inspec-core 4.56.58 → 5.7.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9817a3eab9cc59b2a73fff43f35ecb954d48b9a16b2e1e1a7eb44bbd1389420
-  data.tar.gz: 410c6d2786f8cccc6690593e5db3bb03be0bc77444ea8fab9504213b9594102c
+  metadata.gz: 4c3af1b1fd71ded2286e8aa90c46c74dd20f7fb31c525e56ae03e52952c26b0f
+  data.tar.gz: 507db51585f790cc26af852626b3bb52f8a35f36870ee563902234f1c2664a2a
 SHA512:
-  metadata.gz: c93dd109c5676294db7ecc9dd944769df71badcf3df9d116583b7429a07da78087fa3f1194d6d2cfe0acc6ecf8483abba72fe3d490b2439f01e736bdf41cce3d
-  data.tar.gz: 62058048a64e284a585c4a38f4a906d3aeab03142287726393e71ae8088b8f766d2eed97bd7a4b75446d3b74e2dd469b70906b1c5d3d61b4dd1863eeeee2d68d
+  metadata.gz: 00447ba26c980417a501be959fb8ca85268db4e600417c11a912181da2c75c41169d419f1177fac484a12c1c405cae3aab5912ec9cab24f9a9e4adf355d40faa
+  data.tar.gz: f007b4bc1998187a7313f34f8739145f5e511500e2c9ca280b7163495a6909646be25fed9b4307a27f370e5e36b94b36b558c9e8d5c67079dc6cf24fb93029ea

data/Gemfile

@@ -23,27 +23,42 @@ group :omnibus do
 end
 
 group :test do
-  gem "chefstyle", "~> 2.2.2"
+  gem "chefstyle", "~> 2.0.3"
   gem "concurrent-ruby", "~> 1.0"
-  gem "json_schemer", ">= 0.2.1", "< 2.0.1"
+  gem "html-proofer", platforms: :ruby # do not attempt to run proofer on windows
+  gem "json_schemer", ">= 0.2.1", "< 0.2.19"
   gem "m"
   gem "minitest-sprint", "~> 1.0"
-  gem "minitest", "5.15.0"
-  gem "mocha", "~> 2.1"
+  gem "minitest", "~> 5.5"
+  gem "mocha", "~> 1.1"
   gem "nokogiri", "~> 1.9"
   gem "pry-byebug"
   gem "pry", "~> 0.10"
   gem "rake", ">= 10"
+  gem "ruby-progressbar", "~> 1.8"
   gem "simplecov", "~> 0.21"
   gem "simplecov_json_formatter"
   gem "webmock", "~> 3.0"
-
-  if Gem.ruby_version >= Gem::Version.new("3.0.0")
-    # html-proofer has a dep on io-event, which is ruby-3 only
-    gem "html-proofer", "~> 3.19.4", platforms: :ruby # do not attempt to run proofer on windows. Pinned to 3.19.4 as test is breaking in updated versions.
-  end
 end
 
 group :deploy do
   gem "inquirer"
 end
+
+# Only include Test Kitchen support if we are on Ruby 2.7 or higher
+# as chef-zero support requires Ruby 2.6
+# See https://github.com/inspec/inspec/pull/5341
+if Gem.ruby_version >= Gem::Version.new("2.7.0")
+  group :kitchen do
+    gem "berkshelf"
+    gem "chef", ">= 16.0" # Required to allow net-ssh > 6
+    gem "test-kitchen", ">= 2.8"
+    gem "kitchen-inspec", ">= 2.0"
+    gem "kitchen-dokken", ">= 2.11"
+    gem "git"
+  end
+end
+
+if Gem.ruby_version < Gem::Version.new("2.7.0")
+  gem "activesupport", "6.1.4.4"
+end

data/etc/deprecations.json

@@ -17,9 +17,14 @@
       "prefix": "Inputs should be specified by using the 'inputs' key in profile metadata, not 'attributes'."
     },
     "aws_resources_in_resource_pack": {
-      "comment": "See #3822",
-      "action": "warn",
-      "prefix": "AWS resources shipped with core InSpec are being to moved to a resource pack for faster iteration. Please update your profiles to depend on git@github.com:inspec/inspec-aws.git ."
+      "comment": "Deprecated in InSpec 5",
+      "action": "exit",
+      "prefix": "AWS resources in core InSpec are deprecated and have been removed in InSpec 5. They are now part of a resource pack. Please update your profiles to depend on git@github.com:inspec/inspec-aws.git ."
+    },
+    "azure_resources_in_resource_pack": {
+      "comment": "Deprecated in InSpec 5",
+      "action": "exit",
+      "prefix": "Azure resources in core InSpec are deprecated and have been removed in InSpec 5. They are now part of a resource pack. Please update your profiles to depend on git@github.com:inspec/inspec-azure.git ."
     },
     "cli_option_json_config": {
       "action": "ignore",
@@ -55,10 +60,6 @@
       "action": "fail_control",
       "suffix": "This property was removed in InSpec 4.0."
     },
-    "properties_aws_iam_user": {
-      "action": "fail_control",
-      "suffix": "This property was removed in InSpec 4.0."
-    },
     "properties_shadow": {
       "action": "fail_control",
       "suffix": "This property was removed in InSpec 4.0."
@@ -72,10 +73,6 @@
       "action": "exit",
       "suffix": "This resource was removed in InSpec 4.0."
     },
-    "resource_azure_generic_resource": {
-      "action": "warn",
-      "prefix": "The azure_generic_resource is deprecated. Please use a specific resource. See: 'https://github.com/inspec/inspec/issues/3131'"
-    },
     "resource_iis_website": {
       "action": "exit",
       "suffix": "This resource was removed in InSpec 4.0.",
@@ -125,6 +122,10 @@
       "action": "warn",
       "prefix": "The --hook option is being replaced by the --activator option.",
       "suffix": "This options will be removed in InSpec 4.0."
+    },
+    "cli_option_target_id":{
+      "action": "warn",
+      "prefix": "The --target-id option is deprecated in InSpec 5. Its value will be ignored."
     }
   }
 }

data/inspec-core.gemspec

@@ -13,7 +13,7 @@ Gem::Specification.new do |spec|
   spec.license       = "Apache-2.0"
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.6"
+  spec.required_ruby_version = ">= 2.7"
 
   # the gemfile and gemspec are necessary for appbundler so don't remove it
   spec.files =
@@ -25,12 +25,10 @@ Gem::Specification.new do |spec|
   # Implementation dependencies
   spec.add_dependency "chef-telemetry",     "~> 1.0", ">= 1.0.8" # 1.0.8+ removes the http dep
   spec.add_dependency "license-acceptance", ">= 0.2.13", "< 3.0"
-  # TODO: We should remove the thor pinning in next upcoming releases currently it's breaking our unit test in cli_args_test for aliases due to
-  # recent changes made in thor library REF: https://github.com/rails/thor/releases/tag/v1.3.0 & https://github.com/rails/thor/pull/800
-  spec.add_dependency "thor",               ">= 0.20", "< 1.3.0"
+  spec.add_dependency "thor",               ">= 0.20", "< 2.0"
   spec.add_dependency "method_source",      ">= 0.8", "< 2.0"
   spec.add_dependency "rubyzip",            ">= 1.2.2", "< 3.0"
-  spec.add_dependency "rspec",              ">= 3.9", "<= 3.13"
+  spec.add_dependency "rspec",              ">= 3.9", "<= 3.11"
   spec.add_dependency "rspec-its",          "~> 1.2"
   spec.add_dependency "pry",                "~> 0.13"
   spec.add_dependency "hashie",             ">= 3.4", "< 5.0"

data/lib/inspec/base_cli.rb

@@ -99,8 +99,18 @@ module Inspec
         desc: "Specify a particular shell to use."
       option :ssl, type: :boolean,
         desc: "Use SSL for transport layer encryption (WinRM)."
+      option :ssl_peer_fingerprint, type: :string,
+        desc: "Specify peer fingerprint for SSL authentication, used in lieu of certificates"
       option :self_signed, type: :boolean,
         desc: "Allow remote scans with self-signed certificates (WinRM)."
+      option :ca_trust_file, type: :string,
+        desc: "Specify CA trust file for SSL authentication"
+      option :client_cert, type: :string,
+        desc: "Specify client certificate for SSL authentication"
+      option :client_key, type: :string,
+        desc: "Specify client key required with client cert for SSL authentication"
+      option :client_key_pass, type: :string, lazy_default: -1,
+        desc: "Specify client cert password, if required for SSL authentication"
       option :winrm_transport, type: :string, default: "negotiate",
         desc: "Specify which transport to use, defaults to negotiate (WinRM)."
       option :winrm_disable_sspi, type: :boolean,
@@ -121,7 +131,7 @@ module Inspec
       option :insecure, type: :boolean, default: false,
         desc: "Disable SSL verification on select targets"
       option :target_id, type: :string,
-        desc: "Provide a ID which will be included on reports"
+        desc: "Provide a ID which will be included on reports - deprecated"
       option :winrm_shell_type, type: :string, default: "powershell",
         desc: "Specify a shell type for winrm (eg. 'elevated' or 'powershell')"
       option :docker_url, type: :string,
@@ -135,6 +145,8 @@ module Inspec
         desc: "Folder which contains referenced profiles."
       option :vendor_cache, type: :string,
         desc: "Use the given path for caching dependencies. (default: ~/.inspec/cache)"
+      option :auto_install_gems, type: :boolean, default: false,
+        desc: "Auto installs gem dependencies of the profile or resource pack."
     end
 
     def self.supermarket_options
@@ -152,7 +164,7 @@ module Inspec
         desc: "A list of tags names that are part of controls to filter and run controls, or a list of /regexes/ to match against tags names of controls. Ignore all other tests."
       option :reporter, type: :array,
         banner: "one two:/output/file/path",
-        desc: "Enable one or more output reporters: cli, documentation, html, progress, json, json-min, json-rspec, junit, yaml"
+        desc: "Enable one or more output reporters: cli, documentation, html, progress, progress-bar, json, json-min, json-rspec, junit, yaml"
       option :reporter_message_truncation, type: :string,
         desc: "Number of characters to truncate failure messages and code_desc in report data to (default: no truncation)"
       option :reporter_backtrace_inclusion, type: :boolean,

data/lib/inspec/cli.rb

@@ -95,8 +95,6 @@ class Inspec::InspecCLI < Inspec::BaseCLI
   desc "check PATH", "verify all tests at the specified PATH"
   option :format, type: :string,
     desc: "The output format to use doc (default), json. If valid format is not provided then it will use the default."
-  option :with_cookstyle, type: :boolean,
-    desc: "Enable or disable cookstyle checks.", default: false
   profile_options
   def check(path) # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
     o = config
@@ -189,10 +187,6 @@ class Inspec::InspecCLI < Inspec::BaseCLI
     desc: "Fallback to using local archives if fetching fails."
   option :ignore_errors, type: :boolean, default: false,
     desc: "Ignore profile warnings."
-  option :check, type: :boolean, default: false,
-    desc: "Run profile check before archiving."
-  option :export, type: :boolean, default: false,
-    desc: "Export the profile to inspec.json and include in archive"
   def archive(path)
     o = config
     diagnose(o)
@@ -207,7 +201,13 @@ class Inspec::InspecCLI < Inspec::BaseCLI
     vendor_deps(path, vendor_options)
 
     profile = Inspec::Profile.for_target(path, o)
-    result = profile.check if o[:check]
+    gem_deps = profile.metadata.gem_dependencies + \
+      profile.locked_dependencies.list.map { |_k, v| v.profile.metadata.gem_dependencies }.flatten
+    unless gem_deps.empty?
+      o[:logger].warn "Archiving a profile that contains gem dependencies, but InSpec cannot package gems with the profile! Please archive your ~/.inspec/gems directory separately."
+    end
+
+    result = profile.check
 
     if result && !o[:ignore_errors] == false
       o[:logger].info "Profile check failed. Please fix the profile before generating an archive."
@@ -302,6 +302,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI
   def exec(*targets)
     o = config
     diagnose(o)
+    deprecate_target_id(config)
     configure_logger(o)
 
     runner = Inspec::Runner.new(o)
@@ -320,6 +321,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI
   option :format, type: :string
   def detect
     o = config
+    deprecate_target_id(config)
     o[:command] = "platform.params"
 
     configure_logger(o)
@@ -360,6 +362,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI
     desc: "Specify one or more inputs directly on the command line to the shell, as --input NAME=VALUE. Accepts single-quoted YAML and JSON structures."
   def shell_func
     o = config
+    deprecate_target_id(config)
     diagnose(o)
     o[:debug_shell] = true
 
@@ -447,6 +450,12 @@ class Inspec::InspecCLI < Inspec::BaseCLI
 
   private
 
+  def deprecate_target_id(config)
+    unless config[:target_id].nil?
+      Inspec.deprecate "cli_option_target_id"
+    end
+  end
+
   def run_command(opts)
     runner = Inspec::Runner.new(Inspec::Config.new(opts))
     res = runner.eval_with_virtual_profile(opts[:command])

data/lib/inspec/dependencies/dependency_set.rb

@@ -25,9 +25,7 @@ module Inspec
     def self.from_array(dependencies, cwd, cache, backend)
       dep_list = {}
       dependencies.each do |d|
-        # if depedent profile does not have a source version then only name is used in dependency hash
-        key_name = (d.source_version.blank? ? "#{d.name}" : "#{d.name}-#{d.source_version}") rescue "#{d.name}"
-        dep_list[key_name] = d
+        dep_list[d.name] = d
       end
       new(cwd, cache, dep_list, backend)
     end
@@ -41,9 +39,7 @@ module Inspec
     def self.flatten_dep_tree(dep_tree)
       dep_list = {}
       dep_tree.each do |d|
-        # if depedent profile does not have a source version then only name is used in dependency hash
-        key_name = (d.source_version.blank? ? "#{d.name}" : "#{d.name}-#{d.source_version}") rescue "#{d.name}"
-        dep_list[key_name] = d
+        dep_list[d.name] = d
         dep_list.merge!(flatten_dep_tree(d.dependencies))
       end
       dep_list

data/lib/inspec/dependency_installer.rb

@@ -0,0 +1,74 @@
+# This class will install the gem depedencies for profiles etc.
+# The basic things which is required to install dependencies is the gem path where gem needs to be installed
+# and the list of gems needs to be installed.
+require "rubygems/remote_fetcher"
+require "forwardable" unless defined?(Forwardable)
+
+module Inspec
+  class DependencyInstaller
+    extend Forwardable
+
+    attr_reader :gem_path, :requested_gems, :dependency_loader
+
+    def_delegator :dependency_loader, :inspec_gem_path
+
+    def initialize(gem_path = nil, requested_gems = [])
+      @dependency_loader = Inspec::DependencyLoader.new
+      @gem_path = gem_path || inspec_gem_path
+      @requested_gems = requested_gems
+    end
+
+    def install
+      requested_gems.each do |requested_gem|
+        version = requested_gem[:version].nil? ? "> 0" : requested_gem[:version]
+        install_from_remote_gems(requested_gem[:name], { version: version })
+      end
+    end
+
+    private
+
+    def install_from_remote_gems(requested_gem_name, opts)
+      version = opts[:version].split(",")
+      begin
+        gem_dependency = Gem::Dependency.new(requested_gem_name, version || "> 0")
+
+        # BestSet is rubygems.org API + indexing, APISet is for custom sources
+        sources = if opts[:source]
+                    Gem::Resolver::APISet.new(URI.join(opts[:source] + "/api/v1/dependencies"))
+                  else
+                    Gem::Resolver::BestSet.new
+                  end
+
+        install_gem_to_gems_dir(gem_dependency, [sources], opts[:update_mode])
+      rescue Gem::RemoteFetcher::FetchError => gem_ex
+        ex = Inspec::GemDependencyInstallError.new(gem_ex.message)
+        ex.gem_name = requested_gem_name
+        raise ex
+      rescue Gem::Requirement::BadRequirementError => gem_ex
+        ex = Inspec::GemDependencyInstallError.new(gem_ex.message)
+        ex.gem_name = requested_gem_name
+        raise "Unparseable gem dependency '#{version}' for '#{ex.gem_name}'"
+      end
+    end
+
+    def install_gem_to_gems_dir(gem_dependency, extra_request_sets = [], update_mode = false)
+      # Solve the dependency (that is, find a way to install the new gem and anything it needs)
+      request_set = Gem::RequestSet.new(gem_dependency)
+
+      begin
+        solution = request_set.resolve
+      rescue Gem::UnsatisfiableDependencyError => gem_ex
+        ex = Inspec::GemDependencyInstallError.new(gem_ex.message)
+        ex.gem_name = gem_dependency.name
+        raise ex
+      end
+
+      # OK, perform the installation.
+      # Ignore deps here, because any needed deps should already be baked into gem_dependency
+      request_set.install_into(gem_path, true, ignore_dependencies: true, document: [])
+
+      # Locate the GemVersion for the new dependency and return it
+      solution.detect { |g| g.name == gem_dependency.name }.version
+    end
+  end
+end

data/lib/inspec/dependency_loader.rb

@@ -0,0 +1,97 @@
+# This class will load the gem depedencies for profiles etc.
+# The basic things which is required to load gem dependencies is the path from which gems needs to be loaded
+# and the list of gems needs to be loaded.
+
+module Inspec
+  class DependencyLoader
+    attr_accessor :gem_path, :gem_list
+
+    # initializes the dependency_loader
+    def initialize(gem_path = nil, gem_list = [])
+      @gem_path = gem_path || inspec_gem_path
+      @gem_list = gem_list
+    end
+
+    def load
+      Gem.path << gem_path
+      Gem.refresh
+
+      gem_list.each do |gem_data|
+        version = gem_data[:version].nil? ? "> 0" : gem_data[:version]
+        activate_gem_dependency(gem_data[:name], version)
+      end
+    end
+
+    def inspec_gem_path
+      self.class.inspec_gem_path
+    end
+
+    def self.inspec_gem_path
+      require "rbconfig" unless defined?(RbConfig)
+      ruby_abi_version = RbConfig::CONFIG["ruby_version"]
+      # TODO: why are we installing under the api directory for plugins?
+      base_dir = Inspec.config_dir
+      base_dir = File.realpath base_dir if File.exist? base_dir
+      File.join(base_dir, "gems", ruby_abi_version)
+    end
+
+    # Lists all gems found in the inspec_gem_path.
+    # @return [Array[Gem::Specification]] Specs of all gems found.
+    def list_managed_gems
+      Dir.glob(File.join(gem_path, "specifications", "*.gemspec")).map { |p| Gem::Specification.load(p) }
+    end
+
+    def list_installed_gems
+      list_managed_gems
+    end
+
+    def gem_installed?(name)
+      list_installed_gems.any? { |spec| spec.name == name }
+    end
+
+    def gem_version_installed?(name, version)
+      list_installed_gems.any? { |s| s.name == name && Gem::Requirement.new(version.split(",")) =~ s.version }
+    end
+
+    private
+
+    def activate_gem_dependency(name, version_constraint = "> 0")
+      version_constraint = version_constraint.split(",")
+      gem_deps = [Gem::Dependency.new(name.to_s, version_constraint)]
+      managed_gem_set = Gem::Resolver::VendorSet.new
+
+      # Note: There is an issue in resolving gem dependency.
+      # This block resolves that issue partially.
+      # But this will still fail for the gems which don't have the .gemspec file.
+      # TODO: Find the solution to resolve gem dependencies that work for the unpackaged gems which don't have the .gemspec file.
+      list_managed_gems.each do |spec|
+        unless Dir["#{spec.gem_dir}/*.gemspec"].empty?
+          managed_gem_set.add_vendor_gem(spec.name, spec.gem_dir)
+        end
+      end
+
+      # TODO: Next two lines merge our managed gems with the other gems available
+      # in our "local universe" - which may be the system, or it could be in a Bundler microcosm,
+      # or rbenv, etc. Do we want to merge that, though?
+      distrib_gem_set = Gem::Resolver::CurrentSet.new
+      installed_gem_set = Gem::Resolver.compose_sets(managed_gem_set, distrib_gem_set)
+
+      # So, given what we need, and what we have available, what activations are needed?
+      resolver = Gem::Resolver.new(gem_deps, installed_gem_set)
+
+      begin
+        solution = resolver.resolve
+      rescue Gem::UnsatisfiableDependencyError => gem_ex
+        # If you broke your install, or downgraded to a plugin with a bad gemspec, you could get here.
+        ex = Inspec::GemDependencyLoadError.new(gem_ex.message)
+        raise ex
+      end
+      solution.each do |activation_request|
+        next if activation_request.full_spec.activated?
+
+        activation_request.full_spec.activate
+        # TODO: If we are under Bundler, inform it that we loaded a gem
+      end
+    end
+  end
+end

data/lib/inspec/dsl.rb

@@ -1,17 +1,18 @@
 # copyright: 2015, Dominik Richter
 require "inspec/log"
 require "inspec/plugin/v2"
+require "inspec/utils/deprecated_cloud_resources_list"
 
 module Inspec::DSL
   attr_accessor :backend
 
-  def require_controls(id, version = nil, &block)
-    opts = { profile_id: id, include_all: false, backend: @backend, conf: @conf, dependencies: @dependencies, profile_version: version }
+  def require_controls(id, &block)
+    opts = { profile_id: id, include_all: false, backend: @backend, conf: @conf, dependencies: @dependencies }
     ::Inspec::DSL.load_spec_files_for_profile(self, opts, &block)
   end
 
-  def include_controls(id, version = nil, &block)
-    opts = { profile_id: id, include_all: true, backend: @backend, conf: @conf, dependencies: @dependencies, profile_version: version }
+  def include_controls(id, &block)
+    opts = { profile_id: id, include_all: true, backend: @backend, conf: @conf, dependencies: @dependencies }
     ::Inspec::DSL.load_spec_files_for_profile(self, opts, &block)
   end
 
@@ -38,8 +39,16 @@ module Inspec::DSL
 
     begin
       require "inspec/resources/#{id}"
-    rescue LoadError
-      require "resources/aws/#{id}"
+    rescue LoadError => e
+      include DeprecatedCloudResourcesList
+      cloud_resource = id.start_with?("aws_") ? "aws" : "azure"
+
+      # Deprecated AWS and Azure resources in InSpec 5.
+      if CLOUD_RESOURCES_DEPRECATED.include? id
+        Inspec.deprecate(:"#{cloud_resource}_resources_in_resource_pack", "Resource '#{id}'")
+      else
+        raise LoadError, "#{e.message}"
+      end
     end
 
     klass = Inspec::Resource.registry[id.to_s]
@@ -76,23 +85,7 @@ module Inspec::DSL
   def self.load_spec_files_for_profile(bind_context, opts, &block)
     dependencies = opts[:dependencies]
     profile_id = opts[:profile_id]
-    profile_version = opts[:profile_version]
-
-    new_profile_id = nil
-    if profile_version
-      new_profile_id = "#{profile_id}-#{profile_version}"
-    else
-      dependencies.list.each do |key, value|
-        # 1. Fetching VERSION from a profile dependency name which is in a format NAME-VERSION.
-        # 2. Matching original profile dependency name with profile name used with include or require control DSL.
-        source_version = value.source_version
-        unless source_version.blank?
-          profile_id_key = key.split("-#{source_version}")[0]
-          new_profile_id = key if profile_id_key == profile_id
-        end
-      end
-    end
-    dep_entry = new_profile_id ? dependencies.list[new_profile_id] : dependencies.list[profile_id]
+    dep_entry = dependencies.list[profile_id]
 
     if dep_entry.nil?
       raise <<~EOF

data/lib/inspec/env_printer.rb

@@ -35,7 +35,7 @@ module Inspec
     private
 
     def print_completion_for_shell
-      erb = ERB.new(File.read(completion_template_path), trim_mode: "-")
+      erb = ERB.new(File.read(completion_template_path), nil, "-")
       puts erb.result(TemplateContext.new(@command_class).get_bindings)
     end
 

data/lib/inspec/errors.rb

@@ -15,4 +15,11 @@ module Inspec
   class ConfigError::Invalid < ConfigError; end
 
   class UserInteractionRequired < Error; end
+
+  class GemDependencyLoadError < Error; end
+
+  class GemDependencyInstallError < Error
+    attr_accessor :gem_name
+    attr_accessor :version
+  end
 end