inspec-core 4.36.4 → 4.37.23

Sign up to get free protection for your applications and to get access to all the features.
Files changed (43) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile +14 -1
  3. data/etc/deprecations.json +5 -0
  4. data/inspec-core.gemspec +1 -1
  5. data/lib/inspec/base_cli.rb +2 -2
  6. data/lib/inspec/cli.rb +6 -2
  7. data/lib/inspec/fetcher/local.rb +1 -1
  8. data/lib/inspec/plugin/v2/loader.rb +9 -0
  9. data/lib/inspec/profile_context.rb +1 -1
  10. data/lib/inspec/resources/file.rb +4 -5
  11. data/lib/inspec/resources/http.rb +1 -1
  12. data/lib/inspec/resources/mssql_session.rb +1 -1
  13. data/lib/inspec/resources/mysql_session.rb +1 -1
  14. data/lib/inspec/resources/pip.rb +1 -1
  15. data/lib/inspec/resources/port.rb +9 -3
  16. data/lib/inspec/resources/registry_key.rb +1 -1
  17. data/lib/inspec/resources/users.rb +1 -1
  18. data/lib/inspec/resources/windows_feature.rb +2 -1
  19. data/lib/inspec/resources/windows_firewall_rule.rb +1 -1
  20. data/lib/inspec/resources/zfs_dataset.rb +7 -3
  21. data/lib/inspec/resources/zfs_pool.rb +7 -3
  22. data/lib/inspec/runner.rb +1 -1
  23. data/lib/inspec/utils/erlang_parser.rb +2 -2
  24. data/lib/inspec/utils/filter.rb +7 -7
  25. data/lib/inspec/utils/nginx_parser.rb +3 -3
  26. data/lib/inspec/version.rb +1 -1
  27. data/lib/plugins/inspec-compliance/README.md +125 -2
  28. data/lib/plugins/inspec-compliance/lib/inspec-compliance.rb +5 -0
  29. data/lib/plugins/inspec-compliance/lib/inspec-compliance/api.rb +36 -179
  30. data/lib/plugins/inspec-compliance/lib/inspec-compliance/api/login.rb +15 -137
  31. data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb +26 -28
  32. data/lib/plugins/inspec-compliance/lib/inspec-compliance/target.rb +7 -24
  33. data/lib/plugins/inspec-init/lib/inspec-init/cli_plugin.rb +44 -34
  34. data/lib/plugins/inspec-init/lib/inspec-init/renderer.rb +1 -0
  35. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/Gemfile +6 -6
  36. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/Rakefile +8 -8
  37. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/inspec-plugin-template.gemspec +12 -12
  38. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/{inspec-plugin-template.rb → inspec-plugin-template.erb} +1 -1
  39. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{cli_command.rb → cli_command.erb} +8 -8
  40. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{plugin.rb → plugin.erb} +15 -15
  41. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{reporter.rb → reporter.erb} +0 -0
  42. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{version.rb → version.erb} +1 -1
  43. metadata +13 -7
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2c3d7a6b401a4a92a2dbe1342499857065d9643baeed19d2b1e5af77672be3d8
4
- data.tar.gz: 907c48ac504a9a8588e41a65edfbafc3726c17ce59c5a5a8b3e5c83000fa08db
3
+ metadata.gz: c9e4ef72fd93cf8c9de6cf6a6b14473388a1df8edee971d3e9db0dc89e31a756
4
+ data.tar.gz: 79ab3e58e1f574f6bd34aff949a965ed7c01744745cb09eba4768a420f9fe60b
5
5
  SHA512:
6
- metadata.gz: 5685428db9251aae0e26db8cc0ab81f247115aa70152472421e560cf97c17486e8f656a9be158ba3fbaa00bb078a1fb12eb5077a6d16a4883b052a9aba5c0869
7
- data.tar.gz: baf44fe69d48134e7d6a8760ceb245c10a29a6e423d8afda68ac35225bba6f7a7a0e21f815d5f4b7fb4206b6f4080b01b9e5be16f1e2f030b2f594c53c215b22
6
+ metadata.gz: c1254e07b8263b7f97c53a3a3768db4fd50692d49defe607e2f7ceb42fce86c6a53909472e0b28fe7cbb58cfcdb6255dd549adaca18836ba2475f8644dab4153
7
+ data.tar.gz: 8b45db91165ebd6a9af3102a4a4f60e9cf1fd404f5cc28452cc4df92e1554cce42a009e40b6a11de1d13569bada66a270d344076965138d32e52aea045a8ca52
data/Gemfile CHANGED
@@ -28,7 +28,7 @@ group :omnibus do
28
28
  end
29
29
 
30
30
  group :test do
31
- gem "chefstyle", "~> 1.7.1"
31
+ gem "chefstyle", "~> 2.0.3"
32
32
  gem "concurrent-ruby", "~> 1.0"
33
33
  gem "html-proofer", platforms: :ruby # do not attempt to run proofer on windows
34
34
  gem "json_schemer", ">= 0.2.1", "< 0.2.19"
@@ -48,3 +48,16 @@ end
48
48
  group :deploy do
49
49
  gem "inquirer"
50
50
  end
51
+
52
+ # Only include Test Kitchen support if we are on Ruby 2.7 or higher
53
+ # as chef-zero support requires Ruby 2.6
54
+ # See https://github.com/inspec/inspec/pull/5341
55
+ if Gem.ruby_version >= Gem::Version.new("2.7.0")
56
+ group :kitchen do
57
+ gem "berkshelf"
58
+ gem "test-kitchen", ">= 2.8"
59
+ gem "kitchen-inspec", ">= 2.0"
60
+ gem "kitchen-dokken", ">= 2.11"
61
+ gem "git"
62
+ end
63
+ end
@@ -120,6 +120,11 @@
120
120
  "object_classes": {
121
121
  "action": "warn",
122
122
  "suffix": "These classes will be removed in InSpec 5.0."
123
+ },
124
+ "cli_option_hook":{
125
+ "action": "warn",
126
+ "prefix": "The --hook option is being replaced by the --activator option.",
127
+ "suffix": "This options will be removed in InSpec 4.0."
123
128
  }
124
129
  }
125
130
  }
data/inspec-core.gemspec CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
23
23
  .reject { |f| File.directory?(f) }
24
24
 
25
25
  # Implementation dependencies
26
- spec.add_dependency "chef-telemetry", "~> 1.0"
26
+ spec.add_dependency "chef-telemetry", "~> 1.0", ">= 1.0.8" # 1.0.8+ removes the http dep
27
27
  spec.add_dependency "license-acceptance", ">= 0.2.13", "< 3.0"
28
28
  spec.add_dependency "thor", ">= 0.20", "< 2.0"
29
29
  spec.add_dependency "method_source", ">= 0.8", "< 2.0"
@@ -181,7 +181,7 @@ module Inspec
181
181
  puts " Patents: chef.io/patents\n\n"
182
182
  end
183
183
 
184
- def self.format_platform_info(params: {}, indent: 0, color: 39)
184
+ def self.format_platform_info(params: {}, indent: 0, color: 39, enable_color: true)
185
185
  str = ""
186
186
  params.each do |item, info|
187
187
  data = info
@@ -192,7 +192,7 @@ module Inspec
192
192
  # Do not output fields of data is missing ('unknown' is fine)
193
193
  next if data.nil?
194
194
 
195
- data = "\e[1m\e[#{color}m#{data}\e[0m"
195
+ data = "\e[1m\e[#{color}m#{data}\e[0m" if enable_color
196
196
  str << format("#{" " * indent}%-10s %s\n", item.to_s.capitalize + ":", data)
197
197
  end
198
198
  str
data/lib/inspec/cli.rb CHANGED
@@ -218,9 +218,13 @@ class Inspec::InspecCLI < Inspec::BaseCLI
218
218
 
219
219
  Automate:
220
220
  ```
221
- #{Inspec::Dist::EXEC_NAME} compliance login
221
+ #{Inspec::Dist::EXEC_NAME} automate login
222
222
  #{Inspec::Dist::EXEC_NAME} exec compliance://username/linux-baseline
223
223
  ```
224
+ `inspec compliance` is a backwards compatible alias for `inspec automate` and works the same way:
225
+ ```
226
+ #{Inspec::Dist::EXEC_NAME} compliance login
227
+ ```
224
228
 
225
229
  Supermarket:
226
230
  ```
@@ -301,7 +305,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI
301
305
  puts res.to_json
302
306
  else
303
307
  ui.headline("Platform Details")
304
- ui.plain Inspec::BaseCLI.format_platform_info(params: res, indent: 0, color: 36)
308
+ ui.plain Inspec::BaseCLI.format_platform_info(params: res, indent: 0, color: 36, enable_color: ui.color?)
305
309
  end
306
310
  rescue ArgumentError, RuntimeError, Train::UserError => e
307
311
  $stderr.puts e.message
@@ -31,7 +31,7 @@ module Inspec::Fetcher
31
31
  target = target.gsub(%r{^file://}, "")
32
32
  else
33
33
  # support for windows paths
34
- target = target.tr('\\', "/")
34
+ target = target.tr("\\", "/")
35
35
  end
36
36
 
37
37
  target if File.exist?(File.expand_path(target))
@@ -117,6 +117,15 @@ module Inspec::Plugin::V2
117
117
  # `inspec dosomething` => activate the :dosomething hook
118
118
  activate_me ||= cli_args.include?(act.activator_name.to_s)
119
119
 
120
+ # Only one compliance command to be activated at one time.
121
+ # Since both commands are defined in the same class,
122
+ # activators were not getting fetched uniquely.
123
+ if cli_args.include?("automate") && act.activator_name.to_s.eql?("compliance")
124
+ activate_me = false
125
+ elsif cli_args.include?("compliance") && act.activator_name.to_s.eql?("automate")
126
+ activate_me = false
127
+ end
128
+
120
129
  # OK, activate.
121
130
  if activate_me
122
131
  act.activate
@@ -91,7 +91,7 @@ module Inspec
91
91
  end
92
92
 
93
93
  def all_controls
94
- ret = @rules.values
94
+ ret = @rules.values.compact
95
95
  ret += @control_subcontexts.map(&:all_rules).flatten
96
96
  ret
97
97
  end
@@ -136,10 +136,10 @@ module Inspec::Resources
136
136
  alias sticky? sticky
137
137
 
138
138
  def more_permissive_than?(max_mode = nil)
139
- raise Inspec::Exceptions::ResourceFailed, "The file" + file.path + "doesn't seem to exist" unless exist?
140
- raise ArgumentError, "You must proivde a value for the `maximum allowable permission` for the file." if max_mode.nil?
141
- raise ArgumentError, "You must proivde the `maximum permission target` as a `String`, you provided: " + max_mode.class.to_s unless max_mode.is_a?(String)
142
- raise ArgumentError, "The value of the `maximum permission target` should be a valid file mode in 4-ditgit octal format: for example, `0644` or `0777`" unless /(0)?([0-7])([0-7])([0-7])/.match?(max_mode)
139
+ return nil unless exist?
140
+ raise ArgumentError, "You must provide a value for the `maximum allowable permission` for the file." if max_mode.nil?
141
+ raise ArgumentError, "You must provide the `maximum permission target` as a `String`, you provided: " + max_mode.class.to_s unless max_mode.is_a?(String)
142
+ raise ArgumentError, "The value of the `maximum permission target` should be a valid file mode in 4-digit octal format: for example, `0644` or `0777`" unless /(0)?([0-7])([0-7])([0-7])/.match?(max_mode)
143
143
 
144
144
  # Using the files mode and a few bit-wise calculations we can ensure a
145
145
  # file is no more permisive than desired.
@@ -160,7 +160,6 @@ module Inspec::Resources
160
160
 
161
161
  max_mode = max_mode.to_i(8)
162
162
  inv_mode = 0777 ^ max_mode
163
-
164
163
  inv_mode & file.mode != 0
165
164
  end
166
165
 
@@ -56,7 +56,7 @@ module Inspec::Resources
56
56
  end
57
57
 
58
58
  def body
59
- @worker.body
59
+ @worker.body&.force_encoding(Encoding::UTF_8)
60
60
  end
61
61
 
62
62
  def http_method
@@ -58,7 +58,7 @@ module Inspec::Resources
58
58
  end
59
59
 
60
60
  def query(q) # rubocop:disable Metrics/PerceivedComplexity
61
- escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '""').gsub(/\$/, '\\$')
61
+ escaped_query = q.gsub(/\\/, "\\\\").gsub(/"/, '""').gsub(/\$/, '\\$')
62
62
  # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
63
63
  cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
64
64
  cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
@@ -75,7 +75,7 @@ module Inspec::Resources
75
75
  def create_mysql_cmd(q, db = "")
76
76
  # TODO: simple escape, must be handled by a library
77
77
  # that does this securely
78
- escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
78
+ escaped_query = q.gsub(/\\/, "\\\\").gsub(/"/, '\\"').gsub(/\$/, '\\$')
79
79
 
80
80
  # construct the query
81
81
  command = "mysql"
@@ -117,7 +117,7 @@ module Inspec::Resources
117
117
  if defined?(windows_paths["Python"]) && pipcmd.nil?
118
118
  return nil if windows_paths["Pip"].nil?
119
119
 
120
- pipdir = windows_paths["Python"].split('\\')
120
+ pipdir = windows_paths["Python"].split("\\")
121
121
  # remove python.exe
122
122
  pipdir.pop
123
123
  pipcmd = pipdir.push("Scripts").push("pip.exe").join("/")
@@ -54,7 +54,7 @@ module Inspec::Resources
54
54
  def port_manager_for_os
55
55
  os = inspec.os
56
56
  if os.linux?
57
- LinuxPorts.new(inspec)
57
+ LinuxPorts.new(inspec, @port)
58
58
  elsif os.aix?
59
59
  # AIX: see http://www.ibm.com/developerworks/aix/library/au-lsof.html#resources
60
60
  # and https://www-01.ibm.com/marketing/iwm/iwm/web/reg/pick.do?source=aixbp
@@ -102,8 +102,9 @@ module Inspec::Resources
102
102
  # }]
103
103
  class PortsInfo
104
104
  attr_reader :inspec
105
- def initialize(inspec)
105
+ def initialize(inspec, port = nil)
106
106
  @inspec = inspec
107
+ @port = port
107
108
  end
108
109
  end
109
110
 
@@ -394,7 +395,12 @@ module Inspec::Resources
394
395
  def ports_via_ss
395
396
  return nil unless inspec.command("ss").exist?
396
397
 
397
- cmd = inspec.command("ss -tulpen")
398
+ if @port.nil?
399
+ cmd = inspec.command("ss -tulpen")
400
+ else
401
+ cmd = inspec.command("ss -tulpen '( dport = #{@port} or sport = #{@port} )'")
402
+ end
403
+
398
404
  return nil unless cmd.exit_status.to_i == 0
399
405
 
400
406
  ports = []
@@ -281,7 +281,7 @@ module Inspec::Resources
281
281
  key = @options[:key]
282
282
  return "" unless key
283
283
 
284
- key.start_with?('\\') ? key : "\\#{key}"
284
+ key.start_with?("\\") ? key : "\\#{key}"
285
285
  end
286
286
  end
287
287
 
@@ -611,7 +611,7 @@ module Inspec::Resources
611
611
  # @see https://msdn.microsoft.com/en-us/library/aa394153(v=vs.85).aspx
612
612
  class WindowsUser < UserInfo
613
613
  def parse_windows_account(username)
614
- account = username.split('\\')
614
+ account = username.split("\\")
615
615
  name = account.pop
616
616
  domain = account.pop unless account.empty?
617
617
  [name, domain]
@@ -79,10 +79,11 @@ module Inspec::Resources
79
79
  result = cmd.stdout
80
80
  feature_name_regex = /Feature Name : (.*)(\r\n|\n)/
81
81
  description_regex = /Description : (.*)(\r\n|\n)/
82
+ state_regex = /State : (.*)(\r\n|\n)/
82
83
  feature_info = {
83
84
  name: result.match(feature_name_regex).captures[0].chomp,
84
85
  description: result.match(description_regex).captures[0].chomp,
85
- installed: true,
86
+ installed: result.match(state_regex).captures[0].chomp == "Enabled",
86
87
  }
87
88
  end
88
89
 
@@ -105,7 +105,7 @@ module Inspec::Resources
105
105
  # @see https://github.com/chef/chef/blob/master/lib/chef/resource/windows_firewall_rule.rb
106
106
  def load_firewall_state(rule_name)
107
107
  <<-EOH
108
- Remove-TypeData System.Array # workaround for PS bug here: https://bit.ly/2SRMQ8M
108
+ Get-TypeData -TypeName System.Array | Remove-TypeData # workaround for PS bug here: https://bit.ly/2SRMQ8M
109
109
  $rule = Get-NetFirewallRule -Name "#{rule_name}"
110
110
  $addressFilter = $rule | Get-NetFirewallAddressFilter
111
111
  $portFilter = $rule | Get-NetFirewallPortFilter
@@ -16,16 +16,20 @@ module Inspec::Resources
16
16
  EXAMPLE
17
17
 
18
18
  def initialize(zfs_dataset)
19
- return skip_resource "The `zfs_dataset` resource is not supported on your OS yet." unless inspec.os.bsd?
19
+ return skip_resource "The `zfs_dataset` resource is not supported on your OS yet." unless inspec.os.bsd? || inspec.os.linux?
20
20
 
21
21
  @zfs_dataset = zfs_dataset
22
+ find_zfs = inspec.command("which zfs")
23
+ @zfs_cmd = find_zfs.stdout.strip
24
+
25
+ return skip_resource "zfs is not installed" if find_zfs.exit_status != 0
22
26
 
23
27
  @params = gather
24
28
  end
25
29
 
26
30
  # method called by 'it { should exist }'
27
31
  def exists?
28
- inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}").exit_status == 0
32
+ inspec.command("#{@zfs_cmd} get -Hp all #{@zfs_dataset}").exit_status == 0
29
33
  end
30
34
 
31
35
  def mounted?
@@ -39,7 +43,7 @@ module Inspec::Resources
39
43
  end
40
44
 
41
45
  def gather
42
- cmd = inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}")
46
+ cmd = inspec.command("#{@zfs_cmd} get -Hp all #{@zfs_dataset}")
43
47
  return nil if cmd.exit_status.to_i != 0
44
48
 
45
49
  # parse data
@@ -15,16 +15,20 @@ module Inspec::Resources
15
15
  EXAMPLE
16
16
 
17
17
  def initialize(zfs_pool)
18
- return skip_resource "The `zfs_pool` resource is not supported on your OS yet." unless inspec.os.bsd?
18
+ return skip_resource "The `zfs_pool` resource is not supported on your OS yet." unless inspec.os.bsd? || inspec.os.linux?
19
19
 
20
20
  @zfs_pool = zfs_pool
21
+ find_zpool = inspec.command("which zpool")
22
+ @zpool_cmd = find_zpool.stdout.strip
23
+
24
+ return skip_resource "zfs is not installed" if find_zpool.exit_status != 0
21
25
 
22
26
  @params = gather
23
27
  end
24
28
 
25
29
  # method called by 'it { should exist }'
26
30
  def exists?
27
- inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}").exit_status == 0
31
+ inspec.command("#{@zpool_cmd} get -Hp all #{@zfs_pool}").exit_status == 0
28
32
  end
29
33
 
30
34
  def to_s
@@ -32,7 +36,7 @@ module Inspec::Resources
32
36
  end
33
37
 
34
38
  def gather
35
- cmd = inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}")
39
+ cmd = inspec.command("#{@zpool_cmd} get -Hp all #{@zfs_pool}")
36
40
  return nil if cmd.exit_status.to_i != 0
37
41
 
38
42
  # parse data
data/lib/inspec/runner.rb CHANGED
@@ -243,7 +243,7 @@ module Inspec
243
243
  # to provide access to local profiles that add resources.
244
244
  @depends.each do |dep|
245
245
  # support for windows paths
246
- dep = dep.tr('\\', "/")
246
+ dep = dep.tr("\\", "/")
247
247
  Inspec::Profile.for_path(dep, { profile_context: ctx }).load_libraries
248
248
  end
249
249
 
@@ -52,13 +52,13 @@ class ErlangParser < Parslet::Parser
52
52
 
53
53
  rule(:stringS) do
54
54
  str("'") >> (
55
- str('\\') >> any | str("'").absent? >> any
55
+ str("\\") >> any | str("'").absent? >> any
56
56
  ).repeat.as(:string) >> str("'") >> filler?
57
57
  end
58
58
 
59
59
  rule(:stringD) do
60
60
  str('"') >> (
61
- str('\\') >> any | str('"').absent? >> any
61
+ str("\\") >> any | str('"').absent? >> any
62
62
  ).repeat.as(:string) >> str('"') >> filler?
63
63
  end
64
64
 
@@ -375,13 +375,13 @@ module FilterTable
375
375
  methods_to_install_on_resource_class = @filter_methods + @custom_properties.keys
376
376
  methods_to_install_on_resource_class.each do |method_name|
377
377
  resource_class.send(:define_method, method_name) do |*args, &block|
378
- begin
379
- # self here is the resource instance
380
- filter_table_instance = table_class.new(self, send(raw_data_fetcher_method_name), " with")
381
- filter_table_instance.send(method_name, *args, &block)
382
- rescue Inspec::Exceptions::ResourceFailed, Inspec::Exceptions::ResourceSkipped => e
383
- FilterTable::ExceptionCatcher.new(resource_class, e)
384
- end
378
+
379
+ # self here is the resource instance
380
+ filter_table_instance = table_class.new(self, send(raw_data_fetcher_method_name), " with")
381
+ filter_table_instance.send(method_name, *args, &block)
382
+ rescue Inspec::Exceptions::ResourceFailed, Inspec::Exceptions::ResourceSkipped => e
383
+ FilterTable::ExceptionCatcher.new(resource_class, e)
384
+
385
385
  end
386
386
  end
387
387
  end
@@ -31,19 +31,19 @@ class NginxParser < Parslet::Parser
31
31
 
32
32
  rule(:standard_value) do
33
33
  ((match(/[#;{'"]/).absent? >> any) >> (
34
- str('\\') >> any | match('[#;{]|\s').absent? >> any
34
+ str("\\") >> any | match('[#;{]|\s').absent? >> any
35
35
  ).repeat).as(:value) >> space.repeat
36
36
  end
37
37
 
38
38
  rule(:single_quoted_value) do
39
39
  str("'") >> (
40
- str('\\') >> any | str("'").absent? >> any
40
+ str("\\") >> any | str("'").absent? >> any
41
41
  ).repeat.as(:value) >> str("'") >> space.repeat
42
42
  end
43
43
 
44
44
  rule(:double_quoted_value) do
45
45
  str('"') >> (
46
- str('\\') >> any | str('"').absent? >> any
46
+ str("\\") >> any | str('"').absent? >> any
47
47
  ).repeat.as(:value) >> str('"') >> space.repeat
48
48
  end
49
49
 
@@ -1,3 +1,3 @@
1
1
  module Inspec
2
- VERSION = "4.36.4".freeze
2
+ VERSION = "4.37.23".freeze
3
3
  end
@@ -6,24 +6,50 @@ This extensions offers the following features:
6
6
  - execute profiles directly from Chef Automate/Chef Compliance locally
7
7
  - upload a local profile to Chef Automate/Chef Compliance
8
8
 
9
+ `inspec compliance` is a backwards compatible alias for `inspec automate` and works the same way.
10
+
9
11
  To use the CLI, this InSpec add-on adds the following commands:
10
12
 
13
+ * `$ inspec automate login` - authentication of the API token against Chef Automate/Chef Compliance
14
+ * `$ inspec automate profiles` - list all available Compliance profiles
15
+ * `$ inspec exec compliance://profile` - runs a Compliance profile
16
+ * `$ inspec automate upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
17
+ * `$ inspec automate logout` - logout of Chef Automate/Chef Compliance
18
+
19
+ Similar to these CLI commands are:
20
+
11
21
  * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
12
22
  * `$ inspec compliance profiles` - list all available Compliance profiles
13
- * `$ inspec exec compliance://profile` - runs a Compliance profile
14
23
  * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
15
24
  * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
16
25
 
17
26
  Compliance profiles can be executed in two ways:
18
27
 
19
- - via compliance exec: `inspec compliance exec profile`
28
+ - via compliance exec: `inspec automate exec profile` or `inspec compliance exec profile`
20
29
  - via compliance scheme: `inspec exec compliance://profile`
21
30
 
22
31
 
32
+
33
+
23
34
  ## Usage
24
35
 
25
36
  ### Command options
26
37
 
38
+ ```
39
+ $ inspec automate
40
+ Commands:
41
+ inspec automate download PROFILE # downloads a profile from Chef Compliance
42
+ inspec automate exec PROFILE # executes a Chef Compliance profile
43
+ inspec automate help [COMMAND] # Describe subcommands or one specific subcommand
44
+ inspec automate login SERVER # Log in to a Chef Automate/Chef Compliance SERVER
45
+ inspec automate logout # user logout from Chef Compliance
46
+ inspec automate profiles # list all available profiles in Chef Compliance
47
+ inspec automate upload PATH # uploads a local profile to Chef Compliance
48
+ inspec automate version # displays the version of the Chef Compliance server
49
+ ```
50
+
51
+ or
52
+
27
53
  ```
28
54
  $ inspec compliance
29
55
  Commands:
@@ -41,6 +67,12 @@ Commands:
41
67
 
42
68
  You will need an API token for authentication. You can retrieve one via the admin section of your A2 web gui.
43
69
 
70
+ ```
71
+ $ inspec automate login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
72
+ ```
73
+
74
+ or
75
+
44
76
  ```
45
77
  $ inspec compliance login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
46
78
  ```
@@ -63,6 +95,12 @@ Example:
63
95
 
64
96
  You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
65
97
 
98
+ ```
99
+ $ inspec automate login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
100
+ ```
101
+
102
+ or
103
+
66
104
  ```
67
105
  $ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
68
106
  ```
@@ -75,12 +113,42 @@ You will need an access token for authentication. You can retrieve one via:
75
113
 
76
114
  You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
77
115
 
116
+ ```
117
+ $ inspec automate login https://compliance.test --user admin --insecure --token '...'
118
+ ```
119
+
120
+ or
121
+
78
122
  ```
79
123
  $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
80
124
  ```
81
125
 
82
126
  ### List available profiles via Chef Compliance / Automate
83
127
 
128
+ ```
129
+ $ inspec automate profiles
130
+ Available profiles:
131
+ -------------------
132
+ * base/apache
133
+ * base/linux
134
+ * base/mysql
135
+ * base/postgres
136
+ * base/ssh
137
+ * base/windows
138
+ * cis/cis-centos6-level1
139
+ * cis/cis-centos6-level2
140
+ * cis/cis-centos7-level1
141
+ * cis/cis-centos7-level2
142
+ * cis/cis-rhel7-level1
143
+ * cis/cis-rhel7-level2
144
+ * cis/cis-ubuntu12.04lts-level1
145
+ * cis/cis-ubuntu12.04lts-level2
146
+ * cis/cis-ubuntu14.04lts-level1
147
+ * cis/cis-ubuntu14.04lts-level2
148
+ ```
149
+
150
+ or
151
+
84
152
  ```
85
153
  $ inspec compliance profiles
86
154
  Available profiles:
@@ -105,6 +173,47 @@ Available profiles:
105
173
 
106
174
  ### Upload a profile to Chef Compliance / Automate
107
175
 
176
+ ```
177
+ $ inspec automate version
178
+ Chef Compliance version: 1.0.11
179
+ ➜ inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec automate upload examples/profile
180
+ I, [2016-05-06T14:27:20.907547 #37592] INFO -- : Checking profile in examples/profile
181
+ I, [2016-05-06T14:27:20.907668 #37592] INFO -- : Metadata OK.
182
+ I, [2016-05-06T14:27:20.968584 #37592] INFO -- : Found 4 controls.
183
+ I, [2016-05-06T14:27:20.968638 #37592] INFO -- : Control definitions OK.
184
+ Profile is valid
185
+ Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
186
+ I, [2016-05-06T14:27:21.020017 #37592] INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
187
+ I, [2016-05-06T14:27:21.024837 #37592] INFO -- : Finished archive generation.
188
+ Start upload to admin/profile
189
+ Uploading to Chef Compliance
190
+ Successfully uploaded profile
191
+
192
+ # display all profiles
193
+ $ inspec automate profiles
194
+ Available profiles:
195
+ -------------------
196
+ * admin/profile
197
+ * base/apache
198
+ * base/linux
199
+ * base/mysql
200
+ * base/postgres
201
+ * base/ssh
202
+ * base/windows
203
+ * cis/cis-centos6-level1
204
+ * cis/cis-centos6-level2
205
+ * cis/cis-centos7-level1
206
+ * cis/cis-centos7-level2
207
+ * cis/cis-rhel7-level1
208
+ * cis/cis-rhel7-level2
209
+ * cis/cis-ubuntu12.04lts-level1
210
+ * cis/cis-ubuntu12.04lts-level2
211
+ * cis/cis-ubuntu14.04lts-level1
212
+ * cis/cis-ubuntu14.04lts-level2
213
+ ```
214
+
215
+ or
216
+
108
217
  ```
109
218
  $ inspec compliance version
110
219
  Chef Compliance version: 1.0.11
@@ -168,17 +277,31 @@ $ inspec exec compliance://admin/apache-baseline#2.0.1
168
277
  ```
169
278
 
170
279
  Download a specific version(2.0.2) of a profile when logged in with Automate:
280
+ ```
281
+ $ inspec automate download compliance://admin/apache-baseline#2.0.2
282
+ ```
283
+
284
+ or
285
+
171
286
  ```
172
287
  $ inspec compliance download compliance://admin/apache-baseline#2.0.2
173
288
  ```
174
289
 
175
290
  ### To Logout from Chef Compliance
176
291
 
292
+ ```
293
+ $ inspec automate logout
294
+ Successfully logged out
295
+ ```
296
+
297
+ or
298
+
177
299
  ```
178
300
  $ inspec compliance logout
179
301
  Successfully logged out
180
302
  ```
181
303
 
304
+
182
305
  ## Integration Tests
183
306
 
184
307
  At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time: