inspec-core 2.2.102 → 2.2.112

data/lib/plugins/inspec-habitat/lib/inspec-habitat/cli.rb

@@ -0,0 +1,39 @@
+# encoding: utf-8
+require_relative 'profile'
+
+module InspecPlugins
+  module Habitat
+    class ProfileCLI < Inspec.plugin(2, :cli_command)
+      # Override banner method to correct missing subcommand.
+      # @see https://github.com/erikhuda/thor/issues/261
+      def self.banner(command, _namespace = nil, _subcommand = false)
+        "#{basename} habitat profile #{command.usage}"
+      end
+
+      desc 'create PATH', 'Create a one-time Habitat artifact for the profile found at PATH'
+      option :output_dir, type: :string, required: false,
+        desc: 'Directory in which to save the generated Habitat artifact. Default: current directory'
+      def create(path)
+        InspecPlugins::Habitat::Profile.create(path, options)
+      end
+
+      desc 'setup PATH', 'Configure the profile at PATH for Habitat, including a plan and hooks'
+      def setup(path)
+        InspecPlugins::Habitat::Profile.setup(path)
+      end
+
+      desc 'upload PATH', 'Create a one-time Habitat artifact for the profile found at PATH, and upload it to a Habitat Depot'
+      def upload(path)
+        InspecPlugins::Habitat::Profile.upload(path, options)
+      end
+    end
+
+    class CLI < Inspec.plugin(2, :cli_command)
+      subcommand_desc 'habitat SUBCOMMAND', 'Manage Habitat with InSpec'
+      namespace 'habitat'
+
+      desc 'profile', 'Manage InSpec profiles as Habitat artifacts'
+      subcommand 'profile', ProfileCLI
+    end
+  end
+end

data/lib/plugins/inspec-habitat/lib/inspec-habitat/profile.rb

@@ -0,0 +1,394 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'inspec/profile_vendor'
+require 'mixlib/shellout'
+require 'tomlrb'
+
+module InspecPlugins
+  module Habitat
+    class Profile
+      attr_reader :options, :path, :profile
+
+      def self.create(path, options = {})
+        creator = new(path, options)
+        hart_file = creator.create
+        creator.copy(hart_file)
+      ensure
+        creator.delete_work_dir
+      end
+
+      def self.setup(path)
+        new(path).setup
+      end
+
+      def self.upload(path, options = {})
+        uploader = new(path, options)
+        uploader.upload
+      ensure
+        uploader.delete_work_dir
+      end
+
+      def initialize(path, options = {})
+        @path    = path
+        @options = options
+        @cli_config = nil
+
+        log_level = options.fetch('log_level', 'info')
+        @log = Inspec::Log
+        @log.level(log_level.to_sym)
+      end
+
+      def create
+        @log.info("Creating a Habitat artifact for profile: #{path}")
+
+        validate_habitat_installed
+        validate_habitat_origin
+        create_profile_object
+        verify_profile
+        vendor_profile_dependencies
+        copy_profile_to_work_dir
+        create_habitat_directories(work_dir)
+        create_plan(work_dir)
+        create_run_hook(work_dir)
+        create_settings_file(work_dir)
+        create_default_config(work_dir)
+
+        # returns the path to the .hart file in the work directory
+        build_hart
+      rescue => e
+        @log.debug(e.backtrace.join("\n"))
+        exit_with_error(
+          'Unable to generate Habitat artifact.',
+          "#{e.class} -- #{e.message}",
+        )
+      end
+
+      def copy(hart_file)
+        validate_output_dir
+
+        @log.info("Copying artifact to #{output_dir}...")
+        copy_hart(hart_file)
+      end
+
+      def upload
+        validate_habitat_auth_token
+        hart_file = create
+        upload_hart(hart_file)
+      rescue => e
+        @log.debug(e.backtrace.join("\n"))
+        exit_with_error(
+          'Unable to upload Habitat artifact.',
+          "#{e.class} -- #{e.message}",
+        )
+      end
+
+      def delete_work_dir
+        @log.debug("Deleting work directory #{work_dir}")
+        FileUtils.rm_rf(work_dir) if Dir.exist?(work_dir)
+      end
+
+      def setup
+        @log.info("Setting up profile at #{path} for Habitat...")
+        create_profile_object
+        verify_profile
+        vendor_profile_dependencies
+        create_habitat_directories(path)
+        create_plan(path)
+        create_run_hook(path)
+        create_settings_file(path)
+        create_default_config(path)
+      end
+
+      private
+
+      def create_profile_object
+        @profile = Inspec::Profile.for_target(
+          path,
+          backend: Inspec::Backend.create(target: 'mock://'),
+        )
+      end
+
+      def verify_profile
+        @log.info('Checking to see if the profile is valid...')
+
+        unless profile.check[:summary][:valid]
+          exit_with_error('Profile check failed. Please fix the profile before creating a Habitat artifact.')
+        end
+
+        @log.info('Profile is valid.')
+      end
+
+      def vendor_profile_dependencies
+        profile_vendor = Inspec::ProfileVendor.new(path)
+        if profile_vendor.lockfile.exist? && profile_vendor.cache_path.exist?
+          @log.info("Profile's dependencies are already vendored, skipping vendor process.")
+        else
+          @log.info("Vendoring the profile's dependencies...")
+          profile_vendor.vendor!
+
+          @log.info('Ensuring all vendored content has read permissions...')
+          profile_vendor.make_readable
+
+          # refresh the profile object since the profile now has new files
+          create_profile_object
+        end
+      end
+
+      def validate_habitat_installed
+        @log.info('Checking to see if Habitat is installed...')
+        cmd = Mixlib::ShellOut.new('hab --version')
+        cmd.run_command
+        exit_with_error('Unable to run Habitat commands.', cmd.stderr) if cmd.error?
+      end
+
+      def validate_habitat_origin
+        exit_with_error(
+          'Unable to determine Habitat origin name.',
+          'Run `hab setup` or set the HAB_ORIGIN environment variable.',
+        ) if habitat_origin.nil?
+      end
+
+      def validate_habitat_auth_token
+        exit_with_error(
+          'Unable to determine Habitat auth token for publishing.',
+          'Run `hab setup` or set the HAB_AUTH_TOKEN environment variable.',
+        ) if habitat_auth_token.nil?
+      end
+
+      def validate_output_dir
+        exit_with_error("Output directory #{output_dir} is not a directory or does not exist.") unless
+          File.directory?(output_dir)
+      end
+
+      def work_dir
+        return @work_dir if @work_dir
+
+        @work_dir ||= Dir.mktmpdir('inspec-habitat-exporter')
+        @log.debug("Generated work directory #{@work_dir}")
+
+        @work_dir
+      end
+
+      def create_habitat_directories(parent_directory)
+        [
+          File.join(parent_directory, 'habitat'),
+          File.join(parent_directory, 'habitat', 'config'),
+          File.join(parent_directory, 'habitat', 'hooks'),
+        ].each do |dir|
+          Dir.mkdir(dir) unless Dir.exist?(dir)
+        end
+      end
+
+      def copy_profile_to_work_dir
+        @log.info('Copying profile contents to the work directory...')
+        profile.files.each do |f|
+          src = File.join(profile.root_path, f)
+          dst = File.join(work_dir, f)
+          if File.directory?(f)
+            @log.debug("Creating directory #{dst}")
+            FileUtils.mkdir_p(dst)
+          else
+            @log.debug("Copying file #{src} to #{dst}")
+            FileUtils.cp_r(src, dst)
+          end
+        end
+      end
+
+      def create_plan(directory)
+        plan_file = File.join(directory, 'habitat', 'plan.sh')
+        @log.info("Generating Habitat plan at #{plan_file}...")
+        File.write(plan_file, plan_contents)
+      end
+
+      def create_run_hook(directory)
+        run_hook_file = File.join(directory, 'habitat', 'hooks', 'run')
+        @log.info("Generating a Habitat run hook at #{run_hook_file}...")
+        File.write(run_hook_file, run_hook_contents)
+      end
+
+      def create_settings_file(directory)
+        settings_file = File.join(directory, 'habitat', 'config', 'settings.sh')
+        @log.info("Generating a settings file at #{settings_file}...")
+        File.write(settings_file, "SLEEP_TIME={{cfg.sleep_time}}\n")
+      end
+
+      def create_default_config(directory)
+        default_toml = File.join(directory, 'habitat', 'default.toml')
+        @log.info("Generating Habitat's default.toml configuration...")
+        File.write(default_toml, 'sleep_time = 300')
+      end
+
+      def build_hart
+        @log.info('Building our Habitat artifact...')
+
+        env = {
+          'TERM'               => 'vt100',
+          'HAB_ORIGIN'         => habitat_origin,
+          'HAB_NONINTERACTIVE' => 'true',
+        }
+
+        env['RUST_LOG'] = 'debug' if @log.level == :debug
+
+        # TODO: Would love to use Mixlib::ShellOut here, but it doesn't
+        # seem to preserve the STDIN tty, and docker gets angry.
+        Dir.chdir(work_dir) do
+          unless system(env, 'hab pkg build .')
+            exit_with_error('Unable to build the Habitat artifact.')
+          end
+        end
+
+        hart_files = Dir.glob(File.join(work_dir, 'results', '*.hart'))
+
+        if hart_files.length > 1
+          exit_with_error('More than one Habitat artifact was created which was not expected.')
+        elsif hart_files.empty?
+          exit_with_error('No Habitat artifact was created.')
+        end
+
+        hart_files.first
+      end
+
+      def copy_hart(working_dir_hart)
+        hart_basename = File.basename(working_dir_hart)
+        dst = File.join(output_dir, hart_basename)
+        FileUtils.cp(working_dir_hart, dst)
+
+        dst
+      end
+
+      def upload_hart(hart_file)
+        @log.info('Uploading the Habitat artifact to our Depot...')
+
+        env = {
+          'TERM'               => 'vt100',
+          'HAB_AUTH_TOKEN'     => habitat_auth_token,
+          'HAB_NONINTERACTIVE' => 'true',
+        }
+
+        env['HAB_DEPOT_URL'] = ENV['HAB_DEPOT_URL'] if ENV['HAB_DEPOT_URL']
+
+        cmd = Mixlib::ShellOut.new("hab pkg upload #{hart_file}", env: env)
+        cmd.run_command
+        if cmd.error?
+          exit_with_error(
+            'Unable to upload Habitat artifact to the Depot.',
+            cmd.stdout,
+            cmd.stderr,
+          )
+        end
+
+        @log.info('Upload complete!')
+      end
+
+      def habitat_origin
+        ENV['HAB_ORIGIN'] || habitat_cli_config['origin']
+      end
+
+      def habitat_auth_token
+        ENV['HAB_AUTH_TOKEN'] || habitat_cli_config['auth_token']
+      end
+
+      def habitat_cli_config
+        return @cli_config if @cli_config
+
+        config_file = File.join(ENV['HOME'], '.hab', 'etc', 'cli.toml')
+        return {} unless File.exist?(config_file)
+
+        @cli_config = Tomlrb.load_file(config_file)
+      end
+
+      def output_dir
+        options[:output_dir] || Dir.pwd
+      end
+
+      def exit_with_error(*errors)
+        errors.each do |error_msg|
+          @log.error(error_msg)
+        end
+
+        exit 1
+      end
+
+      def package_name
+        "inspec-profile-#{profile.name}"
+      end
+
+      def plan_contents
+        plan = <<~EOL
+          pkg_name=#{package_name}
+          pkg_version=#{profile.version}
+          pkg_origin=#{habitat_origin}
+          pkg_deps=(chef/inspec core/ruby core/hab)
+          pkg_svc_user=root
+        EOL
+
+        plan += "pkg_license='#{profile.metadata.params[:license]}'\n\n" if profile.metadata.params[:license]
+
+        plan += <<~EOL
+
+          do_build() {
+            cp -vr $PLAN_CONTEXT/../* $HAB_CACHE_SRC_PATH/$pkg_dirname
+          }
+
+          do_install() {
+            local profile_contents
+            local excludes
+            profile_contents=($(ls))
+            excludes=(habitat results *.hart)
+
+            for item in ${excludes[@]}; do
+              profile_contents=(${profile_contents[@]/$item/})
+            done
+
+            mkdir ${pkg_prefix}/dist
+            cp -r ${profile_contents[@]} ${pkg_prefix}/dist/
+          }
+        EOL
+
+        plan
+      end
+
+      def run_hook_contents
+        <<~EOL
+          #!/bin/sh
+
+          # redirect stderr to stdout
+          # ultimately, we'd like to log this somewhere useful, but due to
+          # https://github.com/habitat-sh/habitat/issues/2395, we need to
+          # avoid doing that for now.
+          exec 2>&1
+
+          # InSpec will try to create a .cache directory in the user's home directory
+          # so this needs to be someplace writeable by the hab user
+          export HOME={{pkg.svc_var_path}}
+
+          PROFILE_IDENT="{{pkg.origin}}/{{pkg.name}}"
+          RESULTS_DIR="{{pkg.svc_var_path}}/inspec_results"
+          RESULTS_FILE="${RESULTS_DIR}/{{pkg.name}}.json"
+
+          # Create a directory for inspec formatter output
+          mkdir -p {{pkg.svc_var_path}}/inspec_results
+
+          while true; do
+            echo "Executing InSpec for ${PROFILE_IDENT}"
+            inspec exec {{pkg.path}}/dist --format=json > ${RESULTS_FILE}
+
+            if [ $? -eq 0 ]; then
+              echo "InSpec run completed successfully."
+            else
+              echo "InSpec run did not complete successfully. If you do not see any errors above,"
+              echo "control failures were detected. Check the InSpec results here for details:"
+              echo ${RESULTS_FILE}
+              echo "Otherwise, troubleshoot any errors shown above."
+            fi
+
+            source {{pkg.svc_config_path}}/settings.sh
+            echo "sleeping for ${SLEEP_TIME} seconds"
+            sleep ${SLEEP_TIME}
+          done
+        EOL
+      end
+    end
+  end
+end

data/lib/plugins/inspec-habitat/lib/inspec-habitat.rb

@@ -0,0 +1,11 @@
+module InspecPlugins
+  module Habitat
+    class Plugin < Inspec.plugin(2)
+      plugin_name :'inspec-habitat'
+      cli_command :habitat do
+        require_relative 'inspec-habitat/cli'
+        InspecPlugins::Habitat::CLI
+      end
+    end
+  end
+end

data/lib/plugins/inspec-habitat/test/unit/profile_test.rb

@@ -0,0 +1,184 @@
+require 'mixlib/log'
+require 'ostruct'
+require 'minitest/autorun'
+require 'mocha/setup'
+require_relative '../../lib/inspec-habitat/profile.rb'
+
+describe InspecPlugins::Habitat::Profile do
+  let(:profile) do
+    OpenStruct.new(
+      name:    'my_profile',
+      version: '1.2.3',
+      files:   %w(file1 file2)
+    )
+  end
+
+  let(:subject) { InspecPlugins::Habitat::Profile.new('/path/to/profile', { 'log_level' => 'fatal' }) }
+
+  before do
+    Inspec::Log.level(:fatal)
+  end
+
+  describe '#verify_profile' do
+    it 'exits if the profile is not valid' do
+      profile = mock
+      profile.stubs(:check).returns(summary: { valid: false })
+      subject.expects(:profile).returns(profile)
+      proc { subject.send(:verify_profile) }.must_raise SystemExit
+    end
+
+    it 'does not exist if the profile is valid' do
+      profile = mock
+      profile.stubs(:check).returns(summary: { valid: true })
+      subject.expects(:profile).returns(profile)
+      subject.send(:verify_profile)
+    end
+  end
+
+  describe '#vendor_profile_dependencies' do
+    let(:profile_vendor) do
+      profile_vendor = mock
+      profile_vendor.stubs(:lockfile).returns(lockfile)
+      profile_vendor.stubs(:cache_path).returns(cache_path)
+      profile_vendor
+    end
+    let(:lockfile) { mock }
+    let(:cache_path) { mock }
+
+    before do
+      Inspec::ProfileVendor.expects(:new).returns(profile_vendor)
+    end
+
+    describe 'when lockfile exists and cache dir exists' do
+      it 'does not vendor the dependencies' do
+        lockfile.expects(:exist?).returns(true)
+        cache_path.expects(:exist?).returns(true)
+        profile_vendor.expects(:vendor!).never
+        profile_vendor.expects(:make_readable).never
+        subject.send(:vendor_profile_dependencies)
+      end
+    end
+
+    describe 'when the lockfile exists but the cache dir does not' do
+      it 'vendors the dependencies and refreshes the profile object' do
+        lockfile.expects(:exist?).returns(true)
+        cache_path.expects(:exist?).returns(false)
+        profile_vendor.expects(:vendor!)
+        profile_vendor.expects(:make_readable)
+        subject.expects(:create_profile_object)
+
+        subject.send(:vendor_profile_dependencies)
+      end
+    end
+
+    describe 'when the lockfile does not exist' do
+      it 'vendors the dependencies and refreshes the profile object' do
+        lockfile.expects(:exist?).returns(false)
+        profile_vendor.expects(:vendor!)
+        profile_vendor.expects(:make_readable)
+        subject.expects(:create_profile_object)
+
+        subject.send(:vendor_profile_dependencies)
+      end
+    end
+  end
+
+  describe '#validate_habitat_installed' do
+    it 'exits if hab --version fails' do
+      cmd = mock
+      cmd.stubs(:error?).returns(true)
+      cmd.stubs(:run_command)
+      cmd.stubs(:stdout)
+      cmd.stubs(:stderr)
+      Mixlib::ShellOut.expects(:new).with('hab --version').returns(cmd)
+      proc { subject.send(:validate_habitat_installed) }.must_raise SystemExit
+    end
+  end
+
+  describe '#validate_habitat_origin' do
+    it 'does not exit if the origin key exists' do
+      subject.expects(:habitat_origin).returns('12345')
+      subject.send(:validate_habitat_origin)
+    end
+
+    it 'exits if no origin key exists' do
+      subject.expects(:habitat_origin).returns(nil)
+      proc { subject.send(:validate_habitat_origin) }.must_raise SystemExit
+    end
+  end
+
+  describe '#validate_habitat_auth_token' do
+    it 'does not exit if the auth_token exists' do
+      subject.expects(:habitat_auth_token).returns('12345')
+      subject.send(:validate_habitat_auth_token)
+    end
+
+    it 'exits if no auth_token exists' do
+      subject.expects(:habitat_auth_token).returns(nil)
+      proc { subject.send(:validate_habitat_auth_token) }.must_raise SystemExit
+    end
+  end
+
+  describe '#build_hart' do
+    before do
+      subject.expects(:work_dir).at_least_once.returns(Dir.tmpdir)
+    end
+
+    it 'exits if the build fails' do
+      subject.expects(:system).returns(false)
+      proc { subject.send(:build_hart) }.must_raise SystemExit
+    end
+
+    it 'exits if more than one hart is created' do
+      subject.expects(:system).returns(true)
+      Dir.expects(:glob).returns(%w(hart1 hart2))
+      proc { subject.send(:build_hart) }.must_raise SystemExit
+    end
+
+    it 'exits if more than no hart is created' do
+      subject.expects(:system).returns(true)
+      Dir.expects(:glob).returns([])
+      proc { subject.send(:build_hart) }.must_raise SystemExit
+    end
+
+    it 'returns the hart filename' do
+      subject.expects(:system).returns(true)
+      Dir.expects(:glob).returns(%w(hart1))
+      subject.send(:build_hart).must_equal('hart1')
+    end
+  end
+
+  describe '#upload_hart' do
+    it 'exits if the upload failed' do
+      env = {
+        'TERM'               => 'vt100',
+        'HAB_AUTH_TOKEN'     => 'my_token',
+        'HAB_NONINTERACTIVE' => 'true',
+      }
+
+      cmd = mock
+      cmd.stubs(:run_command)
+      cmd.stubs(:error?).returns(true)
+      cmd.stubs(:stdout)
+      cmd.stubs(:stderr)
+
+      subject.expects(:habitat_auth_token).returns('my_token')
+      Mixlib::ShellOut.expects(:new).with("hab pkg upload my_hart", env: env).returns(cmd)
+      proc { subject.send(:upload_hart, 'my_hart') }.must_raise SystemExit
+    end
+  end
+
+  describe '#habitat_cli_config' do
+    it 'returns an empty hash if the CLI config does not exist' do
+      File.expects(:exist?).with(File.join(ENV['HOME'], '.hab', 'etc', 'cli.toml')).returns(false)
+      subject.send(:habitat_cli_config).must_equal({})
+    end
+
+    it 'returns parsed TOML from the hab config file' do
+      config_file = File.join(ENV['HOME'], '.hab', 'etc', 'cli.toml')
+      File.expects(:exist?).with(config_file).returns(true)
+      Tomlrb.expects(:load_file).with(config_file).returns(foo: 1)
+      subject.send(:habitat_cli_config).must_equal(foo: 1)
+    end
+  end
+end

data/lib/plugins/inspec-init/lib/inspec-init/cli.rb

@@ -0,0 +1,28 @@
+# encoding: utf-8
+
+require 'pathname'
+require_relative 'renderer'
+
+module InspecPlugins
+  module Init
+    class CLI < Inspec.plugin(2, :cli_command)
+      subcommand_desc 'init SUBCOMMAND', 'Initialize InSpec objects'
+
+      # Look in the 'template' directory, and register a subcommand
+      # for each template directory found there.
+      template_dir = File.join(File.dirname(__FILE__), 'templates')
+      Dir.glob(File.join(template_dir, '*')) do |template|
+        template_name = Pathname.new(template).relative_path_from(Pathname.new(template_dir)).to_s
+
+        # register command for the template
+        desc "#{template_name} NAME", "Create a new #{template_name}"
+        option :overwrite, type: :boolean, default: false,
+          desc: 'Overwrites existing directory'
+        define_method template_name.to_sym do |name_for_new_structure|
+          renderer = InspecPlugins::Init::Renderer.new(self, options)
+          renderer.render_with_values(template_name, name: name_for_new_structure)
+        end
+      end
+    end
+  end
+end