mixlib-install 3.15.0 → 3.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87576368d2d140a99f1e02a508c19bb3d55dbc637ca3b4d6b39f6bbfcd857ad6
-  data.tar.gz: 4114e92d08cba4ea18093bfaa2e0f02b584dda06de878e56e11fd2c68aa58b9e
+  metadata.gz: a8834bc88f13ec12a50e22d4173262a60a525c4c1841d7fbf078a078f05aaa75
+  data.tar.gz: 606b0c99f0b2245e5e5b7ccc50c15b306dd3a7e20406225342733075c9bf1069
 SHA512:
-  metadata.gz: 428a3a79f93b46f570ac709eaf7fcae54360dc893742360bf42b02ee0565c2992426d1588b4cd4baf6ae7d84898c284148a284824dece7d9890e75964fcea425
-  data.tar.gz: 991621b4937be08512cc2bb556a3848485a2a2e0223dc05382987a400131e49d20536d06df04c84a9d3d18acd10d6f93a7e6d34bb83c3022999fcfe59b4d4756
+  metadata.gz: fbc683eca04103659882fdf18678b7e7221b590285794896ecfb5d73fee6d5313407eb959565ee2ae320fef92e911f47b5fe810e63d7af77d44c1f05d1da1bdc
+  data.tar.gz: b4fa005ff07749845435b43d5df9fcf4a256924415e416beaa145c91f5cf0251d01945d90749cd34c375d5591bac18643ca65668686b242d8e3661ac68de801a

data/Gemfile

@@ -3,20 +3,6 @@ source "https://rubygems.org"
 gemspec
 
 gem "chef-utils", "= 16.6.14" if RUBY_VERSION < "2.6.0"
-# OpenSSL version constraints to fix CRL checking issues in OpenSSL 3.6+
-# Ruby 2.6-2.7 bundled openssl needs update to 3.1.2+
-# Ruby 3.0-3.2 bundled openssl needs update to 3.1.2+
-# Ruby 3.3 bundled openssl needs update to 3.2.2+
-# Ruby 3.4 bundled openssl needs update to 3.3.1+
-if RUBY_VERSION < "2.7.0"
-  gem "openssl", ">= 3.1.2", "< 3.2.0"
-elsif RUBY_VERSION < "3.3.0"
-  gem "openssl", ">= 3.1.2"
-elsif RUBY_VERSION < "3.4.0"
-  gem "openssl", ">= 3.2.2"
-elsif RUBY_VERSION < "4.0.0"
-  gem "openssl", ">= 3.3.1"
-end
 
 group :test do
   gem "contracts", "~> 0.16.0" # this entry can go away when ruby < 3 support is gone

data/lib/mixlib/install/backend/base.rb

@@ -84,7 +84,7 @@ module Mixlib
         def filter_artifacts(artifacts)
           return artifacts unless platform_filters_available?
 
-          # First filter the artifacts based on the platform and architecture
+          # Filter by the exact platform and architecture the user requested.
           artifacts.select! do |a|
             a.platform == options.platform && a.architecture == options.architecture
           end

data/lib/mixlib/install/backend/package_router.rb

@@ -33,12 +33,19 @@ module Mixlib
 
         COMPAT_DOWNLOAD_URL_ENDPOINT = "http://packages.chef.io".freeze
 
+        # Architecture strings that appear as level-2 keys in PM-structure packages
+        # responses (platform -> arch -> pm -> ...) vs version strings in standard
+        # responses (platform -> version -> arch -> ...).
+        KNOWN_ARCHITECTURES = %w{x86_64 aarch64 i386 arm64 ppc64 ppc64le s390x universal x86}.freeze
+
         # Create filtered list of artifacts
         #
         # @return [Array<ArtifactInfo>] list of artifacts for the configured
         # channel, product name, and product version.
         def available_artifacts
-          artifacts = if options.latest_version? || options.partial_version?
+          artifacts = if use_licensed_api? && platform_filters_available?
+                        artifact_from_licensed_metadata
+                      elsif options.latest_version? || options.partial_version?
                         latest_version
                       else
                         artifacts_for_version(options.product_version)
@@ -78,10 +85,12 @@ module Mixlib
 
           # Circumvent early when there are no product artifacts in a specific channel
           if items.empty?
+            hint = options.license_id ? "" : "For habitat based products please provide a license ID with -L or set CHEF_LICENSE_KEY."
             raise ArtifactsNotFound, <<-EOF
 No artifacts found matching criteria.
   product name: #{options.product_name}
   channel: #{options.channel}
+  #{hint}
 EOF
           end
 
@@ -106,6 +115,9 @@ EOF
         #
         # @return [Array<ArtifactInfo>] Array of info about found artifacts
         def latest_version
+          # Trial API only supports "latest" as the version — skip version resolution
+          return artifacts_for_version("latest") if use_trial_api?
+
           product_versions = if options.partial_version?
                                v = options.product_version
                                partial_version = v.end_with?(".") ? v : v + "."
@@ -137,16 +149,18 @@ EOF
               # Commercial/trial APIs use the packages endpoint which returns metadata for all platforms
               query = "v=#{version}"
               packages_hash = get("/#{options.channel}/#{omnibus_project}/packages?#{query}")
-              # Response is a nested hash: platform -> platform_version -> architecture -> package_info
-              # Flatten it to an array of package metadata objects
+              # Response structure differs between products:
+              # - PM-structure products (e.g. chef-ice, inspec-enterprise): platform -> architecture -> package_manager -> package_info
+              # - Standard products: platform -> platform_version -> architecture -> package_info
               results = []
-              packages_hash.each do |platform, platform_versions|
-                platform_versions.each do |platform_version, architectures|
-                  architectures.each do |arch, pkg_info|
+              if pm_structure_response?(packages_hash)
+                packages_hash.each do |platform, architectures|
+                  architectures.each do |arch, package_managers|
+                    pkg_info = package_managers.values.first
                     results << {
                       "omnibus.version" => pkg_info["version"],
                       "omnibus.platform" => platform,
-                      "omnibus.platform_version" => platform_version,
+                      "omnibus.platform_version" => "",
                       "omnibus.architecture" => arch,
                       "omnibus.project" => omnibus_project,
                       "omnibus.license" => "Apache-2.0",
@@ -156,6 +170,25 @@ EOF
                     }
                   end
                 end
+              else
+                # Standard structure: platform -> platform_version -> architecture -> package_info
+                packages_hash.each do |platform, platform_versions|
+                  platform_versions.each do |platform_version, architectures|
+                    architectures.each do |arch, pkg_info|
+                      results << {
+                        "omnibus.version" => pkg_info["version"],
+                        "omnibus.platform" => platform,
+                        "omnibus.platform_version" => platform_version,
+                        "omnibus.architecture" => arch,
+                        "omnibus.project" => omnibus_project,
+                        "omnibus.license" => "Apache-2.0",
+                        "omnibus.sha256" => pkg_info["sha256"],
+                        "omnibus.sha1" => pkg_info.fetch("sha1", ""),
+                        "omnibus.md5" => pkg_info.fetch("md5", ""),
+                      }
+                    end
+                  end
+                end
               end
             else
               results = get("/api/v1/#{options.channel}/#{omnibus_project}/#{version}/artifacts")["results"]
@@ -198,6 +231,16 @@ EOF
           res = http.request(create_http_request(full_path))
           res.value
           JSON.parse(res.body)
+        rescue Net::HTTPClientError, Net::HTTPServerError => e
+          # Provide helpful error messages for licensed API failures
+          if use_trial_api?
+            if options.channel != :stable || (options.product_version != :latest && options.product_version.to_sym != :latest)
+              raise "Trial API only supports stable channel and latest version. " \
+                    "Current settings: channel=#{options.channel}, version=#{options.product_version}. " \
+                    "Error: #{e.message}"
+            end
+          end
+          raise e
         end
 
         def create_http_request(full_path)
@@ -208,6 +251,50 @@ EOF
           request
         end
 
+        # Detects whether a packages API response uses PM-structure format.
+        # Standard:     platform -> platform_version -> architecture -> pkg_info
+        #
+        # Detection: PM-structure has architecture strings (x86_64, aarch64, …) as
+        # the second-level keys; standard has version strings (20.04, 18.04, …).
+        def pm_structure_response?(packages_hash)
+          first_platform = packages_hash.values.first
+          return false unless first_platform.is_a?(Hash)
+
+          first_platform.keys.any? { |k| KNOWN_ARCHITECTURES.include?(k) }
+        end
+
+        # Fetches a single artifact from the licensed API metadata endpoint.
+        # Used when a platform is specified, giving the server full context to
+        # derive the package manager and return the correct sha256 — no pm needed.
+        def artifact_from_licensed_metadata
+          version = (options.latest_version? || options.partial_version?) ? "latest" : options.product_version
+          query = "v=#{version}&p=#{options.platform}&m=#{Util.normalize_architecture(options.architecture)}"
+          query += "&pv=#{options.platform_version}" unless options.platform_version.to_s.empty?
+
+          begin
+            metadata = get("/#{options.channel}/#{omnibus_project}/metadata?#{query}")
+          rescue Net::HTTPServerException => e
+            return [] if e.message.match?(/400|404/)
+
+            raise e
+          end
+
+          return [] if metadata.nil? || metadata.empty?
+
+          artifact_map = {
+            "omnibus.version" => metadata["version"],
+            "omnibus.platform" => options.platform,
+            "omnibus.platform_version" => options.platform_version.to_s,
+            "omnibus.architecture" => options.architecture,
+            "omnibus.project" => omnibus_project,
+            "omnibus.license" => "Apache-2.0",
+            "omnibus.sha256" => metadata["sha256"],
+            "omnibus.sha1" => metadata.fetch("sha1", ""),
+            "omnibus.md5" => metadata.fetch("md5", ""),
+          }
+          [create_artifact(artifact_map)]
+        end
+
         def create_artifact(artifact_map)
           # set normalized platform and platform version
           platform, platform_version = normalize_platform(
@@ -245,13 +332,15 @@ EOF
 
           # create the download path with the correct endpoint
           if use_licensed_api?
-            # Commercial/trial APIs use the download endpoint with query parameters
-            # Construct platform parameters
-            p_param = platform
-            pv_param = platform_version
+            # Commercial/trial APIs use the download endpoint with query parameters.
+
             m_param = Util.normalize_architecture(artifact_map["omnibus.architecture"])
             v_param = artifact_map["omnibus.version"]
-            download_url = "#{endpoint}/#{options.channel}/#{omnibus_project}/download?p=#{p_param}&pv=#{pv_param}&m=#{m_param}&v=#{v_param}&license_id=#{options.license_id}"
+            # Use the user's actual platform (e.g. "ubuntu", "el") so the server can derive pm.
+            p_param = options.platform || platform
+            pv_param = options.platform_version || platform_version
+            pv_part = pv_param.to_s.empty? ? "" : "&pv=#{pv_param}"
+            download_url = "#{endpoint}/#{options.channel}/#{omnibus_project}/download?p=#{p_param}#{pv_part}&m=#{m_param}&v=#{v_param}&license_id=#{options.license_id}"
           else
             base_url = if use_compat_download_url_endpoint?(platform, platform_version)
                          COMPAT_DOWNLOAD_URL_ENDPOINT

data/lib/mixlib/install/cli.rb

@@ -31,8 +31,12 @@ module Mixlib
       end
 
       desc "list-versions PRODUCT_NAME CHANNEL", "list available version for a product/channel"
+      option :license_id,
+        desc: "License ID for commercial/trial API",
+        aliases: ["-L"]
       def list_versions(product_name, channel)
-        say Mixlib::Install.available_versions(product_name, channel).join("\n")
+        lid = options[:license_id] || ENV["CHEF_LICENSE_KEY"]
+        say Mixlib::Install.available_versions(product_name, channel, license_id: lid).join("\n")
       end
 
       desc "list-products", "list available products"

data/lib/mixlib/install/dist.rb

@@ -26,10 +26,30 @@ module Mixlib
       RESOURCES_URL = "https://www.chef.io/support".freeze
       # MacOS volume name
       MACOS_VOLUME = "chef_software".freeze
-      # Windows install directory name
-      WINDOWS_INSTALL_DIR = "opscode".freeze
-      # Linux install directory name
-      LINUX_INSTALL_DIR = "/opt"
+      # Omnibus Windows install directory name
+      OMNIBUS_WINDOWS_INSTALL_DIR = "opscode".freeze
+      # Omnibus Linux install directory name
+      OMNIBUS_LINUX_INSTALL_DIR = "/opt".freeze
+      # Habitat Windows install directory name
+      HABITAT_WINDOWS_INSTALL_DIR = "hab\\pkgs".freeze
+      # Habitat Linux install directory name
+      HABITAT_LINUX_INSTALL_DIR = "/hab/pkgs".freeze
+
+      # Check if a license_id is for trial API
+      # @param license_id [String] the license ID to check
+      # @return [Boolean] true if license_id indicates trial API usage
+      def self.trial_license?(license_id)
+        !license_id.nil? && !license_id.to_s.empty? &&
+          license_id.start_with?("free-", "trial-")
+      end
+
+      # Check if a license_id is for commercial API
+      # @param license_id [String] the license ID to check
+      # @return [Boolean] true if license_id indicates commercial API usage
+      def self.commercial_license?(license_id)
+        !license_id.nil? && !license_id.to_s.empty? &&
+          !trial_license?(license_id)
+      end
     end
   end
 end

data/lib/mixlib/install/generator/base.rb

@@ -19,7 +19,6 @@ require "erb" unless defined?(Erb)
 require "ostruct" unless defined?(OpenStruct)
 require_relative "../util"
 require_relative "../dist"
-require "net/http" unless defined?(Net::HTTP)
 
 module Mixlib
   class Install
@@ -50,13 +49,12 @@ module Mixlib
           if File.exist? "#{script_path}.erb"
             # Default values to use incase they are not set in the context
             context[:project_name] ||= Mixlib::Install::Dist::PROJECT_NAME.freeze
-            context[:base_url] ||= Mixlib::Install::Dist::OMNITRUCK_ENDPOINT.freeze
             context[:default_product] ||= Mixlib::Install::Dist::DEFAULT_PRODUCT.freeze
             context[:bug_url] ||= Mixlib::Install::Dist::BUG_URL.freeze
             context[:support_url] ||= Mixlib::Install::Dist::SUPPORT_URL.freeze
             context[:resources_url] ||= Mixlib::Install::Dist::RESOURCES_URL.freeze
             context[:macos_dir] ||= Mixlib::Install::Dist::MACOS_VOLUME.freeze
-            context[:windows_dir] ||= Mixlib::Install::Dist::WINDOWS_INSTALL_DIR.freeze
+            context[:windows_dir] ||= context[:default_product].casecmp("chef-ice") == 0 ? Mixlib::Install::Dist::HABITAT_WINDOWS_INSTALL_DIR.freeze : Mixlib::Install::Dist::OMNIBUS_WINDOWS_INSTALL_DIR.freeze
             context[:user_agent_string] = Util.user_agent_string(context[:user_agent_headers])
 
             context_object = OpenStruct.new(context).instance_eval { binding }
@@ -69,17 +67,6 @@ module Mixlib
         def get_script(name, context = {})
           self.class.get_script(name, context)
         end
-
-        def install_sh_from_upstream
-          uri = URI.parse(options.options[:new_omnibus_download_url])
-          response = Net::HTTP.get_response(uri)
-
-          if response.code == "200"
-            response.body
-          else
-            raise StandardError, "unable to fetch the install.sh"
-          end
-        end
       end
     end
   end

data/lib/mixlib/install/generator/bourne/scripts/check_product.sh

@@ -8,7 +8,7 @@ else
 fi
 
 for path in $install_paths; do
-  if [ -d "$path" ] 2>/dev/null && [ "x$install_strategy" = "xonce" ]; then
+  if [ -d "$path" ] && [ "$install_strategy" = "once" ]; then
     echo "$project installation detected at $path"
     echo "install_strategy set to 'once'"
     echo "Nothing to install"

data/lib/mixlib/install/generator/bourne/scripts/fetch_metadata.sh.erb

@@ -3,7 +3,15 @@
 # This section calls omnitruck to get the information about the build to be
 #   installed.
 #
+#  EXAMPLE
+#    curl -L '<%= base_url || "https://chefdownload-commercial.chef.io" %>/install.sh<%= base_url && base_url.include?("chefdownload") ? "?license_id=$CHEF_LICENSE_KEY" : "" %>' | sudo bash -s --  -P chef -c stable
+#
+# Gets the download url and SHA256 checksum for the latest stable release of Chef Workstation.
+#   EXAMPLE
+#     curl -L '<%= base_url || "https://chefdownload-commercial.chef.io" %>/install.sh<%= base_url && base_url.include?("chefdownload") ? "?license_id=$CHEF_LICENSE_KEY" : "" %>' | sudo bash -s --  -P chef-workstation -c stable
+#
 # Inputs:
+# $base_api_url:
 # $channel:
 # $project:
 # $version:
@@ -17,38 +25,60 @@
 # $sha256:
 ############
 
-if test "x$download_url_override" = "x"; then
+if [ -z "$download_url_override" ]; then
   echo "Getting information for $project $channel $version for $platform..."
 
   metadata_filename="$tmp_dir/metadata.txt"
+<% if base_url && !base_url.to_s.empty? %>
+  # Set base_api_url from option if not already set via CLI parameter
+  if [ -z "$base_api_url" ]; then
+    base_api_url="<%= base_url %>"
+  fi
+<% end %>
 
   # Use commercial API if license_id is provided, otherwise use omnitruck
-  if test "x$license_id" != "x"; then
-    # Check if license_id starts with 'free-' or 'trial-' for trial API
-    case "$license_id" in
-      free-*|trial-*)
-        # Trial API endpoint
-        base_api_url="https://chefdownload-trial.chef.io"
-        ;;
-      *)
-        # Commercial API endpoint
-        base_api_url="https://chefdownload-commercial.chef.io"
-        ;;
-    esac
-    metadata_url="$base_api_url/$channel/$project/metadata?v=$version&p=$platform&pv=$platform_version&m=$machine&license_id=$license_id"
+  if [ -z "$base_api_url" ]; then
+    if [ -n "$license_id" ]; then
+      # Check if license_id starts with 'free-' or 'trial-' for trial API
+      case "$license_id" in
+        free-*|trial-*)
+          # Trial API endpoint
+          base_api_url="<%= Mixlib::Install::Dist::TRIAL_API_ENDPOINT %>"
+          ;;
+        *)
+          # Commercial API endpoint
+          base_api_url="<%= Mixlib::Install::Dist::COMMERCIAL_API_ENDPOINT %>"
+          ;;
+      esac
+    else
+      # Omnitruck endpoint
+      base_api_url="<%= Mixlib::Install::Dist::OMNITRUCK_ENDPOINT %>"
+    fi
+  fi
+
+  if [ -n "$license_id" ]; then
+    license_param="&license_id=$license_id"
   else
-    # Omnitruck endpoint
-    metadata_url="<%= base_url %>/$channel/$project/metadata?v=$version&p=$platform&pv=$platform_version&m=$machine"
+    license_param=""
   fi
 
-  do_download "$metadata_url"  "$metadata_filename"
+  if [ -n "$package_manager" ]; then
+    pm_param="&pm=$package_manager"
+  else
+    pm_param=""
+  fi
+
+  # Build the metadata URL.
+  metadata_url="$base_api_url/$channel/$project/metadata?v=$version&p=$platform&pv=$platform_version&m=$machine${license_param}${pm_param}"
+
+  do_download "$metadata_url" "$metadata_filename"
 
   cat "$metadata_filename"
 
   echo ""
 
   # Commercial and trial APIs return JSON, omnitruck returns text format
-  if test "x$license_id" != "x"; then
+  if [ -n "$license_id" ]; then
     # Parse JSON response from commercial/trial API
     # Check if response looks like JSON
     if grep -q '^{' "$metadata_filename" 2>/dev/null; then
@@ -57,7 +87,7 @@ if test "x$download_url_override" = "x"; then
       download_url=`sed -n 's/.*"url":"\([^"]*\)".*/\1/p' "$metadata_filename"`
       sha256=`sed -n 's/.*"sha256":"\([^"]*\)".*/\1/p' "$metadata_filename"`
 
-      if test "x$download_url" != "x" && test "x$sha256" != "x"; then
+      if [ -n "$download_url" ] && [ -n "$sha256" ]; then
         echo "downloaded metadata file looks valid..."
       else
         echo "downloaded metadata file is corrupted or an uncaught error was encountered in downloading the file..."

data/lib/mixlib/install/generator/bourne/scripts/fetch_package.sh

@@ -17,16 +17,36 @@
 
 # For licensed APIs (commercial/trial), the URL is an endpoint, not a direct file URL
 # The actual filename will come from the Content-Disposition header
-if test "x$license_id" != "x"; then
-  # Use content-disposition to get the filename
+# Also check if download_url_override is used with a URL that doesn't have a filename
+# (e.g., ends with /download or /download?params instead of /package-1.2.3.rpm)
+
+# Function to check if URL path contains a valid package filename
+has_package_filename() {
+  url_path=`echo "$1" | sed -e 's/?.*//' -e 's/^.*\///'`
+  # Check if the path segment has a package extension
+  case "$url_path" in
+    *.rpm|*.deb|*.pkg|*.msi|*.dmg|*.bff|*.p5p|*.solaris|*.sh)
+      return 0  # has valid filename
+      ;;
+    *)
+      return 1  # no valid filename
+      ;;
+  esac
+}
+
+# Determine if we need to use content-disposition based on license_id or URL structure
+if [ -n "$license_id" ] || ! has_package_filename "$download_url"; then
+  # Use content-disposition to get the filename if:
+  # 1. license_id is set (commercial/trial API)
+  # 2. URL doesn't contain a package filename (e.g., ends with /download or /download?params)
   use_content_disposition="true"
   # We don't know the filename yet - it will come from Content-Disposition
   # Just set the download directory
-  if test "x$cmdline_filename" != "x"; then
+  if [ -n "$cmdline_filename" ]; then
     download_filename="$cmdline_filename"
     download_dir=`dirname $download_filename`
     use_content_disposition="false"  # User specified exact filename
-  elif test "x$cmdline_dl_dir" != "x"; then
+  elif [ -n "$cmdline_dl_dir" ]; then
     download_dir="$cmdline_dl_dir"
     download_filename=""  # Will be determined after download
   else
@@ -41,9 +61,9 @@ else
   filetype=`echo $filename | sed -e 's/^.*\.//'`
 
   # use either $tmp_dir, the provided directory (-d) or the provided filename (-f)
-  if test "x$cmdline_filename" != "x"; then
+  if [ -n "$cmdline_filename" ]; then
     download_filename="$cmdline_filename"
-  elif test "x$cmdline_dl_dir" != "x"; then
+  elif [ -n "$cmdline_dl_dir" ]; then
     download_filename="$cmdline_dl_dir/$filename"
   else
     download_filename="$tmp_dir/$filename"
@@ -64,19 +84,19 @@ cached_file_available="false"
 verify_checksum="true"
 
 # Skip caching checks when using content-disposition since we don't know the real filename yet
-if test "x$use_content_disposition" = "xtrue"; then
+if [ "$use_content_disposition" = "true" ]; then
   cached_file_available="false"
   verify_checksum="true"
-elif test "x$download_filename" != "x" && test -f "$download_filename"; then
+elif [ -n "$download_filename" ] && [ -f "$download_filename" ]; then
   echo "$download_filename exists"
   cached_file_available="true"
 fi
 
-if test "x$download_url_override" != "x" && test "x$use_content_disposition" = "xfalse"; then
+if [ -n "$download_url_override" ] && [ "$use_content_disposition" = "false" ]; then
   echo "Download URL override specified"
-  if test "x$cached_file_available" = "xtrue"; then
+  if [ "$cached_file_available" = "true" ]; then
     echo "Verifying local file"
-    if test "x$sha256" = "x"; then
+    if [ -z "$sha256" ]; then
       echo "Checksum not specified, ignoring existing file"
       cached_file_available="false" # download new file
       verify_checksum="false" # no checksum to compare after download
@@ -92,7 +112,7 @@ if test "x$download_url_override" != "x" && test "x$use_content_disposition" = "
   else
     echo "$download_filename not found"
     cached_file_available="false" # download new file
-    if test "x$sha256" = "x"; then
+    if [ -z "$sha256" ]; then
       verify_checksum="false" # no checksum to compare after download
     else
       verify_checksum="true" # checksum new downloaded file
@@ -100,8 +120,8 @@ if test "x$download_url_override" != "x" && test "x$use_content_disposition" = "
   fi
 fi
 
-if test "x$cached_file_available" != "xtrue"; then
-  if test "x$use_content_disposition" = "xtrue"; then
+if [ "$cached_file_available" != "true" ]; then
+  if [ "$use_content_disposition" = "true" ]; then
     # For licensed APIs, download to a temporary file and extract filename from response headers
     # The download_dir was already set during initialization above
 
@@ -112,33 +132,33 @@ if test "x$cached_file_available" != "xtrue"; then
     do_download "$download_url" "$temp_download"
 
     # Extract filename from response headers (try multiple methods for compatibility)
-    if test -f "$tmp_dir/stderr"; then
+    if [ -f "$tmp_dir/stderr" ]; then
       # Method 1: Try to extract filename from content-disposition header
       # Format: content-disposition: attachment; filename="chef-18.8.54-1.el9.x86_64.rpm"
       actual_filename=`grep -i 'content-disposition' $tmp_dir/stderr | sed -n 's/.*filename="\([^"]*\)".*/\1/p' | head -1`
 
       # Method 2: If content-disposition failed, try to extract from location redirect header
       # Format: location: https://packages.chef.io/files/stable/chef/18.8.54/el/9/chef-18.8.54-1.el9.x86_64.rpm?licenseId=...
-      if test "x$actual_filename" = "x"; then
+      if [ -z "$actual_filename" ]; then
         actual_filename=`grep -i '^location:' $tmp_dir/stderr | head -1 | sed 's/.*\///' | sed 's/?.*//'`
       fi
 
       # Method 3: Try extracting from any URL-like pattern in stderr
-      if test "x$actual_filename" = "x"; then
+      if [ -z "$actual_filename" ]; then
         actual_filename=`grep -i '\.rpm\|\.deb\|\.pkg\|\.msi\|\.dmg' $tmp_dir/stderr | sed -n 's/.*\/\([^/?]*\.\(rpm\|deb\|pkg\|msi\|dmg\)\).*/\1/p' | head -1`
       fi
     fi
 
     # If we still couldn't extract from headers, construct filename from metadata
-    if test "x$actual_filename" = "x"; then
+    if [ -z "$actual_filename" ]; then
       echo "Warning: Could not extract filename from response headers, using fallback"
       # Construct a reasonable filename from available metadata
       # This is a fallback and may not match the exact package name
-      if test "x$platform" = "xel" || test "x$platform" = "xfedora" || test "x$platform" = "xamazon"; then
+      if [ "$platform" = "el" ] || [ "$platform" = "fedora" ] || [ "$platform" = "amazon" ]; then
         actual_filename="chef-${version}-1.${platform}${platform_version}.${machine}.rpm"
-      elif test "x$platform" = "xdebian" || test "x$platform" = "xubuntu"; then
+      elif [ "$platform" = "debian" ] || [ "$platform" = "ubuntu" ]; then
         actual_filename="chef_${version}-1_${machine}.deb"
-      elif test "x$platform" = "xmac_os_x"; then
+      elif [ "$platform" = "mac_os_x" ]; then
         actual_filename="chef-${version}.dmg"
       else
         actual_filename="chef-${version}.pkg"
@@ -160,8 +180,12 @@ if test "x$cached_file_available" != "xtrue"; then
   fi
 fi
 
-if test "x$verify_checksum" = "xtrue"; then
-  do_checksum "$download_filename" "$sha256" || checksum_mismatch
+if [ "$verify_checksum" = "true" ]; then
+  if [ -z "$sha256" ]; then
+    echo "Skipping checksum verification - no checksum provided"
+  else
+    do_checksum "$download_filename" "$sha256" || checksum_mismatch
+  fi
 fi
 
 ############