inspec-core 7.1.7 → 7.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d615f8a9108fd5631217d136cb8b29e8d1c44f6b049a53c2618907df84876fa8
-  data.tar.gz: 7745773bd58acc11ac0d8acc9cf7c7e3d1bcb945556a6686514d441a6b8375e0
+  metadata.gz: e7a56ab7ed289f14adf2957f8407eb84cc71cb3b49bea6328dde51f544b1cad7
+  data.tar.gz: 633ee36ea973a2dd2edef07122f345d9120dd748edf30d8b1bd0847b8dd4d272
 SHA512:
-  metadata.gz: 4aad4bdd8864cb072120a838b7e342d4d667f24d30cb1a160627f125d6ab9968888f6dc30b0391fed5241afc81c75c4d3bea5868fa6d8f0b26e2847c899d1885
-  data.tar.gz: a2f4f3c01f19816fd77c65db3ac2a737d23093d71dac78ee82bbede8b39816f18efc6f94a5f7ae718533f065f9b87e9f577eeb42545f4b3fc5f75e4880ef8f98
+  metadata.gz: fcd8febd0b3e6b19fac35314ffcb7847dc9ddb08e5add9d9a43cd59e5544d18b3969b8273e16554ddb477b58746870d89c0ba6ac67c777c3c0cc821ff2cca4d1
+  data.tar.gz: e6ad048189427c994b6bd967c3f1aa4690013204523cf591ad9f6d274d61da922c28a7d6c3e0049b259b97ecda90186edc6e814fd24bc6b60b6f7d1b2ee52a81

data/Gemfile

@@ -43,9 +43,7 @@ group :test do
   gem "m"
   gem "minitest-sprint", "~> 1.0"
   gem "minitest"
-  # Ruby 3.4+ extracts minitest-mock to a separate gem (bundled gem)
-  # Adding unconditionally as it's compatible with all Ruby versions
-  gem "minitest-mock"
+  gem "minitest-mock" # Ruby 3.4+ extracts minitest-mock to a separate gem (bundled gem). It's compatible with all Ruby versions.
   gem "mocha"
   gem "nokogiri"
   gem "pry-byebug"

data/etc/deprecations.json

@@ -130,6 +130,9 @@
     "renamed_to_inspec_export":{
       "action": "ignore",
       "prefix": "The `inspec json` command is deprecated in InSpec 5 and replaced with `inspec export` command."
+    },
+    "cli_option_compliance_overwrite": {
+      "action": "warn"
     }
   },
   "fallback_resource_packs":{
@@ -141,7 +144,7 @@
       "gem":"inspec-elasticsearch-resources",
       "message":"The `inspec-elasticsearch-resources` allows testing of elasticsearch using Inspec."
     },
-    "docker.+":{
+    "docker.*":{
       "gem": "inspec-docker-resources",
       "message": "The Inspec docker resources are moved out of InSpec core and will be installed as gem"
     },
@@ -157,7 +160,7 @@
       "gem": "inspec-opa-resources",
       "message": "The Inspec opa resources are moved out of InSpec core and will be installed as gem"
     },
-    "podman.+":{
+    "podman.*":{
       "gem": "inspec-podman-resources",
       "message": "The Inspec podman resources are moved out of InSpec core and will be installed as gem"
     },

data/etc/env.default.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Default environment variables for InSpec development
+# Copy this file to etc/env.sh and uncomment/customize values as needed
+# NEVER commit etc/env.sh to git
+
+# The GitHub repo path for shared-context with optional branch specification
+# export PROGRESS_SHARED_CONTEXT_REPO="progress-infra-poc/shared-context@main"

data/etc/reference-repos.txt

@@ -0,0 +1,2 @@
+inspec/train
+inspec/train-winrm

data/inspec-core.gemspec

@@ -68,7 +68,7 @@ Source code obtained from the Chef GitHub repository is made available under Apa
   # which was causing a LoadError ('cannot load such file -- ast') for users/applications using 'inspec-core'.
   spec.add_dependency "cookstyle"
 
-  spec.add_dependency "train-core", "~> 3.16", ">= 3.16.1"
+  spec.add_dependency "train-core", "~> 3.16", ">= 3.16.5"
   # Minimum major version 1 is required for Chef licensing telemetry
   spec.add_dependency "chef-licensing", ">= 1.2.0"
 end

data/lib/inspec/archive/zip.rb

@@ -5,7 +5,7 @@ require "pathname" unless defined?(Pathname)
 module Inspec::Archive
   class ZipArchiveGenerator
     def archive(base_dir, files, archive)
-      Zip::File.open(archive, Zip::File::CREATE) do |zipfile|
+      Zip::File.open(archive, create: true) do |zipfile|
         files.each do |input_filename|
           zipfile.add(input_filename, Pathname.new(base_dir).join(input_filename))
         end

data/lib/inspec/file_provider.rb

@@ -171,7 +171,15 @@ module Inspec
           # extracted files do not conflict.
           FileUtils.remove_entry(final_path) if File.exist?(final_path)
 
-          archive.extract(file, final_path)
+          # rubyzip 3.x no longer creates missing intermediate directories by
+          # default, so do it ourselves.
+          FileUtils.mkdir_p(File.dirname(final_path))
+
+          # Passing an absolute entry_path alongside the default
+          # destination_directory ('.') makes rubyzip 3.x join them into a
+          # mangled, CWD-relative path. Pass destination_directory explicitly
+          # instead, and let the entry's own (relative) name resolve against it.
+          archive.extract(file, destination_directory: destination_path)
         end
       end
     end

data/lib/inspec/resources/oracledb_session.rb

@@ -66,11 +66,11 @@ module Inspec::Resources
       raise Inspec::Exceptions::ResourceFailed, "#{resource_exception_message}" if resource_failed?
 
       if @sqlcl_bin && inspec.command(@sqlcl_bin).exist?
-        @bin = @sqlcl_bin
+        @bin = "#{@sqlcl_bin} -s"
         format_options = "set sqlformat csv\nSET FEEDBACK OFF"
       else
         @bin = "#{@sqlplus_bin} -S"
-        format_options = "SET PAGESIZE 32000\nSET FEEDBACK OFF\nSET UNDERLINE OFF"
+        format_options = "SET MARKUP CSV ON\nSET PAGESIZE 32000\nSET FEEDBACK OFF\nSET UNDERLINE OFF"
       end
 
       command = command_builder(format_options, sql)
@@ -165,17 +165,21 @@ module Inspec::Resources
     end
 
     def parse_csv_result(stdout)
-      output = stdout.split("oracle_query_string")[-1]
-      # comma_query_sub replaces the csv delimiter "," in the output.
-      # Handles CSV parsing of data like this (DROP,3) etc
+      output = stdout.split("oracle_query_string")[-1].to_s.sub(/\r/, "").strip
+      return [] if output.empty?
 
-      output = output.sub(/\r/, "").strip.gsub(",", "comma_query_sub")
+      # sqlplus (SET MARKUP CSV / quoted output) and sqlcl (set sqlformat csv)
+      # both emit standard RFC 4180 CSV: a header row followed by data rows, with
+      # embedded commas/quotes/newlines quoted per the spec. Parse it directly so
+      # every column is addressable and commas inside quoted fields are preserved.
       converter = ->(header) { header.downcase }
-      CSV.parse(output, headers: true, header_converters: converter).map do |row|
-        next if row.entries.flatten.empty?
+      CSV.parse(output, headers: true, header_converters: converter).filter_map do |row|
+        hash = row.to_h
+        # Drop only truly empty parsed rows (no columns); keep rows whose values
+        # are nil/empty so callers can still index by row position.
+        next if hash.empty?
 
-        revised_row = row.entries.flatten.map { |entry| entry&.gsub("comma_query_sub", ",") }
-        Hashie::Mash.new([revised_row].to_h)
+        Hashie::Mash.new(hash)
       end
     end
 

data/lib/inspec/resources/package.rb

@@ -376,8 +376,15 @@ module Inspec::Resources
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
       ]
 
-      # add 64 bit search paths
-      if inspec.os.arch == "x86_64"
+      # Add WOW6432Node paths for 32-bit apps on 64-bit Windows.
+      # Include these unless the system is explicitly 32-bit (i386) — on 32-bit
+      # Windows, WOW6432Node does not exist since all apps register under the
+      # main Uninstall key.
+      # When os.arch is nil (e.g., train falls back to read_cmd_os in a PowerShell
+      # WinRM session where %PROCESSOR_ARCHITECTURE% is not expanded), we still
+      # include the WOW6432Node paths since virtually all modern Windows systems
+      # are 64-bit.
+      unless inspec.os.arch == "i386"
         search_paths << 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
         search_paths << 'HKCU:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
       end

data/lib/inspec/utils/telemetry/base.rb

@@ -59,7 +59,7 @@ module Inspec
                               os: safe_platform_field(train_platform, :name) || "unknown",
                               version: safe_platform_field(train_platform, :release) || "unknown",
                               architecture: safe_platform_field(train_platform, :arch) || "unknown",
-                              id: safe_platform_field(train_platform, :uuid),
+                              id: hash_to_uuid(safe_platform_field(train_platform, :uuid)),
                             },
 
                             runtime: Inspec::VERSION,
@@ -133,6 +133,38 @@ module Inspec
         platform.send(field)
       end
 
+      # Train's platform.uuid can return a raw 64-char hex identifier (e.g. a Docker
+      # container ID from /proc/self/mountinfo) instead of a proper UUID when running
+      # inside a container. Normalize such values into a valid RFC 4122 (v5-like) UUID
+      # so downstream consumers can always rely on the UUID format. Values that are
+      # already a valid UUID, or that don't match a 64-char hex string, are returned as-is.
+      def hash_to_uuid(value)
+        return nil if value.nil?
+
+        value_str = value.to_s
+        return nil if value_str.empty?
+
+        uuid_format = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/i
+        return value_str if value_str =~ uuid_format
+
+        hex_64_format = /^[0-9a-fA-F]{64}$/i
+        return value_str unless value_str =~ hex_64_format
+
+        bytes = value_str[0, 32].scan(/.{2}/).map { |byte| byte.to_i(16) }
+
+        time_low        = bytes[0..3].inject(0)   { |a, b| (a << 8) | b }
+        time_mid        = bytes[4..5].inject(0)   { |a, b| (a << 8) | b }
+        time_hi_version = bytes[6..7].inject(0)   { |a, b| (a << 8) | b }
+        clock_seq       = bytes[8..9].inject(0)   { |a, b| (a << 8) | b }
+        node            = bytes[10..15].inject(0) { |a, b| (a << 8) | b }
+
+        # Set version (5) and variant (RFC 4122) bits per the UUID spec
+        time_hi_version = (time_hi_version & 0x0FFF) | (5 << 12)
+        clock_seq       = (clock_seq & 0x3FFF) | 0x8000
+
+        format("%08x-%04x-%04x-%04x-%012x", time_low, time_mid, time_hi_version, clock_seq, node)
+      end
+
       def note_per_run_features(opts)
         note_all_invoked_features
         note_gem_dependency_usage(opts)

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "7.1.7".freeze
+  VERSION = "7.3.4".freeze
 end

data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb

@@ -140,6 +140,10 @@ module InspecPlugins
         desc: "Enable legacy functionality, activating both legacy export and legacy check."
       def upload(path) # rubocop:disable Metrics/MethodLength, Metrics/AbcSize, Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
         Inspec.with_feature("inspec-cli-compliance-upload") {
+          if options["overwrite"]
+            Inspec.deprecate(:cli_option_compliance_overwrite, "The --overwrite option is deprecated because it does not work with Automate as expected.")
+          end
+
           config = InspecPlugins::Compliance::Configuration.new
           return unless loggedin(config)
 

data/lib/source_readers/gem.rb

@@ -7,7 +7,11 @@ module SourceReaders
     priority 20
 
     def self.resolve(target)
-      return new(target) unless target.files.grep(/gemspec/).empty?
+      # Only match if gemspec is at root level, not in vendor directories
+      # This prevents archived/vendored profiles from being treated as gem profiles
+      gemspec_files = target.files.grep(/gemspec/)
+      root_gemspec = gemspec_files.reject { |f| f.start_with?("vendor/") }
+      return new(target) unless root_gemspec.empty?
 
       nil
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 7.1.7
+  version: 7.3.4
 platform: ruby
 authors:
 - Chef InSpec Team
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-08 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-telemetry
@@ -441,7 +441,7 @@ dependencies:
         version: '3.16'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.16.1
+        version: 3.16.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -451,7 +451,7 @@ dependencies:
         version: '3.16'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.16.1
+        version: 3.16.5
 - !ruby/object:Gem::Dependency
   name: chef-licensing
   requirement: !ruby/object:Gem::Requirement
@@ -484,10 +484,12 @@ files:
 - Gemfile
 - LICENSE
 - etc/deprecations.json
+- etc/env.default.sh
 - etc/features.sig
 - etc/features.yaml
 - etc/keys/progress-2022-05-04.pem.pub
 - etc/plugin_filters.json
+- etc/reference-repos.txt
 - inspec-core.gemspec
 - lib/bundles/README.md
 - lib/bundles/inspec-compliance/api.rb
@@ -935,7 +937,7 @@ homepage: https://github.com/inspec/inspec
 licenses:
 - LicenseRef-Chef-EULA
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -951,7 +953,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.3.27
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Infrastructure and compliance testing. Core library.
 test_files: []
+...