inspec-core 4.36.4 → 4.37.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile +14 -1
  3. data/etc/deprecations.json +5 -0
  4. data/inspec-core.gemspec +1 -1
  5. data/lib/inspec/base_cli.rb +2 -2
  6. data/lib/inspec/cli.rb +6 -2
  7. data/lib/inspec/fetcher/local.rb +1 -1
  8. data/lib/inspec/plugin/v2/loader.rb +9 -0
  9. data/lib/inspec/profile_context.rb +1 -1
  10. data/lib/inspec/resources/file.rb +4 -5
  11. data/lib/inspec/resources/http.rb +1 -1
  12. data/lib/inspec/resources/mssql_session.rb +1 -1
  13. data/lib/inspec/resources/mysql_session.rb +1 -1
  14. data/lib/inspec/resources/pip.rb +1 -1
  15. data/lib/inspec/resources/port.rb +9 -3
  16. data/lib/inspec/resources/registry_key.rb +1 -1
  17. data/lib/inspec/resources/users.rb +1 -1
  18. data/lib/inspec/resources/windows_feature.rb +2 -1
  19. data/lib/inspec/resources/windows_firewall_rule.rb +1 -1
  20. data/lib/inspec/resources/zfs_dataset.rb +7 -3
  21. data/lib/inspec/resources/zfs_pool.rb +7 -3
  22. data/lib/inspec/runner.rb +1 -1
  23. data/lib/inspec/utils/erlang_parser.rb +2 -2
  24. data/lib/inspec/utils/filter.rb +7 -7
  25. data/lib/inspec/utils/nginx_parser.rb +3 -3
  26. data/lib/inspec/version.rb +1 -1
  27. data/lib/plugins/inspec-compliance/README.md +125 -2
  28. data/lib/plugins/inspec-compliance/lib/inspec-compliance.rb +5 -0
  29. data/lib/plugins/inspec-compliance/lib/inspec-compliance/api.rb +36 -179
  30. data/lib/plugins/inspec-compliance/lib/inspec-compliance/api/login.rb +15 -137
  31. data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb +26 -28
  32. data/lib/plugins/inspec-compliance/lib/inspec-compliance/target.rb +7 -24
  33. data/lib/plugins/inspec-init/lib/inspec-init/cli_plugin.rb +44 -34
  34. data/lib/plugins/inspec-init/lib/inspec-init/renderer.rb +1 -0
  35. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/Gemfile +6 -6
  36. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/Rakefile +8 -8
  37. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/inspec-plugin-template.gemspec +12 -12
  38. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/{inspec-plugin-template.rb → inspec-plugin-template.erb} +1 -1
  39. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{cli_command.rb → cli_command.erb} +8 -8
  40. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{plugin.rb → plugin.erb} +15 -15
  41. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{reporter.rb → reporter.erb} +0 -0
  42. data/lib/plugins/inspec-init/templates/plugins/inspec-plugin-template/lib/inspec-plugin-template/{version.rb → version.erb} +1 -1
  43. metadata +13 -7
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2c3d7a6b401a4a92a2dbe1342499857065d9643baeed19d2b1e5af77672be3d8
4
- data.tar.gz: 907c48ac504a9a8588e41a65edfbafc3726c17ce59c5a5a8b3e5c83000fa08db
3
+ metadata.gz: c9e4ef72fd93cf8c9de6cf6a6b14473388a1df8edee971d3e9db0dc89e31a756
4
+ data.tar.gz: 79ab3e58e1f574f6bd34aff949a965ed7c01744745cb09eba4768a420f9fe60b
5
5
  SHA512:
6
- metadata.gz: 5685428db9251aae0e26db8cc0ab81f247115aa70152472421e560cf97c17486e8f656a9be158ba3fbaa00bb078a1fb12eb5077a6d16a4883b052a9aba5c0869
7
- data.tar.gz: baf44fe69d48134e7d6a8760ceb245c10a29a6e423d8afda68ac35225bba6f7a7a0e21f815d5f4b7fb4206b6f4080b01b9e5be16f1e2f030b2f594c53c215b22
6
+ metadata.gz: c1254e07b8263b7f97c53a3a3768db4fd50692d49defe607e2f7ceb42fce86c6a53909472e0b28fe7cbb58cfcdb6255dd549adaca18836ba2475f8644dab4153
7
+ data.tar.gz: 8b45db91165ebd6a9af3102a4a4f60e9cf1fd404f5cc28452cc4df92e1554cce42a009e40b6a11de1d13569bada66a270d344076965138d32e52aea045a8ca52
data/Gemfile CHANGED
@@ -28,7 +28,7 @@ group :omnibus do
28
28
  end
29
29
 
30
30
  group :test do
31
- gem "chefstyle", "~> 1.7.1"
31
+ gem "chefstyle", "~> 2.0.3"
32
32
  gem "concurrent-ruby", "~> 1.0"
33
33
  gem "html-proofer", platforms: :ruby # do not attempt to run proofer on windows
34
34
  gem "json_schemer", ">= 0.2.1", "< 0.2.19"
@@ -48,3 +48,16 @@ end
48
48
  group :deploy do
49
49
  gem "inquirer"
50
50
  end
51
+
52
+ # Only include Test Kitchen support if we are on Ruby 2.7 or higher
53
+ # as chef-zero support requires Ruby 2.6
54
+ # See https://github.com/inspec/inspec/pull/5341
55
+ if Gem.ruby_version >= Gem::Version.new("2.7.0")
56
+ group :kitchen do
57
+ gem "berkshelf"
58
+ gem "test-kitchen", ">= 2.8"
59
+ gem "kitchen-inspec", ">= 2.0"
60
+ gem "kitchen-dokken", ">= 2.11"
61
+ gem "git"
62
+ end
63
+ end
@@ -120,6 +120,11 @@
120
120
  "object_classes": {
121
121
  "action": "warn",
122
122
  "suffix": "These classes will be removed in InSpec 5.0."
123
+ },
124
+ "cli_option_hook":{
125
+ "action": "warn",
126
+ "prefix": "The --hook option is being replaced by the --activator option.",
127
+ "suffix": "This options will be removed in InSpec 4.0."
123
128
  }
124
129
  }
125
130
  }
data/inspec-core.gemspec CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
23
23
  .reject { |f| File.directory?(f) }
24
24
 
25
25
  # Implementation dependencies
26
- spec.add_dependency "chef-telemetry", "~> 1.0"
26
+ spec.add_dependency "chef-telemetry", "~> 1.0", ">= 1.0.8" # 1.0.8+ removes the http dep
27
27
  spec.add_dependency "license-acceptance", ">= 0.2.13", "< 3.0"
28
28
  spec.add_dependency "thor", ">= 0.20", "< 2.0"
29
29
  spec.add_dependency "method_source", ">= 0.8", "< 2.0"
@@ -181,7 +181,7 @@ module Inspec
181
181
  puts " Patents: chef.io/patents\n\n"
182
182
  end
183
183
 
184
- def self.format_platform_info(params: {}, indent: 0, color: 39)
184
+ def self.format_platform_info(params: {}, indent: 0, color: 39, enable_color: true)
185
185
  str = ""
186
186
  params.each do |item, info|
187
187
  data = info
@@ -192,7 +192,7 @@ module Inspec
192
192
  # Do not output fields of data is missing ('unknown' is fine)
193
193
  next if data.nil?
194
194
 
195
- data = "\e[1m\e[#{color}m#{data}\e[0m"
195
+ data = "\e[1m\e[#{color}m#{data}\e[0m" if enable_color
196
196
  str << format("#{" " * indent}%-10s %s\n", item.to_s.capitalize + ":", data)
197
197
  end
198
198
  str
data/lib/inspec/cli.rb CHANGED
@@ -218,9 +218,13 @@ class Inspec::InspecCLI < Inspec::BaseCLI
218
218
 
219
219
  Automate:
220
220
  ```
221
- #{Inspec::Dist::EXEC_NAME} compliance login
221
+ #{Inspec::Dist::EXEC_NAME} automate login
222
222
  #{Inspec::Dist::EXEC_NAME} exec compliance://username/linux-baseline
223
223
  ```
224
+ `inspec compliance` is a backwards compatible alias for `inspec automate` and works the same way:
225
+ ```
226
+ #{Inspec::Dist::EXEC_NAME} compliance login
227
+ ```
224
228
 
225
229
  Supermarket:
226
230
  ```
@@ -301,7 +305,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI
301
305
  puts res.to_json
302
306
  else
303
307
  ui.headline("Platform Details")
304
- ui.plain Inspec::BaseCLI.format_platform_info(params: res, indent: 0, color: 36)
308
+ ui.plain Inspec::BaseCLI.format_platform_info(params: res, indent: 0, color: 36, enable_color: ui.color?)
305
309
  end
306
310
  rescue ArgumentError, RuntimeError, Train::UserError => e
307
311
  $stderr.puts e.message
@@ -31,7 +31,7 @@ module Inspec::Fetcher
31
31
  target = target.gsub(%r{^file://}, "")
32
32
  else
33
33
  # support for windows paths
34
- target = target.tr('\\', "/")
34
+ target = target.tr("\\", "/")
35
35
  end
36
36
 
37
37
  target if File.exist?(File.expand_path(target))
@@ -117,6 +117,15 @@ module Inspec::Plugin::V2
117
117
  # `inspec dosomething` => activate the :dosomething hook
118
118
  activate_me ||= cli_args.include?(act.activator_name.to_s)
119
119
 
120
+ # Only one compliance command to be activated at one time.
121
+ # Since both commands are defined in the same class,
122
+ # activators were not getting fetched uniquely.
123
+ if cli_args.include?("automate") && act.activator_name.to_s.eql?("compliance")
124
+ activate_me = false
125
+ elsif cli_args.include?("compliance") && act.activator_name.to_s.eql?("automate")
126
+ activate_me = false
127
+ end
128
+
120
129
  # OK, activate.
121
130
  if activate_me
122
131
  act.activate
@@ -91,7 +91,7 @@ module Inspec
91
91
  end
92
92
 
93
93
  def all_controls
94
- ret = @rules.values
94
+ ret = @rules.values.compact
95
95
  ret += @control_subcontexts.map(&:all_rules).flatten
96
96
  ret
97
97
  end
@@ -136,10 +136,10 @@ module Inspec::Resources
136
136
  alias sticky? sticky
137
137
 
138
138
  def more_permissive_than?(max_mode = nil)
139
- raise Inspec::Exceptions::ResourceFailed, "The file" + file.path + "doesn't seem to exist" unless exist?
140
- raise ArgumentError, "You must proivde a value for the `maximum allowable permission` for the file." if max_mode.nil?
141
- raise ArgumentError, "You must proivde the `maximum permission target` as a `String`, you provided: " + max_mode.class.to_s unless max_mode.is_a?(String)
142
- raise ArgumentError, "The value of the `maximum permission target` should be a valid file mode in 4-ditgit octal format: for example, `0644` or `0777`" unless /(0)?([0-7])([0-7])([0-7])/.match?(max_mode)
139
+ return nil unless exist?
140
+ raise ArgumentError, "You must provide a value for the `maximum allowable permission` for the file." if max_mode.nil?
141
+ raise ArgumentError, "You must provide the `maximum permission target` as a `String`, you provided: " + max_mode.class.to_s unless max_mode.is_a?(String)
142
+ raise ArgumentError, "The value of the `maximum permission target` should be a valid file mode in 4-digit octal format: for example, `0644` or `0777`" unless /(0)?([0-7])([0-7])([0-7])/.match?(max_mode)
143
143
 
144
144
  # Using the files mode and a few bit-wise calculations we can ensure a
145
145
  # file is no more permisive than desired.
@@ -160,7 +160,6 @@ module Inspec::Resources
160
160
 
161
161
  max_mode = max_mode.to_i(8)
162
162
  inv_mode = 0777 ^ max_mode
163
-
164
163
  inv_mode & file.mode != 0
165
164
  end
166
165
 
@@ -56,7 +56,7 @@ module Inspec::Resources
56
56
  end
57
57
 
58
58
  def body
59
- @worker.body
59
+ @worker.body&.force_encoding(Encoding::UTF_8)
60
60
  end
61
61
 
62
62
  def http_method
@@ -58,7 +58,7 @@ module Inspec::Resources
58
58
  end
59
59
 
60
60
  def query(q) # rubocop:disable Metrics/PerceivedComplexity
61
- escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '""').gsub(/\$/, '\\$')
61
+ escaped_query = q.gsub(/\\/, "\\\\").gsub(/"/, '""').gsub(/\$/, '\\$')
62
62
  # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
63
63
  cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
64
64
  cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
@@ -75,7 +75,7 @@ module Inspec::Resources
75
75
  def create_mysql_cmd(q, db = "")
76
76
  # TODO: simple escape, must be handled by a library
77
77
  # that does this securely
78
- escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
78
+ escaped_query = q.gsub(/\\/, "\\\\").gsub(/"/, '\\"').gsub(/\$/, '\\$')
79
79
 
80
80
  # construct the query
81
81
  command = "mysql"
@@ -117,7 +117,7 @@ module Inspec::Resources
117
117
  if defined?(windows_paths["Python"]) && pipcmd.nil?
118
118
  return nil if windows_paths["Pip"].nil?
119
119
 
120
- pipdir = windows_paths["Python"].split('\\')
120
+ pipdir = windows_paths["Python"].split("\\")
121
121
  # remove python.exe
122
122
  pipdir.pop
123
123
  pipcmd = pipdir.push("Scripts").push("pip.exe").join("/")
@@ -54,7 +54,7 @@ module Inspec::Resources
54
54
  def port_manager_for_os
55
55
  os = inspec.os
56
56
  if os.linux?
57
- LinuxPorts.new(inspec)
57
+ LinuxPorts.new(inspec, @port)
58
58
  elsif os.aix?
59
59
  # AIX: see http://www.ibm.com/developerworks/aix/library/au-lsof.html#resources
60
60
  # and https://www-01.ibm.com/marketing/iwm/iwm/web/reg/pick.do?source=aixbp
@@ -102,8 +102,9 @@ module Inspec::Resources
102
102
  # }]
103
103
  class PortsInfo
104
104
  attr_reader :inspec
105
- def initialize(inspec)
105
+ def initialize(inspec, port = nil)
106
106
  @inspec = inspec
107
+ @port = port
107
108
  end
108
109
  end
109
110
 
@@ -394,7 +395,12 @@ module Inspec::Resources
394
395
  def ports_via_ss
395
396
  return nil unless inspec.command("ss").exist?
396
397
 
397
- cmd = inspec.command("ss -tulpen")
398
+ if @port.nil?
399
+ cmd = inspec.command("ss -tulpen")
400
+ else
401
+ cmd = inspec.command("ss -tulpen '( dport = #{@port} or sport = #{@port} )'")
402
+ end
403
+
398
404
  return nil unless cmd.exit_status.to_i == 0
399
405
 
400
406
  ports = []
@@ -281,7 +281,7 @@ module Inspec::Resources
281
281
  key = @options[:key]
282
282
  return "" unless key
283
283
 
284
- key.start_with?('\\') ? key : "\\#{key}"
284
+ key.start_with?("\\") ? key : "\\#{key}"
285
285
  end
286
286
  end
287
287
 
@@ -611,7 +611,7 @@ module Inspec::Resources
611
611
  # @see https://msdn.microsoft.com/en-us/library/aa394153(v=vs.85).aspx
612
612
  class WindowsUser < UserInfo
613
613
  def parse_windows_account(username)
614
- account = username.split('\\')
614
+ account = username.split("\\")
615
615
  name = account.pop
616
616
  domain = account.pop unless account.empty?
617
617
  [name, domain]
@@ -79,10 +79,11 @@ module Inspec::Resources
79
79
  result = cmd.stdout
80
80
  feature_name_regex = /Feature Name : (.*)(\r\n|\n)/
81
81
  description_regex = /Description : (.*)(\r\n|\n)/
82
+ state_regex = /State : (.*)(\r\n|\n)/
82
83
  feature_info = {
83
84
  name: result.match(feature_name_regex).captures[0].chomp,
84
85
  description: result.match(description_regex).captures[0].chomp,
85
- installed: true,
86
+ installed: result.match(state_regex).captures[0].chomp == "Enabled",
86
87
  }
87
88
  end
88
89
 
@@ -105,7 +105,7 @@ module Inspec::Resources
105
105
  # @see https://github.com/chef/chef/blob/master/lib/chef/resource/windows_firewall_rule.rb
106
106
  def load_firewall_state(rule_name)
107
107
  <<-EOH
108
- Remove-TypeData System.Array # workaround for PS bug here: https://bit.ly/2SRMQ8M
108
+ Get-TypeData -TypeName System.Array | Remove-TypeData # workaround for PS bug here: https://bit.ly/2SRMQ8M
109
109
  $rule = Get-NetFirewallRule -Name "#{rule_name}"
110
110
  $addressFilter = $rule | Get-NetFirewallAddressFilter
111
111
  $portFilter = $rule | Get-NetFirewallPortFilter
@@ -16,16 +16,20 @@ module Inspec::Resources
16
16
  EXAMPLE
17
17
 
18
18
  def initialize(zfs_dataset)
19
- return skip_resource "The `zfs_dataset` resource is not supported on your OS yet." unless inspec.os.bsd?
19
+ return skip_resource "The `zfs_dataset` resource is not supported on your OS yet." unless inspec.os.bsd? || inspec.os.linux?
20
20
 
21
21
  @zfs_dataset = zfs_dataset
22
+ find_zfs = inspec.command("which zfs")
23
+ @zfs_cmd = find_zfs.stdout.strip
24
+
25
+ return skip_resource "zfs is not installed" if find_zfs.exit_status != 0
22
26
 
23
27
  @params = gather
24
28
  end
25
29
 
26
30
  # method called by 'it { should exist }'
27
31
  def exists?
28
- inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}").exit_status == 0
32
+ inspec.command("#{@zfs_cmd} get -Hp all #{@zfs_dataset}").exit_status == 0
29
33
  end
30
34
 
31
35
  def mounted?
@@ -39,7 +43,7 @@ module Inspec::Resources
39
43
  end
40
44
 
41
45
  def gather
42
- cmd = inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}")
46
+ cmd = inspec.command("#{@zfs_cmd} get -Hp all #{@zfs_dataset}")
43
47
  return nil if cmd.exit_status.to_i != 0
44
48
 
45
49
  # parse data
@@ -15,16 +15,20 @@ module Inspec::Resources
15
15
  EXAMPLE
16
16
 
17
17
  def initialize(zfs_pool)
18
- return skip_resource "The `zfs_pool` resource is not supported on your OS yet." unless inspec.os.bsd?
18
+ return skip_resource "The `zfs_pool` resource is not supported on your OS yet." unless inspec.os.bsd? || inspec.os.linux?
19
19
 
20
20
  @zfs_pool = zfs_pool
21
+ find_zpool = inspec.command("which zpool")
22
+ @zpool_cmd = find_zpool.stdout.strip
23
+
24
+ return skip_resource "zfs is not installed" if find_zpool.exit_status != 0
21
25
 
22
26
  @params = gather
23
27
  end
24
28
 
25
29
  # method called by 'it { should exist }'
26
30
  def exists?
27
- inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}").exit_status == 0
31
+ inspec.command("#{@zpool_cmd} get -Hp all #{@zfs_pool}").exit_status == 0
28
32
  end
29
33
 
30
34
  def to_s
@@ -32,7 +36,7 @@ module Inspec::Resources
32
36
  end
33
37
 
34
38
  def gather
35
- cmd = inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}")
39
+ cmd = inspec.command("#{@zpool_cmd} get -Hp all #{@zfs_pool}")
36
40
  return nil if cmd.exit_status.to_i != 0
37
41
 
38
42
  # parse data
data/lib/inspec/runner.rb CHANGED
@@ -243,7 +243,7 @@ module Inspec
243
243
  # to provide access to local profiles that add resources.
244
244
  @depends.each do |dep|
245
245
  # support for windows paths
246
- dep = dep.tr('\\', "/")
246
+ dep = dep.tr("\\", "/")
247
247
  Inspec::Profile.for_path(dep, { profile_context: ctx }).load_libraries
248
248
  end
249
249
 
@@ -52,13 +52,13 @@ class ErlangParser < Parslet::Parser
52
52
 
53
53
  rule(:stringS) do
54
54
  str("'") >> (
55
- str('\\') >> any | str("'").absent? >> any
55
+ str("\\") >> any | str("'").absent? >> any
56
56
  ).repeat.as(:string) >> str("'") >> filler?
57
57
  end
58
58
 
59
59
  rule(:stringD) do
60
60
  str('"') >> (
61
- str('\\') >> any | str('"').absent? >> any
61
+ str("\\") >> any | str('"').absent? >> any
62
62
  ).repeat.as(:string) >> str('"') >> filler?
63
63
  end
64
64
 
@@ -375,13 +375,13 @@ module FilterTable
375
375
  methods_to_install_on_resource_class = @filter_methods + @custom_properties.keys
376
376
  methods_to_install_on_resource_class.each do |method_name|
377
377
  resource_class.send(:define_method, method_name) do |*args, &block|
378
- begin
379
- # self here is the resource instance
380
- filter_table_instance = table_class.new(self, send(raw_data_fetcher_method_name), " with")
381
- filter_table_instance.send(method_name, *args, &block)
382
- rescue Inspec::Exceptions::ResourceFailed, Inspec::Exceptions::ResourceSkipped => e
383
- FilterTable::ExceptionCatcher.new(resource_class, e)
384
- end
378
+
379
+ # self here is the resource instance
380
+ filter_table_instance = table_class.new(self, send(raw_data_fetcher_method_name), " with")
381
+ filter_table_instance.send(method_name, *args, &block)
382
+ rescue Inspec::Exceptions::ResourceFailed, Inspec::Exceptions::ResourceSkipped => e
383
+ FilterTable::ExceptionCatcher.new(resource_class, e)
384
+
385
385
  end
386
386
  end
387
387
  end
@@ -31,19 +31,19 @@ class NginxParser < Parslet::Parser
31
31
 
32
32
  rule(:standard_value) do
33
33
  ((match(/[#;{'"]/).absent? >> any) >> (
34
- str('\\') >> any | match('[#;{]|\s').absent? >> any
34
+ str("\\") >> any | match('[#;{]|\s').absent? >> any
35
35
  ).repeat).as(:value) >> space.repeat
36
36
  end
37
37
 
38
38
  rule(:single_quoted_value) do
39
39
  str("'") >> (
40
- str('\\') >> any | str("'").absent? >> any
40
+ str("\\") >> any | str("'").absent? >> any
41
41
  ).repeat.as(:value) >> str("'") >> space.repeat
42
42
  end
43
43
 
44
44
  rule(:double_quoted_value) do
45
45
  str('"') >> (
46
- str('\\') >> any | str('"').absent? >> any
46
+ str("\\") >> any | str('"').absent? >> any
47
47
  ).repeat.as(:value) >> str('"') >> space.repeat
48
48
  end
49
49
 
@@ -1,3 +1,3 @@
1
1
  module Inspec
2
- VERSION = "4.36.4".freeze
2
+ VERSION = "4.37.23".freeze
3
3
  end
@@ -6,24 +6,50 @@ This extensions offers the following features:
6
6
  - execute profiles directly from Chef Automate/Chef Compliance locally
7
7
  - upload a local profile to Chef Automate/Chef Compliance
8
8
 
9
+ `inspec compliance` is a backwards compatible alias for `inspec automate` and works the same way.
10
+
9
11
  To use the CLI, this InSpec add-on adds the following commands:
10
12
 
13
+ * `$ inspec automate login` - authentication of the API token against Chef Automate/Chef Compliance
14
+ * `$ inspec automate profiles` - list all available Compliance profiles
15
+ * `$ inspec exec compliance://profile` - runs a Compliance profile
16
+ * `$ inspec automate upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
17
+ * `$ inspec automate logout` - logout of Chef Automate/Chef Compliance
18
+
19
+ Similar to these CLI commands are:
20
+
11
21
  * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
12
22
  * `$ inspec compliance profiles` - list all available Compliance profiles
13
- * `$ inspec exec compliance://profile` - runs a Compliance profile
14
23
  * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
15
24
  * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
16
25
 
17
26
  Compliance profiles can be executed in two ways:
18
27
 
19
- - via compliance exec: `inspec compliance exec profile`
28
+ - via compliance exec: `inspec automate exec profile` or `inspec compliance exec profile`
20
29
  - via compliance scheme: `inspec exec compliance://profile`
21
30
 
22
31
 
32
+
33
+
23
34
  ## Usage
24
35
 
25
36
  ### Command options
26
37
 
38
+ ```
39
+ $ inspec automate
40
+ Commands:
41
+ inspec automate download PROFILE # downloads a profile from Chef Compliance
42
+ inspec automate exec PROFILE # executes a Chef Compliance profile
43
+ inspec automate help [COMMAND] # Describe subcommands or one specific subcommand
44
+ inspec automate login SERVER # Log in to a Chef Automate/Chef Compliance SERVER
45
+ inspec automate logout # user logout from Chef Compliance
46
+ inspec automate profiles # list all available profiles in Chef Compliance
47
+ inspec automate upload PATH # uploads a local profile to Chef Compliance
48
+ inspec automate version # displays the version of the Chef Compliance server
49
+ ```
50
+
51
+ or
52
+
27
53
  ```
28
54
  $ inspec compliance
29
55
  Commands:
@@ -41,6 +67,12 @@ Commands:
41
67
 
42
68
  You will need an API token for authentication. You can retrieve one via the admin section of your A2 web gui.
43
69
 
70
+ ```
71
+ $ inspec automate login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
72
+ ```
73
+
74
+ or
75
+
44
76
  ```
45
77
  $ inspec compliance login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
46
78
  ```
@@ -63,6 +95,12 @@ Example:
63
95
 
64
96
  You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
65
97
 
98
+ ```
99
+ $ inspec automate login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
100
+ ```
101
+
102
+ or
103
+
66
104
  ```
67
105
  $ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
68
106
  ```
@@ -75,12 +113,42 @@ You will need an access token for authentication. You can retrieve one via:
75
113
 
76
114
  You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
77
115
 
116
+ ```
117
+ $ inspec automate login https://compliance.test --user admin --insecure --token '...'
118
+ ```
119
+
120
+ or
121
+
78
122
  ```
79
123
  $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
80
124
  ```
81
125
 
82
126
  ### List available profiles via Chef Compliance / Automate
83
127
 
128
+ ```
129
+ $ inspec automate profiles
130
+ Available profiles:
131
+ -------------------
132
+ * base/apache
133
+ * base/linux
134
+ * base/mysql
135
+ * base/postgres
136
+ * base/ssh
137
+ * base/windows
138
+ * cis/cis-centos6-level1
139
+ * cis/cis-centos6-level2
140
+ * cis/cis-centos7-level1
141
+ * cis/cis-centos7-level2
142
+ * cis/cis-rhel7-level1
143
+ * cis/cis-rhel7-level2
144
+ * cis/cis-ubuntu12.04lts-level1
145
+ * cis/cis-ubuntu12.04lts-level2
146
+ * cis/cis-ubuntu14.04lts-level1
147
+ * cis/cis-ubuntu14.04lts-level2
148
+ ```
149
+
150
+ or
151
+
84
152
  ```
85
153
  $ inspec compliance profiles
86
154
  Available profiles:
@@ -105,6 +173,47 @@ Available profiles:
105
173
 
106
174
  ### Upload a profile to Chef Compliance / Automate
107
175
 
176
+ ```
177
+ $ inspec automate version
178
+ Chef Compliance version: 1.0.11
179
+ ➜ inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec automate upload examples/profile
180
+ I, [2016-05-06T14:27:20.907547 #37592] INFO -- : Checking profile in examples/profile
181
+ I, [2016-05-06T14:27:20.907668 #37592] INFO -- : Metadata OK.
182
+ I, [2016-05-06T14:27:20.968584 #37592] INFO -- : Found 4 controls.
183
+ I, [2016-05-06T14:27:20.968638 #37592] INFO -- : Control definitions OK.
184
+ Profile is valid
185
+ Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
186
+ I, [2016-05-06T14:27:21.020017 #37592] INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
187
+ I, [2016-05-06T14:27:21.024837 #37592] INFO -- : Finished archive generation.
188
+ Start upload to admin/profile
189
+ Uploading to Chef Compliance
190
+ Successfully uploaded profile
191
+
192
+ # display all profiles
193
+ $ inspec automate profiles
194
+ Available profiles:
195
+ -------------------
196
+ * admin/profile
197
+ * base/apache
198
+ * base/linux
199
+ * base/mysql
200
+ * base/postgres
201
+ * base/ssh
202
+ * base/windows
203
+ * cis/cis-centos6-level1
204
+ * cis/cis-centos6-level2
205
+ * cis/cis-centos7-level1
206
+ * cis/cis-centos7-level2
207
+ * cis/cis-rhel7-level1
208
+ * cis/cis-rhel7-level2
209
+ * cis/cis-ubuntu12.04lts-level1
210
+ * cis/cis-ubuntu12.04lts-level2
211
+ * cis/cis-ubuntu14.04lts-level1
212
+ * cis/cis-ubuntu14.04lts-level2
213
+ ```
214
+
215
+ or
216
+
108
217
  ```
109
218
  $ inspec compliance version
110
219
  Chef Compliance version: 1.0.11
@@ -168,17 +277,31 @@ $ inspec exec compliance://admin/apache-baseline#2.0.1
168
277
  ```
169
278
 
170
279
  Download a specific version(2.0.2) of a profile when logged in with Automate:
280
+ ```
281
+ $ inspec automate download compliance://admin/apache-baseline#2.0.2
282
+ ```
283
+
284
+ or
285
+
171
286
  ```
172
287
  $ inspec compliance download compliance://admin/apache-baseline#2.0.2
173
288
  ```
174
289
 
175
290
  ### To Logout from Chef Compliance
176
291
 
292
+ ```
293
+ $ inspec automate logout
294
+ Successfully logged out
295
+ ```
296
+
297
+ or
298
+
177
299
  ```
178
300
  $ inspec compliance logout
179
301
  Successfully logged out
180
302
  ```
181
303
 
304
+
182
305
  ## Integration Tests
183
306
 
184
307
  At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time: