archive_dll_path)
-      Chef::Log.debug("archive.dll not found in Habitat path: #{habitat_libarchive_path}")
-      return
+    if archive_dll_path
+      FFI::DynamicLibrary.open(archive_dll_path, FFI::DynamicLibrary::RTLD_LAZY)
+      Chef::Log.debug("Explicitly loaded archive.dll from Habitat path: #{archive_dll_path}")
+    else
+      Chef::Log.debug("archive.dll not located via Habitat; relying on default library search paths")
     end
-
-    FFI::DynamicLibrary.open(archive_dll_path, FFI::DynamicLibrary::RTLD_LAZY) # Explicitly load the DLL
-    Chef::Log.debug("Explicitly loaded archive.dll from Habitat path: #{archive_dll_path}")
   end
 
   # ffi-libarchive must be eager loaded see: https://github.com/chef/chef/issues/12228
@@ -171,8 +167,14 @@ class Chef
 
         if new_resource.owner || new_resource.group
           converge_by("set owner of files extracted in #{new_resource.destination} to #{new_resource.owner}:#{new_resource.group}") do
+            dest_realpath = ::File.expand_path(new_resource.destination)
             Archive::Reader.open_filename(new_resource.path, nil, strip_components: new_resource.strip_components) do |archive|
               archive.each_entry do |e|
+                # Validate path is within destination before chown-ing.
+                # Use expand_path for security check, original string for the chown call.
+                chown_path_expanded = ::File.expand_path("#{new_resource.destination}/#{e.pathname}")
+                next unless chown_path_expanded.start_with?(dest_realpath + ::File::SEPARATOR) || chown_path_expanded == dest_realpath
+
                 FileUtils.chown(new_resource.owner, new_resource.group, "#{new_resource.destination}/#{e.pathname}")
               end
             end
@@ -211,10 +213,16 @@ class Chef
         # @return [Boolean]
         def archive_differs_from_disk?(src, dest)
           modified = false
+          dest_realpath = ::File.expand_path(dest)
           Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
             Chef::Log.trace("Beginning the comparison of file mtime between contents of #{src} and #{dest}")
             archive.each_entry do |e|
-              pathname = ::File.expand_path(e.pathname, dest)
+              pathname = ::File.expand_path(e.pathname, dest_realpath)
+              # Skip archive entries that resolve outside the destination directory.
+              # A traversal entry (e.g. "../escaped") must not influence the mtime
+              # comparison and must never trigger extraction.
+              next unless pathname.start_with?(dest_realpath + ::File::SEPARATOR) || pathname == dest_realpath
+
               if ::File.exist?(pathname)
                 Chef::Log.trace("#{pathname} mtime is #{::File.mtime(pathname)} and archive is #{e.mtime}")
                 modified = true unless ::File.mtime(pathname) == e.mtime
@@ -236,12 +244,33 @@ class Chef
         # @return [void]
         def extract(src, dest, options = [])
           converge_by("extract #{src} to #{dest}") do
-            flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|)
+            user_flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|).to_i
+            # Always apply libarchive security flags to prevent path traversal.
+            # These are not user-overridable hence directly added here
+            # instead of options array. NODOTDOT blocks "../" sequences,
+            # NOABSOLUTEPATHS blocks absolute-path entries, SECURE_SYMLINKS prevents
+            # symlink attacks. Combined with the check below in archive.each_entry
+            # they safeguard against Zip Slip / CWE-22 attacks.
+            security_flags = Archive::EXTRACT_SECURE_NODOTDOT |
+              Archive::EXTRACT_SECURE_NOABSOLUTEPATHS |
+              Archive::EXTRACT_SECURE_SYMLINKS
+            all_flags = user_flags | security_flags
+            dest_realpath = ::File.expand_path(dest)
 
             Dir.chdir(dest) do
               Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
                 archive.each_entry do |e|
-                  archive.extract(e, flags.to_i)
+                  # reject any entry whose resolved path
+                  # falls outside the destination directory before calling into libarchive.
+                  entry_realpath = ::File.expand_path(e.pathname, dest_realpath)
+                  unless entry_realpath.start_with?(dest_realpath + ::File::SEPARATOR) || entry_realpath == dest_realpath
+                    raise Chef::Exceptions::ValidationFailed,
+                      "Refusing to extract archive entry #{e.pathname.inspect}: resolved path " \
+                      "#{entry_realpath.inspect} is outside destination #{dest_realpath.inspect}. " \
+                      "This archive may contain a path traversal attack."
+                  end
+
+                  archive.extract(e, all_flags)
                 end
               end
             end

data/lib/chef/resource/chef_client_config.rb

@@ -21,6 +21,14 @@ class Chef
   class Resource
     class ChefClientConfig < Chef::Resource
 
+      DIRECTORY_SPEC_DEFAULTS = {
+        config: { mode: "0750", inherits: :auto },
+        client_d: { mode: "0750", inherits: :auto },
+        logs: { mode: "0755", inherits: :auto },
+        cache: { mode: "0750", inherits: :auto },
+        backups: { mode: "0750", inherits: :auto },
+      }.freeze
+
       provides :chef_client_config, target_mode: true
       target_mode support: :full
 
@@ -77,12 +85,12 @@ class Chef
         chef_server_url 'https://chef.example.dmz'
         report_handlers [
           {
-           'class' => 'ReportHandler1Class',
-           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+            'class' => 'ReportHandler1Class',
+            'arguments' => ["'FirstArgument'", "'SecondArgument'"],
           },
           {
-           'class' => 'ReportHandler2Class',
-           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+            'class' => 'ReportHandler2Class',
+            'arguments' => ["'FirstArgument'", "'SecondArgument'"],
           },
         ]
       end
@@ -97,6 +105,48 @@ class Chef
         data_collector_token 'TEST_TOKEN_TEST'
       end
       ```
+
+      **Set Linux directory ownership and modes**:
+
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        user 'root'
+        group 'root'
+        file_cache_path '/var/chef/cache'
+        file_backup_path '/var/chef/backups'
+        log_location '/var/log/chef/client.log'
+        directory_specs(
+          config: { owner: 'root', group: 'root', mode: '0700' },
+          client_d: { owner: 'root', group: 'root', mode: '0700' },
+          logs: { owner: 'root', group: 'root', mode: '0750' },
+          cache: { owner: 'root', group: 'root', mode: '0750' },
+          backups: { owner: 'root', group: 'root', mode: '0750' }
+        )
+      end
+      ```
+
+      **Set Windows directory inheritance and rights**:
+
+      ```ruby
+      chef_client_config 'Create client.rb' do
+        chef_server_url 'https://chef.example.dmz'
+        config_directory 'C:/chef'
+        file_cache_path 'C:/chef/cache'
+        file_backup_path 'C:/chef/backups'
+        log_location 'C:/chef/log/client.log'
+        directory_specs(
+          config: {
+            owner: 'Administrators',
+            inherits: false,
+            rights: {
+              'Administrators' => :full_control,
+              'SYSTEM' => :full_control,
+            },
+          }
+        )
+      end
+      ```
       DOC
 
       # @todo policy_file or policy_group being set requires the other to be set so enforce that.
@@ -120,7 +170,7 @@ class Chef
       property :config_directory, String,
         description: "The directory to store the client.rb in.",
         default: ChefConfig::Config.etc_chef_dir,
-        default_description: "`/etc/chef/` on *nix-like systems and `C:\\chef\\` on Windows"
+        default_description: '`/etc/chef/` on *nix-like systems and `C:\\chef\\` on Windows'
 
       property :user, String,
         description: "The user that should own the client.rb file and the configuration directory if it needs to be created. Note: The configuration directory will not be created if it already exists, which allows you to further control the setup of that directory outside of this resource."
@@ -212,7 +262,7 @@ class Chef
         default: []
 
       property :rubygems_url, [String, Array],
-        description: "The location to source rubygems. It can be set to a string or array of strings for URIs to set as rubygems sources. This allows individuals to setup an internal mirror of rubygems for “airgapped” environments.",
+        description: 'The location to source rubygems. It can be set to a string or array of strings for URIs to set as rubygems sources. This allows individuals to setup an internal mirror of rubygems for "airgapped" environments.',
         introduced: "17.11"
 
       property :exception_handlers, Array,
@@ -255,21 +305,83 @@ class Chef
         description: "The data collector token to interact with the data collector server URL (Automate). Note: If possible, use Chef Infra Server to do all data collection reporting, as this removes the need to distribute tokens to individual nodes.",
         introduced: "17.8"
 
+      property :directory_specs, Hash,
+        description: <<~DESC,
+          Permission overrides for Chef-managed directories.
+          This must be a hash of hashes: top-level keys are directory names, values are per-directory option hashes.
+
+          Use this property like:
+            directory_specs(
+              config: { owner: "root", group: "root", mode: "0700" },
+              client_d: { owner: "root", group: "root", mode: "0700" },
+              logs: { owner: "root", group: "root", mode: "0700" },
+              cache: { owner: "root", group: "root", mode: "0700" },
+              backups: { owner: "root", group: "root", mode: "0700" }
+            )
+
+          Directory keys: :config, :client_d, :logs, :cache, :backups
+          Override keys: :owner, :group, :mode, :rights, :inherits (:rights and :inherits are Windows-only)
+        DESC
+        callbacks: {
+          "keys must be one of :config, :client_d, :logs, :cache, :backups" => lambda { |v|
+            valid_keys = %i{config client_d logs cache backups}
+            v.keys.all? { |k| valid_keys.include?(k) }
+          },
+          "values must be a hash with keys only from :owner, :group, :mode, :rights, :inherits" => lambda { |v|
+            valid_inner_keys = %i{owner group mode rights inherits}
+            v.values.all? { |value| value.is_a?(Hash) && value.keys.all? { |k| valid_inner_keys.include?(k) } }
+          },
+        },
+        default: DIRECTORY_SPEC_DEFAULTS,
+        coerce: proc { |v|
+          DIRECTORY_SPEC_DEFAULTS.merge(v) do |_key, base, override|
+            override.is_a?(Hash) ? base.merge(override) : override
+          end
+        }
+
+      property :client_rb_mode, String,
+        description: "The mode to set on the client.rb file that is written out by this resource (e.g., 0600).",
+        default: "0640"
+
       action :create, description: "Create a client.rb config file and folders for configuring #{ChefUtils::Dist::Infra::PRODUCT}." do
-        [
-          new_resource.config_directory,
-          (::File.dirname(new_resource.log_location) if new_resource.log_location.is_a?(String) && !%w{STDOUT STDERR}.include?(new_resource.log_location) && !new_resource.log_location.empty?),
-          new_resource.file_backup_path,
-          new_resource.file_cache_path,
-          ::File.join(new_resource.config_directory, "client.d"),
-          (::File.dirname(new_resource.pid_file) unless new_resource.pid_file.nil?),
-        ].compact.each do |dir_path|
-
-          directory dir_path do
-            user new_resource.user unless new_resource.user.nil?
-            group new_resource.group unless new_resource.group.nil?
-            mode dir_path == ::File.dirname(new_resource.log_location.to_s) ? "0755" : "0750"
-            recursive true
+        # The logs directory is derived from log_location, which may be a symbol
+        # or a stream name (STDOUT/STDERR) rather than a file path. Only raise if
+        # the user customized logs specs but log_location is not a usable file path.
+        if new_resource.directory_specs[:logs] != DIRECTORY_SPEC_DEFAULTS[:logs] && log_directory.nil?
+          raise ArgumentError, "Invalid directory_specs: logs requires :logs (file path)"
+        end
+
+        # Build path map for each managed directory. For cache and backups, fall
+        # back to ChefConfig defaults when not explicitly set so that directory_specs
+        # overrides are applied even if the user didn't configure a custom path in client.rb.
+        spec_paths = {
+          config: new_resource.config_directory,
+          client_d: ::File.join(new_resource.config_directory, "client.d"),
+          logs: log_directory,
+          cache: new_resource.file_cache_path || ChefConfig::Config.file_cache_path,
+          backups: new_resource.file_backup_path || ChefConfig::Config.file_backup_path,
+        }
+
+        # Build directory specs based on user input and defaults
+        specs = {}
+        new_resource.directory_specs.each do |key, overrides|
+          path = spec_paths[key]
+          next if path.nil?
+
+          specs[key] = DirectorySpec.new(
+            path: path,
+            owner: overrides[:owner] || new_resource.user,
+            group: overrides[:group] || new_resource.group,
+            mode: overrides[:mode],
+            rights: overrides[:rights],
+            inherits: overrides[:inherits]
+          )
+        end
+
+        # Converge directories
+        specs.each_value do |spec|
+          directory spec.path do
+            spec.apply(self)
           end
         end
 
@@ -310,7 +422,7 @@ class Chef
             data_collector_server_url: new_resource.data_collector_server_url,
             data_collector_token: new_resource.data_collector_token
           )
-          mode "0640"
+          mode new_resource.client_rb_mode
           action :create
         end
       end
@@ -334,6 +446,60 @@ class Chef
             "#{handler["class"]}.new(#{handler["arguments"].join(",")})"
           end
         end
+
+        # A helper class to encapsulate directory spec data and application logic for both *nix and Windows.
+        # This allows us to keep the logic for how to apply permissions to directories in one place and makes it easier to test.
+        class DirectorySpec
+          attr_reader :path, :owner, :group, :mode, :rights, :inherits
+
+          def initialize(path:, owner: nil, group: nil, mode: nil, rights: nil, inherits: :auto)
+            @path   = path
+            @owner  = owner
+            @group  = group
+            @mode   = mode
+            @rights = rights
+            @inherits = inherits
+          end
+
+          def windows?
+            Chef::Platform.windows?
+          end
+
+          def apply(resource)
+            resource.recursive true
+
+            if windows?
+              if rights && !rights.empty?
+                resource.inherits(inherits == :auto ? false : inherits)
+
+                rights.each do |principal, permission|
+                  resource.rights(permission, principal)
+                end
+              else
+                # Ensure defaults can restore inherited ACL behavior after custom rights were applied.
+                resource.inherits(inherits == :auto ? true : inherits)
+                resource.mode(mode) if mode
+              end
+
+              resource.owner(owner) if owner
+            else
+              resource.owner(owner) if owner
+              resource.group(group) if group
+              resource.mode(mode) if mode
+            end
+          end
+        end
+
+        # A helper method to determine the directory to apply log permissions to based on the log_location property.
+        # If log_location is a file path, this returns the directory containing that file.
+        # If log_location is not a file path (e.g., it's a symbol for syslog or win_evt, or it's STDOUT/STDERR),
+        # this returns nil since there is no directory to apply permissions to.
+        def log_directory
+          return unless new_resource.log_location.is_a?(String)
+          return if %w{STDOUT STDERR}.include?(new_resource.log_location)
+
+          ::File.dirname(new_resource.log_location)
+        end
       end
     end
   end

data/lib/chef/resource/chef_client_hab_ca_cert.rb

@@ -104,10 +104,17 @@ class Chef
 
           # Extract package ident from path: /hab/pkgs/chef/chef-infra-client/VERSION/RELEASE/bin/chef-client
           # or: C:\hab\pkgs\chef\chef-infra-client\VERSION\RELEASE\bin\chef-client.exe
+          # or: /opt/hab/pkgs/chef/chef-infra-client/VERSION/RELEASE/bin/chef-client (hab root not "/hab")
           # Result should be: chef/chef-infra-client/VERSION/RELEASE
-          package_ident = ::File.join(Pathname.new(current_chef_path).each_filename.to_a[2..5])
+          filename_parts = Pathname.new(current_chef_path).each_filename.to_a
+          pkgs_index = filename_parts.index("pkgs")
+          if pkgs_index.nil?
+            raise "Unable to determine habitat package ident from #{ChefUtils::Dist::Infra::CLIENT} path '#{current_chef_path}'."
+          end
+
+          package_ident = ::File.join(filename_parts[(pkgs_index + 1)..(pkgs_index + 4)])
 
-          ca_pkg = shell_out("#{current_hab_path} pkg dependencies #{package_ident}")
+          ca_pkg = shell_out("#{current_hab_path} pkg dependencies #{package_ident}", environment: { "HAB_LICENSE" => "accept-no-persist" })
           if ca_pkg.error?
             raise "Failed to determine CA Certs for the #{ChefUtils::Dist::Infra::PRODUCT}'s habitat package"
           end
@@ -118,7 +125,7 @@ class Chef
             raise "Unable to find 'core/cacerts' package in dependencies. Failed to determine CA Certs."
           end
 
-          ca_path = shell_out("#{current_hab_path} pkg path #{hab_cacerts_pkg}")
+          ca_path = shell_out("#{current_hab_path} pkg path #{hab_cacerts_pkg}", environment: { "HAB_LICENSE" => "accept-no-persist" })
           if ca_path.error?
             raise "Unable to find path for the 'core/cacerts' habitat package."
           end

data/lib/chef/resource/chef_vault_secret.rb

@@ -65,7 +65,7 @@ class Chef
       property :search, String, default: "*:*", desired_state: false,
         description: "Search query that would match the same used for the clients, gets stored as a field in the item."
 
-      property :raw_data, [Hash, Mash], default: {},
+      property :raw_data, [Hash, Mash], default: {}, sensitive: true,
         description: "The raw data, as a Ruby Hash, that will be stored in the item."
 
       property :environment, [String, NilClass], desired_state: false,

data/lib/chef/resource/chocolatey_installer.rb

@@ -1,3 +1,6 @@
+require "cgi" unless defined?(CGI)
+require "uri" unless defined?(URI)
+
 class Chef
   class Resource
     class ChocolateyInstaller < Chef::Resource
@@ -70,7 +73,7 @@ class Chef
       property :proxy_user, String,
         description: "The username to use to build a proxy credential with. Will be consumed by the proxy_credential property if both this property and proxy_password are set"
 
-      property :proxy_password, String,
+      property :proxy_password, String, sensitive: true,
         description: "The password to use to build a proxy credential with. Will be consumed by the proxy_credential property if both this property and proxy_user are set"
 
       load_current_value do
@@ -91,6 +94,25 @@ class Chef
         Gem::Version.new(get_choco_version)
       end
 
+      def download_url_path
+        return download_url if download_url.match?(%r{^[a-zA-Z]:[\\/]}) || download_url.start_with?("\\\\")
+
+        ::URI.parse(download_url).path
+      rescue URI::InvalidURIError
+        download_url
+      end
+
+      def download_url_script?
+        ::File.extname(download_url_path).casecmp(".ps1") == 0
+      end
+
+      def download_destination
+        filename = ::File.basename(::CGI.unescape(download_url_path.to_s))
+        filename = "chocolatey.nupkg" if filename.empty? || ["/", "\\", "."].include?(filename)
+
+        Chef::Util::PathHelper.join(ChefConfig::Config.etc_chef_dir(windows: true), filename)
+      end
+
       def define_resource_requirements
         requirements.assert(:install, :upgrade).each do |a|
           a.assertion do
@@ -131,16 +153,28 @@ class Chef
         # note that Invoke-Expression is being called on the downloaded script (outer parens),
         # not triggering the script download (inner parens)
         converge_if_changed do
-          powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))").error!
+          if new_resource.download_url
+            Chef::Log.info("Using custom download URL for Chocolatey installation: #{new_resource.download_url}")
+            # If it's a PowerShell script, execute it directly (original behavior)
+            if download_url_script?
+              powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('#{new_resource.download_url}'))").error!
+            else
+              # Assume it's a direct link to a nupkg or other file and handle accordingly
+              destination = download_destination
+
+              powershell_exec("Invoke-WebRequest '#{new_resource.download_url}' -OutFile '#{destination}'").error!
+              Chef::Log.info("Downloaded file from #{new_resource.download_url} to #{destination}")
+            end
+          else
+            powershell_exec("Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))").error!
+          end
         end
       end
 
       action :upgrade, description: "Upgrades the Chocolatey package manager" do
-        if new_resource.chocolatey_version
-          proposed_version = Gem::Version.new(new_resource.chocolatey_version)
-        else
-          proposed_version = nil
-        end
+        proposed_version = if new_resource.chocolatey_version
+                             Gem::Version.new(new_resource.chocolatey_version)
+                           end
 
         if new_resource.download_url
           powershell_exec("Set-Item -path env:ChocolateyDownloadUrl -Value #{new_resource.download_url}")

data/lib/chef/resource/chocolatey_package.rb

@@ -59,7 +59,7 @@ class Chef
         introduced: "15.3",
         description: "The username to authenticate feeds."
 
-      property :password, String,
+      property :password, String, sensitive: true,
         introduced: "15.3",
         description: "The password to authenticate to the source."
 

data/lib/chef/resource/dnf_package.rb

@@ -57,7 +57,7 @@ class Chef
           if v.is_a?(Hash)
             v
           elsif v.is_a?(Array)
-            v.each_with_object({}) { |arg, obj| obj[arg] = true }
+            v.to_h { |arg| [arg, true] }
           elsif v.is_a?(TrueClass) || v.is_a?(FalseClass)
             { before: v, after: v }
           elsif v == :before

data/lib/chef/resource/habitat/habitat_package.rb

@@ -108,7 +108,7 @@ class Chef
       property :channel, String, default: "stable",
       description: "The release channel to install your package from."
 
-      property :auth_token, String,
+      property :auth_token, String, sensitive: true,
       description: "Auth token for installing a package from a private organization on Habitat builder."
 
       property :binlink, [true, false, :force], default: false,

data/lib/chef/resource/habitat/habitat_sup.rb

@@ -130,10 +130,10 @@ class Chef
       property :auto_update, [true, false], default: false,
       description: "Passes `--auto-update`. This will set the Habitat supervisor to automatically update itself any time a stable version has been released."
 
-      property :auth_token, String,
+      property :auth_token, String, sensitive: true,
       description: "Auth token for accessing a private organization on bldr. This value is templated into the appropriate service file."
 
-      property :gateway_auth_token, String,
+      property :gateway_auth_token, String, sensitive: true,
       description: "Auth token for accessing the supervisor's HTTP gateway. This value is templated into the appropriate service file."
 
       property :update_condition, String,

data/lib/chef/resource/habitat_config.rb

@@ -56,7 +56,7 @@ class Chef
       property :remote_sup_http, String, default: "127.0.0.1:9631", desired_state: false,
         description: "Address for remote supervisor http port. Used to pull existing."
 
-      property :gateway_auth_token, String, desired_state: false,
+      property :gateway_auth_token, String, sensitive: true, desired_state: false,
         description: "Auth token for accessing the remote supervisor's http port."
 
       property :user, String, desired_state: false,

data/lib/chef/resource/habitat_service.rb

@@ -119,7 +119,7 @@ class Chef
       property :remote_sup_http, String, default: "127.0.0.1:9631", desired_state: false,
         description: "IP address and port used to communicate with the remote supervisor. If this value is invalid, the resource will update the supervisor configuration each time #{ChefUtils::Dist::Server::PRODUCT} runs."
 
-      property :gateway_auth_token, String, desired_state: false,
+      property :gateway_auth_token, String, sensitive: true, desired_state: false,
         description: "Auth token for accessing the remote supervisor's http port."
 
       property :update_condition, [Symbol, String], equal_to: [:latest, "latest", :'track-channel', "track-channel"], default: :latest, coerce: proc { |s| s.is_a?(String) ? s.to_sym : s },