inspec-core 2.1.67

data/lib/bundles/inspec-init.rb

@@ -0,0 +1,8 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+libdir = File.dirname(__FILE__)
+$LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
+
+require 'inspec-init/cli'

data/lib/bundles/inspec-init/README.md

@@ -0,0 +1,31 @@
+# InSpec Extension to create new profiles
+
+This extensions helps you to easily create a new profile
+
+## Usage
+
+```
+$ inspec init profile examples/new-profile
+Create new profile at /Users/chartmann/Development/compliance/inspec/examples/new-profile
+  * Create directory controls
+  * Create file controls/example.rb
+  * Create file inspec.yml
+  * Create directory libraries
+  * Create file README.md
+  * Create file libraries/.gitkeep
+
+$ inspec check examples/new-profile
+Summary
+-------
+Location: examples/new-profile
+Profile: examples/new-profile
+Controls: 2
+Timestamp: 2016-05-06T14:39:47+02:00
+Valid: true
+
+Errors
+------
+
+Warnings
+--------
+```

data/lib/bundles/inspec-init/cli.rb

@@ -0,0 +1,97 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+
+require 'pathname'
+
+module Init
+  class CLI < Inspec::BaseCLI
+    namespace 'init'
+
+    # TODO: find another solution, once https://github.com/erikhuda/thor/issues/261 is fixed
+    def self.banner(command, _namespace = nil, _subcommand = false)
+      "#{basename} #{subcommand_prefix} #{command.usage}"
+    end
+
+    def self.subcommand_prefix
+      namespace
+    end
+
+    # read template directoy
+    template_dir = File.join(File.dirname(__FILE__), 'templates')
+    Dir.glob(File.join(template_dir, '*')) do |template|
+      relative = Pathname.new(template).relative_path_from(Pathname.new(template_dir))
+
+      # register command for the template
+      desc "#{relative} NAME", "Create a new #{relative}"
+      option :overwrite, type: :boolean, default: false,
+         desc: 'Overwrites existing directory'
+      define_method relative.to_s.to_sym do |name|
+        generator(relative.to_s, { name: name }, options)
+      end
+    end
+
+    private
+
+    # 1. iterate over all files
+    # 2. read content in erb
+    # 3. write to target
+    def generator(type, attributes = {}, options = {}) # rubocop:disable Metrics/AbcSize
+      # path of this script
+      dir = File.dirname(__FILE__)
+      # look for template directory
+      base_dir = File.join(dir, 'templates', type)
+      # prepare glob for all subdirectories and files
+      template = File.join(base_dir, '**', '{*,.*}')
+      # generate target path
+      target = Pathname.new(Dir.pwd).join(attributes[:name])
+      puts "Create new #{type} at #{mark_text(target)}"
+
+      # check that the directory does not exist
+      if File.exist?(target) && !options['overwrite']
+        error "#{mark_text(target)} exists already, use --overwrite"
+        exit 1
+      end
+
+      # ensure that target directory is available
+      FileUtils.mkdir_p(target)
+
+      # iterate over files and write to target path
+      Dir.glob(template) do |file|
+        relative = Pathname.new(file).relative_path_from(Pathname.new(base_dir))
+        destination = Pathname.new(target).join(relative)
+        if File.directory?(file)
+          li "Create directory #{mark_text(relative)}"
+          FileUtils.mkdir_p(destination)
+        elsif File.file?(file)
+          li "Create file #{mark_text(relative)}"
+          # read & render content
+          content = render(File.read(file), attributes)
+          # write file content
+          File.write(destination, content)
+        else
+          puts "Ignore #{file}, because its not an file or directoy"
+        end
+      end
+    end
+
+    # This is a render helper to bind hash values to a ERB template
+    def render(content, hash)
+      # create a new binding class
+      cls = Class.new do
+        hash.each do |key, value|
+          define_method key.to_sym do
+            value
+          end
+        end
+        # expose binding
+        define_method :bind do
+          binding
+        end
+      end
+      ERB.new(content).result(cls.new.bind)
+    end
+  end
+
+  # register the subcommand to Inspec CLI registry
+  Inspec::Plugins::CLI.add_subcommand(Init::CLI, 'init', 'init TEMPLATE ...', 'Scaffolds a new project', {})
+end

data/lib/bundles/inspec-init/templates/profile/README.md

@@ -0,0 +1,3 @@
+# Example InSpec Profile
+
+This example shows the implementation of an InSpec profile.

data/lib/bundles/inspec-init/templates/profile/controls/example.rb

@@ -0,0 +1,19 @@
+# encoding: utf-8
+# copyright: 2018, The Authors
+
+title 'sample section'
+
+# you can also use plain tests
+describe file('/tmp') do
+  it { should be_directory }
+end
+
+# you add controls here
+control 'tmp-1.0' do                        # A unique ID for this control
+  impact 0.7                                # The criticality, if this control fails.
+  title 'Create /tmp directory'             # A human-readable title
+  desc 'An optional description...'
+  describe file('/tmp') do                  # The actual test
+    it { should be_directory }
+  end
+end

data/lib/bundles/inspec-init/templates/profile/inspec.yml

@@ -0,0 +1,8 @@
+name: <%= name %>
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0

data/lib/bundles/inspec-supermarket.rb

@@ -0,0 +1,13 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+libdir = File.dirname(__FILE__)
+$LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
+
+module Supermarket
+  autoload :API, 'inspec-supermarket/api'
+end
+
+require 'inspec-supermarket/cli'
+require 'inspec-supermarket/target'

data/lib/bundles/inspec-supermarket/README.md

@@ -0,0 +1,45 @@
+# InSpec Extension for Chef Supermarket
+
+To use the CLI, this InSpec add-on adds the following commands:
+
+ * `$ inspec supermarket configure` - configures the supermarket server
+ * `$ inspec supermarket search` - searches for a compliance profile on supermarket
+ * `$ inspec supermarket exec nathenharvey/tmp-compliance-profile` - extends execute to load the profile
+
+ Compliance profiles from Supermarket can be executed in two ways:
+
+ - via supermarket exec: `inspec supermarket exec nathenharvey/tmp-compliance-profile`
+ - via supermarket scheme: `inspec exec supermarket://nathenharvey/tmp-compliance-profile`
+
+## Usage
+
+```
+$ inspec supermarket
+Commands:
+  inspec supermarket exec PROFILE    # execute a Supermarket profile
+  inspec supermarket help [COMMAND]  # Describe subcommands or one specific subcommand
+  inspec supermarket info PROFILE    # display Supermarket profile details
+  inspec supermarket profiles        # list all available profiles in Chef Supermarket
+
+$ inspec supermarket profiles
+Available profiles:
+-------------------
+ * nathenharvey/tmp-compliance-profile
+ * hardening/os-hardening
+ * hardening/ssh-hardening
+
+$ inspec supermarket info hardening/os-hardening
+name:   os-hardening
+owner:  hardening
+url:    https://github.com/dev-sec/tests-os-hardening
+
+description:   Base Linux Compliance profile, used for Security + DevOps. More Information is available at http://dev-sec.io/
+
+$ inspec exec supermarket://hardening/os-hardening
+........F.F.................F......FFF.....FFFF.F........FF....FFFFFFF...FF.FFFFFF.FFFFFFFFFFF.F...
+
+...
+
+Finished in 3.81 seconds (files took 5.69 seconds to load)
+99 examples, 40 failures
+```

data/lib/bundles/inspec-supermarket/api.rb

@@ -0,0 +1,84 @@
+# encoding: utf-8
+# frozen_string_literal: true
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'net/http'
+require 'addressable/uri'
+
+module Supermarket
+  class API
+    SUPERMARKET_URL = 'https://supermarket.chef.io'
+
+    # displays a list of profiles
+    def self.profiles(supermarket_url = SUPERMARKET_URL)
+      url = "#{supermarket_url}/api/v1/tools-search"
+      _success, data = get(url, { type: 'compliance_profile', items: 100 })
+      if !data.nil?
+        profiles = JSON.parse(data)
+        profiles['items'].map { |x|
+          m = %r{^#{supermarket_url}/api/v1/tools/(?<slug>[\w-]+)(/)?$}.match(x['tool'])
+          x['slug'] = m[:slug]
+          x
+        }
+      else
+        []
+      end
+    end
+
+    def self.profile_name(profile)
+      # We use Addressable::URI here because URI has a bug in Ruby 2.1.x where it doesn't allow underscore in host
+      uri = Addressable::URI.parse profile
+      [uri.host, uri.path[1..-1]]
+    rescue
+      nil
+    end
+
+    # displays profile infos
+    def self.info(profile, supermarket_url = SUPERMARKET_URL)
+      _tool_owner, tool_name = profile_name("supermarket://#{profile}")
+      return if tool_name.nil? || tool_name.empty?
+      url = "#{supermarket_url}/api/v1/tools/#{tool_name}"
+      _success, data = get(url, {})
+      JSON.parse(data) if !data.nil?
+    rescue JSON::ParserError
+      nil
+    end
+
+    # compares a profile with the supermarket tool info
+    def self.same?(profile, supermarket_tool, supermarket_url = SUPERMARKET_URL)
+      tool_owner, tool_name = profile_name(profile)
+      tool = "#{supermarket_url}/api/v1/tools/#{tool_name}"
+      supermarket_tool['tool_owner'] == tool_owner && supermarket_tool['tool'] == tool
+    end
+
+    def self.find(profile, supermarket_url = SUPERMARKET_URL)
+      profiles = Supermarket::API.profiles(supermarket_url)
+      return if profiles.empty?
+
+      index = profiles.index { |t| same?(profile, t, supermarket_url) }
+      # return profile or nil
+      profiles[index] if !index.nil? && index >= 0
+    end
+
+    # verifies that a profile exists
+    def self.exist?(profile, supermarket_url = SUPERMARKET_URL)
+      !find(profile, supermarket_url).nil?
+    end
+
+    def self.get(url, params)
+      uri = URI.parse(url)
+      uri.query = URI.encode_www_form(params)
+      req = Net::HTTP::Get.new(uri)
+      send_request(uri, req)
+    end
+
+    def self.send_request(uri, req)
+      # send request
+      res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
+        http.request(req)
+      end
+      [res.is_a?(Net::HTTPSuccess), res.body]
+    end
+  end
+end

data/lib/bundles/inspec-supermarket/cli.rb

@@ -0,0 +1,73 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+module Supermarket
+  class SupermarketCLI < Inspec::BaseCLI
+    namespace 'supermarket'
+
+    # TODO: find another solution, once https://github.com/erikhuda/thor/issues/261 is fixed
+    def self.banner(command, _namespace = nil, _subcommand = false)
+      "#{basename} #{subcommand_prefix} #{command.usage}"
+    end
+
+    def self.subcommand_prefix
+      namespace
+    end
+
+    desc 'profiles', 'list all available profiles in Chef Supermarket'
+    def profiles
+      # display profiles in format user/profile
+      supermarket_profiles = Supermarket::API.profiles
+
+      headline('Available profiles:')
+      supermarket_profiles.each { |p|
+        li("#{p['tool_name']} #{mark_text(p['tool_owner'] + '/' + p['slug'])}")
+      }
+    end
+
+    desc 'exec PROFILE', 'execute a Supermarket profile'
+    exec_options
+    def exec(*tests)
+      o = opts(:exec).dup
+      diagnose(o)
+      configure_logger(o)
+
+      # iterate over tests and add compliance scheme
+      tests = tests.map { |t| 'supermarket://' + t }
+
+      runner = Inspec::Runner.new(o)
+      tests.each { |target| runner.add_target(target) }
+
+      exit runner.run
+    rescue ArgumentError, RuntimeError, Train::UserError => e
+      $stderr.puts e.message
+      exit 1
+    end
+
+    desc 'info PROFILE', 'display Supermarket profile details'
+    def info(profile)
+      # check that the profile is available
+      supermarket_profiles = Supermarket::API.profiles
+      found = supermarket_profiles.select { |p|
+        profile == "#{p['tool_owner']}/#{p['slug']}"
+      }
+
+      if found.empty?
+        puts "#{mark_text(profile)} is not available on Supermarket"
+        return
+      end
+
+      # load details for the specific profile
+      info = Supermarket::API.info(profile)
+      puts "#{mark_text('name: ')}  #{info['slug']}"
+      puts "#{mark_text('owner:')}  #{info['owner']}"
+      puts "#{mark_text('url:  ')}  #{info['source_url']}"
+      puts
+      puts "#{mark_text('description:  ')} #{info['description']}"
+    end
+  end
+
+  # register the subcommand to Inspec CLI registry
+  Inspec::Plugins::CLI.add_subcommand(SupermarketCLI, 'supermarket', 'supermarket SUBCOMMAND ...', 'Supermarket commands', {})
+end

data/lib/bundles/inspec-supermarket/target.rb

@@ -0,0 +1,34 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'uri'
+require 'inspec/fetcher'
+require 'fetchers/url'
+
+# InSpec Target Helper for Supermarket
+module Supermarket
+  class Fetcher < Inspec.fetcher(1)
+    name 'supermarket'
+    priority 500
+
+    def self.resolve(target, opts = {})
+      supermarket_uri, supermarket_server = if target.is_a?(String) && URI(target).scheme == 'supermarket'
+                                              [target, Supermarket::API::SUPERMARKET_URL]
+                                            elsif target.respond_to?(:key?) && target.key?(:supermarket)
+                                              supermarket_server = target[:supermarket_url] || Supermarket::API::SUPERMARKET_URL
+                                              ["supermarket://#{target[:supermarket]}", supermarket_server]
+                                            end
+      return nil unless supermarket_uri
+      return nil unless Supermarket::API.exist?(supermarket_uri, supermarket_server)
+      tool_info = Supermarket::API.find(supermarket_uri, supermarket_server)
+      resolve_next(tool_info['tool_source_url'], opts)
+    rescue URI::Error
+      nil
+    end
+
+    def to_s
+      'Chef Compliance Profile Loader'
+    end
+  end
+end

data/lib/fetchers/git.rb

@@ -0,0 +1,163 @@
+# encoding: utf-8
+require 'tmpdir'
+require 'fileutils'
+require 'mixlib/shellout'
+require 'inspec/log'
+
+module Fetchers
+  #
+  # The git fetcher uses the git binary to fetch remote git sources.
+  # Git-based sources should be specified with the `git:` key in the
+  # source hash. Additionally, we accept `:branch`, `:ref`, and `:tag`
+  # keys to allow users to pin to a particular revision.
+  #
+  # Parts of this class are derived from:
+  #
+  #  https://github.com/chef/omnibus/blob/master/lib/omnibus/fetchers/git_fetcher.rb
+  #
+  # which is Copyright 2012-2014 Chef Software, Inc. and offered under
+  # the same Apache 2 software license as inspec.
+  #
+  # Many thanks to the omnibus authors!
+  #
+  # Note that we haven't replicated all of omnibus' features here.  If
+  # you got to this file during debugging, you may want to look at the
+  # omnibus source for hints.
+  #
+  class Git < Inspec.fetcher(1)
+    name 'git'
+    priority 200
+
+    def self.resolve(target, opts = {})
+      new(target[:git], opts.merge(target)) if target.respond_to?(:has_key?) && target.key?(:git)
+    end
+
+    def initialize(remote_url, opts = {})
+      @branch = opts[:branch]
+      @tag = opts[:tag]
+      @ref = opts[:ref]
+      @remote_url = remote_url
+      @repo_directory = nil
+    end
+
+    def fetch(dir)
+      @repo_directory = dir
+      FileUtils.mkdir_p(dir) unless Dir.exist?(dir)
+
+      if cloned?
+        checkout
+      else
+        Dir.mktmpdir do |tmpdir|
+          checkout(tmpdir)
+          Inspec::Log.debug("Checkout of #{resolved_ref} successful. Moving checkout to #{dir}")
+          FileUtils.cp_r(tmpdir, @repo_directory)
+        end
+      end
+      @repo_directory
+    end
+
+    def cache_key
+      resolved_ref
+    end
+
+    def archive_path
+      @repo_directory
+    end
+
+    def resolved_source
+      { git: @remote_url, ref: resolved_ref }
+    end
+
+    private
+
+    def resolved_ref
+      @resolved_ref ||= if @ref
+                          @ref
+                        elsif @branch
+                          resolve_ref(@branch)
+                        elsif @tag
+                          resolve_ref(@tag)
+                        else
+                          resolve_ref('master')
+                        end
+    end
+
+    def resolve_ref(ref_name)
+      cmd = shellout("git ls-remote \"#{@remote_url}\" \"#{ref_name}*\"")
+      ref = parse_ls_remote(cmd.stdout, ref_name)
+      if !ref
+        raise "Unable to resolve #{ref_name} to a specific git commit for #{@remote_url}"
+      end
+      ref
+    end
+
+    #
+    # The following comment is a minor modification of the comment in
+    # the omnibus source for a similar function:
+    #
+    # Dereference annotated tags.
+    #
+    # The +remote_list+ parameter is assumed to look like this:
+    #
+    #   a2ed66c01f42514bcab77fd628149eccb4ecee28        refs/tags/rel-0.11.0
+    #   f915286abdbc1907878376cce9222ac0b08b12b8        refs/tags/rel-0.11.0^{}
+    #
+    # The SHA with ^{} is the commit pointed to by an annotated
+    # tag. If ref isn't an annotated tag, there will not be a line
+    # with trailing ^{}.
+    #
+    # @param [String] output
+    #   output from `git ls-remote origin` command
+    # @param [String] ref_name
+    #   the target git ref_name
+    #
+    # @return [String]
+    #
+    def parse_ls_remote(output, ref_name)
+      pairs = output.lines.map { |l| l.chomp.split("\t") }
+      tagged_commit = pairs.find { |m| m[1].end_with?("#{ref_name}^{}") }
+      if tagged_commit
+        tagged_commit.first
+      else
+        pairs.find { |m| m[1].end_with?(ref_name.to_s) }&.first
+      end
+    end
+
+    def cloned?
+      File.directory?(File.join(@repo_directory, '.git'))
+    end
+
+    def clone(dir = @repo_directory)
+      git_cmd("clone #{@remote_url} ./", dir) unless cloned?
+      @repo_directory
+    end
+
+    def checkout(dir = @repo_directory)
+      clone(dir)
+      git_cmd("checkout #{resolved_ref}", dir)
+      @repo_directory
+    end
+
+    def git_cmd(cmd, dir = @repo_directory)
+      cmd = shellout("git #{cmd}", cwd: dir)
+      cmd.error!
+      cmd.status
+    rescue Errno::ENOENT
+      raise 'To use git sources, you must have git installed.'
+    end
+
+    def shellout(cmd, opts = {})
+      Inspec::Log.debug("Running external command: #{cmd} (#{opts})")
+      cmd = Mixlib::ShellOut.new(cmd, opts)
+      cmd.run_command
+      Inspec::Log.debug("External command: completed with exit status: #{cmd.exitstatus}")
+      Inspec::Log.debug('External command: STDOUT BEGIN')
+      Inspec::Log.debug(cmd.stdout)
+      Inspec::Log.debug('External command: STDOUT END')
+      Inspec::Log.debug('External command: STDERR BEGIN')
+      Inspec::Log.debug(cmd.stderr)
+      Inspec::Log.debug('External command: STDERR END')
+      cmd
+    end
+  end
+end