inspec-core 2.1.67

data/lib/inspec/dependencies/lockfile.rb

@@ -0,0 +1,115 @@
+# encoding: utf-8
+require 'yaml'
+
+module Inspec
+  class Lockfile
+    # When we finalize this feature, we should set these to 1
+    MINIMUM_SUPPORTED_VERSION = 1
+    CURRENT_LOCKFILE_VERSION = 1
+
+    def self.from_dependency_set(dep_set)
+      lockfile_content = {
+        'lockfile_version' => CURRENT_LOCKFILE_VERSION,
+        'depends' => dep_set.to_array,
+      }
+      new(lockfile_content)
+    end
+
+    def self.from_content(content)
+      parsed_content = YAML.load(content)
+      version = parsed_content['lockfile_version']
+      raise "No lockfile_version set in #{path}!" if version.nil?
+      validate_lockfile_version!(version.to_i)
+      new(parsed_content)
+    end
+
+    def self.from_file(path)
+      content = File.read(path)
+      from_content(content)
+    end
+
+    def self.validate_lockfile_version!(version)
+      if version < MINIMUM_SUPPORTED_VERSION
+        raise <<~EOF
+          This lockfile specifies a lockfile_version of #{version} which is
+          lower than the minimum supported version #{MINIMUM_SUPPORTED_VERSION}.
+
+          Please create a new lockfile for this project by running:
+
+              inspec vendor
+        EOF
+      elsif version > CURRENT_LOCKFILE_VERSION
+        raise <<~EOF
+          This lockfile claims to be version #{version} which is greater than
+          the most recent lockfile version(#{CURRENT_LOCKFILE_VERSION}).
+
+          This may happen if you are using an older version of inspec than was
+          used to create the lockfile.
+        EOF
+      end
+    end
+
+    attr_reader :version, :deps
+    def initialize(lockfile_content_hash)
+      version = lockfile_content_hash['lockfile_version']
+      @version = version.to_i
+      parse_content_hash(lockfile_content_hash)
+    end
+
+    def to_yaml
+      {
+        'lockfile_version' => CURRENT_LOCKFILE_VERSION,
+        'depends' => @deps.map { |i| stringify_keys(i) },
+      }.to_yaml
+    end
+
+    private
+
+    # Refactor this to be "version-wise" - i.e. make one dispatch
+    # function for each version so that even if it duplicates code,
+    # it can describe the part of the code that it expects to be
+    # different. Then that dispatch routine can call more well
+    # defined methods like "parse_v0_dependencies" or
+    # "parse_flat_dependencies" or what not as things generally
+    # develop. It does help people easily set breakpoints/track
+    # different entry points of the API.
+    def parse_content_hash(lockfile_content_hash)
+      case version
+      when 1
+        parse_content_hash_1(lockfile_content_hash)
+      else
+        # If we've gotten here, there is likely a mistake in the
+        # lockfile version validation in the constructor.
+        raise "No lockfile parser for version #{version}"
+      end
+    end
+
+    def parse_content_hash_1(lockfile_content_hash)
+      @deps = lockfile_content_hash['depends']&.map { |i| symbolize_keys(i) }
+    end
+
+    def mutate_hash_keys_with(hash, fun)
+      hash.each_with_object({}) do |v, memo|
+        key = fun.call(v[0])
+        value = if v[1].is_a?(Hash)
+                  mutate_hash_keys_with(v[1], fun)
+                elsif v[1].is_a?(Array)
+                  v[1].map do |i|
+                    i.is_a?(Hash) ? mutate_hash_keys_with(i, fun) : i
+                  end
+                else
+                  v[1]
+                end
+        memo[key] = value
+      end
+    end
+
+    def stringify_keys(hash)
+      mutate_hash_keys_with(hash, proc { |i| i.to_s })
+    end
+
+    def symbolize_keys(hash)
+      mutate_hash_keys_with(hash, proc { |i| i.to_sym })
+    end
+  end
+end

data/lib/inspec/dependencies/requirement.rb

@@ -0,0 +1,123 @@
+# encoding: utf-8
+require 'inspec/cached_fetcher'
+require 'inspec/dependencies/dependency_set'
+require 'semverse'
+
+module Inspec
+  #
+  # Inspec::Requirement represents a given profile dependency, where
+  # appropriate we delegate to Inspec::Profile directly.
+  #
+  class Requirement
+    def self.from_metadata(dep, cache, opts)
+      raise 'Cannot load empty dependency.' if dep.nil? || dep.empty?
+
+      req_path = opts[:cwd]
+
+      if dep[:path]
+        req_path = File.expand_path(dep[:path], req_path)
+      end
+
+      new(dep[:name],
+          dep[:version],
+          cache,
+          req_path,
+          opts.merge(dep))
+    end
+
+    def self.from_lock_entry(entry, cwd, cache, backend, opts = {})
+      req = new(entry[:name],
+                entry[:version_constraints],
+                cache,
+                cwd,
+                entry[:resolved_source].merge(backend: backend).merge(opts))
+
+      locked_deps = []
+      Array(entry[:dependencies]).each do |dep_entry|
+        locked_deps << Inspec::Requirement.from_lock_entry(dep_entry, cwd, cache, backend, opts)
+      end
+      req.lock_deps(locked_deps)
+      req
+    end
+
+    attr_reader :cwd, :opts, :version_constraints
+    def initialize(name, version_constraints, cache, cwd, opts)
+      @name = name
+      @version_constraints = Array(version_constraints)
+      @cache = cache
+      @backend = opts[:backend]
+      @opts = opts
+      @cwd = cwd
+    end
+
+    #
+    # A dependency can be renamed in inspec.yml/inspec.lock.  Prefer
+    # the name the user gave this dependency over the profile name.
+    #
+    def name
+      @name || profile.name
+    end
+
+    def source_version
+      profile.version
+    end
+
+    def source_satisfies_spec?
+      return true if version_constraints.empty?
+
+      # Semverse::Constraint.satisfy_all returns a list of versions that match all of the
+      # supplied constraints. Since we're only matching against a single version, the return
+      # of satisfy_all will be non-empty if the profile version we have satisfies the constraints.
+      constraints = @version_constraints.map { |x| Semverse::Constraint.new(x) }
+      !Semverse::Constraint.satisfy_all(constraints, Semverse::Version.new(profile.version)).empty?
+    end
+
+    def resolved_source
+      @resolved_source ||= fetcher.resolved_source
+    end
+
+    def to_hash
+      h = {
+        'name' => name,
+        'resolved_source' => resolved_source,
+        'version_constraints' => version_constraints,
+      }
+
+      if !dependencies.empty?
+        h['dependencies'] = dependencies.map(&:to_hash)
+      end
+
+      h
+    end
+
+    def lock_deps(dep_array)
+      @dependencies = dep_array
+    end
+
+    def fetcher
+      @fetcher ||= Inspec::CachedFetcher.new(opts, @cache)
+    end
+
+    # load dependencies of the dependency
+    def dependencies
+      @dependencies ||= profile.metadata.dependencies.map do |r|
+        Inspec::Requirement.from_metadata(r, @cache, cwd: @cwd, backend: @backend)
+      end
+    end
+
+    def to_s
+      name
+    end
+
+    # load the profile for the requirement
+    def profile
+      return @profile unless @profile.nil?
+      opts = @opts.dup
+      opts[:backend] = @backend
+      if !@dependencies.nil?
+        opts[:dependencies] = Inspec::DependencySet.from_array(@dependencies, @cwd, @cache, @backend)
+      end
+      @profile = Inspec::Profile.for_fetcher(fetcher, opts)
+    end
+  end
+end

data/lib/inspec/dependencies/resolver.rb

@@ -0,0 +1,86 @@
+# encoding: utf-8
+# author: Steven Danna <steve@chef.io>
+require 'inspec/log'
+require 'inspec/errors'
+
+module Inspec
+  #
+  # Inspec::Resolver is a simple dependency resolver. Unlike Bundler
+  # or Berkshelf, it does not attempt to resolve each named dependency
+  # to a single version. Rather, it traverses down the dependency tree
+  # and:
+  #
+  # - Fetches the dependency from the source
+  # - Checks the presence of cycles, and
+  # - Checks that the specified dependency source satisfies the
+  #   specified version constraint
+  #
+  # The full dependency tree is then available for the loader, which
+  # will provide the isolation necessary to support multiple versions
+  # of the same profile being used at runtime.
+  #
+  # Currently the fetching happens somewhat lazily depending on the
+  # implementation of the fetcher being used.
+  #
+  class Resolver
+    def self.resolve(dependencies, cache, working_dir, backend)
+      reqs = dependencies.map do |dep|
+        req = Inspec::Requirement.from_metadata(dep, cache, cwd: working_dir, backend: backend)
+        req || raise("Cannot initialize dependency: #{req}")
+      end
+      new.resolve(reqs)
+    end
+
+    def detect_duplicates(deps, top_level, path_string)
+      seen_items_local = []
+      deps.each do |dep|
+        if seen_items_local.include?(dep.name)
+          problem_cookbook = if top_level
+                               'the inspec.yml for this profile.'
+                             else
+                               "the dependency information for #{path_string.split(' ').last}"
+                             end
+          raise Inspec::DuplicateDep, "The dependency #{dep.name} is listed twice in #{problem_cookbook}"
+        else
+          seen_items_local << dep.name
+        end
+      end
+    end
+
+    def resolve(deps, top_level = true, seen_items = {}, path_string = '') # rubocop:disable Metrics/AbcSize
+      graph = {}
+      if top_level
+        Inspec::Log.debug("Starting traversal of dependencies #{deps.map(&:to_s)}")
+      else
+        Inspec::Log.debug("Traversing dependency tree of transitive dependency #{deps.map(&:name)}")
+      end
+
+      detect_duplicates(deps, top_level, path_string)
+      deps.each do |dep|
+        new_seen_items = seen_items.dup
+        new_path_string = if path_string.empty?
+                            dep.name
+                          else
+                            path_string + " -> #{dep.name}"
+                          end
+
+        raise Inspec::CyclicDependencyError, "Dependency #{dep} would cause a dependency cycle (#{new_path_string})" if new_seen_items.key?(dep.resolved_source)
+
+        new_seen_items[dep.resolved_source] = true
+
+        if !dep.source_satisfies_spec?
+          raise Inspec::UnsatisfiedVersionSpecification, "The profile #{dep.name} from #{dep.resolved_source} has a version #{dep.source_version} which doesn't match #{dep.version_constraints}"
+        end
+
+        Inspec::Log.debug("Adding dependency #{dep.name} (#{dep.resolved_source})")
+        graph[dep.name] = dep
+        if !dep.dependencies.empty?
+          resolve(dep.dependencies, false, new_seen_items.dup, new_path_string)
+        end
+      end
+
+      Inspec::Log.debug('Dependency traversal complete.') if top_level
+      graph
+    end
+  end
+end

data/lib/inspec/describe.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  class DescribeBase
+    def initialize(action)
+      @action = action
+      @checks = []
+    end
+
+    # Evaluate the given block and collect all checks. These will be registered
+    # with the callback function under the 'describe.one' name.
+    #
+    # @param [Proc] ruby block containing checks (e.g. via describe)
+    # @return [nil]
+    def one(&block)
+      return unless block_given?
+      instance_eval(&block)
+      @action.call('describe.one', @checks, nil)
+    end
+
+    def describe(*args, &block)
+      @checks.push(['describe', args, block])
+    end
+  end
+end

data/lib/inspec/dsl.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# author: Dominik Richter
+# author: Christoph Hartmann
+require 'inspec/log'
+
+module Inspec::DSL
+  def require_controls(id, &block)
+    opts = { profile_id: id, include_all: false, backend: @backend, conf: @conf, dependencies: @dependencies }
+    ::Inspec::DSL.load_spec_files_for_profile(self, opts, &block)
+  end
+
+  def include_controls(id, &block)
+    opts = { profile_id: id, include_all: true, backend: @backend, conf: @conf, dependencies: @dependencies }
+    ::Inspec::DSL.load_spec_files_for_profile(self, opts, &block)
+  end
+
+  alias require_rules require_controls
+  alias include_rules include_controls
+
+  def require_resource(options = {})
+    raise 'You must specify a specific resource name when calling require_resource()' if options[:resource].nil?
+
+    from_profile = options[:profile] || profile_name
+    target_name = options[:as] || options[:resource]
+    res = resource_class(from_profile, options[:resource])
+    add_resource(target_name, res)
+  end
+
+  def self.load_spec_files_for_profile(bind_context, opts, &block)
+    dependencies = opts[:dependencies]
+    profile_id = opts[:profile_id]
+
+    dep_entry = dependencies.list[profile_id]
+    if dep_entry.nil?
+      raise <<~EOF
+        Cannot load #{profile_id} since it is not listed as a dependency of #{bind_context.profile_name}.
+
+        Dependencies available from this context are:
+            #{dependencies.list.keys.join("\n    ")}
+      EOF
+    end
+
+    context = dep_entry.profile.runner_context
+    # if we don't want all the rules, then just make 1 pass to get all rule_IDs
+    # that we want to keep from the original
+    filter_included_controls(context, dep_entry.profile, &block) if !opts[:include_all]
+    # interpret the block and skip/modify as required
+    context.load(block) if block_given?
+    bind_context.add_subcontext(context)
+  end
+
+  def self.filter_included_controls(context, profile, &block)
+    mock = Inspec::Backend.create({ backend: 'mock' })
+    include_ctx = Inspec::ProfileContext.for_profile(profile, mock, {})
+    include_ctx.load(block) if block_given?
+    # remove all rules that were not registered
+    context.all_rules.each do |r|
+      id = Inspec::Rule.rule_id(r)
+      fid = Inspec::Rule.profile_id(r) + '/' + id
+      unless include_ctx.rules[id] || include_ctx.rules[fid]
+        context.remove_rule(fid)
+      end
+    end
+  end
+end

data/lib/inspec/dsl_shared.rb

@@ -0,0 +1,33 @@
+# encoding: utf-8
+module Inspec
+  #
+  # Contains methods we would like in multiple DSL
+  #
+  module DSL
+    module RequireOverride
+      # Save the toplevel require method to load all ruby dependencies.
+      # It is used whenever the `require 'lib'` is not in libraries.
+      alias __ruby_require require
+
+      def require(path)
+        rbpath = path + '.rb'
+        return __ruby_require(path) if !@require_loader.exists?(rbpath)
+        return false if @require_loader.loaded?(rbpath)
+
+        # This is equivalent to calling `require 'lib'` with lib on disk.
+        # We cannot rely on libraries residing on disk however.
+        # TODO: Sandboxing.
+        content, path, line = @require_loader.load(rbpath)
+
+        # If we are in the realm of libraries and the LibraryEvalContext
+        # we should have access to the __inspec_binding, which is a Binding
+        # context that provides the correct plane to evaluate all required files to.
+        # It will ensure that embedded calls to `require` still call this
+        # method and get loaded from their correct paths.
+        return __inspec_binding.eval(content, path, line) if defined?(__inspec_binding)
+
+        eval(content, TOPLEVEL_BINDING, path, line) # rubocop:disable Security/Eval
+      end
+    end
+  end
+end