inspec-core 2.1.67

data/lib/inspec/formatters.rb

@@ -0,0 +1,3 @@
+require 'inspec/formatters/base'
+require 'inspec/formatters/json_rspec'
+require 'inspec/formatters/show_progress'

data/lib/inspec/formatters/base.rb

@@ -0,0 +1,259 @@
+require 'rspec/core'
+require 'rspec/core/formatters/base_formatter'
+
+module Inspec::Formatters
+  class Base < RSpec::Core::Formatters::BaseFormatter
+    RSpec::Core::Formatters.register self, :close, :dump_summary, :stop
+
+    attr_accessor :backend, :run_data
+
+    def initialize(output)
+      super(output)
+
+      @run_data = {}
+      @profiles = []
+      @profiles_info = nil
+      @backend = nil
+    end
+
+    # RSpec Override: #dump_summary
+    #
+    # Supply run summary data, such as the InSpec version and the total duration.
+    def dump_summary(summary)
+      run_data[:version] = Inspec::VERSION
+      run_data[:statistics] = {
+        duration: summary.duration,
+        controls: statistics,
+      }
+    end
+
+    # RSpec Override: #stop
+    #
+    # Called at the end of a complete RSpec run.
+    # We use this to map tests to controls and flesh out the rest of the run_data
+    # hash to include details about the run, the platform, etc.
+    def stop(notification)
+      # This might be a bit confusing. The results are not actually organized
+      # by control. It is organized by test. So if a control has 3 tests, the
+      # output will have 3 control entries, each one with the same control id
+      # and different test results. An rspec example maps to an inspec test.
+      run_data[:controls] = notification.examples.map do |example|
+        format_example(example).tap do |hash|
+          e = example.exception
+          next unless e
+
+          if example.metadata[:sensitive]
+            hash[:message] = '*** sensitive output suppressed ***'
+          else
+            hash[:message] = exception_message(e)
+          end
+
+          next if e.is_a? RSpec::Expectations::ExpectationNotMetError
+          hash[:exception] = e.class.name
+          hash[:backtrace] = e.backtrace
+        end
+      end
+
+      # include any tests that were run that were not part of a control
+      run_data[:other_checks] = examples_without_controls
+      examples_with_controls.each do |example|
+        control = example2control(example)
+        move_example_into_control(example, control)
+      end
+
+      # flesh out the profiles key with additional profile information
+      run_data[:profiles] = profiles_info
+
+      # add the platform information for this particular target
+      run_data[:platform] = {
+        name: platform(:name),
+        release: platform(:release),
+        target: backend_target,
+        uuid: platform(:uuid),
+      }
+    end
+
+    # Add the current profile to the list of executed profiles.
+    # Called by the runner during example collection.
+    def add_profile(profile)
+      @profiles.push(profile)
+    end
+
+    # Return all the collected output to the caller
+    def results
+      run_data
+    end
+
+    private
+
+    def all_unique_controls
+      unique_controls = Set.new
+      run_data[:profiles].each do |profile|
+        profile[:controls].map { |control| unique_controls.add(control) }
+      end
+
+      unique_controls
+    end
+
+    def statistics
+      failed = 0
+      skipped = 0
+      passed = 0
+
+      all_unique_controls.each do |control|
+        next unless control[:results]
+        if control[:results].any? { |r| r[:status] == 'failed' }
+          failed += 1
+        elsif control[:results].any? { |r| r[:status] == 'skipped' }
+          skipped += 1
+        else
+          passed += 1
+        end
+      end
+
+      total = failed + passed + skipped
+
+      {
+        total: total,
+        passed: {
+          total: passed,
+        },
+        skipped: {
+          total: skipped,
+        },
+        failed: {
+          total: failed,
+        },
+      }
+    end
+
+    def exception_message(exception)
+      if exception.is_a?(RSpec::Core::MultipleExceptionError)
+        exception.all_exceptions.map(&:message).uniq.join("\n\n")
+      else
+        exception.message
+      end
+    end
+
+    # RSpec Override: #format_example
+    #
+    # Called after test execution, this allows us to populate our own hash with data
+    # for this test that is necessary for the rest of our reports.
+    def format_example(example) # rubocop:disable Metrics/AbcSize
+      if !example.metadata[:description_args].empty? && example.metadata[:skip]
+        # For skipped profiles, rspec returns in full_description the skip_message as well. We don't want
+        # to mix the two, so we pick the full_description from the example.metadata[:example_group] hash.
+        code_description = example.metadata[:example_group][:description]
+      else
+        code_description = example.metadata[:full_description]
+      end
+
+      res = {
+        id: example.metadata[:id],
+        profile_id: example.metadata[:profile_id],
+        status: example.execution_result.status.to_s,
+        code_desc: code_description,
+        run_time: example.execution_result.run_time,
+        start_time: example.execution_result.started_at.to_datetime.rfc3339.to_s,
+        resource_title: example.metadata[:described_class] || example.metadata[:example_group][:description],
+        expectation_message: format_expectation_message(example),
+      }
+
+      unless (pid = example.metadata[:profile_id]).nil?
+        res[:profile_id] = pid
+      end
+
+      if res[:status] == 'pending'
+        res[:status] = 'skipped'
+        res[:skip_message] = example.metadata[:description]
+        res[:resource] = example.metadata[:described_class].to_s
+      end
+
+      res
+    end
+
+    def format_expectation_message(example)
+      if (example.metadata[:example_group][:description_args].first == example.metadata[:example_group][:described_class]) ||
+         example.metadata[:example_group][:described_class].nil?
+        example.metadata[:description]
+      else
+        "#{example.metadata[:example_group][:description]} #{example.metadata[:description]}"
+      end
+    end
+
+    # This formatter runs for all reports and we cannot error on missing fields.
+    # Return nil if not found or Train error. If needed, we will raise an error inside
+    # the proper report.
+    def platform(field)
+      return nil if @backend.nil?
+      begin
+        @backend.platform[field]
+      rescue Train::Error => e
+        Inspec::Log.error(e.message)
+        nil
+      end
+    end
+
+    def backend_target
+      return nil if @backend.nil?
+      connection = @backend.backend
+      connection.respond_to?(:uri) ? connection.uri : nil
+    end
+
+    def examples
+      run_data[:controls]
+    end
+
+    def examples_without_controls
+      examples.find_all { |example| example2control(example).nil? }
+    end
+
+    def examples_with_controls
+      examples.find_all { |example| !example2control(example).nil? }
+    end
+
+    def profiles_info
+      @profiles_info ||= @profiles.map(&:info!).map(&:dup)
+    end
+
+    def example2control(example)
+      profile = profile_from_example(example)
+      return nil unless profile&.[](:controls)
+      profile[:controls].find { |x| x[:id] == example[:id] }
+    end
+
+    def profile_from_example(example)
+      profiles_info.find { |p| profile_contains_example?(p, example) }
+    end
+
+    def profile_contains_example?(profile, example)
+      profile_name = profile[:name]
+      example_profile_id = example[:profile_id]
+
+      # if either the profile name is nil or the profile in the given example
+      # is nil, assume the profile doesn't contain the example and default
+      # to creating a new profile. Otherwise, for profiles that have no
+      # metadata, this may incorrectly match a profile that does not contain
+      # this example, leading to Ruby exceptions.
+      return false if profile_name.nil? || example_profile_id.nil?
+
+      # The correct profile is one where the name of the profile, and the profile
+      # name in the example match. Additionally, the list of controls in the
+      # profile must contain the example in question (which we match by ID).
+      #
+      # While the profile name match is usually good enough, we must also match by
+      # the control ID in the case where an InSpec runner has multiple profiles of
+      # the same name (i.e. when Test Kitchen is running concurrently using a
+      # single test suite that uses the Flat source reader, in which case InSpec
+      # creates a fake profile with a name like "tests from /path/to/tests")
+      profile_name == example_profile_id && profile[:controls].any? { |control| control[:id] == example[:id] }
+    end
+
+    def move_example_into_control(example, control)
+      control[:results] ||= []
+      example.delete(:id)
+      example.delete(:profile_id)
+      control[:results].push(example)
+    end
+  end
+end

data/lib/inspec/formatters/json_rspec.rb

@@ -0,0 +1,20 @@
+module Inspec::Formatters
+  class RspecJson < RSpec::Core::Formatters::JsonFormatter
+    RSpec::Core::Formatters.register self
+
+    private
+
+    # We are cheating and overriding a private method in RSpec's core JsonFormatter.
+    # This is to avoid having to repeat this id functionality in both dump_summary
+    # and dump_profile (both of which call format_example).
+    # See https://github.com/rspec/rspec-core/blob/master/lib/rspec/core/formatters/json_formatter.rb
+    #
+    # rspec's example id here corresponds to an inspec test's control name -
+    # either explicitly specified or auto-generated by rspec itself.
+    def format_example(example)
+      res = super(example)
+      res[:id] = example.metadata[:id]
+      res
+    end
+  end
+end

data/lib/inspec/formatters/show_progress.rb

@@ -0,0 +1,12 @@
+module Inspec::Formatters
+  class ShowProgress < RSpec::Core::Formatters::ProgressFormatter
+    RSpec::Core::Formatters.register self
+
+    # remove summary output from progress
+    %w{dump_summary dump_failures dump_pending message seed start_dump}.each do |m|
+      define_method(m) do |*args|
+        # override
+      end
+    end
+  end
+end

data/lib/inspec/library_eval_context.rb

@@ -0,0 +1,58 @@
+# encoding: utf-8
+# author: Steven Danna
+# author: Victoria Jeffrey
+require 'inspec/plugins/resource'
+require 'inspec/dsl_shared'
+
+module Inspec
+  #
+  # LibaryEvalContext constructs an instance of an anonymous class
+  # that library files will be instance_exec'd against.
+  #
+  # The anonymous class ensures that `Inspec.resource(1)` will return
+  # an anonymouse class that is suitable as the parent class of an
+  # inspec resource. The class returned will have the resource
+  # registry used by all dsl methods bound to the resource registry
+  # passed into the #create constructor.
+  #
+  #
+  class LibraryEvalContext
+    def self.create(registry, require_loader)
+      c = Class.new do
+        extend Inspec::ResourceDSL
+        include Inspec::ResourceBehaviors
+        define_singleton_method :__resource_registry do
+          registry
+        end
+      end
+
+      c2 = Class.new do
+        define_singleton_method :resource do |version|
+          Inspec.validate_resource_dsl_version!(version)
+          c
+        end
+      end
+
+      c3 = Class.new do
+        include Inspec::DSL::RequireOverride
+        def initialize(require_loader)
+          @require_loader = require_loader
+          @inspec_binding = nil
+        end
+
+        def __inspec_binding
+          @inspec_binding
+        end
+      end
+
+      c3.const_set(:Inspec, c2)
+      res = c3.new(require_loader)
+
+      # Provide the local binding for this context which is necessary for
+      # calls to `require` to create all dependent objects in the correct
+      # context.
+      res.instance_variable_set('@inspec_binding', res.instance_eval('binding'))
+      res
+    end
+  end
+end

data/lib/inspec/log.rb

@@ -0,0 +1,11 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'mixlib/log'
+
+module Inspec
+  class Log
+    extend Mixlib::Log
+  end
+end

data/lib/inspec/metadata.rb

@@ -0,0 +1,247 @@
+# encoding: utf-8
+# Copyright 2015 Dominik Richter
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'logger'
+require 'rubygems/version'
+require 'rubygems/requirement'
+require 'semverse'
+require 'utils/spdx'
+
+module Inspec
+  # Extract metadata.rb information
+  # A Metadata object may be created and finalized with invalid data.
+  # This allows the check CLI command to analyse the issues.
+  # Use valid? to determine if the metadata is coherent.
+  class Metadata
+    attr_reader :ref
+    attr_accessor :params, :content
+    def initialize(ref, logger = nil)
+      @ref = ref
+      @logger = logger || Logger.new(nil)
+      @content = ''
+      @params = {}
+      @missing_methods = []
+    end
+
+    %w{
+      name
+      title
+      maintainer
+      maintainer_email
+      copyright
+      copyright_email
+      license
+      summary
+      description
+      version
+      inspec_version
+    }.each do |name|
+      define_method name.to_sym do |arg|
+        params[name.to_sym] = arg
+      end
+    end
+
+    def dependencies
+      params[:depends] || []
+    end
+
+    def supports(sth, version = nil)
+      # Ignore supports with metadata.rb. This file is legacy and the way it
+      # it handles `supports` deprecated. A deprecation warning will be printed
+      # already.
+    end
+
+    def inspec_requirement
+      # using Gem::Requirement here to allow nil values which
+      # translate to [">= 0"]
+      Gem::Requirement.create(params[:inspec_version])
+    end
+
+    def supports_runtime?
+      running = Gem::Version.new(Inspec::VERSION)
+      inspec_requirement.satisfied_by?(running)
+    end
+
+    def supports_platform?(backend)
+      backend.platform.supported?(params[:supports])
+    end
+
+    # return all warn and errors
+    def valid # rubocop:disable Metrics/AbcSize
+      errors = []
+      warnings = []
+
+      %w{name version}.each do |field|
+        next unless params[field.to_sym].nil?
+        errors.push("Missing profile #{field} in #{ref}")
+      end
+
+      if params[:name] =~ %r{[\/\\]}
+        warnings.push("Your profile name (#{params[:name]}) contains a slash " \
+          'which will not be permitted in InSpec 2.0. Please change your profile ' \
+          'name in the `inspec.yml` file.')
+      end
+
+      # if version is set, ensure it is correct
+      if !params[:version].nil? && !valid_version?(params[:version])
+        errors.push('Version needs to be in SemVer format')
+      end
+
+      %w{title summary maintainer copyright license}.each do |field|
+        next unless params[field.to_sym].nil?
+        warnings.push("Missing profile #{field} in #{ref}")
+      end
+
+      # if version is set, ensure it is in SPDX format
+      if !params[:license].nil? && !Spdx.valid_license?(params[:license])
+        warnings.push("License '#{params[:license]}' needs to be in SPDX format. See https://spdx.org/licenses/.")
+      end
+
+      [errors, warnings]
+    end
+
+    # returns true or false
+    def valid?
+      errors, _warnings = valid
+      errors.empty? && unsupported.empty?
+    end
+
+    def valid_version?(value)
+      Semverse::Version.new(value)
+      true
+    rescue Semverse::InvalidVersionFormat
+      false
+    end
+
+    def method_missing(sth, *args)
+      @logger.warn "#{ref} doesn't support: #{sth} #{args}"
+      @missing_methods.push(sth)
+    end
+
+    def unsupported
+      @missing_methods
+    end
+
+    def self.symbolize_keys(obj)
+      return obj.map { |i| symbolize_keys(i) } if obj.is_a?(Array)
+      return obj unless obj.is_a?(Hash)
+
+      obj.each_with_object({}) do |(k, v), h|
+        v = symbolize_keys(v) if v.is_a?(Hash)
+        v = symbolize_keys(v) if v.is_a?(Array)
+        h[k.to_sym] = v
+      end
+    end
+
+    def self.finalize_supports_elem(elem, logger)
+      case x = elem
+      when Hash
+        x[:release] = x[:release].to_s if x[:release]
+        x
+      when Array
+        logger.warn(
+          'Failed to read supports entry that is an array. Please use '\
+          'the `supports: {os-family: xyz}` syntax.',
+        )
+        nil
+      when nil then nil
+      else
+        logger ||= Logger.new(nil)
+        logger.warn(
+          "Do not use deprecated `supports: #{x}` syntax. Instead use:\n"\
+          "supports:\n  - os-family: #{x}\n\n",
+        )
+        { :'os-family' => x } # rubocop:disable Style/HashSyntax
+      end
+    end
+
+    def self.finalize_supports(supports, logger)
+      case x = supports
+      when Hash   then [finalize_supports_elem(x, logger)]
+      when Array  then x.map { |e| finalize_supports_elem(e, logger) }.compact
+      when nil    then []
+      else
+        logger ||= Logger.new(nil)
+        logger.warn(
+          "Do not use deprecated `supports: #{x}` syntax. Instead use:\n"\
+          "supports:\n  - os-family: #{x}\n\n",
+        )
+        [{ :'os-family' => x }] # rubocop:disable Style/HashSyntax
+      end
+    end
+
+    def self.finalize_name(metadata, profile_id, original_target)
+      # profile_id always overwrites whatever already exists as the name
+      unless profile_id.to_s.empty?
+        metadata.params[:name] = profile_id.to_s
+        return
+      end
+
+      # don't overwrite an existing name
+      return unless metadata.params[:name].nil?
+
+      # if there's a title, there is no need to set a name too
+      return unless metadata.params[:title].nil?
+
+      # create a new name based on the original target if it exists
+      # Crudely slug the target to not contain slashes, to avoid breaking
+      # unit tests that look for warning sequences
+      return if original_target.to_s.empty?
+      metadata.params[:title] = "tests from #{original_target}"
+      metadata.params[:name] = metadata.params[:title].gsub(%r{[\\\/]}, '.')
+    end
+
+    def self.finalize(metadata, profile_id, options, logger = nil)
+      return nil if metadata.nil?
+      param = metadata.params || {}
+      options ||= {}
+      param['version'] = param['version'].to_s unless param['version'].nil?
+      metadata.params = symbolize_keys(param)
+      metadata.params[:supports] = finalize_supports(metadata.params[:supports], logger)
+      finalize_name(metadata, profile_id, options[:target])
+
+      metadata
+    end
+
+    def self.from_yaml(ref, content, profile_id, logger = nil)
+      res = Metadata.new(ref, logger)
+      res.params = YAML.load(content)
+      res.content = content
+      finalize(res, profile_id, {}, logger)
+    end
+
+    def self.from_ruby(ref, content, profile_id, logger = nil)
+      res = Metadata.new(ref, logger)
+      res.instance_eval(content, ref, 1)
+      res.content = content
+      finalize(res, profile_id, {}, logger)
+    end
+
+    def self.from_ref(ref, content, profile_id, logger = nil)
+      # NOTE there doesn't have to exist an actual file, it may come from an
+      # archive (i.e., content)
+      case File.basename(ref)
+      when 'inspec.yml'
+        from_yaml(ref, content, profile_id, logger)
+      when 'metadata.rb'
+        from_ruby(ref, content, profile_id, logger)
+      else
+        logger ||= Logger.new(nil)
+        logger.error "Don't know how to handle metadata in #{ref}"
+        nil
+      end
+    end
+
+    def self.from_file(path, profile_id, logger = nil)
+      unless File.file?(path)
+        logger ||= Logger.new(nil)
+        logger.error "Can't find metadata file #{path}"
+        return nil
+      end
+
+      from_ref(File.basename(path), File.read(path), profile_id, logger)
+    end
+  end
+end