inspec 0.34.1 → 1.0.0

data/lib/fetchers/url.rb

@@ -3,6 +3,7 @@
 # author: Christoph Hartmann
 
 require 'uri'
+require 'digest'
 require 'tempfile'
 require 'open-uri'
 
@@ -81,43 +82,68 @@ module Fetchers
     end
 
     def fetch(path)
-      Inspec::Log.debug("Fetching URL: #{@target}")
-      @archive_path = download_archive(path)
+      @archive_path ||= download_archive(path)
     end
 
     def resolved_source
-      { url: @target }
+      @resolved_source ||= { url: @target, sha256: sha256 }
     end
 
-    private
+    def cache_key
+      @archive_shasum ||= sha256
+    end
 
-    # download url into archive using opts,
-    # returns File object and content-type from HTTP headers
-    def download_archive(path)
-      http_opts = {}
-      http_opts['ssl_verify_mode'.to_sym] = OpenSSL::SSL::VERIFY_NONE if @insecure
-      http_opts['Authorization'] = "Bearer #{@token}" if @token
+    def to_s
+      @target
+    end
 
-      remote = open(@target, http_opts)
+    private
 
+    def sha256
+      file = @archive_path || temp_archive_path
+      Digest::SHA256.hexdigest File.read(file)
+    end
+
+    def file_type_from_remote(remote)
       content_type = remote.meta['content-type']
-      file_type = MIME_TYPES[content_type] ||
-                  throw(RuntimeError, 'Failed to resolve URL target, its '\
-                  "metadata did not match ZIP or TAR: #{content_type}")
+      file_type = MIME_TYPES[content_type]
 
-      # fall back to tar
       if file_type.nil?
-        fail "Could not determine file type for content type #{content_type}."
+        Inspec::Log.warn("Unrecognized content type: #{content_type}. Assuming tar.gz")
+        file_type = '.tar.gz'
       end
-      final_path = "#{path}#{file_type}"
-      # download content
-      archive = Tempfile.new(['inspec-dl-', file_type])
+
+      file_type
+    end
+
+    def temp_archive_path
+      @temp_archive_path ||= download_archive_to_temp
+    end
+
+    # Downloads archive to temporary file with side effect :( of setting @archive_type
+    def download_archive_to_temp
+      return @temp_archive_path if ! @temp_archive_path.nil?
+      Inspec::Log.debug("Fetching URL: #{@target}")
+      http_opts = {}
+      http_opts['ssl_verify_mode'.to_sym] = OpenSSL::SSL::VERIFY_NONE if @insecure
+      http_opts['Authorization'] = "Bearer #{@token}" if @token
+      remote = open(@target, http_opts)
+      @archive_type = file_type_from_remote(remote) # side effect :(
+      archive = Tempfile.new(['inspec-dl-', @archive_type])
       archive.binmode
       archive.write(remote.read)
       archive.rewind
       archive.close
-      FileUtils.mv(archive.path, final_path)
+      Inspec::Log.debug("Archive stored at temporary location: #{archive.path}")
+      @temp_archive_path = archive.path
+    end
+
+    def download_archive(path)
+      download_archive_to_temp
+      final_path = "#{path}#{@archive_type}"
+      FileUtils.mv(temp_archive_path, final_path)
       Inspec::Log.debug("Fetched archive moved to: #{final_path}")
+      @temp_archive_path = nil
       final_path
     end
   end

data/lib/inspec/base_cli.rb

@@ -58,6 +58,10 @@ module Inspec
         desc: 'Use colors in output.'
       option :attrs, type: :array,
         desc: 'Load attributes file (experimental)'
+      option :cache, type: :string,
+        desc: 'Use the given path for caching dependencies. (default: ~/.inspec/cache)'
+      option :create_lockfile, type: :boolean, default: true,
+        desc: 'Write out a lockfile based on this execution (unless one already exists)'
     end
 
     private
@@ -128,6 +132,16 @@ module Inspec
       Logger.const_get(l.upcase)
     end
 
+    def pretty_handle_exception(exception)
+      case exception
+      when Inspec::Error
+        $stderr.puts exception.message
+        exit(1)
+      else
+        raise exception # rubocop:disable Style/SignalException
+      end
+    end
+
     def configure_logger(o)
       #
       # TODO(ssd): This is a big gross, but this configures the

data/lib/inspec/cached_fetcher.rb

@@ -0,0 +1,67 @@
+# encoding: utf-8
+require 'inspec/fetcher'
+require 'forwardable'
+
+module Inspec
+  class CachedFetcher
+    extend Forwardable
+
+    attr_reader :cache, :target, :fetcher
+    def initialize(target, cache)
+      @target = target
+      @fetcher = Inspec::Fetcher.resolve(target)
+
+      if @fetcher.nil?
+        fail("Could not fetch inspec profile in #{target.inspect}.")
+      end
+
+      @cache = cache
+    end
+
+    def resolved_source
+      fetch
+      @fetcher.resolved_source
+    end
+
+    def cache_key
+      k = if target.is_a?(Hash)
+            target[:sha256] || target[:ref]
+          end
+
+      if k.nil?
+        fetcher.cache_key
+      else
+        k
+      end
+    end
+
+    def fetch
+      if cache.exists?(cache_key)
+        Inspec::Log.debug "Using cached dependency for #{target}"
+        [cache.prefered_entry_for(cache_key), false]
+      else
+        Inspec::Log.debug "Dependency does not exist in the cache #{target}"
+        fetcher.fetch(cache.base_path_for(fetcher.cache_key))
+        assert_cache_sanity!
+        [fetcher.archive_path, fetcher.writable?]
+      end
+    end
+
+    def assert_cache_sanity!
+      if target.respond_to?(:key?) && target.key?(:sha256)
+        if fetcher.resolved_source[:sha256] != target[:sha256]
+          fail <<EOF
+The remote source #{fetcher} no longer has the requested content:
+
+Request Content Hash: #{target[:sha256]}
+ Actual Content Hash: #{fetcher.resolved_source[:sha256]}
+
+For URL, supermarket, compliance, and other sources that do not
+provide versioned artifacts, this likely means that the remote source
+has changed since your lockfile was generated.
+EOF
+        end
+      end
+    end
+  end
+end

data/lib/inspec/cli.rb

@@ -48,6 +48,8 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
       fdst = File.expand_path(dst)
       File.write(fdst, JSON.dump(profile.info))
     end
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'check PATH', 'verify all tests at the specified PATH'
@@ -97,14 +99,18 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
       end
     end
     exit 1 unless result[:summary][:valid]
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'vendor', 'Download all dependencies and generate a lockfile'
   def vendor(path = nil)
     configure_logger(opts)
-    profile = Inspec::Profile.for_target('./', opts)
-    lockfile = profile.generate_lockfile(path)
+    profile = Inspec::Profile.for_target('./', opts.merge(cache: Inspec::Cache.new(path)))
+    lockfile = profile.generate_lockfile
     File.write('inspec.lock', lockfile.to_yaml)
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'archive PATH', 'archive a profile to tar.gz (default) or zip'
@@ -136,6 +142,8 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
 
     # generate archive
     exit 1 unless profile.archive(opts)
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'exec PATHS', 'run all test files at the specified PATH.'
@@ -147,6 +155,8 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
 
     # run tests
     run_tests(targets, o)
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'detect', 'detect the target OS'
@@ -165,6 +175,8 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
                     mark_text(res[item.to_sym]))
       }
     end
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'shell', 'open an interactive debugging shell'
@@ -196,12 +208,16 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
     exit 0
   rescue RuntimeError, Train::UserError => e
     $stderr.puts e.message
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'env', 'Output shell-appropriate completion configuration'
   def env(shell = nil)
     p = Inspec::EnvPrinter.new(self.class, shell)
     p.print_and_exit!
+  rescue StandardError => e
+    pretty_handle_exception(e)
   end
 
   desc 'version', 'prints the version of this tool'
@@ -213,13 +229,11 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
 
   def run_command(opts)
     runner = Inspec::Runner.new(opts)
-    ctx = runner.create_context(opts)
-    res = ctx.load(opts[:command])
+    res = runner.eval_with_virtual_profile(opts[:command])
+    runner.load
 
-    return :ruby_eval, res if ctx.rules.empty?
-
-    runner.register_rules(ctx)
-    return :rspec_run, runner.run # rubocop:disable Style/RedundantReturn
+    return :ruby_eval, res if runner.all_rules.empty?
+    return :rspec_run, runner.run_tests # rubocop:disable Style/RedundantReturn
   end
 end
 

data/lib/inspec/control_eval_context.rb

@@ -23,7 +23,7 @@ module Inspec
       require 'rspec/core/dsl'
       Class.new(Inspec::Rule) do
         include RSpec::Core::DSL
-        include resources_dsl
+        with_resource_dsl resources_dsl
       end
     end
 
@@ -92,6 +92,14 @@ module Inspec
           res
         end
 
+        define_method :add_resource do |name, new_res|
+          resources_dsl.module_exec do
+            define_method name.to_sym do |*args|
+              new_res.new(@backend, name.to_s, *args)
+            end
+          end
+        end
+
         define_method :add_resources do |context|
           self.class.class_eval do
             include context.to_resources_dsl
@@ -107,7 +115,9 @@ module Inspec
         end
 
         define_method :register_control do |control, &block|
-          ::Inspec::Rule.set_skip_rule(control, true) if @skip_profile
+          if @skip_profile || !profile_context_owner.profile_supports_os?
+            ::Inspec::Rule.set_skip_rule(control, true)
+          end
 
           profile_context_owner.register_rule(control, &block) unless control.nil?
         end

data/lib/inspec/dependencies/{vendor_index.rb → cache.rb}

@@ -4,7 +4,7 @@ require 'fileutils'
 
 module Inspec
   #
-  # VendorIndex manages an on-disk cache of inspec profiles.  The
+  # Inspec::Cache manages an on-disk cache of inspec profiles.  The
   # cache can contain:
   #
   #  - .tar.gz profile archives
@@ -16,7 +16,7 @@ module Inspec
   # sources.
   #
   #
-  class VendorIndex
+  class Cache
     attr_reader :path
     def initialize(path = nil)
       @path = path || File.join(Dir.home, '.inspec', 'cache')
@@ -43,19 +43,20 @@ module Inspec
 
     #
     # For a given name and source_url, return true if the
-    # profile exists in the VendorIndex.
+    # profile exists in the Cache.
     #
     # @param [String] name
     # @param [String] source_url
     # @return [Boolean]
     #
     def exists?(key)
+      return false if key.nil? || key.empty?
       path = base_path_for(key)
       File.directory?(path) || File.exist?("#{path}.tar.gz") || File.exist?("#{path}.zip")
     end
 
     #
-    # Return the path to given profile in the vendor index.
+    # Return the path to given profile in the cache.
     #
     # The `source_url` parameter should be a URI-like string that
     # fully specifies the source of the exact version we want to pull

data/lib/inspec/dependencies/dependency_set.rb

@@ -1,5 +1,4 @@
 # encoding: utf-8
-require 'inspec/dependencies/vendor_index'
 require 'inspec/dependencies/requirement'
 require 'inspec/dependencies/resolver'
 
@@ -7,9 +6,6 @@ module Inspec
   #
   # A DependencySet manages a list of dependencies for a profile.
   #
-  # Currently this class is a thin wrapper interface to coordinate the
-  # VendorIndex and the Resolver.
-  #
   class DependencySet
     #
     # Return a dependency set given a lockfile.
@@ -18,22 +14,21 @@ module Inspec
     # @param cwd [String] Current working directory for relative path includes
     # @param vendor_path [String] Path to the vendor directory
     #
-    def self.from_lockfile(lockfile, cwd, vendor_path, backend)
-      vendor_index = VendorIndex.new(vendor_path)
+    def self.from_lockfile(lockfile, cwd, cache, backend)
       dep_tree = lockfile.deps.map do |dep|
-        Inspec::Requirement.from_lock_entry(dep, cwd, vendor_index, backend)
+        Inspec::Requirement.from_lock_entry(dep, cwd, cache, backend)
       end
 
       dep_list = flatten_dep_tree(dep_tree)
-      new(cwd, vendor_path, dep_list, backend)
+      new(cwd, cache, dep_list, backend)
     end
 
-    def self.from_array(dependencies, cwd, vendor_path, backend)
+    def self.from_array(dependencies, cwd, cache, backend)
       dep_list = {}
       dependencies.each do |d|
         dep_list[d.name] = d
       end
-      new(cwd, vendor_path, dep_list, backend)
+      new(cwd, cache, dep_list, backend)
     end
 
     # This is experimental code to test the working of the
@@ -58,9 +53,9 @@ module Inspec
     # @param cwd [String] current working directory for relative path includes
     # @param vendor_path [String] path which contains vendored dependencies
     # @return [dependencies] this
-    def initialize(cwd, vendor_path, dep_list, backend)
+    def initialize(cwd, cache, dep_list, backend)
       @cwd = cwd
-      @vendor_path = vendor_path
+      @cache = cache
       @dep_list = dep_list
       @backend = backend
     end
@@ -91,8 +86,7 @@ module Inspec
     #
     def vendor(dependencies)
       return nil if dependencies.nil? || dependencies.empty?
-      @vendor_index ||= VendorIndex.new(@vendor_path)
-      @dep_list = Resolver.resolve(dependencies, @vendor_index, @cwd, @backend)
+      @dep_list = Resolver.resolve(dependencies, @cache, @cwd, @backend)
     end
   end
 end

data/lib/inspec/dependencies/lockfile.rb

@@ -4,8 +4,8 @@ require 'yaml'
 module Inspec
   class Lockfile
     # When we finalize this feature, we should set these to 1
-    MINIMUM_SUPPORTED_VERSION = 0
-    CURRENT_LOCKFILE_VERSION = 0
+    MINIMUM_SUPPORTED_VERSION = 1
+    CURRENT_LOCKFILE_VERSION = 1
 
     def self.from_dependency_set(dep_set)
       lockfile_content = {
@@ -32,14 +32,6 @@ lower than the minimum supported version #{MINIMUM_SUPPORTED_VERSION}.
 Please create a new lockfile for this project by running:
 
     inspec vendor
-EOF
-      elsif version == 0
-        # Remove this case once this feature stablizes
-        $stderr.puts <<EOF
-WARNING: This is a version 0 lockfile. Thank you for trying the
-experimental dependency management feature. Please be aware you may
-need to regenerate this lockfile in future versions as the feature is
-currently in development.
 EOF
       elsif version > CURRENT_LOCKFILE_VERSION
         fail <<EOF
@@ -78,8 +70,8 @@ EOF
     # different entry points of the API.
     def parse_content_hash(lockfile_content_hash)
       case version
-      when 0
-        parse_content_hash_0(lockfile_content_hash)
+      when 1
+        parse_content_hash_1(lockfile_content_hash)
       else
         # If we've gotten here, there is likely a mistake in the
         # lockfile version validation in the constructor.
@@ -87,7 +79,7 @@ EOF
       end
     end
 
-    def parse_content_hash_0(lockfile_content_hash)
+    def parse_content_hash_1(lockfile_content_hash)
       @deps = if lockfile_content_hash['depends']
                 lockfile_content_hash['depends'].map { |i| symbolize_keys(i) }
               end

data/lib/inspec/dependencies/requirement.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
-require 'inspec/fetcher'
+require 'inspec/cached_fetcher'
 require 'inspec/dependencies/dependency_set'
 require 'digest'
 
@@ -9,53 +9,54 @@ module Inspec
   # appropriate we delegate to Inspec::Profile directly.
   #
   class Requirement
-    attr_reader :name, :dep, :cwd, :opts
-    attr_writer :dependencies
-
-    def self.from_metadata(dep, vendor_index, opts)
+    def self.from_metadata(dep, cache, opts)
       fail 'Cannot load empty dependency.' if dep.nil? || dep.empty?
-      name = dep[:name] || fail('You must provide a name for all dependencies')
-      version = dep[:version]
-      new(name, version, vendor_index, opts[:cwd], opts.merge(dep))
+      new(dep[:name], dep[:version], cache, opts[:cwd], opts.merge(dep))
     end
 
-    def self.from_lock_entry(entry, cwd, vendor_index, backend)
+    def self.from_lock_entry(entry, cwd, cache, backend)
       req = new(entry[:name],
                 entry[:version_constraints],
-                vendor_index,
+                cache,
                 cwd,
                 entry[:resolved_source].merge(backend: backend))
 
       locked_deps = []
-      Array(entry['dependencies']).each do |dep_entry|
-        locked_deps << Inspec::Requirement.from_lock_entry(dep_entry, cwd, vendor_index, backend)
+      Array(entry[:dependencies]).each do |dep_entry|
+        locked_deps << Inspec::Requirement.from_lock_entry(dep_entry, cwd, cache, backend)
       end
       req.lock_deps(locked_deps)
       req
     end
 
-    def initialize(name, version_constraints, vendor_index, cwd, opts)
+    attr_reader :cwd, :opts, :required_version
+    def initialize(name, version_constraints, cache, cwd, opts)
       @name = name
-      @version_requirement = Gem::Requirement.new(Array(version_constraints))
-      @dep = Gem::Dependency.new(name, @version_requirement, :runtime)
-      @vendor_index = vendor_index
+      @required_version = Gem::Requirement.new(Array(version_constraints))
+      @cache = cache
       @backend = opts[:backend]
       @opts = opts
       @cwd = cwd
     end
 
-    def required_version
-      @version_requirement
+    #
+    # A dependency can be renamed in inspec.yml/inspec.lock.  Prefer
+    # the name the user gave this dependency over the profile name.
+    #
+    def name
+      @name || profile.name
     end
 
     def source_version
-      profile.metadata.params[:version]
+      profile.version
     end
 
     def source_satisfies_spec?
-      name = profile.metadata.params[:name]
-      version = profile.metadata.params[:version]
-      @dep.match?(name, version)
+      gem_dep.match?(profile.name, profile.version)
+    end
+
+    def gem_dep
+      @gem_dep ||= Gem::Dependency.new(profile.name, required_version, :runtime)
     end
 
     def resolved_source
@@ -66,14 +67,13 @@ module Inspec
       h = {
         'name' => name,
         'resolved_source' => resolved_source,
-        'version_constraints' => @version_requirement.to_s,
+        'version_constraints' => required_version.to_s,
       }
 
       if !dependencies.empty?
         h['dependencies'] = dependencies.map(&:to_hash)
       end
 
-      h['content_hash'] = content_hash if content_hash
       h
     end
 
@@ -81,39 +81,29 @@ module Inspec
       @dependencies = dep_array
     end
 
-    def content_hash
-      @content_hash ||= begin
-                          archive_path = @vendor_index.archive_entry_for(fetcher.cache_key) || fetcher.archive_path
-                          if archive_path && File.file?(archive_path)
-                            Digest::SHA256.hexdigest File.read(archive_path)
-                          end
-                        end
-    end
-
     def fetcher
-      @fetcher ||= Inspec::Fetcher.resolve(opts)
-      fail "No fetcher for #{name} (options: #{opts})" if @fetcher.nil?
-      @fetcher
+      @fetcher ||= Inspec::CachedFetcher.new(opts, @cache)
     end
 
     def dependencies
       @dependencies ||= profile.metadata.dependencies.map do |r|
-        Inspec::Requirement.from_metadata(r, @vendor_index, cwd: @cwd, backend: @backend)
+        Inspec::Requirement.from_metadata(r, @cache, cwd: @cwd, backend: @backend)
       end
     end
 
     def to_s
-      "#{dep} (#{resolved_source})"
+      name
     end
 
     def profile
+      return @profile if ! @profile.nil?
+
       opts = @opts.dup
-      opts[:cache] = @vendor_index
       opts[:backend] = @backend
       if !@dependencies.nil?
-        opts[:dependencies] = Inspec::DependencySet.from_array(@dependencies, @cwd, @vendor_index, @backend)
+        opts[:dependencies] = Inspec::DependencySet.from_array(@dependencies, @cwd, @cache, @backend)
       end
-      @profile ||= Inspec::Profile.for_target(opts, opts)
+      @profile = Inspec::Profile.for_fetcher(fetcher, opts)
     end
   end
 end

data/lib/inspec/dependencies/resolver.rb

@@ -23,9 +23,9 @@ module Inspec
   # implementation of the fetcher being used.
   #
   class Resolver
-    def self.resolve(dependencies, vendor_index, working_dir, backend)
+    def self.resolve(dependencies, cache, working_dir, backend)
       reqs = dependencies.map do |dep|
-        req = Inspec::Requirement.from_metadata(dep, vendor_index, cwd: working_dir, backend: backend)
+        req = Inspec::Requirement.from_metadata(dep, cache, cwd: working_dir, backend: backend)
         req || fail("Cannot initialize dependency: #{req}")
       end
       new.resolve(reqs)
@@ -50,7 +50,7 @@ module Inspec
     def resolve(deps, top_level = true, seen_items = {}, path_string = '') # rubocop:disable Metrics/AbcSize
       graph = {}
       if top_level
-        Inspec::Log.debug("Starting traversal of dependencies #{deps.map(&:name)}")
+        Inspec::Log.debug("Starting traversal of dependencies #{deps.map(&:to_s)}")
       else
         Inspec::Log.debug("Traversing dependency tree of transitive dependency #{deps.map(&:name)}")
       end

data/lib/inspec/dsl.rb

@@ -18,6 +18,15 @@ module Inspec::DSL
   alias require_rules require_controls
   alias include_rules include_controls
 
+  def require_resource(options = {})
+    fail 'You must specify a specific resource name when calling require_resource()' if options[:resource].nil?
+
+    from_profile = options[:profile] || profile_name
+    target_name = options[:as] || options[:resource]
+    res = resource_class(from_profile, options[:resource])
+    add_resource(target_name, res)
+  end
+
   def self.load_spec_files_for_profile(bind_context, opts, &block)
     dependencies = opts[:dependencies]
     profile_id = opts[:profile_id]
@@ -44,12 +53,15 @@ EOF
   end
 
   def self.filter_included_controls(context, profile, &block)
-    include_ctx = profile.runner_context
+    mock = Inspec::Backend.create({ backend: 'mock' })
+    include_ctx = Inspec::ProfileContext.for_profile(profile, mock, {})
     include_ctx.load(block) if block_given?
     # remove all rules that were not registered
-    context.rules.keys.each do |id|
-      unless include_ctx.rules[id]
-        context.rules[id] = nil
+    context.all_rules.each do |r|
+      id = Inspec::Rule.rule_id(r)
+      fid = Inspec::Rule.profile_id(r) + '/' + id
+      unless include_ctx.rules[id] || include_ctx.rules[fid]
+        context.remove_rule(fid)
       end
     end
   end

data/lib/inspec/errors.rb

@@ -9,4 +9,5 @@ module Inspec
   class CyclicDependencyError < Error; end
   class UnsatisfiedVersionSpecification < Error; end
   class DuplicateDep < Error; end
+  class FetcherFailure < Error; end
 end