inspec-core 5.22.50 → 6.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Chef-EULA +9 -0
- data/Gemfile +14 -4
- data/etc/features.sig +6 -0
- data/etc/features.yaml +97 -0
- data/inspec-core.gemspec +17 -7
- data/lib/inspec/backend.rb +2 -0
- data/lib/inspec/base_cli.rb +80 -4
- data/lib/inspec/cached_fetcher.rb +24 -3
- data/lib/inspec/cli.rb +293 -236
- data/lib/inspec/config.rb +24 -2
- data/lib/inspec/dependencies/cache.rb +33 -0
- data/lib/inspec/enhanced_outcomes.rb +1 -0
- data/lib/inspec/errors.rb +5 -0
- data/lib/inspec/exceptions.rb +2 -0
- data/lib/inspec/feature/config.rb +75 -0
- data/lib/inspec/feature/runner.rb +29 -0
- data/lib/inspec/feature.rb +42 -0
- data/lib/inspec/fetcher/git.rb +5 -0
- data/lib/inspec/fetcher/url.rb +24 -4
- data/lib/inspec/globals.rb +6 -0
- data/lib/inspec/iaf_file.rb +3 -2
- data/lib/inspec/input_registry.rb +5 -1
- data/lib/inspec/plugin/v1/plugin_types/fetcher.rb +7 -0
- data/lib/inspec/plugin/v2/plugin_types/streaming_reporter.rb +30 -2
- data/lib/inspec/profile.rb +44 -1
- data/lib/inspec/reporters.rb +67 -54
- data/lib/inspec/resources/nftables.rb +14 -1
- data/lib/inspec/resources/oracledb_session.rb +12 -3
- data/lib/inspec/resources/ssh_config.rb +100 -9
- data/lib/inspec/resources/ssh_key.rb +124 -0
- data/lib/inspec/resources/sshd_active_config.rb +2 -0
- data/lib/inspec/resources/sybase_session.rb +11 -2
- data/lib/inspec/resources.rb +1 -0
- data/lib/inspec/rule.rb +6 -6
- data/lib/inspec/run_data.rb +7 -5
- data/lib/inspec/runner.rb +43 -6
- data/lib/inspec/runner_rspec.rb +12 -9
- data/lib/inspec/secrets/yaml.rb +9 -3
- data/lib/inspec/shell.rb +10 -0
- data/lib/inspec/ui.rb +4 -0
- data/lib/inspec/utils/licensing_config.rb +9 -0
- data/lib/inspec/utils/telemetry/base.rb +149 -0
- data/lib/inspec/utils/telemetry/http.rb +40 -0
- data/lib/inspec/utils/telemetry/null.rb +11 -0
- data/lib/inspec/utils/telemetry/run_context_probe.rb +13 -1
- data/lib/inspec/utils/telemetry.rb +74 -3
- data/lib/inspec/version.rb +1 -1
- data/lib/inspec/waiver_file_reader.rb +68 -27
- data/lib/inspec.rb +2 -2
- data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb +189 -168
- data/lib/plugins/inspec-habitat/lib/inspec-habitat/cli.rb +10 -3
- data/lib/plugins/inspec-init/lib/inspec-init/cli.rb +1 -0
- data/lib/plugins/inspec-init/lib/inspec-init/cli_plugin.rb +23 -21
- data/lib/plugins/inspec-init/lib/inspec-init/cli_profile.rb +15 -13
- data/lib/plugins/inspec-init/lib/inspec-init/cli_resource.rb +15 -13
- data/lib/plugins/inspec-license/README.md +16 -0
- data/lib/plugins/inspec-license/inspec-license.gemspec +6 -0
- data/lib/plugins/inspec-license/lib/inspec-license/cli.rb +26 -0
- data/lib/plugins/inspec-license/lib/inspec-license.rb +14 -0
- data/lib/plugins/inspec-parallel/README.md +27 -0
- data/lib/plugins/inspec-parallel/inspec-parallel.gemspec +6 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/child_status_reporter.rb +61 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/cli.rb +39 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/command.rb +219 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/runner.rb +270 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/base.rb +24 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/silent.rb +7 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/status.rb +125 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/text.rb +23 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel/validator.rb +170 -0
- data/lib/plugins/inspec-parallel/lib/inspec-parallel.rb +18 -0
- data/lib/plugins/inspec-sign/lib/inspec-sign/base.rb +20 -8
- data/lib/plugins/inspec-sign/lib/inspec-sign/cli.rb +11 -4
- data/lib/plugins/inspec-streaming-reporter-progress-bar/lib/inspec-streaming-reporter-progress-bar/streaming_reporter.rb +6 -13
- metadata +61 -19
- data/lib/inspec/utils/telemetry/collector.rb +0 -81
- data/lib/inspec/utils/telemetry/data_series.rb +0 -44
- data/lib/inspec/utils/telemetry/global_methods.rb +0 -22
@@ -0,0 +1,125 @@
|
|
1
|
+
require "highline"
|
2
|
+
|
3
|
+
module InspecPlugins::Parallelism
|
4
|
+
class SuperReporter
|
5
|
+
class Status < InspecPlugins::Parallelism::SuperReporter::Base
|
6
|
+
|
7
|
+
attr_reader :status_by_pid, :slots
|
8
|
+
|
9
|
+
def initialize(job_count, invocations)
|
10
|
+
@status_by_pid = {}
|
11
|
+
@slots = Array.new(job_count)
|
12
|
+
paint_header(job_count, invocations)
|
13
|
+
paint
|
14
|
+
end
|
15
|
+
|
16
|
+
# --------
|
17
|
+
# SuperReporter API
|
18
|
+
# --------
|
19
|
+
def child_spawned(pid, invocation)
|
20
|
+
new_child("spawned", pid, invocation)
|
21
|
+
end
|
22
|
+
|
23
|
+
def child_forked(pid, invocation)
|
24
|
+
new_child("forked", pid, invocation)
|
25
|
+
end
|
26
|
+
|
27
|
+
def child_exited(pid)
|
28
|
+
slots[status_by_pid[pid][:slot]] = "exited"
|
29
|
+
|
30
|
+
status_by_pid[pid][:pct] = 100.0
|
31
|
+
status_by_pid[pid][:slot] = nil
|
32
|
+
status_by_pid[pid][:exit] = $?
|
33
|
+
|
34
|
+
# TODO: consider holding slot in 100 status for UI grace
|
35
|
+
|
36
|
+
paint
|
37
|
+
end
|
38
|
+
|
39
|
+
def child_status_update_line(pid, update_line)
|
40
|
+
control_serial, status, control_count, title = update_line.split("/")
|
41
|
+
percent = 100.0 * control_serial.to_i / control_count.to_i.to_f
|
42
|
+
|
43
|
+
status_by_pid[pid][:pct] = percent
|
44
|
+
status_by_pid[pid][:last_control] = title
|
45
|
+
status_by_pid[pid][:last_status] = status
|
46
|
+
|
47
|
+
sleep 0.5
|
48
|
+
paint
|
49
|
+
end
|
50
|
+
|
51
|
+
# --------
|
52
|
+
# Utilities
|
53
|
+
# --------
|
54
|
+
private
|
55
|
+
|
56
|
+
def new_child(how, pid, invocation)
|
57
|
+
# Update status by PID with new info
|
58
|
+
status_by_pid[pid] = {
|
59
|
+
pct: 0.0,
|
60
|
+
inv: invocation,
|
61
|
+
how: how,
|
62
|
+
}
|
63
|
+
|
64
|
+
# Assign first empty slot
|
65
|
+
slots.each_index do |idx|
|
66
|
+
next unless slots[idx].nil? || slots[idx] == "exited"
|
67
|
+
|
68
|
+
slots[idx] = pid
|
69
|
+
status_by_pid[pid][:slot] = idx
|
70
|
+
break
|
71
|
+
end
|
72
|
+
|
73
|
+
# TODO: consider printing log message
|
74
|
+
paint
|
75
|
+
end
|
76
|
+
|
77
|
+
def terminal_width
|
78
|
+
return @terminal_width if @terminal_width
|
79
|
+
|
80
|
+
@highline ||= HighLine.new
|
81
|
+
width = @highline.output_cols.to_i
|
82
|
+
width = 80 if width < 1
|
83
|
+
@terminal_width = width
|
84
|
+
end
|
85
|
+
|
86
|
+
def paint
|
87
|
+
# Determine the width of a slot
|
88
|
+
slot_width = terminal_width / slots.length
|
89
|
+
line = ""
|
90
|
+
# Loop over slots
|
91
|
+
slots.each_index do |idx|
|
92
|
+
if slots[idx].nil?
|
93
|
+
# line += "idle".center(slot_width)
|
94
|
+
# Need to improve UI
|
95
|
+
elsif slots[idx] == "exited"
|
96
|
+
line += "Done".center(slot_width)
|
97
|
+
else
|
98
|
+
pid = slots[idx]
|
99
|
+
with_pid = format("%s: %0.1f%%", pid, status_by_pid[pid][:pct])
|
100
|
+
if with_pid.length <= slot_width - 2
|
101
|
+
line += with_pid.center(slot_width)
|
102
|
+
else
|
103
|
+
line += format("%0.1f%%", status_by_pid[pid][:pct]).center(slot_width)
|
104
|
+
end
|
105
|
+
end
|
106
|
+
end
|
107
|
+
|
108
|
+
print "\r" + (" " * terminal_width) + "\r"
|
109
|
+
print line
|
110
|
+
end
|
111
|
+
|
112
|
+
def paint_header(jobs, invocations)
|
113
|
+
puts "InSpec Parallel".center(terminal_width)
|
114
|
+
puts "Running #{invocations.length} invocations in #{jobs} slots".center(terminal_width)
|
115
|
+
puts "-" * terminal_width
|
116
|
+
slot_width = terminal_width / slots.length
|
117
|
+
slots.each_index do |idx|
|
118
|
+
print "Slot #{idx + 1}".center(slot_width)
|
119
|
+
end
|
120
|
+
puts
|
121
|
+
puts "-" * terminal_width
|
122
|
+
end
|
123
|
+
end
|
124
|
+
end
|
125
|
+
end
|
@@ -0,0 +1,23 @@
|
|
1
|
+
module InspecPlugins::Parallelism
|
2
|
+
class SuperReporter
|
3
|
+
class Text < InspecPlugins::Parallelism::SuperReporter::Base
|
4
|
+
def child_spawned(pid, _inv)
|
5
|
+
puts "[#{Time.now.iso8601}] Spawned child PID #{pid}"
|
6
|
+
end
|
7
|
+
|
8
|
+
def child_forked(pid, _inv)
|
9
|
+
puts "[#{Time.now.iso8601}] Forked child PID #{pid}"
|
10
|
+
end
|
11
|
+
|
12
|
+
def child_exited(pid)
|
13
|
+
puts "[#{Time.now.iso8601}] Exited child PID #{pid} status #{$?}"
|
14
|
+
end
|
15
|
+
|
16
|
+
def child_status_update_line(pid, update_line)
|
17
|
+
control_serial, _status, control_count, _title = update_line.split("/")
|
18
|
+
percent = 100.0 * control_serial.to_i / control_count.to_i.to_f
|
19
|
+
puts "[#{Time.now.iso8601}] #{pid} " + format("%.1f%%", percent)
|
20
|
+
end
|
21
|
+
end
|
22
|
+
end
|
23
|
+
end
|
@@ -0,0 +1,170 @@
|
|
1
|
+
require "inspec/cli"
|
2
|
+
module InspecPlugins
|
3
|
+
module Parallelism
|
4
|
+
class Validator
|
5
|
+
|
6
|
+
# TODO: make this list dynamic so plugins can self-declare
|
7
|
+
PARALLEL_SAFE_REPORTERS = [
|
8
|
+
"automate", # Performs HTTP transactions, silent on STDOUT
|
9
|
+
"child-status", # Writes dedicated protocol to STDOUT, expected by parent
|
10
|
+
].freeze
|
11
|
+
|
12
|
+
attr_accessor :invocations, :sub_cmd, :thor_options_for_sub_cmd, :aliases_mapping, :cli_options, :config_content, :stdin_config
|
13
|
+
|
14
|
+
def initialize(invocations, cli_options, sub_cmd = "exec")
|
15
|
+
@invocations = invocations
|
16
|
+
@sub_cmd = sub_cmd
|
17
|
+
@thor_options_for_sub_cmd = Inspec::InspecCLI.commands[sub_cmd].options
|
18
|
+
@aliases_mapping = create_aliases_mapping
|
19
|
+
@cli_options = cli_options
|
20
|
+
@config_content = nil
|
21
|
+
@stdin_config = nil
|
22
|
+
end
|
23
|
+
|
24
|
+
def validate
|
25
|
+
invocations.each do |invocation_data|
|
26
|
+
invocation_data[:validation_errors] = []
|
27
|
+
|
28
|
+
convert_cli_to_thor_options(invocation_data)
|
29
|
+
check_for_spurious_options(invocation_data)
|
30
|
+
check_for_required_fields(invocation_data)
|
31
|
+
check_for_reporter_options(invocation_data)
|
32
|
+
|
33
|
+
end
|
34
|
+
end
|
35
|
+
|
36
|
+
def validate_log_path
|
37
|
+
return [] unless cli_options["log_path"]
|
38
|
+
|
39
|
+
if File.directory?(cli_options["log_path"])
|
40
|
+
[]
|
41
|
+
else
|
42
|
+
[true, "Log path #{cli_options["log_path"]} is not accessible"]
|
43
|
+
end
|
44
|
+
end
|
45
|
+
|
46
|
+
private
|
47
|
+
|
48
|
+
def create_aliases_mapping
|
49
|
+
alias_mapping = {}
|
50
|
+
thor_options_for_sub_cmd.each do |_, sub_cmd_option|
|
51
|
+
aliases = sub_cmd_option.aliases
|
52
|
+
unless aliases.empty?
|
53
|
+
alias_mapping[aliases[0]] = sub_cmd_option.name
|
54
|
+
end
|
55
|
+
end
|
56
|
+
alias_mapping
|
57
|
+
end
|
58
|
+
|
59
|
+
def check_for_spurious_options(invocation_data)
|
60
|
+
# LIMITATION: Assume the first arg is the profile name, and there is exactly one of them.
|
61
|
+
invalid_options = invocation_data[:thor_args][1..-1]
|
62
|
+
invocation_data[:validation_errors].push "No such option: #{invalid_options}" unless invalid_options.empty?
|
63
|
+
end
|
64
|
+
|
65
|
+
def check_for_required_fields(invocation_data)
|
66
|
+
required_fields = thor_options_for_sub_cmd.collect { |_, thor_option| thor_option.name if thor_option.required }.compact
|
67
|
+
option_keys = invocation_data[:thor_opts].keys
|
68
|
+
invocation_data[:thor_opts].keys.map { |key| option_keys.push(aliases_mapping[key.to_sym]) if aliases_mapping[key.to_sym] }
|
69
|
+
if !required_fields.empty? && (option_keys & required_fields).empty?
|
70
|
+
invocation_data[:validation_errors].push "No value provided for required options: #{required_fields}"
|
71
|
+
end
|
72
|
+
end
|
73
|
+
|
74
|
+
def check_for_reporter_options(invocation_data)
|
75
|
+
# if no reporter option, that's an error
|
76
|
+
unless invocation_data[:thor_opts].include?("reporter")
|
77
|
+
# Check for config reporter validation only if --reporter option is missing from options file
|
78
|
+
return if check_reporter_options_in_config(invocation_data)
|
79
|
+
|
80
|
+
invocation_data[:validation_errors] << "A --reporter option must be specified for each invocation in the options file"
|
81
|
+
return
|
82
|
+
end
|
83
|
+
|
84
|
+
have_child_status_reporter = false
|
85
|
+
|
86
|
+
# Reporter option is formatted as an array
|
87
|
+
invocation_data[:thor_opts]["reporter"].each do |reporter_spec|
|
88
|
+
reporter_name, file_output = reporter_spec.split(":")
|
89
|
+
|
90
|
+
have_child_status_reporter = true if reporter_name == "child-status"
|
91
|
+
|
92
|
+
# if there is a reporter option, each entry must either write to a file or
|
93
|
+
# else be the special child-status reporter or the automate reporter
|
94
|
+
next if PARALLEL_SAFE_REPORTERS.include?(reporter_name)
|
95
|
+
|
96
|
+
unless file_output
|
97
|
+
invocation_data[:validation_errors] << "The #{reporter_name} reporter requires being directed to a file, like #{reporter_name}:filename.out"
|
98
|
+
end
|
99
|
+
end
|
100
|
+
|
101
|
+
# if there is no child-status reporter, add one to the raw value and the parsed array
|
102
|
+
unless have_child_status_reporter
|
103
|
+
# Eww
|
104
|
+
invocation_data[:thor_opts]["reporter"] << "child-status"
|
105
|
+
invocation_data[:value].gsub!("--reporter ", "--reporter child-status ")
|
106
|
+
end
|
107
|
+
end
|
108
|
+
|
109
|
+
def check_reporter_options_in_config(invocation_data)
|
110
|
+
config_opts = invocation_data[:thor_opts]["config"] || invocation_data[:thor_opts]["json_config"]
|
111
|
+
cfg_io = check_for_piped_config_from_stdin(config_opts)
|
112
|
+
|
113
|
+
if cfg_io == STDIN
|
114
|
+
# Scenario of using config from STDIN
|
115
|
+
@config_content ||= cfg_io.read
|
116
|
+
else
|
117
|
+
if config_opts.nil?
|
118
|
+
# Scenario of using default config.json file when path not provided
|
119
|
+
default_path = File.join(Inspec.config_dir, "config.json")
|
120
|
+
config_opts = default_path
|
121
|
+
return unless File.exist?(config_opts)
|
122
|
+
elsif !File.exist?(config_opts)
|
123
|
+
invocation_data[:validation_errors] << "Could not read configuration file at #{config_opts}"
|
124
|
+
return
|
125
|
+
end
|
126
|
+
@config_content = File.open(config_opts).read
|
127
|
+
end
|
128
|
+
|
129
|
+
reporter_config = JSON.parse(config_content)["reporter"] unless config_content.nil? || config_content.empty?
|
130
|
+
unless reporter_config
|
131
|
+
invocation_data[:validation_errors] << "Config should have reporter option specified for each invocation which is not using --reporter option in options file"
|
132
|
+
end
|
133
|
+
@config_content
|
134
|
+
end
|
135
|
+
|
136
|
+
def check_for_piped_config_from_stdin(config_opts)
|
137
|
+
return nil unless config_opts
|
138
|
+
return nil unless config_opts == "-"
|
139
|
+
|
140
|
+
@stdin_config ||= STDIN
|
141
|
+
end
|
142
|
+
|
143
|
+
## Utility functions
|
144
|
+
|
145
|
+
# Parse the invocation string using Thor into Thor options
|
146
|
+
# This approach was reverse engineered from studying
|
147
|
+
# https://github.com/rails/thor/blob/ab3b5be455791f4efb79f0efb4f88cc6b59c8ccf/lib/thor/base.rb#L53
|
148
|
+
|
149
|
+
def convert_cli_to_thor_options(invocation_data)
|
150
|
+
invocation_words = invocation_data[:value].split(" ")
|
151
|
+
|
152
|
+
# LIMITATION: this approach is limited to having exactly one profile in the invocation
|
153
|
+
args = [invocation_words.shift] # That is, the profile path
|
154
|
+
|
155
|
+
# Here we're piggybacking on on a hook used by the start() method, and provides the
|
156
|
+
# specifics for the subcommand
|
157
|
+
config = { command_options: thor_options_for_sub_cmd }
|
158
|
+
|
159
|
+
# This performs the parse
|
160
|
+
thor = Inspec::InspecCLI.new(args, invocation_words, config)
|
161
|
+
|
162
|
+
# A hash (with indifferent access) of option names to option config data
|
163
|
+
invocation_data[:thor_opts] = thor.options
|
164
|
+
|
165
|
+
# A list of everything else it could not parse, including the profile
|
166
|
+
invocation_data[:thor_args] = thor.args
|
167
|
+
end
|
168
|
+
end
|
169
|
+
end
|
170
|
+
end
|
@@ -0,0 +1,18 @@
|
|
1
|
+
module InspecPlugins
|
2
|
+
module Parallelism
|
3
|
+
class Plugin < ::Inspec.plugin(2)
|
4
|
+
plugin_name :"inspec-parallel"
|
5
|
+
|
6
|
+
cli_command :parallel do
|
7
|
+
require_relative "inspec-parallel/cli"
|
8
|
+
InspecPlugins::Parallelism::CLI
|
9
|
+
end
|
10
|
+
|
11
|
+
streaming_reporter :"child-status" do
|
12
|
+
require_relative "inspec-parallel/child_status_reporter"
|
13
|
+
InspecPlugins::Parallelism::StreamingReporter
|
14
|
+
end
|
15
|
+
|
16
|
+
end
|
17
|
+
end
|
18
|
+
end
|
@@ -32,15 +32,22 @@ module InspecPlugins
|
|
32
32
|
def self.keygen(options)
|
33
33
|
key = KEY_ALG.new KEY_BITS
|
34
34
|
|
35
|
-
|
35
|
+
# config_dir is the directory where the keys will be stored.
|
36
|
+
# options["config_dir"] is passed explicitly only for testing purposes.
|
37
|
+
config_dir = options["config_dir"] || Inspec.config_dir
|
38
|
+
path = File.join(config_dir, "keys")
|
36
39
|
FileUtils.mkdir_p(path)
|
37
40
|
|
38
41
|
puts "Generating signing key in #{path}/#{options["keyname"]}.pem.key"
|
39
|
-
|
42
|
+
# https://github.com/inspec/inspec/security/code-scanning/1
|
43
|
+
# https://github.com/inspec/inspec/security/code-scanning/2
|
44
|
+
# The following line was flagged by GitHub code scanning as a security vulnerability.
|
45
|
+
# Update the code to eliminate the vulnerability.
|
46
|
+
File.open("#{path}/#{options["keyname"]}.pem.key", "w") do |io|
|
40
47
|
io.write key.to_pem
|
41
48
|
end
|
42
49
|
puts "Generating validation key in #{path}/#{options["keyname"]}.pem.pub"
|
43
|
-
open
|
50
|
+
File.open("#{path}/#{options["keyname"]}.pem.pub", "w") do |io|
|
44
51
|
io.write key.public_key.to_pem
|
45
52
|
end
|
46
53
|
end
|
@@ -54,7 +61,7 @@ module InspecPlugins
|
|
54
61
|
end
|
55
62
|
|
56
63
|
puts "Signing #{profile_path} with key #{options["keyname"]}"
|
57
|
-
keypath = Inspec::IafFile.find_signing_key(options["keyname"])
|
64
|
+
keypath = Inspec::IafFile.find_signing_key(options["keyname"], options["config_dir"])
|
58
65
|
|
59
66
|
# Read name and version from metadata and use them to form the filename
|
60
67
|
profile_md = artifact.read_profile_metadata(profile_path)
|
@@ -67,7 +74,8 @@ module InspecPlugins
|
|
67
74
|
# Generating tar.gz file using archive method of Inspec Cli
|
68
75
|
Inspec::InspecCLI.new.archive(profile_path, "error")
|
69
76
|
tarfile = "#{filename}.tar.gz"
|
70
|
-
|
77
|
+
# Update IO.binread with File.binread because of https://github.com/inspec/inspec/security/code-scanning/3
|
78
|
+
tar_content = File.binread(tarfile)
|
71
79
|
FileUtils.rm(tarfile)
|
72
80
|
|
73
81
|
# Generate the signature
|
@@ -92,12 +100,16 @@ module InspecPlugins
|
|
92
100
|
Inspec::UI.new.exit(:usage_error)
|
93
101
|
end
|
94
102
|
|
95
|
-
def self.profile_verify(signed_profile_path)
|
103
|
+
def self.profile_verify(signed_profile_path, silent = false)
|
96
104
|
file_to_verify = signed_profile_path
|
97
|
-
puts "Verifying #{file_to_verify}"
|
105
|
+
puts "Verifying #{file_to_verify}" unless silent
|
98
106
|
|
99
107
|
iaf_file = Inspec::IafFile.new(file_to_verify)
|
100
108
|
if iaf_file.valid?
|
109
|
+
# Signed profile verification is called from runner and not from CLI
|
110
|
+
# Do not exit and do not print logs
|
111
|
+
return if silent
|
112
|
+
|
101
113
|
puts "Detected format version '#{iaf_file.version}'"
|
102
114
|
puts "Attempting to verify using key '#{iaf_file.key_name}'"
|
103
115
|
puts "Profile is valid."
|
@@ -152,7 +164,7 @@ module InspecPlugins
|
|
152
164
|
ui.exit(:usage_error)
|
153
165
|
end
|
154
166
|
|
155
|
-
lines =
|
167
|
+
lines = File.readlines(p)
|
156
168
|
lines << "\nprofile_content_id: #{profile_content_id}\n"
|
157
169
|
|
158
170
|
File.open("#{p}", "w" ) do |f|
|
@@ -1,5 +1,6 @@
|
|
1
1
|
require_relative "base"
|
2
2
|
require "inspec/dist"
|
3
|
+
require "inspec/feature"
|
3
4
|
|
4
5
|
#
|
5
6
|
# Notes:
|
@@ -85,8 +86,10 @@ module InspecPlugins
|
|
85
86
|
option :keydir, type: :string, default: "./",
|
86
87
|
desc: "Directory to search for keys"
|
87
88
|
def generate_keys
|
88
|
-
|
89
|
-
|
89
|
+
Inspec.with_feature("inspec-cli-sign-generate-keys") {
|
90
|
+
puts "Generating keys"
|
91
|
+
InspecPlugins::Sign::Base.keygen(options)
|
92
|
+
}
|
90
93
|
end
|
91
94
|
|
92
95
|
desc "profile PATH", "sign the profile in PATH and generate .iaf artifact."
|
@@ -95,12 +98,16 @@ module InspecPlugins
|
|
95
98
|
option :profile_content_id, type: :string,
|
96
99
|
desc: "UUID of the profile. This will write the profile_content_id in the metadata file if it does not already exist in the metadata file."
|
97
100
|
def profile(profile_path)
|
98
|
-
|
101
|
+
Inspec.with_feature("inspec-cli-sign-profile") {
|
102
|
+
InspecPlugins::Sign::Base.profile_sign(profile_path, options)
|
103
|
+
}
|
99
104
|
end
|
100
105
|
|
101
106
|
desc "verify PATH", "Verify a signed profile .iaf artifact at given path."
|
102
107
|
def verify(signed_profile_path)
|
103
|
-
|
108
|
+
Inspec.with_feature("inspec-cli-sign-verify") {
|
109
|
+
InspecPlugins::Sign::Base.profile_verify(signed_profile_path)
|
110
|
+
}
|
104
111
|
end
|
105
112
|
end
|
106
113
|
end
|
@@ -91,23 +91,20 @@ module InspecPlugins::StreamingReporterProgressBar
|
|
91
91
|
|
92
92
|
set_status_mapping(control_id, status)
|
93
93
|
collect_notifications(notification, control_id, status)
|
94
|
-
|
95
|
-
if control_ended
|
96
|
-
control_outcome = add_enhanced_outcomes(control_id) if enhanced_outcomes
|
97
|
-
show_progress(control_id, title, full_description, control_outcome)
|
98
|
-
end
|
94
|
+
show_progress(control_id, title, full_description) if control_ended?(notification, control_id)
|
99
95
|
end
|
100
96
|
|
101
|
-
def show_progress(control_id, title, full_description
|
97
|
+
def show_progress(control_id, title, full_description)
|
102
98
|
@bar ||= ProgressBar.new(controls_count, :bar, :counter, :percentage)
|
103
99
|
sleep 0.1
|
104
100
|
@bar.increment!
|
105
|
-
@bar.puts format_it(control_id, title, full_description
|
101
|
+
@bar.puts format_it(control_id, title, full_description)
|
106
102
|
rescue StandardError => e
|
107
103
|
raise "Exception in Progress Bar streaming reporter: #{e}"
|
108
104
|
end
|
109
105
|
|
110
|
-
def format_it(control_id, title, full_description
|
106
|
+
def format_it(control_id, title, full_description)
|
107
|
+
control_outcome = control_outcome(control_id)
|
111
108
|
if control_outcome
|
112
109
|
control_status = control_outcome
|
113
110
|
else
|
@@ -121,11 +118,7 @@ module InspecPlugins::StreamingReporterProgressBar
|
|
121
118
|
end
|
122
119
|
end
|
123
120
|
indicator = INDICATORS[control_status]
|
124
|
-
message_to_format =
|
125
|
-
message_to_format += "#{indicator} "
|
126
|
-
message_to_format += "#{control_id.to_s.strip.dup.force_encoding(Encoding::UTF_8)} "
|
127
|
-
message_to_format += "#{title.gsub(/\n*\s+/, " ").to_s.force_encoding(Encoding::UTF_8)} " if title
|
128
|
-
message_to_format += "#{full_description.gsub(/\n*\s+/, " ").to_s.force_encoding(Encoding::UTF_8)} " unless title
|
121
|
+
message_to_format = format_message(indicator, control_id, title, full_description)
|
129
122
|
format_with_color(control_status, message_to_format)
|
130
123
|
rescue Exception => e
|
131
124
|
raise "Exception in show_progress: #{e}"
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: inspec-core
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 6.8.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Chef InSpec Team
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-07-25 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: chef-telemetry
|
@@ -119,7 +119,7 @@ dependencies:
|
|
119
119
|
version: '3.9'
|
120
120
|
- - "<="
|
121
121
|
- !ruby/object:Gem::Version
|
122
|
-
version: '3.
|
122
|
+
version: '3.14'
|
123
123
|
type: :runtime
|
124
124
|
prerelease: false
|
125
125
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -129,7 +129,7 @@ dependencies:
|
|
129
129
|
version: '3.9'
|
130
130
|
- - "<="
|
131
131
|
- !ruby/object:Gem::Version
|
132
|
-
version: '3.
|
132
|
+
version: '3.14'
|
133
133
|
- !ruby/object:Gem::Dependency
|
134
134
|
name: rspec-its
|
135
135
|
requirement: !ruby/object:Gem::Requirement
|
@@ -325,7 +325,7 @@ dependencies:
|
|
325
325
|
version: '1.5'
|
326
326
|
- - "<"
|
327
327
|
- !ruby/object:Gem::Version
|
328
|
-
version: '
|
328
|
+
version: '2.0'
|
329
329
|
type: :runtime
|
330
330
|
prerelease: false
|
331
331
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -335,7 +335,7 @@ dependencies:
|
|
335
335
|
version: '1.5'
|
336
336
|
- - "<"
|
337
337
|
- !ruby/object:Gem::Version
|
338
|
-
version: '
|
338
|
+
version: '2.0'
|
339
339
|
- !ruby/object:Gem::Dependency
|
340
340
|
name: semverse
|
341
341
|
requirement: !ruby/object:Gem::Requirement
|
@@ -382,30 +382,50 @@ dependencies:
|
|
382
382
|
name: train-core
|
383
383
|
requirement: !ruby/object:Gem::Requirement
|
384
384
|
requirements:
|
385
|
-
- - "
|
385
|
+
- - ">="
|
386
386
|
- !ruby/object:Gem::Version
|
387
|
-
version:
|
387
|
+
version: 3.11.0
|
388
388
|
type: :runtime
|
389
389
|
prerelease: false
|
390
390
|
version_requirements: !ruby/object:Gem::Requirement
|
391
391
|
requirements:
|
392
|
-
- - "
|
392
|
+
- - ">="
|
393
|
+
- !ruby/object:Gem::Version
|
394
|
+
version: 3.11.0
|
395
|
+
- !ruby/object:Gem::Dependency
|
396
|
+
name: chef-licensing
|
397
|
+
requirement: !ruby/object:Gem::Requirement
|
398
|
+
requirements:
|
399
|
+
- - ">="
|
400
|
+
- !ruby/object:Gem::Version
|
401
|
+
version: 1.0.2
|
402
|
+
type: :runtime
|
403
|
+
prerelease: false
|
404
|
+
version_requirements: !ruby/object:Gem::Requirement
|
405
|
+
requirements:
|
406
|
+
- - ">="
|
393
407
|
- !ruby/object:Gem::Version
|
394
|
-
version:
|
395
|
-
description:
|
396
|
-
You can use it for integration or even compliance testing. Create fully portable
|
397
|
-
test profiles and use them in your workflow to ensure stability and security. Integrate
|
398
|
-
InSpec in your change lifecycle for local testing, CI/CD, and deployment verification.
|
408
|
+
version: 1.0.2
|
409
|
+
description: |+
|
410
|
+
InSpec provides a framework for creating end-to-end infrastructure tests. You can use it for integration or even compliance testing. Create fully portable test profiles and use them in your workflow to ensure stability and security. Integrate InSpec in your change lifecycle for local testing, CI/CD, and deployment verification.
|
399
411
|
This has local support only. See the `inspec` gem for full support.
|
412
|
+
|
413
|
+
Packaged distributions of Progress® Chef® products obtained from RubyGems are made available pursuant to the Progress Chef EULA at https://www.chef.io/end-user-license-agreement, unless there is an executed agreement in effect between you and Progress that covers the Progress Chef products ("Master Agreement"), in which case the Master Agreement shall govern.
|
414
|
+
|
415
|
+
Source code obtained from the Chef GitHub repository is made available under Apache-2.0, a copy of which is included.
|
416
|
+
|
400
417
|
email:
|
401
418
|
- inspec@chef.io
|
402
419
|
executables: []
|
403
420
|
extensions: []
|
404
421
|
extra_rdoc_files: []
|
405
422
|
files:
|
423
|
+
- Chef-EULA
|
406
424
|
- Gemfile
|
407
425
|
- LICENSE
|
408
426
|
- etc/deprecations.json
|
427
|
+
- etc/features.sig
|
428
|
+
- etc/features.yaml
|
409
429
|
- etc/keys/progress-2022-05-04.pem.pub
|
410
430
|
- etc/plugin_filters.json
|
411
431
|
- inspec-core.gemspec
|
@@ -448,6 +468,9 @@ files:
|
|
448
468
|
- lib/inspec/errors.rb
|
449
469
|
- lib/inspec/exceptions.rb
|
450
470
|
- lib/inspec/expect.rb
|
471
|
+
- lib/inspec/feature.rb
|
472
|
+
- lib/inspec/feature/config.rb
|
473
|
+
- lib/inspec/feature/runner.rb
|
451
474
|
- lib/inspec/fetcher.rb
|
452
475
|
- lib/inspec/fetcher/git.rb
|
453
476
|
- lib/inspec/fetcher/local.rb
|
@@ -650,6 +673,8 @@ files:
|
|
650
673
|
- lib/inspec/resources/service.rb
|
651
674
|
- lib/inspec/resources/shadow.rb
|
652
675
|
- lib/inspec/resources/ssh_config.rb
|
676
|
+
- lib/inspec/resources/ssh_key.rb
|
677
|
+
- lib/inspec/resources/sshd_active_config.rb
|
653
678
|
- lib/inspec/resources/sshd_config.rb
|
654
679
|
- lib/inspec/resources/ssl.rb
|
655
680
|
- lib/inspec/resources/sybase_conf.rb
|
@@ -724,6 +749,7 @@ files:
|
|
724
749
|
- lib/inspec/utils/install_context.rb
|
725
750
|
- lib/inspec/utils/json_log.rb
|
726
751
|
- lib/inspec/utils/json_profile_summary.rb
|
752
|
+
- lib/inspec/utils/licensing_config.rb
|
727
753
|
- lib/inspec/utils/modulator.rb
|
728
754
|
- lib/inspec/utils/nginx_parser.rb
|
729
755
|
- lib/inspec/utils/object_traversal.rb
|
@@ -736,9 +762,9 @@ files:
|
|
736
762
|
- lib/inspec/utils/spdx.rb
|
737
763
|
- lib/inspec/utils/spdx.txt
|
738
764
|
- lib/inspec/utils/telemetry.rb
|
739
|
-
- lib/inspec/utils/telemetry/
|
740
|
-
- lib/inspec/utils/telemetry/
|
741
|
-
- lib/inspec/utils/telemetry/
|
765
|
+
- lib/inspec/utils/telemetry/base.rb
|
766
|
+
- lib/inspec/utils/telemetry/http.rb
|
767
|
+
- lib/inspec/utils/telemetry/null.rb
|
742
768
|
- lib/inspec/utils/telemetry/run_context_probe.rb
|
743
769
|
- lib/inspec/utils/waivers/csv_file_reader.rb
|
744
770
|
- lib/inspec/utils/waivers/excel_file_reader.rb
|
@@ -808,6 +834,22 @@ files:
|
|
808
834
|
- lib/plugins/inspec-init/templates/resources/basic/libraries/inspec-resource-template.erb
|
809
835
|
- lib/plugins/inspec-init/templates/resources/plural/docs/resource-doc.erb
|
810
836
|
- lib/plugins/inspec-init/templates/resources/plural/libraries/inspec-resource-template.erb
|
837
|
+
- lib/plugins/inspec-license/README.md
|
838
|
+
- lib/plugins/inspec-license/inspec-license.gemspec
|
839
|
+
- lib/plugins/inspec-license/lib/inspec-license.rb
|
840
|
+
- lib/plugins/inspec-license/lib/inspec-license/cli.rb
|
841
|
+
- lib/plugins/inspec-parallel/README.md
|
842
|
+
- lib/plugins/inspec-parallel/inspec-parallel.gemspec
|
843
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel.rb
|
844
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/child_status_reporter.rb
|
845
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/cli.rb
|
846
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/command.rb
|
847
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/runner.rb
|
848
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/base.rb
|
849
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/silent.rb
|
850
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/status.rb
|
851
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/super_reporter/text.rb
|
852
|
+
- lib/plugins/inspec-parallel/lib/inspec-parallel/validator.rb
|
811
853
|
- lib/plugins/inspec-plugin-manager-cli/README.md
|
812
854
|
- lib/plugins/inspec-plugin-manager-cli/inspec-plugin-manager-cli.gemspec
|
813
855
|
- lib/plugins/inspec-plugin-manager-cli/lib/inspec-plugin-manager-cli.rb
|
@@ -851,7 +893,7 @@ files:
|
|
851
893
|
- lib/source_readers/inspec.rb
|
852
894
|
homepage: https://github.com/inspec/inspec
|
853
895
|
licenses:
|
854
|
-
-
|
896
|
+
- LicenseRef-Chef-EULA
|
855
897
|
metadata: {}
|
856
898
|
post_install_message:
|
857
899
|
rdoc_options: []
|
@@ -861,7 +903,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
861
903
|
requirements:
|
862
904
|
- - ">="
|
863
905
|
- !ruby/object:Gem::Version
|
864
|
-
version:
|
906
|
+
version: 3.1.0
|
865
907
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
866
908
|
requirements:
|
867
909
|
- - ">="
|