Decoding the Change: Why Progress Chef is Moving to Licensed Downloads

Important Notice: All dates and products referenced on this blog are tentative and may be revised without prior notice based on technical, operational, or customer-impact considerations. Customers should refer to this page and official communications for the most up-to-date information.

Our customers are at the heart of every decision we make. We understand that change, especially when it affects your daily operations, can be challenging. That’s why we want to be transparent, supportive and remind you again about an important update: all Chef product downloads will soon require license validation.

This transition isn’t just a technical shift; it’s a reflection of our unwavering commitment to your security, your success and the long-term excellence of our products.

Why Are We Making This Change?

For years, Chef binaries have been available through open, unauthorized channels. While this approach was originally designed for flexibility and ease, the digital landscape has evolved. Today, software supply-chain security has become a critical concern. When binaries are distributed through unauthorized channels, it becomes harder to ensure customers are consistently using supported, maintained, and verified artifacts. This increases the risk of outdated or unsupported versions remaining in production environments and limits our ability to proactively notify customers of critical fixes, deprecations, or security advisories. Our goal is to provide every Chef user with a secure, consistent, and supported experience. By moving to authorized downloads, we’re taking a significant step forward in that direction.

This is not the first time Chef has modernized its download infrastructure to serve customers better. In 2016, Chef transitioned away from hosting artifacts on JFrog Bintray, moving all public distribution services to packages.chef.io to deliver a more seamless and performant experience for customers. Although, advance notice was provided, a significant number of customers did not update their download endpoints in time, which resulted in broken automation, failed installs, and unexpected outages once Bintray access was shut down.

We want to avoid a repeat of that experience.

Today’s move to licensed downloads builds on those lessons. By introducing phased timelines, and documented migration paths, we are helping customers plan ahead, reduce risk, and avoid disruption, rather than reacting after legacy download paths are no longer available.

What’s Changing?

Here’s what you can expect as we roll out this transition:

• Phased Implementation: We’re gradually retiring unauthorized downloads and introducing authorized, license-validated downloads in stages. The process begins with deprecated products and Chef Server, then extends to older Chef Client versions.
• The Chef Portal for Downloads: From now on, the official Chef Downloads Portal is your go-to destination for all Chef binaries. This portal is designed to be secure, user-friendly and always up to date.
• License Key Requirement: To download any Chef product, you’ll need a valid license key. This ensures that every download is traceable and authorized. You can get a free, trial or a commercial license. For more guidance, please refer to this blog.
• Automated downloads: All automated downloads will need to refer to the new APIs, which will accept a license as a parameter. You can find more details in the “Update Automation” section later on this blog. We are also working on maintaining seamless Kitchen converge operation.
  

What Should You Do Next?

Important Notice: All dates and products referenced on this blog are tentative and may be revised without prior notice based on technical, operational, or customer-impact considerations. Customers should refer to this page and official communications for the most up-to-date information.

We’re here to help you make this transition as seamless as possible. Here are some steps you can take now:

1. Review Your Current Processes:
Identify where and how Chef products are currently being downloaded across your environments. Common patterns include:

• Scripts using curl or wget to pull binaries directly from omnitruck.chef.io or packages.chef.io
• CI/CD pipelines or workflows that install Chef Client, Workstation, or InSpec automatically
• Automation relying on Mixlib Install, install scripts, Chef Client Updater cookbook or or direct package repository registrations ( packages.chef.io configured as a yum/RPM or apt repository)

For further guidance on updating legacy endpoints, refer to this KB article

2. Update Automation:

 All automated downloads must transition to the new download format, which requires a license key parameter.

This may involve:

• Updating Install scripts and direct download URLs to use the new Commercial APIs
• Automation relying on Mixlib Install, Chef Client Updater cookbook, workstation and test kitchen will need to adopt updated versions once they are released
• Update package repository registrations (packages.chef.io configured via yum/RPM or apt) to maintain continued access to licensed downloads
• Existing pipelines should be reviewed to ensure they can securely pass a license identifier when required

Note: We are actively working on releasing the updated versions of Mixlib Install, Chef Client Updater cookbook, workstation and Test Kitchen to support this transition. We will share guidance as soon as it is available.

3. Explore Chef 360: Consider migrating to the Chef 360 platform for an even more streamlined experience.

Additionally, we encourage you to read our blog on the improved Chef Download Portal to get guidance on migrating to licensed downloads.

Implementation Timeline

• Immediate: Legacy and deprecated products will be removed from unauthorized download areas.
• 2026: Older server and client versions will be phased out in stages, with advance notice for each product.
• Next Phase: The next phase will expand beyond the initial transition to address the broader Chef ecosystem, including Chef Client, Chef InSpec and Chef Habitat. This phase will begin with the General Availability of Chef Client 19, which marks the first Chef ecosystem release offered under a Long-Term Support (LTS) model. The GA announcement will also initiate the recommended upgrade window, allowing customers to plan and execute updates in alignment with the new LTS cadence. 

Chef Product Download Changes Phase-wise Shutdown Schedule

The table below outlines when unauthorized downloads will be removed for each product. After these dates, a valid license key will be required to download affected binaries through the new download portal. Deprecated and Legacy products will not be available for download post the mentioned dates.

Important Notice: All dates and products referenced on this blog are tentative and may be revised without prior notice based on technical, operational, or customer-impact considerations. Customers should refer to this page and official communications for the most up-to-date information.

Products with Unauthorized Downloads Already Disabled

Products Scheduled for Unauthorized Download Removal

Our Commitment to You

We understand that any change can feel overwhelming, and we want you to know we’re here with you every step of the way. Our support team is ready to answer your questions, provide guidance and provide any resources you need. Your partnership and trust mean everything to us, and we’re committed to making this transition as smooth as possible. Please refer to this blog and KB article for more guidance.

Thank you for being a valued member of the Chef community. Together, we’re building a safer, more reliable future for everyone.