inspec-core 2.1.67

data/lib/inspec/base_cli.rb

@@ -0,0 +1,368 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'thor'
+require 'inspec/log'
+require 'inspec/profile_vendor'
+
+module Inspec
+  class BaseCLI < Thor
+    # https://github.com/erikhuda/thor/issues/244
+    def self.exit_on_failure?
+      true
+    end
+
+    def self.target_options
+      option :target, aliases: :t, type: :string,
+        desc: 'Simple targeting option using URIs, e.g. ssh://user:pass@host:port'
+      option :backend, aliases: :b, type: :string,
+        desc: 'Choose a backend: local, ssh, winrm, docker.'
+      option :host, type: :string,
+        desc: 'Specify a remote host which is tested.'
+      option :port, aliases: :p, type: :numeric,
+        desc: 'Specify the login port for a remote scan.'
+      option :user, type: :string,
+        desc: 'The login user for a remote scan.'
+      option :password, type: :string, lazy_default: -1,
+        desc: 'Login password for a remote scan, if required.'
+      option :enable_password, type: :string, lazy_default: -1,
+        desc: 'Password for enable mode on Cisco IOS devices.'
+      option :key_files, aliases: :i, type: :array,
+        desc: 'Login key or certificate file for a remote scan.'
+      option :path, type: :string,
+        desc: 'Login path to use when connecting to the target (WinRM).'
+      option :sudo, type: :boolean,
+        desc: 'Run scans with sudo. Only activates on Unix and non-root user.'
+      option :sudo_password, type: :string, lazy_default: -1,
+        desc: 'Specify a sudo password, if it is required.'
+      option :sudo_options, type: :string,
+        desc: 'Additional sudo options for a remote scan.'
+      option :sudo_command, type: :string,
+        desc: 'Alternate command for sudo.'
+      option :shell, type: :boolean,
+        desc: 'Run scans in a subshell. Only activates on Unix.'
+      option :shell_options, type: :string,
+        desc: 'Additional shell options.'
+      option :shell_command, type: :string,
+        desc: 'Specify a particular shell to use.'
+      option :ssl, type: :boolean,
+        desc: 'Use SSL for transport layer encryption (WinRM).'
+      option :self_signed, type: :boolean,
+        desc: 'Allow remote scans with self-signed certificates (WinRM).'
+      option :json_config, type: :string,
+        desc: 'Read configuration from JSON file (`-` reads from stdin).'
+      option :proxy_command, type: :string,
+        desc: 'Specifies the command to use to connect to the server'
+    end
+
+    def self.profile_options
+      option :profiles_path, type: :string,
+        desc: 'Folder which contains referenced profiles.'
+    end
+
+    def self.exec_options
+      target_options
+      profile_options
+      option :controls, type: :array,
+        desc: 'A list of controls to run. Ignore all other tests.'
+      option :format, type: :string,
+        desc: '[DEPRECATED] Please use --reporter - this will be removed in InSpec 3.0'
+      option :reporter, type: :array,
+        banner: 'one two:/output/file/path',
+        desc: 'Enable one or more output reporters: cli, documentation, html, progress, json, json-min, json-rspec, junit'
+      option :color, type: :boolean,
+        desc: 'Use colors in output.'
+      option :attrs, type: :array,
+        desc: 'Load attributes file (experimental)'
+      option :vendor_cache, type: :string,
+        desc: 'Use the given path for caching dependencies. (default: ~/.inspec/cache)'
+      option :create_lockfile, type: :boolean,
+        desc: 'Write out a lockfile based on this execution (unless one already exists)'
+      option :backend_cache, type: :boolean,
+        desc: 'Allow caching for backend command output. (default: true)'
+      option :show_progress, type: :boolean,
+        desc: 'Show progress while executing tests.'
+    end
+
+    def self.default_options
+      {
+        exec: {
+          'reporter' => ['cli'],
+          'show_progress' => false,
+          'color' => true,
+          'create_lockfile' => true,
+          'backend_cache' => true,
+        },
+        shell: {
+          'reporter' => ['cli'],
+        },
+      }
+    end
+
+    def self.parse_reporters(opts) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      # merge in any legacy formats as reporter
+      # this method will only be used for ad-hoc runners
+      if !opts['format'].nil? && opts['reporter'].nil?
+        warn '[DEPRECATED] The option --format is being deprecated and will be removed in inspec 3.0. Please use --reporter'
+
+        # see if we are using the legacy output to write to files
+        if opts['output']
+          warn '[DEPRECATED] The option \'output\' is being deprecated and will be removed in inspec 3.0. Please use --reporter name:path'
+          opts['format'] = "#{opts['format']}:#{opts['output']}"
+          opts.delete('output')
+        end
+
+        opts['reporter'] = Array(opts['format'])
+        opts.delete('format')
+      end
+
+      # default to cli report for ad-hoc runners
+      opts['reporter'] = ['cli'] if opts['reporter'].nil?
+
+      # parse out cli to proper report format
+      if opts['reporter'].is_a?(Array)
+        reports = {}
+        opts['reporter'].each do |report|
+          reporter_name, target = report.split(':')
+          if target.nil? || target.strip == '-'
+            reports[reporter_name] = { 'stdout' => true }
+          else
+            reports[reporter_name] = {
+              'file' => target,
+              'stdout' => false,
+            }
+          end
+        end
+        opts['reporter'] = reports
+      end
+
+      # add in stdout if not specified
+      if opts['reporter'].is_a?(Hash)
+        opts['reporter'].each do |reporter_name, config|
+          opts['reporter'][reporter_name] = {} if config.nil?
+          opts['reporter'][reporter_name]['stdout'] = true if opts['reporter'][reporter_name].empty?
+        end
+      end
+
+      validate_reporters(opts['reporter'])
+      opts
+    end
+
+    def self.validate_reporters(reporters)
+      return if reporters.nil?
+
+      valid_types = [
+        'automate',
+        'cli',
+        'documentation',
+        'html',
+        'json',
+        'json-min',
+        'json-rspec',
+        'junit',
+        'progress',
+      ]
+
+      reporters.each do |k, v|
+        raise NotImplementedError, "'#{k}' is not a valid reporter type." unless valid_types.include?(k)
+
+        next unless k == 'automate'
+        %w{token url}.each do |option|
+          raise Inspec::ReporterError, "You must specify a automate #{option} via the json-config." if v[option].nil?
+        end
+      end
+
+      # check to make sure we are only reporting one type to stdout
+      stdout = 0
+      reporters.each_value do |v|
+        stdout += 1 if v['stdout'] == true
+      end
+
+      raise ArgumentError, 'The option --reporter can only have a single report outputting to stdout.' if stdout > 1
+    end
+
+    def self.detect(params: {}, indent: 0, color: 39)
+      str = ''
+      params.each { |item, info|
+        data = info
+
+        # Format Array for better output if applicable
+        data = data.join(', ') if data.is_a?(Array)
+
+        # Do not output fields of data is missing ('unknown' is fine)
+        next if data.nil?
+
+        data = "\e[1m\e[#{color}m#{data}\e[0m"
+        str << format("#{' ' * indent}%-10s %s\n", item.to_s.capitalize + ':', data)
+      }
+      str
+    end
+
+    private
+
+    def suppress_log_output?(opts)
+      return false if opts['reporter'].nil?
+      match = %w{json json-min json-rspec junit html} & opts['reporter'].keys
+      unless match.empty?
+        match.each do |m|
+          # check to see if we are outputting to stdout
+          return true if opts['reporter'][m]['stdout'] == true
+        end
+      end
+      false
+    end
+
+    def diagnose(opts)
+      return unless opts['diagnose']
+      puts "InSpec version: #{Inspec::VERSION}"
+      puts "Train version: #{Train::VERSION}"
+      puts 'Command line configuration:'
+      pp options
+      puts 'JSON configuration file:'
+      pp options_json
+      puts 'Merged configuration:'
+      pp opts
+      puts
+    end
+
+    def opts(type = nil)
+      o = merged_opts(type)
+
+      # Due to limitations in Thor it is not possible to set an argument to be
+      # both optional and its value to be mandatory. E.g. the user supplying
+      # the --password argument is optional and not always required, but
+      # whenever it is used, it requires a value. Handle options that were
+      # defined above and require a value here:
+      %w{password sudo-password}.each do |v|
+        id = v.tr('-', '_').to_sym
+        next unless o[id] == -1
+        raise ArgumentError, "Please provide a value for --#{v}. For example: --#{v}=hello."
+      end
+
+      # check for compliance settings
+      Compliance::API.login(o['compliance']) if o['compliance']
+
+      o
+    end
+
+    def merged_opts(type = nil)
+      opts = {}
+
+      # start with default options if we have any
+      opts = BaseCLI.default_options[type] unless type.nil? || BaseCLI.default_options[type].nil?
+      opts['type'] = type unless type.nil?
+
+      # merge in any options from json-config
+      json_config = options_json
+      opts.merge!(json_config)
+
+      # remove the default reporter if we are setting a legacy format on the cli
+      # or via json-config
+      opts.delete('reporter') if options['format'] || json_config['format']
+
+      # merge in any options defined via thor
+      opts.merge!(options)
+
+      # parse reporter options
+      opts = BaseCLI.parse_reporters(opts) if %i(exec shell).include?(type)
+
+      Thor::CoreExt::HashWithIndifferentAccess.new(opts)
+    end
+
+    def options_json
+      conffile = options['json_config']
+      @json ||= conffile ? read_config(conffile) : {}
+    end
+
+    def read_config(file)
+      if file == '-'
+        puts 'WARN: reading JSON config from standard input' if STDIN.tty?
+        config = STDIN.read
+      else
+        config = File.read(file)
+      end
+
+      JSON.parse(config)
+    rescue JSON::ParserError => e
+      puts "Failed to load JSON configuration: #{e}\nConfig was: #{config.inspect}"
+      exit 1
+    end
+
+    # get the log level
+    # DEBUG < INFO < WARN < ERROR < FATAL < UNKNOWN
+    def get_log_level(level)
+      valid = %w{debug info warn error fatal}
+
+      if valid.include?(level)
+        l = level
+      else
+        l = 'info'
+      end
+
+      Logger.const_get(l.upcase)
+    end
+
+    def pretty_handle_exception(exception)
+      case exception
+      when Inspec::Error
+        $stderr.puts exception.message
+        exit(1)
+      else
+        raise exception
+      end
+    end
+
+    def vendor_deps(path, opts)
+      profile_path = path || Dir.pwd
+      profile_vendor = Inspec::ProfileVendor.new(profile_path)
+
+      if (profile_vendor.cache_path.exist? || profile_vendor.lockfile.exist?) && !opts[:overwrite]
+        puts 'Profile is already vendored. Use --overwrite.'
+        return false
+      end
+
+      profile_vendor.vendor!
+      puts "Dependencies for profile #{profile_path} successfully vendored to #{profile_vendor.cache_path}"
+    rescue StandardError => e
+      pretty_handle_exception(e)
+    end
+
+    def configure_logger(o)
+      #
+      # TODO(ssd): This is a big gross, but this configures the
+      # logging singleton Inspec::Log. Eventually it would be nice to
+      # move internal debug logging to use this logging singleton.
+      #
+      loc = if o.log_location
+              o.log_location
+            elsif suppress_log_output?(o)
+              STDERR
+            else
+              STDOUT
+            end
+
+      Inspec::Log.init(loc)
+      Inspec::Log.level = get_log_level(o.log_level)
+
+      o[:logger] = Logger.new(loc)
+      # output json if we have activated the json formatter
+      if o['log-format'] == 'json'
+        o[:logger].formatter = Logger::JSONFormatter.new
+      end
+      o[:logger].level = get_log_level(o.log_level)
+    end
+
+    def mark_text(text)
+      "\e[0;36m#{text}\e[0m"
+    end
+
+    def headline(title)
+      puts "\n== #{title}\n\n"
+    end
+
+    def li(entry)
+      puts " #{mark_text('*')} #{entry}"
+    end
+  end
+end

data/lib/inspec/cached_fetcher.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+require 'inspec/fetcher'
+require 'forwardable'
+
+module Inspec
+  class CachedFetcher
+    extend Forwardable
+
+    attr_reader :cache, :target, :fetcher
+    def initialize(target, cache)
+      @target = target
+      @fetcher = Inspec::Fetcher.resolve(target)
+
+      if @fetcher.nil?
+        raise("Could not fetch inspec profile in #{target.inspect}.")
+      end
+
+      @cache = cache
+    end
+
+    def resolved_source
+      fetch
+      @fetcher.resolved_source
+    end
+
+    def cache_key
+      k = if target.is_a?(Hash)
+            target[:sha256] || target[:ref]
+          end
+
+      if k.nil?
+        fetcher.cache_key
+      else
+        k
+      end
+    end
+
+    def fetch
+      if cache.exists?(cache_key)
+        Inspec::Log.debug "Using cached dependency for #{target}"
+        [cache.prefered_entry_for(cache_key), false]
+      else
+        Inspec::Log.debug "Dependency does not exist in the cache #{target}"
+        fetcher.fetch(cache.base_path_for(fetcher.cache_key))
+        assert_cache_sanity!
+        [fetcher.archive_path, fetcher.writable?]
+      end
+    end
+
+    def assert_cache_sanity!
+      return unless target.respond_to?(:key?) && target.key?(:sha256)
+
+      exception_message = <<~EOF
+        The remote source #{fetcher} no longer has the requested content:
+
+        Request Content Hash: #{target[:sha256]}
+        Actual Content Hash: #{fetcher.resolved_source[:sha256]}
+
+        For URL, supermarket, compliance, and other sources that do not
+        provide versioned artifacts, this likely means that the remote source
+        has changed since your lockfile was generated.
+      EOF
+      raise exception_message if fetcher.resolved_source[:sha256] != target[:sha256]
+    end
+  end
+end

data/lib/inspec/cli.rb

@@ -0,0 +1,292 @@
+# encoding: utf-8
+# Copyright 2015 Dominik Richter
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'logger'
+require 'thor'
+require 'json'
+require 'pp'
+require 'utils/json_log'
+require 'utils/latest_version'
+require 'inspec/base_cli'
+require 'inspec/plugins'
+require 'inspec/runner_mock'
+require 'inspec/env_printer'
+require 'inspec/schema'
+
+class Inspec::InspecCLI < Inspec::BaseCLI
+  class_option :log_level, aliases: :l, type: :string,
+               desc: 'Set the log level: info (default), debug, warn, error'
+
+  class_option :log_location, type: :string,
+               desc: 'Location to send diagnostic log messages to. (default: STDOUT or STDERR)'
+
+  class_option :diagnose, type: :boolean,
+    desc: 'Show diagnostics (versions, configurations)'
+
+  desc 'json PATH', 'read all tests in PATH and generate a JSON summary'
+  option :output, aliases: :o, type: :string,
+    desc: 'Save the created profile to a path'
+  option :controls, type: :array,
+    desc: 'A list of controls to include. Ignore all other tests.'
+  profile_options
+  def json(target)
+    o = opts.dup
+    diagnose(o)
+    o[:ignore_supports] = true
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
+    o[:check_mode] = true
+
+    profile = Inspec::Profile.for_target(target, o)
+    info = profile.info
+    # add in inspec version
+    info[:generator] = {
+      name: 'inspec',
+      version: Inspec::VERSION,
+    }
+    dst = o[:output].to_s
+    if dst.empty?
+      puts JSON.dump(info)
+    else
+      if File.exist? dst
+        puts "----> updating #{dst}"
+      else
+        puts "----> creating #{dst}"
+      end
+      fdst = File.expand_path(dst)
+      File.write(fdst, JSON.dump(info))
+    end
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'check PATH', 'verify all tests at the specified PATH'
+  option :format, type: :string
+  profile_options
+  def check(path) # rubocop:disable Metrics/AbcSize
+    o = opts.dup
+    diagnose(o)
+    o[:ignore_supports] = true # we check for integrity only
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
+    o[:check_mode] = true
+
+    # run check
+    profile = Inspec::Profile.for_target(path, o)
+    result = profile.check
+
+    if o['format'] == 'json'
+      puts JSON.generate(result)
+    else
+      %w{location profile controls timestamp valid}.each do |item|
+        puts format('%-12s %s', item.to_s.capitalize + ':',
+                    mark_text(result[:summary][item.to_sym]))
+      end
+      puts
+
+      if result[:errors].empty? and result[:warnings].empty?
+        puts 'No errors or warnings'
+      else
+        red    = "\033[31m"
+        yellow = "\033[33m"
+        rst    = "\033[0m"
+
+        item_msg = lambda { |item|
+          pos = [item[:file], item[:line], item[:column]].compact.join(':')
+          pos.empty? ? item[:msg] : pos + ': ' + item[:msg]
+        }
+        result[:errors].each do |item|
+          puts "#{red}  ✖  #{item_msg.call(item)}#{rst}"
+        end
+        result[:warnings].each do |item|
+          puts "#{yellow}  !  #{item_msg.call(item)}#{rst}"
+        end
+
+        puts
+        puts format('Summary:     %s%d errors%s, %s%d warnings%s',
+                    red, result[:errors].length, rst,
+                    yellow, result[:warnings].length, rst)
+      end
+    end
+    exit 1 unless result[:summary][:valid]
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'vendor PATH', 'Download all dependencies and generate a lockfile in a `vendor` directory'
+  option :overwrite, type: :boolean, default: false,
+    desc: 'Overwrite existing vendored dependencies and lockfile.'
+  def vendor(path = nil)
+    o = opts.dup
+    vendor_deps(path, o)
+  end
+
+  desc 'archive PATH', 'archive a profile to tar.gz (default) or zip'
+  profile_options
+  option :output, aliases: :o, type: :string,
+    desc: 'Save the archive to a path'
+  option :zip, type: :boolean, default: false,
+    desc: 'Generates a zip archive.'
+  option :tar, type: :boolean, default: false,
+    desc: 'Generates a tar.gz archive.'
+  option :overwrite, type: :boolean, default: false,
+    desc: 'Overwrite existing archive.'
+  option :ignore_errors, type: :boolean, default: false,
+    desc: 'Ignore profile warnings.'
+  def archive(path)
+    o = opts.dup
+    diagnose(o)
+
+    o[:logger] = Logger.new(STDOUT)
+    o[:logger].level = get_log_level(o.log_level)
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
+
+    profile = Inspec::Profile.for_target(path, o)
+    result = profile.check
+
+    if result && !o[:ignore_errors] == false
+      o[:logger].info 'Profile check failed. Please fix the profile before generating an archive.'
+      return exit 1
+    end
+
+    # generate archive
+    exit 1 unless profile.archive(o)
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'exec PATHS', 'run all test files at the specified PATH.'
+  exec_options
+  def exec(*targets)
+    o = opts(:exec).dup
+    diagnose(o)
+    configure_logger(o)
+
+    runner = Inspec::Runner.new(o)
+    targets.each { |target| runner.add_target(target) }
+
+    exit runner.run
+  rescue ArgumentError, RuntimeError, Train::UserError => e
+    $stderr.puts e.message
+    exit 1
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'detect', 'detect the target OS'
+  target_options
+  option :format, type: :string
+  def detect
+    o = opts(:detect).dup
+    o[:command] = 'platform.params'
+    (_, res) = run_command(o)
+    if o['format'] == 'json'
+      puts res.to_json
+    else
+      headline('Platform Details')
+      puts Inspec::BaseCLI.detect(params: res, indent: 0, color: 36)
+    end
+  rescue ArgumentError, RuntimeError, Train::UserError => e
+    $stderr.puts e.message
+    exit 1
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'shell', 'open an interactive debugging shell'
+  target_options
+  option :command, aliases: :c,
+    desc: 'A single command string to run instead of launching the shell'
+  option :format, type: :string, default: nil, hide: true,
+    desc: '[DEPRECATED] Please use --reporter - this will be removed in InSpec 3.0'
+  option :reporter, type: :array,
+    banner: 'one two:/output/file/path',
+    desc: 'Enable one or more output reporters: cli, documentation, html, progress, json, json-min, json-rspec, junit'
+  option :depends, type: :array, default: [],
+    desc: 'A space-delimited list of local folders containing profiles whose libraries and resources will be loaded into the new shell'
+  def shell_func
+    o = opts(:shell).dup
+    diagnose(o)
+    o[:debug_shell] = true
+
+    log_device = suppress_log_output?(o) ? nil : STDOUT
+    o[:logger] = Logger.new(log_device)
+    o[:logger].level = get_log_level(o.log_level)
+
+    if o[:command].nil?
+      runner = Inspec::Runner.new(o)
+      return Inspec::Shell.new(runner).start
+    end
+
+    run_type, res = run_command(o)
+    exit res unless run_type == :ruby_eval
+
+    # No InSpec tests - just print evaluation output.
+    res = (res.respond_to?(:to_json) ? res.to_json : JSON.dump(res)) if o['reporter']&.keys&.include?('json')
+    puts res
+    exit 0
+  rescue RuntimeError, Train::UserError => e
+    $stderr.puts e.message
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'env', 'Output shell-appropriate completion configuration'
+  def env(shell = nil)
+    p = Inspec::EnvPrinter.new(self.class, shell)
+    p.print_and_exit!
+  rescue StandardError => e
+    pretty_handle_exception(e)
+  end
+
+  desc 'schema NAME', 'print the JSON schema', hide: true
+  def schema(name)
+    puts Inspec::Schema.json(name)
+  rescue StandardError => e
+    puts e
+    puts "Valid schemas are #{Inspec::Schema.names.join(', ')}"
+  end
+
+  desc 'version', 'prints the version of this tool'
+  option :format, type: :string
+  def version
+    if opts['format'] == 'json'
+      v = { version: Inspec::VERSION }
+      puts v.to_json
+    else
+      puts Inspec::VERSION
+      # display outdated version
+      latest = LatestInSpecVersion.new.latest
+      if Gem::Version.new(Inspec::VERSION) < Gem::Version.new(latest)
+        puts "\nYour version of InSpec is out of date! The latest version is #{latest}."
+      end
+    end
+  end
+  map %w{-v --version} => :version
+
+  private
+
+  def run_command(opts)
+    runner = Inspec::Runner.new(opts)
+    res = runner.eval_with_virtual_profile(opts[:command])
+    runner.load
+
+    return :ruby_eval, res if runner.all_rules.empty?
+    return :rspec_run, runner.run_tests # rubocop:disable Style/RedundantReturn
+  end
+end
+
+# Load all plugins on startup
+ctl = Inspec::PluginCtl.new
+ctl.list.each { |x| ctl.load(x) }
+
+# load CLI plugins before the Inspec CLI has been started
+Inspec::Plugins::CLI.subcommands.each { |_subcommand, params|
+  Inspec::InspecCLI.register(
+    params[:klass],
+    params[:subcommand_name],
+    params[:usage],
+    params[:description],
+    params[:options],
+  )
+}