inspec-core 7.0.107 → 7.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45c2a8606fc27e3246476e86b6d87ab22b5e9b0ea8f85d8381e71a5b74d1b0d0
-  data.tar.gz: af209e2f16b169913314c0aee8bd2c4ed0a05d92a187ad421ef81c6a22d3cc26
+  metadata.gz: ed63ed9529571a4192cc3d69253bb303cddb5f6c07dd7f6c5009846e20fc2d74
+  data.tar.gz: e3f693766b0698bba07fc6ae2e823a51993484d88cd5f309dd83b6dd832a55d4
 SHA512:
-  metadata.gz: 5e15e616ac53c257b7f3b23744745798cb22fbaa91ff6668140bf40ecfee92da7931e31949429fe337984c8716538ff84c8ca03acbcf9303fc93d45b20a3f4df
-  data.tar.gz: 63064836ca735a8ab3dfe01ccfb4c2cdc791dbf9474e2eff83df893ad04ef79979f5850bc7536967b5b2d871d31ad4cbc0ef61aa1ca92dbcde30eeef72a00fd2
+  metadata.gz: 3c0bc69773b1376970e84b073b556731af530f4706779f5c5ccf3807a6ca5ba4e55a747f08581bb001ed796468108b0080df8197f8484d7a43594d3c4410e3c2
+  data.tar.gz: ee83f8a1efd8aca287f1c9fb426083cc1245f1174252747a1a88cb8c6c488d939b2797c415498a54bb4297249ca09ae43618f0a02e55c5fe7dcfee18cf821148

data/Gemfile

@@ -43,14 +43,12 @@ group :test do
   gem "m"
   gem "minitest-sprint", "~> 1.0"
   gem "minitest"
-  # Ruby 3.4+ extracts minitest-mock to a separate gem (bundled gem)
-  # Adding unconditionally as it's compatible with all Ruby versions
-  gem "minitest-mock"
+  gem "minitest-mock" # Ruby 3.4+ extracts minitest-mock to a separate gem (bundled gem). It's compatible with all Ruby versions.
   gem "mocha"
   gem "nokogiri"
   gem "pry-byebug"
   gem "pry"
-  gem "rake"
+  gem "rake", ">= 12.3.3"
   gem "simplecov"
   gem "simplecov_json_formatter"
   gem "webmock"

data/etc/deprecations.json

@@ -130,6 +130,9 @@
     "renamed_to_inspec_export":{
       "action": "ignore",
       "prefix": "The `inspec json` command is deprecated in InSpec 5 and replaced with `inspec export` command."
+    },
+    "cli_option_compliance_overwrite": {
+      "action": "warn"
     }
   },
   "fallback_resource_packs":{
@@ -141,7 +144,7 @@
       "gem":"inspec-elasticsearch-resources",
       "message":"The `inspec-elasticsearch-resources` allows testing of elasticsearch using Inspec."
     },
-    "docker.+":{
+    "docker.*":{
       "gem": "inspec-docker-resources",
       "message": "The Inspec docker resources are moved out of InSpec core and will be installed as gem"
     },
@@ -157,7 +160,7 @@
       "gem": "inspec-opa-resources",
       "message": "The Inspec opa resources are moved out of InSpec core and will be installed as gem"
     },
-    "podman.+":{
+    "podman.*":{
       "gem": "inspec-podman-resources",
       "message": "The Inspec podman resources are moved out of InSpec core and will be installed as gem"
     },

data/etc/env.default.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Default environment variables for InSpec development
+# Copy this file to etc/env.sh and uncomment/customize values as needed
+# NEVER commit etc/env.sh to git
+
+# The GitHub repo path for shared-context with optional branch specification
+# export PROGRESS_SHARED_CONTEXT_REPO="progress-infra-poc/shared-context@main"

data/etc/reference-repos.txt

@@ -0,0 +1,2 @@
+inspec/train
+inspec/train-winrm

data/inspec-core.gemspec

@@ -50,7 +50,7 @@ Source code obtained from the Chef GitHub repository is made available under Apa
   spec.add_dependency "tty-table",                "~> 0.10"
   spec.add_dependency "tty-prompt",               "~> 0.17"
   spec.add_dependency "tomlrb",                   ">= 1.3", "< 2.1"
-  spec.add_dependency "addressable",              "~> 2.4"
+  spec.add_dependency "addressable",              "~> 2.9"
   spec.add_dependency "parslet",                  ">= 1.5", "< 3.0" # Pinned < 2.0, see #5389
   spec.add_dependency "semverse",                 "~> 3.0"
   spec.add_dependency "multipart-post",           "~> 2.0"
@@ -68,7 +68,7 @@ Source code obtained from the Chef GitHub repository is made available under Apa
   # which was causing a LoadError ('cannot load such file -- ast') for users/applications using 'inspec-core'.
   spec.add_dependency "cookstyle"
 
-  spec.add_dependency "train-core", "~> 3.16", ">= 3.16.1"
+  spec.add_dependency "train-core", "~> 3.16", ">= 3.16.5"
   # Minimum major version 1 is required for Chef licensing telemetry
   spec.add_dependency "chef-licensing", ">= 1.2.0"
 end

data/lib/inspec/iaf_file.rb

@@ -45,7 +45,7 @@ module Inspec
 
     def self.fetch_validation_key_from_github(keyname)
       URI.open("https://raw.githubusercontent.com/inspec/inspec/main/etc/keys/#{keyname}.pem.pub") do |r|
-        puts "Fetching validation key '#{keyname}' from github"
+        Inspec::Log.debug "Fetching validation key '#{keyname}' from github"
         dir = File.join(Inspec.config_dir, "keys")
         FileUtils.mkdir_p dir
         key_file = File.join(dir, "#{keyname}.pem.pub")

data/lib/inspec/reporters/json.rb

@@ -55,6 +55,11 @@ module Inspec::Reporters
     def extract_resource_id(r)
       # According to the RunData API, this is supposed to be an anonymous
       # class that represents a resource, with embedded instance methods....
+      # Prefer resource object if present and exposes resource_id
+      resource_candidate = r[:resource]
+      return resource_candidate.resource_id if resource_candidate.respond_to?(:resource_id)
+
+      # Fall back to resource_title
       resource_obj = r[:resource_title]
       return resource_obj.resource_id if resource_obj.respond_to?(:resource_id)
 
@@ -62,8 +67,13 @@ module Inspec::Reporters
       if resource_obj.is_a?(String)
         orig_str = resource_obj
         # Try to trim off the resource class - eg "File /some/path" => "/some/path"
-        trimmed_str = orig_str.sub(/^#{r[:resource_class]}/i, "").strip
-        trimmed_str.empty? ? orig_str : trimmed_str
+        resource_class = r[:resource_class].to_s
+        trimmed_str = orig_str.sub(/^#{Regexp.escape(resource_class)}/i, "").strip
+
+        # Cap the resource_id to a reasonable length to avoid bloating reports
+        max_length = 256
+        candidate = trimmed_str.empty? ? orig_str : trimmed_str
+        candidate.length > max_length ? candidate[0, max_length] : candidate
       else
         # Boo, InSpec is crazy, and we don't know what it possibly could be.
         # Failsafe for resource_id is empty string.

data/lib/inspec/resources/mssql_session.rb

@@ -30,9 +30,15 @@ module Inspec::Resources
         its('value') { should_not be_empty }
         its('value') { should cmp == 1 }
       end
+
+      # Trust the SQL Server TLS certificate when using sqlcmd
+      sql_tls = mssql_session(user: 'myuser', password: 'mypassword', trust_server_certificate: true)
+      describe sql_tls.query(\"SELECT SERVERPROPERTY('ProductVersion') as \\\"version\\\";\").row(0).column('version') do
+        its('value') { should_not be_empty }
+      end
     EXAMPLE
 
-    attr_reader :user, :password, :host, :port, :instance, :local_mode, :db_name
+    attr_reader :user, :password, :host, :port, :instance, :local_mode, :db_name, :trust_server_certificate
     def initialize(opts = {})
       @user = opts[:user]
       @password = opts[:password] || opts[:pass]
@@ -46,6 +52,7 @@ module Inspec::Resources
       end
       @instance = opts[:instance]
       @db_name = opts[:db_name]
+      @trust_server_certificate = !!opts[:trust_server_certificate] # rubocop:disable Style/DoubleNegation
 
       # check if sqlcmd is available
       raise Inspec::Exceptions::ResourceSkipped, "sqlcmd is missing" unless inspec.command("sqlcmd").exist?
@@ -57,6 +64,7 @@ module Inspec::Resources
       escaped_query = q.gsub(/\\/, "\\\\").gsub(/"/, '""').gsub(/\$/, '\\$')
       # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
       cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
+      cmd_string += " -C" if trust_server_certificate?
       cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
       cmd_string += " -d '#{@db_name}'" unless @db_name.nil?
       unless local_mode?
@@ -94,6 +102,10 @@ module Inspec::Resources
       !!@local_mode # rubocop:disable Style/DoubleNegation
     end
 
+    def trust_server_certificate?
+      @trust_server_certificate
+    end
+
     def test_connection
       !query("select getdate()").empty?
     end

data/lib/inspec/resources/package.rb

@@ -376,8 +376,15 @@ module Inspec::Resources
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
       ]
 
-      # add 64 bit search paths
-      if inspec.os.arch == "x86_64"
+      # Add WOW6432Node paths for 32-bit apps on 64-bit Windows.
+      # Include these unless the system is explicitly 32-bit (i386) — on 32-bit
+      # Windows, WOW6432Node does not exist since all apps register under the
+      # main Uninstall key.
+      # When os.arch is nil (e.g., train falls back to read_cmd_os in a PowerShell
+      # WinRM session where %PROCESSOR_ARCHITECTURE% is not expanded), we still
+      # include the WOW6432Node paths since virtually all modern Windows systems
+      # are 64-bit.
+      unless inspec.os.arch == "i386"
         search_paths << 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
         search_paths << 'HKCU:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
       end

data/lib/inspec/rule.rb

@@ -48,12 +48,23 @@ module Inspec
       return unless block_given?
 
       begin
-        instance_eval(&block)
-
-        # By applying waivers *after* the instance eval, we assure that
-        # waivers have higher precedence than only_if.
+        # Pre-check: apply waivers before evaluating the control block.
+        # If the control is waived with run: false, skip the block entirely
+        # to avoid eager resource evaluation (e.g., `command('find /').stdout`
+        # executing expensive commands for waived controls).
         __apply_waivers
 
+        unless @__skip_rule[:result] && @__skip_rule[:type] == :waiver
+          instance_eval(&block)
+
+          # Re-apply waivers after instance eval. This is a no-op in practice:
+          # run:false waivers are already handled by the pre-check above (the
+          # unless guard prevents instance_eval from running at all), and
+          # run:true / no-run-key waivers do not set a skip flag. Kept for
+          # defensive correctness in case waiver state changes during eval.
+          __apply_waivers
+        end
+
       rescue SystemStackError, StandardError => e
         # We've encountered an exception while trying to eval the code inside the
         # control block. We need to prevent the exception from bubbling up, and

data/lib/inspec/utils/install_context.rb

@@ -6,7 +6,6 @@ module Inspec
     def guess_install_context
       # These all work by simple path recognition
       return "chef-workstation" if chef_workstation_install?
-      return "omnibus" if omnibus_install?
       return "chefdk" if chefdk_install?
       return "habitat" if habitat_install?
 
@@ -36,10 +35,6 @@ module Inspec
       !!src_root.match(%r{hab/pkgs/chef/inspec/\d+\.\d+\.\d+/\d{14}})
     end
 
-    def omnibus_install?
-      !!(src_root.start_with?("/opt/inspec") || src_root.start_with?("C:/opscode/inspec"))
-    end
-
     def rubygem_install?
       !!src_root.match(%r{gems/inspec-\d+\.\d+\.\d+})
     end

data/lib/inspec/utils/profile_ast_helpers.rb

@@ -24,6 +24,37 @@ module Inspec
           @memo = memo
         end
 
+        def extract_node_value(node)
+          case node.class.to_s
+          when "RuboCop::AST::HashNode"
+            # Handle hash nodes
+            values = {}
+            node.children.each do |pair_node|
+              values.merge!(pair_node.key.value => extract_node_value(pair_node.value))
+            end
+            values
+          when "RuboCop::AST::ArrayNode"
+            # Handle array nodes
+            node.children.map { |element| extract_node_value(element) }
+          else
+            # Handle simple nodes (strings, numbers, symbols, booleans, nil, etc.)
+            if node.respond_to?(:type)
+              case node.type
+              when :true
+                true
+              when :false
+                false
+              when :nil
+                nil
+              else
+                node.respond_to?(:value) ? node.value : node
+              end
+            else
+              node.respond_to?(:value) ? node.value : node
+            end
+          end
+        end
+
         def collect_input(input_children)
           input_name = input_children.children[2].value
 
@@ -39,15 +70,9 @@ module Inspec
                 if VALID_INPUT_OPTIONS.include?(child_node.key.value)
                   if child_node.value.class == RuboCop::AST::Node && REQUIRED_VALUES_MAP.key?(child_node.value.type)
                     opts.merge!(child_node.key.value => REQUIRED_VALUES_MAP[child_node.value.type])
-                  elsif child_node.value.class == RuboCop::AST::HashNode
-                    # Here value will be a hash
-                    values = {}
-                    child_node.value.children.each do |grand_child_node|
-                      values.merge!(grand_child_node.key.value => grand_child_node.value.value)
-                    end
-                    opts.merge!(child_node.key.value => values)
                   else
-                    opts.merge!(child_node.key.value => child_node.value.value)
+                    # Use the helper method to recursively extract values from any node type
+                    opts.merge!(child_node.key.value => extract_node_value(child_node.value))
                   end
                 end
               end
@@ -313,8 +338,11 @@ module Inspec
             collectors.push InputCollectorWithinControlBlock.new(@memo)
             collectors.push TestsCollector.new(control_data) if include_tests
 
-            begin_block.each_node do |node_within_control|
-              collectors.each { |collector| collector.process(node_within_control) }
+            # Handle empty control blocks (e.g., control "id" do end)
+            if begin_block
+              begin_block.each_node do |node_within_control|
+                collectors.each { |collector| collector.process(node_within_control) }
+              end
             end
 
             memo[:controls].push control_data

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "7.0.107".freeze
+  VERSION = "7.2.1".freeze
 end

data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb

@@ -140,6 +140,10 @@ module InspecPlugins
         desc: "Enable legacy functionality, activating both legacy export and legacy check."
       def upload(path) # rubocop:disable Metrics/MethodLength, Metrics/AbcSize, Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
         Inspec.with_feature("inspec-cli-compliance-upload") {
+          if options["overwrite"]
+            Inspec.deprecate(:cli_option_compliance_overwrite, "The --overwrite option is deprecated because it does not work with Automate as expected.")
+          end
+
           config = InspecPlugins::Compliance::Configuration.new
           return unless loggedin(config)
 

data/lib/plugins/inspec-habitat/lib/inspec-habitat/profile.rb

@@ -57,7 +57,7 @@ module InspecPlugins
         path = profile.root_path
         logger.debug("Setting up #{path} for Habitat...")
 
-        plan_file = File.join(path, "habitat", "plan.sh")
+        plan_file = File.join(path, "habitat", "x86_64-linux", "plan.sh")
         logger.info("Generating Habitat plan at #{plan_file}...")
         vars = {
           profile: profile,

data/lib/plugins/inspec-plugin-manager-cli/lib/inspec-plugin-manager-cli/cli_command.rb

@@ -426,7 +426,7 @@ module InspecPlugins
                  "at https://github.com/inspec/inspec/issues/new")
         ui.exit Inspec::UI::EXIT_PLUGIN_ERROR
       rescue Inspec::Plugin::V2::InstallError => e
-        # This change is required for Ruby 3.3 upgrade
+        # This change is compatible with various versions of Ruby, including Ruby 3.3
         # Using Inspec::Log::level breaks with error `undefined method nil` in Ruby log library
         Inspec::Log.debug e.backtrace
 

data/lib/source_readers/gem.rb

@@ -7,7 +7,11 @@ module SourceReaders
     priority 20
 
     def self.resolve(target)
-      return new(target) unless target.files.grep(/gemspec/).empty?
+      # Only match if gemspec is at root level, not in vendor directories
+      # This prevents archived/vendored profiles from being treated as gem profiles
+      gemspec_files = target.files.grep(/gemspec/)
+      root_gemspec = gemspec_files.reject { |f| f.start_with?("vendor/") }
+      return new(target) unless root_gemspec.empty?
 
       nil
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 7.0.107
+  version: 7.2.1
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-02-20 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-telemetry
@@ -314,14 +314,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.9'
 - !ruby/object:Gem::Dependency
   name: parslet
   requirement: !ruby/object:Gem::Requirement
@@ -441,7 +441,7 @@ dependencies:
         version: '3.16'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.16.1
+        version: 3.16.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -451,7 +451,7 @@ dependencies:
         version: '3.16'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.16.1
+        version: 3.16.5
 - !ruby/object:Gem::Dependency
   name: chef-licensing
   requirement: !ruby/object:Gem::Requirement
@@ -484,10 +484,12 @@ files:
 - Gemfile
 - LICENSE
 - etc/deprecations.json
+- etc/env.default.sh
 - etc/features.sig
 - etc/features.yaml
 - etc/keys/progress-2022-05-04.pem.pub
 - etc/plugin_filters.json
+- etc/reference-repos.txt
 - inspec-core.gemspec
 - lib/bundles/README.md
 - lib/bundles/inspec-compliance/api.rb