From 4ca63d18279b5a77e524e00c5b30091aaea61ebe Mon Sep 17 00:00:00 2001 From: nitin sanghi Date: Tue, 11 Aug 2026 16:36:46 +0530 Subject: [PATCH 1/4] SSL not found issue fix Signed-off-by: nitin sanghi --- habitat/aarch64-darwin/plan.sh | 6 +++++- habitat/plan.ps1 | 3 +++ habitat/plan.sh | 6 +++++- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/habitat/aarch64-darwin/plan.sh b/habitat/aarch64-darwin/plan.sh index db8c5c7b..fe2bb117 100644 --- a/habitat/aarch64-darwin/plan.sh +++ b/habitat/aarch64-darwin/plan.sh @@ -13,7 +13,7 @@ pkg_build_deps=( core/make core/cmake ) -pkg_deps=(${ruby_pkg} core/coreutils core/libarchive) +pkg_deps=(${ruby_pkg} core/coreutils core/libarchive core/cacerts) pkg_svc_user=root @@ -61,6 +61,8 @@ do_build() { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 + export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" + export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" bundle install gem build chef-cli.gemspec ruby ./cleanup_gem_lockfiles.rb @@ -109,6 +111,8 @@ set -e export PATH="$(pkg_path_for ${ruby_pkg})/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:$pkg_prefix/vendor/bin:\$PATH" export DYLD_LIBRARY_PATH="$(pkg_path_for core/libarchive)/lib:\$DYLD_LIBRARY_PATH" +export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" +export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" export GEM_HOME="$pkg_prefix/vendor" export GEM_PATH="$pkg_prefix/vendor" export APPBUNDLER_ALLOW_RVM="true" diff --git a/habitat/plan.ps1 b/habitat/plan.ps1 index 73b1693e..ef8343af 100644 --- a/habitat/plan.ps1 +++ b/habitat/plan.ps1 @@ -12,6 +12,7 @@ $pkg_deps=@( "core/ruby3_4-plus-devkit" "core/libarchive" "core/zlib" + "core/cacerts" ) $pkg_build_deps=@( "core/git" @@ -34,6 +35,7 @@ function Invoke-SetupEnvironment { Set-RuntimeEnv APPBUNDLER_ALLOW_RVM "true" # prevent appbundler from clearing out the carefully constructed runtime GEM_PATH Set-RuntimeEnv FORCE_FFI_YAJL "ext" + Set-RuntimeEnv SSL_CERT_FILE "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" Set-RuntimeEnv LANG "en_US.UTF-8" Set-RuntimeEnv LC_CTYPE "en_US.UTF-8" @@ -54,6 +56,7 @@ function Invoke-Build { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 + $env:SSL_CERT_FILE = "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" Write-BuildLine " ** Using bundler to retrieve the Ruby dependencies" bundle install diff --git a/habitat/plan.sh b/habitat/plan.sh index 3e652345..10ca7417 100644 --- a/habitat/plan.sh +++ b/habitat/plan.sh @@ -3,7 +3,7 @@ export HAB_REFRESH_CHANNEL="base-2025" pkg_name=chef-cli pkg_origin=chef ruby_pkg="core/ruby3_4" -pkg_deps=(${ruby_pkg} core/coreutils core/libarchive) +pkg_deps=(${ruby_pkg} core/coreutils core/libarchive core/cacerts) pkg_build_deps=( core/make core/gcc @@ -53,6 +53,8 @@ do_build() { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 + export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" + export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" bundle install gem build chef-cli.gemspec gem install rspec-core -v '~> 3.12.3' @@ -104,6 +106,8 @@ mkdir -p "\${USER_GEM_HOME}" export PATH="$(pkg_path_for ${ruby_pkg})/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:\${USER_GEM_HOME}/bin:$pkg_prefix/vendor/bin:\$PATH" export LD_LIBRARY_PATH="$(pkg_path_for core/libarchive)/lib:\$LD_LIBRARY_PATH" +export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" +export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" export GEM_HOME="\${USER_GEM_HOME}" export GEM_PATH="\${USER_GEM_HOME}:$pkg_prefix/vendor" From c232935b6bbff0ece7557a83151b59c85740f258 Mon Sep 17 00:00:00 2001 From: nitin sanghi Date: Tue, 11 Aug 2026 18:21:15 +0530 Subject: [PATCH 2/4] CHEF-37581: Use -Force on Set-RuntimeEnv SSL_CERT_FILE to avoid conflict with core/cacerts pkg_env Signed-off-by: nitin sanghi --- habitat/plan.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/habitat/plan.ps1 b/habitat/plan.ps1 index ef8343af..b7c7a431 100644 --- a/habitat/plan.ps1 +++ b/habitat/plan.ps1 @@ -35,7 +35,7 @@ function Invoke-SetupEnvironment { Set-RuntimeEnv APPBUNDLER_ALLOW_RVM "true" # prevent appbundler from clearing out the carefully constructed runtime GEM_PATH Set-RuntimeEnv FORCE_FFI_YAJL "ext" - Set-RuntimeEnv SSL_CERT_FILE "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" + Set-RuntimeEnv -Force SSL_CERT_FILE "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" Set-RuntimeEnv LANG "en_US.UTF-8" Set-RuntimeEnv LC_CTYPE "en_US.UTF-8" From ee8068567c904fc012d6c592e089f4f0d1728467 Mon Sep 17 00:00:00 2001 From: nitin sanghi Date: Tue, 11 Aug 2026 18:24:35 +0530 Subject: [PATCH 3/4] CHEF-37581: Use set_runtime_env -f for SSL vars on Linux/macOS to avoid conflict with core/cacerts pkg_env Signed-off-by: nitin sanghi --- habitat/aarch64-darwin/plan.sh | 6 ++++-- habitat/plan.sh | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/habitat/aarch64-darwin/plan.sh b/habitat/aarch64-darwin/plan.sh index fe2bb117..ac6fd216 100644 --- a/habitat/aarch64-darwin/plan.sh +++ b/habitat/aarch64-darwin/plan.sh @@ -35,6 +35,10 @@ do_setup_environment() { set_runtime_env APPBUNDLER_ALLOW_RVM "true" # prevent appbundler from clearing out the carefully constructed runtime GEM_PATH set_runtime_env LANG "en_US.UTF-8" set_runtime_env LC_CTYPE "en_US.UTF-8" + + # core/cacerts already exports SSL_CERT_FILE; -f forces our declaration to win + set_runtime_env -f SSL_CERT_FILE "$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" + set_runtime_env -f SSL_CERT_DIR "$(pkg_path_for core/cacerts)/ssl/certs" } do_prepare() { @@ -61,8 +65,6 @@ do_build() { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 - export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" - export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" bundle install gem build chef-cli.gemspec ruby ./cleanup_gem_lockfiles.rb diff --git a/habitat/plan.sh b/habitat/plan.sh index 10ca7417..eaf7b5a1 100644 --- a/habitat/plan.sh +++ b/habitat/plan.sh @@ -22,6 +22,10 @@ do_setup_environment() { # The actual GEM_HOME/GEM_PATH will be resolved at runtime via the wrapper # script to include ~/.chef/ruby//gems. set_runtime_env CHEF_GEM_HOME_ENABLED "true" + + # core/cacerts already exports SSL_CERT_FILE; -f forces our declaration to win + set_runtime_env -f SSL_CERT_FILE "$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" + set_runtime_env -f SSL_CERT_DIR "$(pkg_path_for core/cacerts)/ssl/certs" } do_prepare() { @@ -53,8 +57,6 @@ do_build() { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 - export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" - export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" bundle install gem build chef-cli.gemspec gem install rspec-core -v '~> 3.12.3' From ab25017194be636897df2f9963c5d4cdd09728c1 Mon Sep 17 00:00:00 2001 From: nitin sanghi Date: Tue, 11 Aug 2026 18:41:11 +0530 Subject: [PATCH 4/4] Fixed copilot suggestion Signed-off-by: nitin sanghi --- habitat/aarch64-darwin/plan.sh | 8 ++------ habitat/plan.ps1 | 3 +-- habitat/plan.sh | 8 ++------ 3 files changed, 5 insertions(+), 14 deletions(-) diff --git a/habitat/aarch64-darwin/plan.sh b/habitat/aarch64-darwin/plan.sh index ac6fd216..65636671 100644 --- a/habitat/aarch64-darwin/plan.sh +++ b/habitat/aarch64-darwin/plan.sh @@ -35,10 +35,6 @@ do_setup_environment() { set_runtime_env APPBUNDLER_ALLOW_RVM "true" # prevent appbundler from clearing out the carefully constructed runtime GEM_PATH set_runtime_env LANG "en_US.UTF-8" set_runtime_env LC_CTYPE "en_US.UTF-8" - - # core/cacerts already exports SSL_CERT_FILE; -f forces our declaration to win - set_runtime_env -f SSL_CERT_FILE "$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" - set_runtime_env -f SSL_CERT_DIR "$(pkg_path_for core/cacerts)/ssl/certs" } do_prepare() { @@ -113,8 +109,8 @@ set -e export PATH="$(pkg_path_for ${ruby_pkg})/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:$pkg_prefix/vendor/bin:\$PATH" export DYLD_LIBRARY_PATH="$(pkg_path_for core/libarchive)/lib:\$DYLD_LIBRARY_PATH" -export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" -export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" +export SSL_CERT_FILE="\${SSL_CERT_FILE:-$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem}" +export SSL_CERT_DIR="\${SSL_CERT_DIR:-$(pkg_path_for core/cacerts)/ssl/certs}" export GEM_HOME="$pkg_prefix/vendor" export GEM_PATH="$pkg_prefix/vendor" export APPBUNDLER_ALLOW_RVM="true" diff --git a/habitat/plan.ps1 b/habitat/plan.ps1 index b7c7a431..11e4310d 100644 --- a/habitat/plan.ps1 +++ b/habitat/plan.ps1 @@ -35,7 +35,6 @@ function Invoke-SetupEnvironment { Set-RuntimeEnv APPBUNDLER_ALLOW_RVM "true" # prevent appbundler from clearing out the carefully constructed runtime GEM_PATH Set-RuntimeEnv FORCE_FFI_YAJL "ext" - Set-RuntimeEnv -Force SSL_CERT_FILE "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" Set-RuntimeEnv LANG "en_US.UTF-8" Set-RuntimeEnv LC_CTYPE "en_US.UTF-8" @@ -56,7 +55,7 @@ function Invoke-Build { bundle config --local jobs 4 bundle config --local retry 5 bundle config --local silence_root_warning 1 - $env:SSL_CERT_FILE = "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" + if (-not $env:SSL_CERT_FILE) { $env:SSL_CERT_FILE = "$(Get-HabPackagePath 'core/cacerts')/ssl/certs/cacert.pem" } Write-BuildLine " ** Using bundler to retrieve the Ruby dependencies" bundle install diff --git a/habitat/plan.sh b/habitat/plan.sh index eaf7b5a1..38443d93 100644 --- a/habitat/plan.sh +++ b/habitat/plan.sh @@ -22,10 +22,6 @@ do_setup_environment() { # The actual GEM_HOME/GEM_PATH will be resolved at runtime via the wrapper # script to include ~/.chef/ruby//gems. set_runtime_env CHEF_GEM_HOME_ENABLED "true" - - # core/cacerts already exports SSL_CERT_FILE; -f forces our declaration to win - set_runtime_env -f SSL_CERT_FILE "$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" - set_runtime_env -f SSL_CERT_DIR "$(pkg_path_for core/cacerts)/ssl/certs" } do_prepare() { @@ -108,8 +104,8 @@ mkdir -p "\${USER_GEM_HOME}" export PATH="$(pkg_path_for ${ruby_pkg})/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:\${USER_GEM_HOME}/bin:$pkg_prefix/vendor/bin:\$PATH" export LD_LIBRARY_PATH="$(pkg_path_for core/libarchive)/lib:\$LD_LIBRARY_PATH" -export SSL_CERT_FILE="$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem" -export SSL_CERT_DIR="$(pkg_path_for core/cacerts)/ssl/certs" +export SSL_CERT_FILE="\${SSL_CERT_FILE:-$(pkg_path_for core/cacerts)/ssl/certs/cacert.pem}" +export SSL_CERT_DIR="\${SSL_CERT_DIR:-$(pkg_path_for core/cacerts)/ssl/certs}" export GEM_HOME="\${USER_GEM_HOME}" export GEM_PATH="\${USER_GEM_HOME}:$pkg_prefix/vendor"