inspec-core 4.28.0 → 4.33.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f7e64d5cc4ef40dc18b0c488e88c804425403123a38ed5bdfbeac8e4e26c4f02
-  data.tar.gz: 1b953e8cf39b218bed69e379bb5f03d92ae7bde3f402de1a17bfee2a7c67f58d
+  metadata.gz: ec42612f75dc95f62517b85b024c039ad15965f7c98dfaecb9494161b9f85611
+  data.tar.gz: 6373b89393e737cacdcb859ca510758afb9ce7e16d89e90d86877205a3d8d335
 SHA512:
-  metadata.gz: 9f6b97c6cc9e7d23f64a5f5b9666831e6a1577ad164ce3b32a3bff3ce24b628be65f0b60894681aa9d408ce989355d5da946bc87f67ec51ca4679e04be2f0b77
-  data.tar.gz: 246ddd83d0af2e3ce069deb932451c0eb905e2e73dc5255b8ce574e862115b03e30cfc92a9cda0611a996d1d00ddb3895a7284cb44aa66677e4fea932bff9d09
+  metadata.gz: f1591b7c166d00fe78037f703eb55292384b2c2b13195db150da008b198424177809078db9509054af664f91aca8bae06f93f41939d808263cc78baf0414f29c
+  data.tar.gz: 5124bfc3a8b676bd097efc319233fec94d3fd3739b727e1b92678c7929d280c093c46136b80607f166d164e0bd85586b9ce560e2ebed0eadbd7f35d09bd517b9

data/lib/inspec/base_cli.rb

@@ -120,6 +120,8 @@ module Inspec
         desc: "Provide a ID which will be included on reports"
       option :winrm_shell_type, type: :string, default: "powershell",
         desc: "Specify a shell type for winrm (eg. 'elevated' or 'powershell')"
+      option :docker_url, type: :string,
+        desc: "Provides path to Docker API endpoint (Docker)"
     end
 
     def self.profile_options
@@ -166,6 +168,11 @@ module Inspec
         desc: "After normal execution order, results are sorted by control ID, or by file (default), or randomly. None uses legacy unsorted mode."
       option :filter_empty_profiles, type: :boolean, default: false,
         desc: "Filter empty profiles (profiles without controls) from the report."
+      option :command_timeout, type: :numeric,
+        desc: "Maximum seconds to allow commands to run during execution.",
+        long_desc: "Maximum seconds to allow commands to run during execution. A timed out command is considered an error."
+      option :reporter_include_source, type: :boolean, default: false,
+        desc: "Include full source code of controls in the CLI report"
     end
 
     def self.help(*args)

data/lib/inspec/cli.rb

@@ -321,7 +321,14 @@ class Inspec::InspecCLI < Inspec::BaseCLI
     desc: "A space-delimited list of local folders containing profiles whose libraries and resources will be loaded into the new shell"
   option :distinct_exit, type: :boolean, default: true,
     desc: "Exit with code 100 if any tests fail, and 101 if any are skipped but none failed (default).  If disabled, exit 0 on skips and 1 for failures."
+  option :command_timeout, type: :numeric,
+      desc: "Maximum seconds to allow a command to run.",
+      long_desc: "Maximum seconds to allow commands to run. A timed out command is considered an error."
   option :inspect, type: :boolean, default: false, desc: "Use verbose/debugging output for resources."
+  option :input_file, type: :array,
+    desc: "Load one or more input files, a YAML file with values for the shell to use"
+  option :input, type: :array, banner: "name1=value1 name2=value2",
+    desc: "Specify one or more inputs directly on the command line to the shell, as --input NAME=VALUE. Accepts single-quoted YAML and JSON structures."
   def shell_func
     o = config
     diagnose(o)

data/lib/inspec/control_eval_context.rb

@@ -53,8 +53,9 @@ module Inspec
 
     def control(id, opts = {}, &block)
       opts[:skip_only_if_eval] = @skip_only_if_eval
-
-      register_control(Inspec::Rule.new(id, profile_id, resources_dsl, opts, &block))
+      if control_exist_in_controls_list?(id) || controls_list_empty?
+        register_control(Inspec::Rule.new(id, profile_id, resources_dsl, opts, &block))
+      end
     end
     alias rule control
 
@@ -68,10 +69,14 @@ module Inspec
       id = "(generated from #{loc} #{SecureRandom.hex})"
 
       res = nil
+
       rule = Inspec::Rule.new(id, profile_id, resources_dsl, {}) do
         res = describe(*args, &block)
       end
-      register_control(rule, &block)
+
+      if control_exist_in_controls_list?(id) || controls_list_empty?
+        register_control(rule, &block)
+      end
 
       res
     end
@@ -176,5 +181,26 @@ module Inspec
         "#{File.basename(path)}:#{line}"
       end
     end
+
+    # Returns true if configuration hash is not empty and it contains the list of controls is not empty
+    def profile_config_exist?
+      !@conf.empty? && @conf.key?("profile") && !@conf["profile"].include_controls_list.empty?
+    end
+
+    # Returns true if configuration hash is empty or configuration hash does not have the list of controls that needs to be included
+    def controls_list_empty?
+      !@conf.empty? && @conf.key?("profile") && @conf["profile"].include_controls_list.empty? || @conf.empty?
+    end
+
+    # Check if the given control exist in the --controls option
+    def control_exist_in_controls_list?(id)
+      if profile_config_exist?
+        id_exist_in_list = @conf["profile"].include_controls_list.any? do |inclusion|
+          # Try to see if the inclusion is a regex, and if it matches
+          inclusion == id || (inclusion.is_a?(Regexp) && inclusion =~ id)
+        end
+      end
+      id_exist_in_list
+    end
   end
 end

data/lib/inspec/fetcher/git.rb

@@ -62,7 +62,6 @@ module Inspec::Fetcher
     def fetch(destination_path)
       @repo_directory = destination_path # Might be the cache, or vendoring, or something else
       FileUtils.mkdir_p(destination_path) unless Dir.exist?(destination_path)
-
       if cloned?
         checkout
       else
@@ -126,10 +125,25 @@ module Inspec::Fetcher
                         elsif @tag
                           resolve_ref(@tag)
                         else
-                          resolve_ref("master")
+                          resolve_ref(default_ref)
                         end
     end
 
+    def default_ref
+      command_string = "git remote show #{@remote_url}"
+      cmd = shellout(command_string)
+      unless cmd.exitstatus == 0
+        raise(Inspec::FetcherFailure, "Profile git dependency failed with default reference - #{@remote_url} - error running '#{command_string}': #{cmd.stderr}")
+      else
+        ref = cmd.stdout.lines.detect { |l| l.include? "HEAD branch:" }&.split(":")&.last&.strip
+        unless ref
+          raise(Inspec::FetcherFailure, "Profile git dependency failed with default reference - #{@remote_url} - error running '#{command_string}': NULL reference")
+        end
+
+        ref
+      end
+    end
+
     def resolve_ref(ref_name)
       command_string = "git ls-remote \"#{@remote_url}\" \"#{ref_name}*\""
       cmd = shellout(command_string)

data/lib/inspec/input_registry.rb

@@ -82,6 +82,7 @@ module Inspec
     def find_or_register_input(input_name, profile_name, options = {})
       input_name = input_name.to_s
       profile_name = profile_name.to_s
+      options[:event].value = Thor::CoreExt::HashWithIndifferentAccess.new(options[:event].value) if options[:event]&.value.is_a?(Hash)
 
       if profile_alias?(profile_name) && !profile_aliases[profile_name].nil?
         alias_name = profile_name

data/lib/inspec/profile.rb

@@ -225,14 +225,17 @@ module Inspec
         end
         @tests_collected = true
       end
-      filter_controls(@runner_context.all_rules, include_list)
+      @runner_context.all_rules
     end
 
-    def filter_controls(controls_array, include_list)
-      return controls_array if include_list.nil? || include_list.empty?
+    # This creates the list of controls provided in the --controls options which need to be include
+    # for evaluation.
+    def include_controls_list
+      return [] if @controls.nil? || @controls.empty?
 
+      included_controls = @controls
       # Check for anything that might be a regex in the list, and make it official
-      include_list.each_with_index do |inclusion, index|
+      included_controls.each_with_index do |inclusion, index|
         next if inclusion.is_a?(Regexp)
         # Insist the user wrap the regex in slashes to demarcate it as a regex
         next unless inclusion.start_with?("/") && inclusion.end_with?("/")
@@ -240,21 +243,14 @@ module Inspec
         inclusion = inclusion[1..-2] # Trim slashes
         begin
           re = Regexp.new(inclusion)
-          include_list[index] = re
+          included_controls[index] = re
         rescue RegexpError => e
           warn "Ignoring unparseable regex '/#{inclusion}/' in --control CLI option: #{e.message}"
-          include_list[index] = nil
-        end
-      end
-      include_list.compact!
-
-      controls_array.select do |c|
-        id = ::Inspec::Rule.rule_id(c)
-        include_list.any? do |inclusion|
-          # Try to see if the inclusion is a regex, and if it matches
-          inclusion == id || (inclusion.is_a?(Regexp) && inclusion =~ id)
+          included_controls[index] = nil
         end
       end
+      included_controls.compact!
+      included_controls
     end
 
     def load_libraries

data/lib/inspec/reporters/cli.rb

@@ -41,12 +41,14 @@ module Inspec::Reporters
     MULTI_TEST_CONTROL_SUMMARY_MAX_LEN = 60
 
     def render
+      @src_extent_map = {}
       run_data[:profiles].each do |profile|
         if profile[:status] == "skipped"
           platform = run_data[:platform]
           output("Skipping profile: '#{profile[:name]}' on unsupported platform: '#{platform[:name]}/#{platform[:release]}'.")
           next
         end
+        read_control_source(profile)
         @control_count = 0
         output("")
         print_profile_header(profile)
@@ -89,6 +91,7 @@ module Inspec::Reporters
         next if control.results.nil?
 
         output(format_control_header(control))
+        output(format_control_source(control)) if Inspec::Config.cached[:reporter_include_source]
         control.results.each do |result|
           output(format_result(control, result, :standard))
           @control_count += 1
@@ -127,6 +130,62 @@ module Inspec::Reporters
       )
     end
 
+    def format_control_source(control)
+      src = @control_source[control.id]
+      message  = "Control Source from #{src[:path]}:#{src[:start]}..#{src[:end]}\n"
+      message += src[:content]
+      format_message(
+        color: "skipped",
+        indentation: 5,
+        message: message
+      )
+    end
+
+    def read_control_source(profile)
+      return unless Inspec::Config.cached[:reporter_include_source]
+
+      @control_source = {}
+      src_extent_map = {}
+
+      # First pass: build map of paths => ids => [start]
+      all_unique_controls.each do |control|
+        id = control[:id]
+        path = control[:source_location][:ref]
+        start = control[:source_location][:line]
+        next if path.nil? || start.nil?
+
+        src_extent_map[path] ||= []
+        src_extent_map[path] << { start: start, id: id }
+      end
+
+      # Now sort the controls by their starting line in their control file
+      src_extent_map.values.each do |extent_list|
+        extent_list.sort! { |a, b| a[:start] <=> b[:start] }
+      end
+
+      # Third pass: Read in files and split into lines
+      src_extent_map.keys.each do |path|
+        control_file_lines = File.read(path).lines # TODO error handling
+        last_line_in_file = control_file_lines.count
+        extent_list = src_extent_map[path]
+        extent_list.each_with_index do |extent, idx|
+          if idx == extent_list.count - 1 # Last entry
+            extent[:end] = last_line_in_file
+          else
+            extent[:end] = extent_list[idx + 1][:start] - 1
+          end
+
+          @control_source[extent[:id]] =
+            {
+              path: path,
+              start: extent[:start],
+              end: extent[:end],
+              content: control_file_lines.slice(extent[:start] - 1, extent[:end] - extent[:start] + 1).join(""),
+            }
+        end
+      end
+    end
+
     def format_result(control, result, type)
       impact = control.impact_string_for_result(result)
 
@@ -170,7 +229,7 @@ module Inspec::Reporters
     end
 
     def all_unique_controls
-      @unique_controls ||= begin
+      @unique_controls ||= begin # rubocop:disable Style/RedundantBegin
                              run_data[:profiles].flat_map do |profile|
                                profile[:controls]
                              end.uniq
@@ -312,6 +371,10 @@ module Inspec::Reporters
         data[:impact]
       end
 
+      def source_location
+        data[:source_location]
+      end
+
       def anonymous?
         id.start_with?("(generated from ")
       end

data/lib/inspec/reporters/json.rb

@@ -8,7 +8,7 @@ module Inspec::Reporters
     end
 
     def report
-      {
+      output = {
         platform: platform,
         profiles: profiles,
         statistics: {
@@ -16,6 +16,11 @@ module Inspec::Reporters
         },
         version: run_data[:version],
       }
+
+      %w{passthrough}.each do |option|
+        output[option.to_sym] = @config[option] unless @config[option].nil?
+      end
+      output
     end
 
     private

data/lib/inspec/reporters/json_automate.rb

@@ -24,7 +24,7 @@ module Inspec::Reporters
         version: run_data[:version],
       }
 
-      # optional json-config passthrough options
+      # optional jsonconfig passthrough options
       %w{node_name environment roles job_uuid passthrough}.each do |option|
         output[option.to_sym] = @config[option] unless @config[option].nil?
       end

data/lib/inspec/resources/apt.rb

@@ -78,7 +78,7 @@ module Inspec::Resources
       return @repo_cache if defined?(@repo_cache)
 
       # load all lists
-      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
+      cmd = inspec.command("find /etc/apt/ -name \"*.list\" -exec sh -c 'cat {} || echo -n' \\;")
 
       # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
       @repo_cache = cmd.stdout.lines.map do |raw_line|

data/lib/inspec/resources/command.rb

@@ -31,6 +31,11 @@ module Inspec::Resources
       end
 
       @command = cmd
+      cli_timeout = Inspec::Config.cached["command_timeout"]&.to_i
+      # Can access this via Inspec::InspecCLI.commands["exec"].options[:command_timeout].default,
+      # but that may not be loaded for kitchen-inspec and other pure gem consumers
+      cli_timeout = nil if cli_timeout == 0 # Under test-kitchen we get a 0 timeout, which can't be a resonable value
+      @timeout = cli_timeout || options[:timeout]&.to_i
 
       if options[:redact_regex]
         unless options[:redact_regex].is_a?(Regexp)
@@ -44,7 +49,15 @@ module Inspec::Resources
     end
 
     def result
-      @result ||= inspec.backend.run_command(@command)
+      @result ||= begin
+        inspec.backend.run_command(@command, timeout: @timeout)
+                  rescue Train::CommandTimeoutReached
+                    # Without a small sleep, the train connection gets broken
+                    # We've already timed out, so a small sleep is not likely to be painful here.
+                    sleep 0.1
+                    raise Inspec::Exceptions::ResourceFailed,
+                          "Command `#{@command}` timed out after #{@timeout} seconds"
+      end
     end
 
     def stdout

data/lib/inspec/utils/filter.rb

@@ -36,14 +36,20 @@ module FilterTable
     # RSpec will check the object returned to see if it responds to a method
     # before calling it. We need to fake it out and tell it that it does. This
     # allows it to skip past that check and fall through to #method_missing
-    def respond_to?(_method)
+    def respond_to?(_method, include_all = false)
       true
     end
 
     def to_s
-      @original_resource.to_s
+      "#{@original_resource} (#{@original_exception.message})"
     end
     alias inspect to_s
+
+    # Rspec is not able to convert FilterTable::ExceptionCatcher issue https://github.com/inspec/inspec/issues/5369
+    # which result into not showing actual exception message this allows to convert it properly.
+    def to_ary
+      [ to_s ]
+    end
   end
 
   class Trace

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "4.28.0".freeze
+  VERSION = "4.33.1".freeze
 end

data/lib/plugins/inspec-init/templates/profiles/aws/README.md

@@ -2,7 +2,7 @@
 
 This example shows the implementation of an InSpec profile for AWS.
 
-##  Create a profile 
+##  Create a profile
 
 ```
 $ inspec init profile --platform aws my-profile
@@ -15,12 +15,12 @@ Creating new profile at /Users/spaterson/my-profile
  • Creating directory controls
  • Creating file controls/example.rb
  • Creating file inspec.yml
- • Creating file attributes.yml
+ • Creating file inputs.yml
  • Creating file libraries/.gitkeep
- 
+
 ```
 
-## Optionally update `attributes.yml` to point to your custom VPC
+## Optionally update `inputs.yml` to point to your custom VPC
 
 ```
 aws_vpc_id: 'custom-vpc-id'
@@ -32,11 +32,11 @@ The related control will simply be skipped if this is not provided.  See the [In
 
 ### With a VPC Identifier
 
-With a supplied VPC identifier in `attributes.yml` both of the example controls will run.  The 'aws-single-vpc-exists-check' control will only check for a VPC identifier in the currently configured AWS SDK region e.g. `eu-west-2` in the below:
+With a supplied VPC identifier in `inputs.yml` both of the example controls will run.  The 'aws-single-vpc-exists-check' control will only check for a VPC identifier in the currently configured AWS SDK region e.g. `eu-west-2` in the below:
 
 ```
 $ cd my-profile/
-$ inspec exec . -t aws://  --attrs attributes.yml
+$ inspec exec . -t aws://  --input-file=inputs.yml
 
 Profile: AWS InSpec Profile (my-profile)
 Version: 0.1.0
@@ -111,13 +111,13 @@ Test Summary: 53 successful, 0 failures, 0 skipped
 ```
 
 
-### Without Supplying a VPC Identifier 
+### Without Supplying a VPC Identifier
 
-If no VPC identifier is supplied, the 'aws-single-vpc-exists-check' control is skipped and the other control runs.  The `attributes.yml` file does not have to be specified to InSpec in this case.
+If no VPC identifier is supplied, the 'aws-single-vpc-exists-check' control is skipped and the other control runs.  The `inputs.yml` file does not have to be specified to InSpec in this case.
 
 ```
 $ cd my-profile/
-$ inspec exec . -t aws://  
+$ inspec exec . -t aws://
 
 Profile: AWS InSpec Profile (my-profile)
 Version: 0.1.0
@@ -189,4 +189,4 @@ Target:  aws://eu-west-2
 
 Profile Summary: 2 successful controls, 0 control failures, 1 control skipped
 Test Summary: 52 successful, 0 failures, 1 skipped
-```
+```

data/lib/plugins/inspec-init/templates/profiles/aws/controls/example.rb

@@ -2,11 +2,11 @@
 
 title "Sample Section"
 
-aws_vpc_id = attribute("aws_vpc_id", default: "", description: "Optional AWS VPC identifier.")
+aws_vpc_id = input("aws_vpc_id")
 
 # You add controls here
-control "aws-single-vpc-exists-check" do # A unique ID for this control.
-  only_if { aws_vpc_id != "" } # Only run this control if the `aws_vpc_id` attribute is provided.
+control "aws-single-vpc-exists-check" do                                    # A unique ID for this control.
+  only_if { aws_vpc_id != "" }                                              # Only run this control if the `aws_vpc_id` input is provided.
   impact 1.0                                                                # The criticality, if this control fails.
   title "Check to see if custom VPC exists."                                # A human-readable title.
   describe aws_vpc(aws_vpc_id) do                                           # The test itself.

data/lib/plugins/inspec-init/templates/profiles/aws/inspec.yml

@@ -7,14 +7,13 @@ license: Apache-2.0
 summary: An InSpec Compliance Profile For AWS
 version: 0.1.0
 inspec_version: '~> 4'
-attributes:
+inputs:
 - name: aws_vpc_id
   required: false
   # Below is deliberately left as a default empty string to allow the profile to run when this is not provided.
   # Please see the README for more details.
-  default: ''
+  value: ''
   description: 'Optional Custom AWS VPC Id'
-  type: string
 depends:
   - name: inspec-aws
     url: https://github.com/inspec/inspec-aws/archive/master.tar.gz

data/lib/plugins/inspec-init/templates/profiles/gcp/README.md

@@ -2,7 +2,7 @@
 
 This example shows the implementation of an InSpec profile for GCP that depends on the [InSpec GCP Resource Pack](https://github.com/inspec/inspec-gcp).  See the [README](https://github.com/inspec/inspec-gcp) for instructions on setting up appropriate GCP credentials.
 
-##  Create a profile 
+##  Create a profile
 
 ```
 $ inspec init profile --platform gcp my-profile
@@ -12,12 +12,12 @@ Create new profile at /Users/spaterson/my-profile
  * Create directory controls
  * Create file controls/example.rb
  * Create file inspec.yml
- * Create file attributes.yml
- * Create file libraries/.gitkeep 
- 
+ * Create file inputs.yml
+ * Create file libraries/.gitkeep
+
 ```
 
-## Update `attributes.yml` to point to your project
+## Update `inputs.yml` to point to your project
 
 ```
 gcp_project_id: 'my-gcp-project'
@@ -27,7 +27,7 @@ gcp_project_id: 'my-gcp-project'
 
 ```
 $ cd gcp-profile/
-$ inspec exec . -t gcp:// --attrs attributes.yml
+$ inspec exec . -t gcp:// --input-file=inputs.yml
 
 Profile: GCP InSpec Profile (my-profile)
 Version: 0.1.0
@@ -63,4 +63,4 @@ Target:  gcp://local-service-account@my-gcp-project.iam.gserviceaccount.com
 
 Profile Summary: 2 successful controls, 0 control failures, 0 controls skipped
 Test Summary: 18 successful, 0 failures, 0 skipped
-```
+```

data/lib/plugins/inspec-init/templates/profiles/gcp/controls/example.rb

@@ -2,7 +2,7 @@
 
 title "Sample Section"
 
-gcp_project_id = attribute("gcp_project_id")
+gcp_project_id = input("gcp_project_id")
 
 # you add controls here
 control "gcp-single-region-1.0" do                                                    # A unique ID for this control

data/lib/plugins/inspec-init/templates/profiles/gcp/inspec.yml

@@ -6,14 +6,13 @@ copyright_email: you@example.com
 license: Apache-2.0
 summary: An InSpec Compliance Profile For GCP
 version: 0.1.0
-inspec_version: '>= 2.3.5'
-attributes:
+inspec_version: '>= 4'
+inputs:
 - name: gcp_project_id
   required: true
   description: 'The GCP project identifier.'
-  type: string
 depends:
 - name: inspec-gcp
   url: https://github.com/inspec/inspec-gcp/archive/master.tar.gz
 supports:
-- platform: gcp
+- platform: gcp

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 4.28.0
+  version: 4.33.1
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-16 00:00:00.000000000 Z
+date: 2021-04-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-telemetry
@@ -711,15 +711,15 @@ files:
 - lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/reporter.rb
 - lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/version.rb
 - lib/plugins/inspec-init/templates/profiles/aws/README.md
-- lib/plugins/inspec-init/templates/profiles/aws/attributes.yml
 - lib/plugins/inspec-init/templates/profiles/aws/controls/example.rb
+- lib/plugins/inspec-init/templates/profiles/aws/inputs.yml
 - lib/plugins/inspec-init/templates/profiles/aws/inspec.yml
 - lib/plugins/inspec-init/templates/profiles/azure/README.md
 - lib/plugins/inspec-init/templates/profiles/azure/controls/example.rb
 - lib/plugins/inspec-init/templates/profiles/azure/inspec.yml
 - lib/plugins/inspec-init/templates/profiles/gcp/README.md
-- lib/plugins/inspec-init/templates/profiles/gcp/attributes.yml
 - lib/plugins/inspec-init/templates/profiles/gcp/controls/example.rb
+- lib/plugins/inspec-init/templates/profiles/gcp/inputs.yml
 - lib/plugins/inspec-init/templates/profiles/gcp/inspec.yml
 - lib/plugins/inspec-init/templates/profiles/os/README.md
 - lib/plugins/inspec-init/templates/profiles/os/controls/example.rb