inspec-core 2.1.67

data/docs/shared/matcher_eq.md.erb

@@ -0,0 +1,3 @@
+Use the `eq` matcher to test the equality of two values: `its('Port') { should eq '22' }`.
+
+Using `its('Port') { should eq 22 }` will fail because `22` is not a string value! Use the `cmp` matcher for less restrictive value comparisons.

data/docs/shared/matcher_include.md.erb

@@ -0,0 +1 @@
+Use the `include` matcher to verify that a string value is included in a list: `its('list') { should include 'string' }`.

data/docs/shared/matcher_match.md.erb

@@ -0,0 +1 @@
+Use the `match` matcher to check if a string matches a regular expression: `its('string') { should_not match /regex/ }`.

data/docs/shell.md

@@ -0,0 +1,217 @@
+---
+title: InSpec Shell
+---
+
+# InSpec Shell
+
+The InSpec interactive shell is a pry based REPL that can be used to
+quickly run InSpec controls and tests without having to write it to a
+file. Its functionality is similar to [chef-shell](https://docs.chef.io/chef_shell.html) as it provides a way
+to exercise the InSpec DSL, its resources, tests, and plugins without
+having to create a profile or write a test file. See
+[http://pryrepl.org/](http://pryrepl.org/) for an introduction to what pry is and what it can
+do.
+
+See [Explore InSpec resources](https://learn.chef.io/modules/explore-inspec-resources#/) on Learn Chef Rally for a hands-on example that uses InSpec shell.
+
+## Launching the shell
+
+If you are using InSpec from a platform-specific package (rpm, msi,
+etc.) or from a chef prepared shell in ChefDK, you can directly launch
+InSpec shell against your local machine using the following. See
+<https://docs.chef.io/install_dk.html#set-system-ruby> for details.
+
+```bash
+$ inspec shell
+$ inspec help shell # This will describe inspec shell usage
+```
+
+If you wish to connect to a remote machine (called a target within
+InSpec), you can use the `-t` flag. We support connecting using SSH,
+WinRM and docker. If no target is provided, we implicitly support the
+"local" target - i.e. tests running on the current machine running
+InSpec. For an SSH connection, use `-i` for specifying SSH key files,
+and the `--sudo*` commands for requesting a privilege escalation after
+logging in. For a WinRM connection, use `--path` to change the login
+path, `--ssl` to use SSL for transport layer encryption.
+
+```bash
+$ inspec shell -t ssh://root@192.168.64.2:11022  # Login to remote machine using ssh as root.
+$ inspec shell -t ssh://user@hostname:1234 -i /path/to/user_key  # Login to hostname on port 1234 as user using given ssh key.
+$ inspec shell -t winrm://UserName:Password@windowsmachine:1234  # Login to windowsmachine over WinRM as UserName.
+$ inspec shell -t docker://container_id # Login to a Docker container.
+```
+
+## Resource Packs
+
+Use resource packs to share custom resources with other InSpec users.
+A resource pack is an InSpec profile that contains only custom resources and no other controls or tests.
+
+For example, the profile in [`examples/profile`](https://github.com/chef/inspec/tree/master/examples/profile)in the InSpec git repo defines a [`gordon_config` resource](https://github.com/chef/inspec/blob/master/examples/profile/controls/gordon.rb). To use these resources within the InSpec shell, you will need to download and specify them as a dependency.
+
+Once you have local access to the profile, you can use the `gordon_config` custom resource provided in the `examples/profile` GitHub repo in your local environment :
+
+```bash
+inspec shell --depends examples/profile
+```
+
+Once inside the shell your resource will be available:
+
+```ruby
+inspec> gordon_config
+```
+
+## Using Ruby in InSpec shell
+
+Since InSpec shell is pry based, you may treat the shell as an
+interactive Ruby session. You may write Ruby expressions and evaluate
+them. Source high-lighting, automatic indentation and command history
+(using the up and down arrow keys) are available to make your experience
+more delightful. You can exit the shell using `exit`.
+
+```bash
+$ inspec shell
+Welcome to the interactive InSpec Shell
+To find out how to use it, type: help
+
+inspec> 1 + 2
+=> 3
+inspec> exit
+```
+
+## Using InSpec DSL in InSpec shell
+
+InSpec shell will automatically evaluate the result of every command as
+if it were a test file. If you type in a Ruby command that is not an
+InSpec control or test, the shell will evaluate it as if it were a
+regular ruby command.
+
+Bare InSpec resources are instantiated and their help text is presented.
+You may also access the resource contents or other matchers that they
+define. Run `help <resource>` to get more help on using a particular
+resource or see the InSpec resources documentation online.
+
+```bash
+$ inspec shell
+Welcome to the interactive InSpec Shell
+To find out how to use it, type: help
+
+inspec> file('/Users/myuser').directory?
+=> true
+inspec> os_env('HOME')
+=> Environment variable HOME
+inspec> os_env('HOME').content
+=> /Users/myuser
+inspec> exit
+```
+
+InSpec tests are immediately executed.
+
+```bash
+inspec> describe file('/Users')     # Empty test.
+Summary: 0 successful, 0 failures, 0 skipped
+inspec> describe file('/Users') do  # Test with one check.
+inspec>   it { should exist }
+inspec> end
+  ✔  File /Users should exist
+
+Summary: 1 successful, 0 failures, 0 skipped
+```
+
+All tests in a control are immediately executed as well. If a control is
+redefined in the shell, the old control's tests are destroyed and
+replaced with the redefinition and the control is re-run.
+
+```bash
+inspec> control 'my_control' do
+inspec>   describe os_env('HOME') do
+inspec>     its('content') { should eq '/Users/myuser' }
+inspec>   end
+inspec> end
+  ✔  my_control: Environment variable HOME content should eq "/Users/myuser"
+
+  Summary: 1 successful, 0 failures, 0 skipped
+```
+
+Syntax errors are illegal tests are also detected and reported.
+
+```bash
+inspec> control 'foo' do
+inspec>   thisisnonsense
+inspec> end
+NameError: undefined local variable or method `thisisnonsense' for #<#<Class:0x007fd63b571f98>:0x007fd639825cc8>
+from /usr/local/lib/ruby/gems/2.3.0/gems/rspec-expectations-3.5.0/lib/rspec/matchers.rb:967:in `method_missing'
+inspec> control 'foo' do
+inspec>   describe file('wut') do
+inspec>     its('thismakesnosense') { should cmp 'fail' }
+inspec>   end
+inspec> end
+  ✖  foo: File wut thismakesnosense  (undefined method `thismakesnosense' for File wut:Inspec::Resource::Registry::File)
+
+  Summary: 0 successful, 1 failures, 0 skipped
+```
+
+## Running a single InSpec command
+
+If you wish to run a single InSpec command and fetch its results, you
+may use the `-c` flag. This is similar to using `bash -c`.
+
+```bash
+$ inspec shell -c 'describe file("/Users/myuser") do it { should exist } end'
+Target:  local://
+
+  ✔  File /Users/myuser should exist
+
+Summary: 1 successful, 0 failures, 0 skipped
+```
+
+```bash
+$ inspec shell --format json -c 'describe file("/Users/test") do it { should exist } end'
+{
+  "version": "1.49.2",
+  "controls": [{
+    "status": "passed",
+    "code_desc": "File /Users/test should exist",
+    "run_time": 0.002374,
+    "start_time": "2018-01-06 18:32:38 -0500"
+  }],
+  "other_checks": [],
+  "profiles": [{
+    "name": "inspec-shell",
+    "supports": [],
+    "controls": [{
+      "title": null,
+      "desc": null,
+      "impact": 0.5,
+      "refs": [],
+      "tags": {},
+      "code": "",
+      "source_location": {
+        "ref": "/usr/local/lib/ruby/gems/2.4.0/gems/inspec-1.49.2/lib/inspec/control_eval_context.rb",
+        "line": 89
+      },
+      "id": "(generated from (eval):1 7b6f82c2cc5e4205b3e2c97c8e855f2d)",
+      "results": [{
+        "status": "passed",
+        "code_desc": "File /Users/test should exist",
+        "run_time": 0.002374,
+        "start_time": "2018-01-06 18:32:38 -0500"
+      }]
+    }],
+    "groups": [{
+      "title": null,
+      "controls": ["(generated from (eval):1 7b6f82c2cc5e4205b3e2c97c8e855f2d)"],
+      "id": "unknown"
+    }],
+    "attributes": [],
+    "sha256": "29c070a90b7e3521babf618215573284a790d92907783d5b2c138f411bfd2e74"
+  }],
+  "platform": {
+    "name": "mac_os_x",
+    "release": "17.3.0"
+  },
+  "statistics": {
+    "duration": 0.003171
+  }
+}
+```

data/examples/README.md

@@ -0,0 +1,8 @@
+# InSpec examples
+
+This directory contains multiple examples that explain the usage of the InSpec:
+
+ - `kitchen-chef` Test-Kitchen with [Chef and InSpec](kitchen-chef/README.md)
+ - `kitchen-puppet` Test-Kitchen with [Puppet and InSpec](kitchen-puppet/README.md)
+ - `kitchen-ansible` Test-Kitchen with [Ansible and InSpec](kitchen-ansible/README.md)
+ - `profile` Example of an InSpec profile

data/examples/inheritance/README.md

@@ -0,0 +1,65 @@
+# Example InSpec Profile
+
+This example shows the use of InSpec [profile](../../docs/profiles.rst) inheritance.
+
+## Verify a profile
+
+InSpec ships with built-in features to verify a profile structure.
+
+```bash
+$ inspec check examples/inheritance
+```
+
+## Execute a profile
+
+To run a profile on a local machine use `inspec exec /path/to/profile`. All dependencies are automatically resolved.
+
+```bash
+$ inspec exec examples/inheritance
+```
+
+## Set attributes for dependent profiles
+
+Without setting attributes, an `inspec exec` would return the following:
+
+```
+$ inspec git:(master) ✗ b inspec exec examples/inheritance
+
+Profile: InSpec example inheritance (inheritance)
+Version: 1.0.0
+Target:  local://
+
+
+  ○  gordon-1.0: Verify the version number of Gordon (1 skipped)
+     ○  Can't find file "/tmp/gordon/config.yaml"
+     ✔  File  content should match nil
+  ✔  ssh-1: Allow only SSH Protocol 2
+     ✔  File /bin/sh should be owned by "root"
+
+  File /tmp
+     ✔  should be directory
+  alice should
+     ✖  eq "bob"
+
+     expected: "bob"
+          got: "alice"
+
+     (compared using ==)
+
+  should eq
+     ✖  "secret"
+
+     expected: "secret"
+          got: nil
+
+     (compared using ==)
+
+
+Test Summary: 3 successful, 2 failures, 1 skipped
+```
+
+To pass in attributes, just call:
+
+```
+$ inspec exec examples/inheritance --attrs examples/profile-attribute.yml
+```

data/examples/inheritance/controls/example.rb

@@ -0,0 +1,14 @@
+# encoding: utf-8
+# copyright: 2016, Chef Software, Inc.
+
+# manipulate controls of `profile`
+include_controls 'profile' do
+  skip_control 'tmp-1.0'
+
+  control 'gordon-1.0' do
+    impact 0.0
+  end
+end
+
+# load all controls of `profile-attribute`
+include_controls 'profile-attribute'

data/examples/inheritance/inspec.yml

@@ -0,0 +1,15 @@
+name: inheritance
+title: InSpec example inheritance
+maintainer: Chef Software, Inc.
+copyright: Chef Software, Inc.
+copyright_email: support@chef.io
+license: Apache-2.0
+summary: Demonstrates the use of InSpec profile inheritance
+version: 1.0.0
+supports:
+  - os-family: unix
+depends:
+  - name: profile
+    path: ../profile
+  - name: profile-attribute
+    path: ../profile-attribute

data/examples/kitchen-ansible/.kitchen.yml

@@ -0,0 +1,25 @@
+---
+driver:
+  name: vagrant
+
+provisioner:
+  hosts: webservers
+  name: ansible_playbook
+  # Use el7 epel repo instead of the default el6
+  ansible_yum_repo: "https://download.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm"
+  require_chef_for_busser: false
+  require_ruby_for_busser: false
+  ansible_verbosity: 2
+  ansible_verbose: true
+  # starting playbook is at: test/integration/default/default.yml
+
+verifier:
+  name: inspec
+
+platforms:
+  - name: centos-7.1
+  - name: ubuntu-12.04
+  - name: ubuntu-14.04
+
+suites:
+  - name: default

data/examples/kitchen-ansible/Gemfile

@@ -0,0 +1,19 @@
+# encoding: utf-8
+source 'https://rubygems.org'
+
+gem 'inspec', path: '../../.'
+
+group :test do
+  gem 'bundler', '~> 1.5'
+  gem 'minitest', '~> 5.5'
+  gem 'rake', '~> 10'
+  gem 'simplecov', '~> 0.10'
+end
+
+group :integration do
+  gem 'test-kitchen', '~> 1.4'
+  gem 'kitchen-ansible'
+  gem 'kitchen-vagrant'
+  gem 'kitchen-inspec'
+  gem 'concurrent-ruby', '~> 1.0'
+end

data/examples/kitchen-ansible/README.md

@@ -0,0 +1,53 @@
+# Test-Kitchen - InSpec with Ansible Example
+
+This example demonstrates a complete roundtrip via [Test-Kitchen](http://kitchen.ci/).
+
+```bash
+# install all dependencies
+$ bundle install
+# show all available tests
+$ bundle exec kitchen list
+Instance             Driver   Provisioner      Verifier  Transport  Last Action
+default-centos-71    Vagrant  AnsiblePlaybook  Inspec    Ssh        <Not Created>
+default-ubuntu-1204  Vagrant  AnsiblePlaybook  Inspec    Ssh        <Not Created>
+default-ubuntu-1404  Vagrant  AnsiblePlaybook  Inspec    Ssh        <Not Created>
+
+# Now we are ready to run a complete test
+$ bundle exec kitchen test default-ubuntu-1404
+-----> Starting Kitchen (v1.4.2)
+-----> Cleaning up any prior instances of <default-ubuntu-1404>
+-----> Destroying <default-ubuntu-1404>...
+       Finished destroying <default-ubuntu-1404> (0m0.00s).
+-----> Testing <default-ubuntu-1404>
+-----> Creating <default-ubuntu-1404>...
+       Bringing machine 'default' up with 'virtualbox' provider...
+       ==> default: Importing base box 'opscode-ubuntu-14.04'...
+
+...
+
+       Vagrant instance <default-ubuntu-1404> created.
+       Finished creating <default-ubuntu-1404> (0m37.51s).
+-----> Converging <default-ubuntu-1404>...
+       Preparing files for transfer
+       Preparing playbook
+
+...
+
+       Finished converging <default-ubuntu-1404> (1m14.53s).
+-----> Setting up <default-ubuntu-1404>...
+       Finished setting up <default-ubuntu-1404> (0m0.00s).
+-----> Verifying <default-ubuntu-1404>...
+.....
+
+Finished in 0.08796 seconds (files took 1 minute 52.3 seconds to load)
+5 examples, 0 failures
+
+       Finished verifying <default-ubuntu-1404> (0m0.27s).
+-----> Destroying <default-ubuntu-1404>...
+       ==> default: Forcing shutdown of VM...
+       ==> default: Destroying VM and associated drives...
+       Vagrant instance <default-ubuntu-1404> destroyed.
+       Finished destroying <default-ubuntu-1404> (0m4.41s).
+       Finished testing <default-ubuntu-1404> (1m56.73s).
+-----> Kitchen is finished. (1m57.06s)
+```

data/examples/kitchen-ansible/files/nginx.repo

@@ -0,0 +1,6 @@
+[nginx]
+name=Nginx Repo
+baseurl=http://nginx.org/packages/centos/7/x86_64
+enabled=1
+gpgcheck=1
+gpgkey=http://nginx.org/keys/nginx_signing.key

data/examples/kitchen-ansible/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: create nginx yum repo if OS family is RedHat
+  copy: src=nginx.repo dest=/etc/yum.repos.d/
+        owner=root group=root mode=0644
+  when: (ansible_os_family == "RedHat" and ansible_distribution_major_version == "7")
+
+- name: ensure nginx is at the latest version if OS family is RedHat
+  yum: name=nginx state=latest
+  when: ansible_os_family == "RedHat"
+
+- name: ensure nginx is at the latest version if OS family is Debian
+  apt: name=nginx state=latest
+  when: ansible_os_family == "Debian"
+
+- name: ensure nginx is running (and enable it at boot)
+  service: name=nginx state=started enabled=yes