chef 18.8.11 → 18.8.46

data/spec/unit/compliance/reporter/compliance_enforcer_spec.rb

@@ -1,49 +0,0 @@
-require "spec_helper"
-require "chef/compliance/reporter/compliance_enforcer"
-
-describe Chef::Compliance::Reporter::ComplianceEnforcer do
-  let(:reporter) { Chef::Compliance::Reporter::ComplianceEnforcer.new }
-
-  it "does not raise error for a successful InSpec report" do
-    report = {
-      "profiles": [
-        {
-          "controls": [
-            { "id": "c1", "results": [{ "status": "passed" }] },
-            { "id": "c2", "results": [{ "status": "passed" }] },
-          ],
-        },
-      ],
-    }
-
-    expect(reporter.send_report(report)).to eq(true)
-  end
-
-  it "does not raise error for an InSpec report with no controls" do
-    report = { "profiles": [{ "name": "empty" }] }
-
-    expect(reporter.send_report(report)).to eq(true)
-  end
-
-  it "does not raise error for an InSpec report with controls but no results" do
-    report = { "profiles": [{ "controls": [{ "id": "empty" }] }] }
-    expect(reporter.send_report(report)).to eq(true)
-  end
-
-  it "raises an error for a failed InSpec report" do
-    report = {
-      "profiles": [
-        {
-          "controls": [
-            { "id": "c1", "results": [{ "status": "passed" }] },
-            { "id": "c2", "results": [{ "status": "failed" }] },
-          ],
-        },
-      ],
-    }
-
-    expect {
-      reporter.send_report(report)
-    }.to raise_error(Chef::Compliance::Reporter::ComplianceEnforcer::ControlFailure, "Audit c2 has failed. Aborting chef-client run.")
-  end
-end

data/spec/unit/compliance/runner_spec.rb

@@ -1,354 +0,0 @@
-require "spec_helper"
-require "tmpdir"
-
-describe Chef::Compliance::Runner do
-  let(:logger) { double(:logger).as_null_object }
-  let(:node) { Chef::Node.new(logger: logger) }
-
-  let(:runner) do
-    described_class.new.tap do |r|
-      r.node = node
-      r.run_id = "my_run_id"
-    end
-  end
-
-  describe "#enabled?" do
-    context "when the node is not available" do
-      let(:runner) { described_class.new }
-      it "is false because it needs the node to answer that question" do
-        expect(runner).not_to be_enabled
-      end
-    end
-
-    it "is true if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is nil" do
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = nil
-
-      expect(runner).to be_enabled
-    end
-
-    it "is true if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is true" do
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = true
-
-      expect(runner).to be_enabled
-    end
-
-    it "is false if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is false" do
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = false
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is false if the node attributes have audit profiles and the audit cookbook is present, and the complince mode attribute is nil" do
-      stub_const("::Reporter::ChefAutomate", true)
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = nil
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is false if the node attributes have audit profiles and the audit cookbook is present, and the complince mode attribute is false" do
-      stub_const("::Reporter::ChefAutomate", true)
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = false
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is true if the node attributes have audit profiles and the audit cookbook is present, and the complince mode attribute is true" do
-      stub_const("::Reporter::ChefAutomate", true)
-      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
-      node.normal["audit"]["compliance_phase"] = true
-
-      expect(runner).to be_enabled
-    end
-
-    it "is false if the node attributes do not have audit profiles and the audit cookbook is not present, and the complince mode attribute is nil" do
-      node.normal["audit"]["profiles"] = {}
-      node.normal["audit"]["compliance_phase"] = nil
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is false if the node attributes do not have audit profiles and the audit cookbook is present, and the complince mode attribute is nil" do
-      stub_const("::Reporter::ChefAutomate", true)
-      node.automatic["recipes"] = %w{ audit::default fancy_cookbook::fanciness tacobell::nachos }
-      node.normal["audit"]["compliance_phase"] = nil
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is false if the node attributes do not have audit attributes and the audit cookbook is not present, and the complince mode attribute is nil" do
-      node.automatic["recipes"] = %w{ fancy_cookbook::fanciness tacobell::nachos }
-      node.normal["audit"]["compliance_phase"] = nil
-
-      expect(runner).not_to be_enabled
-    end
-
-    it "is true if the node attributes do not have audit profiles and the audit cookbook is not present, and the complince mode attribute is true" do
-      node.normal["audit"]["profiles"] = {}
-      node.normal["audit"]["compliance_phase"] = true
-
-      expect(runner).to be_enabled
-    end
-
-    it "is true if the node attributes do not have audit profiles and the audit cookbook is present, and the complince mode attribute is true" do
-      stub_const("::Reporter::ChefAutomate", true)
-      node.automatic["recipes"] = %w{ audit::default fancy_cookbook::fanciness tacobell::nachos }
-      node.normal["audit"]["compliance_phase"] = true
-
-      expect(runner).to be_enabled
-    end
-
-    it "is true if the node attributes do not have audit attributes and the audit cookbook is not present, and the complince mode attribute is true" do
-      node.automatic["recipes"] = %w{ fancy_cookbook::fanciness tacobell::nachos }
-      node.normal["audit"]["compliance_phase"] = true
-      expect(runner).to be_enabled
-    end
-  end
-
-  describe "#inspec_profiles" do
-    it "returns an empty list with no profiles defined" do
-      expect(runner.inspec_profiles).to eq([])
-    end
-
-    it "converts from the attribute format to the format Inspec expects" do
-      node.normal["audit"]["profiles"]["linux-baseline"] = {
-        'compliance': "user/linux-baseline",
-        'version': "2.1.0",
-      }
-
-      node.normal["audit"]["profiles"]["ssh"] = {
-        'supermarket': "hardening/ssh-hardening",
-      }
-
-      expected = [
-        {
-          compliance: "user/linux-baseline",
-          name: "linux-baseline",
-          version: "2.1.0",
-        },
-        {
-          name: "ssh",
-          supermarket: "hardening/ssh-hardening",
-        },
-      ]
-
-      expect(runner.inspec_profiles).to eq(expected)
-    end
-
-    it "raises a CMPL010 message when the profiles are in the old audit-cookbook format" do
-      node.normal["audit"]["profiles"] = [
-        {
-          name: "Windows 2019 Baseline",
-          compliance: "admin/windows-2019-baseline",
-        },
-      ]
-
-      expect { runner.inspec_profiles }.to raise_error(/CMPL010:/)
-    end
-  end
-
-  describe "#warn_for_deprecated_config_values!" do
-    it "logs a warning when deprecated config values are present" do
-      node.normal["audit"]["owner"] = "my_org"
-      node.normal["audit"]["inspec_version"] = "90210"
-
-      expect(logger).to receive(:warn).with(/config values 'inspec_version', 'owner' are not supported/)
-
-      runner.warn_for_deprecated_config_values!
-    end
-
-    it "does not log a warning with no deprecated config values" do
-      node.normal["audit"]["profiles"]["linux-baseline"] = {
-        'compliance': "user/linux-baseline",
-        'version': "2.1.0",
-      }
-
-      expect(logger).not_to receive(:warn)
-
-      runner.warn_for_deprecated_config_values!
-    end
-  end
-
-  describe "#reporter" do
-    context "chef-server-automate reporter" do
-      it "uses the correct URL when 'server' attribute is set" do
-        Chef::Config[:chef_server_url] = "https://chef_config_url.example.com/my_org"
-        node.normal["audit"]["server"] = "https://server_attribute_url.example.com/application/sub_application"
-
-        reporter = runner.reporter("chef-server-automate")
-
-        expect(reporter).to be_kind_of(Chef::Compliance::Reporter::ChefServerAutomate)
-        expect(reporter.url).to eq(URI("https://server_attribute_url.example.com/application/sub_application/organizations/my_org/data-collector"))
-      end
-
-      it "falls back to chef_server_url for URL when 'server' attribute is not set" do
-        Chef::Config[:chef_server_url] = "https://chef_config_url.example.com/my_org"
-
-        reporter = runner.reporter("chef-server-automate")
-
-        expect(reporter).to be_kind_of(Chef::Compliance::Reporter::ChefServerAutomate)
-        expect(reporter.url).to eq(URI("https://chef_config_url.example.com/organizations/my_org/data-collector"))
-      end
-    end
-
-  end
-
-  describe "#load_and_validate! when compliance is enabled" do
-    before do
-      allow(runner).to receive(:enabled?).and_return(true)
-    end
-
-    it "raises CMPL003 when the reporter is not a supported reporter type" do
-      node.normal["audit"]["reporter"] = [ "invalid" ]
-      expect { runner.load_and_validate! }.to raise_error(/^CMPL003:/)
-    end
-    it "raises CMPL002 if the configured fetcher is not supported" do
-      node.normal["audit"]["fetcher"] = "invalid"
-      expect { runner.load_and_validate! }.to raise_error(/^CMPL002:/)
-    end
-
-    it "raises CMPL004 if both the inputs and attributes node attributes are set" do
-      node.normal["audit"]["attributes"] = {
-        "tacos" => "lunch",
-      }
-      node.normal["audit"]["inputs"] = {
-        "tacos" => "lunch",
-      }
-      expect { runner.load_and_validate! }.to raise_error(/^CMPL011:/)
-    end
-
-    it "validates configured reporters" do
-      node.normal["audit"]["reporter"] = [ "chef-automate" ]
-      reporter_double = double("reporter", validate_config!: nil)
-      expect(runner).to receive(:reporter).with("chef-automate").and_return(reporter_double)
-      expect(runner).to receive(:reporter).with("cli").and_return(reporter_double)
-      runner.load_and_validate!
-    end
-
-  end
-
-  describe "#inspec_opts" do
-    it "pulls inputs from the attributes setting" do
-      node.normal["audit"]["attributes"] = {
-        "tacos" => "lunch",
-      }
-
-      inputs = runner.inspec_opts[:inputs]
-
-      expect(inputs["tacos"]).to eq("lunch")
-    end
-
-    it "pulls inputs from the inputs setting" do
-      node.normal["audit"]["inputs"] = {
-        "tacos" => "lunch",
-      }
-
-      inputs = runner.inspec_opts[:inputs]
-
-      expect(inputs["tacos"]).to eq("lunch")
-    end
-
-    it "favors inputs over attributes" do
-      node.normal["audit"]["attributes"] = {
-        "tacos" => "dinner",
-      }
-
-      node.normal["audit"]["inputs"] = {
-        "tacos" => "lunch",
-      }
-
-      inputs = runner.inspec_opts[:inputs]
-
-      expect(inputs["tacos"]).to eq("lunch")
-    end
-
-    it "does not include chef_node in inputs by default" do
-      node.normal["audit"]["attributes"] = {
-        "tacos" => "lunch",
-        "nachos" => "dinner",
-      }
-
-      inputs = runner.inspec_opts[:inputs]
-
-      expect(inputs["tacos"]).to eq("lunch")
-      expect(inputs.key?("chef_node")).to eq(true)
-    end
-
-    it "includes chef_node in inputs with chef_node_attribute_enabled set" do
-      node.normal["audit"]["chef_node_attribute_enabled"] = true
-      node.normal["audit"]["attributes"] = {
-        "tacos" => "lunch",
-        "nachos" => "dinner",
-      }
-
-      inputs = runner.inspec_opts[:inputs]
-
-      expect(inputs["tacos"]).to eq("lunch")
-      expect(inputs["chef_node"]["audit"]["reporter"]).to eq(nil)
-      expect(inputs["chef_node"]["chef_environment"]).to eq("_default")
-    end
-  end
-
-  describe "interval running" do
-    let(:tempdir) { Dir.mktmpdir("chef-compliance-tests") }
-
-    before do
-      allow(runner).to receive(:report_timing_file).and_return("#{tempdir}/report_timing.json")
-    end
-
-    it "is disabled by default" do
-      expect(runner.node["audit"]["interval"]["enabled"]).to be false
-    end
-
-    it "defaults to 24 hours / 1440 minutes" do
-      expect(runner.node["audit"]["interval"]["time"]).to be 1440
-    end
-
-    it "runs when the timing file does not exist" do
-      expect(runner).to receive(:report)
-      runner.report_with_interval
-    end
-
-    it "runs when the timing file does not exist and intervals are enabled" do
-      node.normal["audit"]["interval"]["enabled"] = true
-      expect(runner).to receive(:report)
-      runner.report_with_interval
-    end
-
-    it "runs when the timing file exists and has a recent timestamp" do
-      FileUtils.touch runner.report_timing_file
-      expect(runner).to receive(:report)
-      runner.report_with_interval
-    end
-
-    it "does not runs when the timing file exists and has a recent timestamp and intervals are enabled" do
-      node.normal["audit"]["interval"]["enabled"] = true
-      FileUtils.touch runner.report_timing_file
-      expect(runner).not_to receive(:report)
-      runner.report_with_interval
-    end
-
-    it "does not runs when the timing file exists and has a recent timestamp and intervals are enabled" do
-      node.normal["audit"]["interval"]["enabled"] = true
-      FileUtils.touch runner.report_timing_file
-      ten_minutes_ago = Time.now - 600
-      File.utime ten_minutes_ago, ten_minutes_ago, runner.report_timing_file
-      expect(runner).not_to receive(:report)
-      runner.report_with_interval
-    end
-
-    it "runs when the timing file exists and has a recent timestamp and intervals are enabled and the time is short" do
-      node.normal["audit"]["interval"]["enabled"] = true
-      node.normal["audit"]["interval"]["time"] = 9
-      FileUtils.touch runner.report_timing_file
-      ten_minutes_ago = Time.now - 600
-      File.utime ten_minutes_ago, ten_minutes_ago, runner.report_timing_file
-      expect(runner).to receive(:report)
-      runner.report_with_interval
-    end
-  end
-end

data/spec/unit/compliance/waiver_spec.rb

@@ -1,104 +0,0 @@
-#
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require "spec_helper"
-require "tempfile"
-
-describe Chef::Compliance::Waiver do
-  let(:events) { Chef::EventDispatch::Dispatcher.new }
-  let(:data) { { "ssh-01" => { "expiration_date" => Date.jd(2463810), "justification" => "waived, yo", "run" => false } } }
-  let(:path) { "/var/chef/cache/cookbooks/acme_compliance/compliance/waivers/default.yml" }
-  let(:cookbook_name) { "acme_compliance" }
-  let(:waiver) { Chef::Compliance::Waiver.new(events, data, path, cookbook_name) }
-
-  it "has a cookbook_name" do
-    expect(waiver.cookbook_name).to eql(cookbook_name)
-  end
-
-  it "has a path" do
-    expect(waiver.path).to eql(path)
-  end
-
-  it "has a pathname based on the path" do
-    expect(waiver.pathname).to eql("default")
-  end
-
-  it "is disabled" do
-    expect(waiver.enabled).to eql(false)
-    expect(waiver.enabled?).to eql(false)
-  end
-
-  it "has an event handler" do
-    expect(waiver.events).to eql(events)
-  end
-
-  it "can be enabled by enable!" do
-    waiver.enable!
-    expect(waiver.enabled).to eql(true)
-    expect(waiver.enabled?).to eql(true)
-  end
-
-  it "enabling sends an event" do
-    expect(events).to receive(:compliance_waiver_enabled).with(waiver)
-    waiver.enable!
-  end
-
-  it "can be disabled by disable!" do
-    waiver.enable!
-    waiver.disable!
-    expect(waiver.enabled).to eql(false)
-    expect(waiver.enabled?).to eql(false)
-  end
-
-  it "has a #inspec_data method that renders the data" do
-    expect(waiver.inspec_data).to eql(data)
-  end
-
-  it "doesn't render the events in the inspect output" do
-    expect(waiver.inspect).not_to include("events")
-  end
-
-  it "inflates objects from YAML" do
-    string = <<~EOH
-ssh-01:
-  expiration_date: 2033-07-31
-  run: false
-  justification: "waived, yo"
-    EOH
-    newwaiver = Chef::Compliance::Waiver.from_yaml(events, string, path, cookbook_name)
-    expect(newwaiver.data).to eql(data)
-  end
-
-  it "inflates objects from files" do
-    string = <<~EOH
-ssh-01:
-  expiration_date: 2033-07-31
-  run: false
-  justification: "waived, yo"
-    EOH
-    tempfile = Tempfile.new("chef-compliance-test")
-    tempfile.write string
-    tempfile.close
-    newwaiver = Chef::Compliance::Waiver.from_file(events, tempfile.path, cookbook_name)
-    expect(newwaiver.data).to eql(data)
-  end
-
-  it "inflates objects from hashes" do
-    newwaiver = Chef::Compliance::Waiver.from_hash(events, data, path, cookbook_name)
-    expect(newwaiver.data).to eql(data)
-  end
-end

data/spec/unit/config_fetcher_spec.rb

@@ -1,125 +0,0 @@
-require "spec_helper"
-require "chef/config_fetcher"
-
-describe Chef::ConfigFetcher do
-  let(:valid_json) { Chef::JSONCompat.to_json({ a: "b" }) }
-  let(:invalid_json) { %q[{"syntax-error": "missing quote}] }
-  let(:http) { double("Chef::HTTP::Simple") }
-
-  let(:config_location_regex) { Regexp.escape(config_location) }
-  let(:invalid_json_error_regex) { /Could not parse the provided JSON file \(#{config_location_regex}\)/ }
-
-  let(:fetcher) { Chef::ConfigFetcher.new(config_location) }
-
-  context "when loading a local file" do
-    let(:config_location) { "/etc/chef/client.rb" }
-    let(:config_content) { "# The client.rb content" }
-
-    it "reads the file from disk" do
-      expect(::File).to receive(:read)
-        .with(config_location)
-        .and_return(config_content)
-      expect(fetcher.read_config).to eq(config_content)
-    end
-
-    it "gives the expanded path to the config file" do
-      expect(fetcher.expanded_path).to eq(File.expand_path(config_location))
-    end
-
-    context "with a relative path" do
-
-      let(:config_location) { "client.rb" }
-
-      it "gives the expanded path to the config file" do
-        expected = File.join(Dir.pwd, config_location)
-        expect(fetcher.expanded_path).to eq(expected)
-      end
-
-    end
-
-    context "and consuming JSON" do
-
-      let(:config_location) { "/etc/chef/first-boot.json" }
-
-      it "returns the parsed JSON" do
-        expect(::File).to receive(:read)
-          .with(config_location)
-          .and_return(valid_json)
-
-        expect(fetcher.fetch_json).to eq({ "a" => "b" })
-      end
-
-      context "and the JSON is invalid" do
-
-        it "reports the JSON error" do
-
-          expect(::File).to receive(:read)
-            .with(config_location)
-            .and_return(invalid_json)
-
-          expect(Chef::Application).to receive(:fatal!)
-            .with(invalid_json_error_regex)
-          fetcher.fetch_json
-        end
-      end
-    end
-
-  end
-
-  context "with an HTTP URL config location" do
-
-    let(:config_location) { "https://example.com/client.rb" }
-    let(:config_content) { "# The client.rb content" }
-
-    it "returns the config location unchanged for #expanded_path" do
-      expect(fetcher.expanded_path).to eq(config_location)
-    end
-
-    describe "reading the file" do
-
-      before do
-        expect(Chef::HTTP::Simple).to receive(:new)
-          .with(config_location)
-          .and_return(http)
-      end
-
-      it "reads the file over HTTP" do
-        expect(http).to receive(:get)
-          .with("").and_return(config_content)
-        expect(fetcher.read_config).to eq(config_content)
-      end
-
-      context "and consuming JSON" do
-        let(:config_location) { "https://example.com/foo.json" }
-
-        it "fetches the file and parses it" do
-          expect(http).to receive(:get)
-            .with("").and_return(valid_json)
-          expect(fetcher.fetch_json).to eq({ "a" => "b" })
-        end
-
-        context "and the JSON is invalid" do
-          it "reports the JSON error" do
-            expect(http).to receive(:get)
-              .with("").and_return(invalid_json)
-
-            expect(Chef::Application).to receive(:fatal!)
-              .with(invalid_json_error_regex)
-            fetcher.fetch_json
-          end
-        end
-      end
-    end
-
-  end
-
-  context "with a nil config file argument" do
-
-    let(:config_location) { nil }
-
-    it "returns the config location unchanged for #expanded_path" do
-      expect(fetcher.expanded_path).to eq(nil)
-    end
-  end
-
-end

data/spec/unit/config_spec.rb

@@ -1,31 +0,0 @@
-
-require "spec_helper"
-
-require "chef/config"
-
-RSpec.describe Chef::Config do
-
-  shared_examples_for "deprecated by ohai but not deprecated" do
-    it "does not emit a deprecation warning when set" do
-      expect(Chef::Log).to_not receive(:warn)
-        .with(/Ohai::Config\[:#{option}\] is deprecated/)
-      Chef::Config[option] = value
-      expect(Chef::Config[option]).to eq(value)
-    end
-  end
-
-  describe ":log_level" do
-    include_examples "deprecated by ohai but not deprecated" do
-      let(:option) { :log_level }
-      let(:value) { :debug }
-    end
-  end
-
-  describe ":log_location" do
-    include_examples "deprecated by ohai but not deprecated" do
-      let(:option) { :log_location }
-      let(:value) { "path/to/log" }
-    end
-  end
-
-end