inspec 0.34.1 → 1.0.0

data/lib/inspec/fetcher.rb

@@ -6,7 +6,31 @@ require 'inspec/plugins'
 require 'utils/plugin_registry'
 
 module Inspec
-  Fetcher = PluginRegistry.new
+  class FetcherRegistry < PluginRegistry
+    def resolve(target)
+      if fetcher_specified?(target)
+        super(target)
+      else
+        Inspec::Log.debug("Assuming default supermarket source for #{target}")
+        super(with_default_fetcher(target))
+      end
+    end
+
+    NON_FETCHER_KEYS = [:name, :version_constraint, :cwd, :backend, :cache, :sha256].freeze
+    def fetcher_specified?(target)
+      # Only set a default for Hash-based (i.e. from
+      # inspec.yml/inspec.lock) targets
+
+      return true if !target.respond_to?(:keys)
+      !(target.keys - NON_FETCHER_KEYS).empty?
+    end
+
+    def with_default_fetcher(target)
+      target.merge({ supermarket: target[:name] })
+    end
+  end
+
+  Fetcher = FetcherRegistry.new
 
   def self.fetcher(version)
     if version != 1

data/lib/inspec/objects/each_loop.rb

@@ -2,10 +2,11 @@
 
 module Inspec
   class EachLoop < List
-    attr_reader :tests
+    attr_reader :tests, :variables
     def initialize
       super
       @tests = []
+      @variables = []
     end
 
     def add_test(t = nil)
@@ -24,9 +25,11 @@ module Inspec
     end
 
     def to_ruby
+      vars = variables.map(&:to_ruby).join("\n")
+      vars += "\n" unless vars.empty?
       obj = super
       all_tests = @tests.map(&:to_ruby).join("\n").gsub("\n", "\n  ")
-      format("%s.each do |entry|\n  %s\nend", obj, all_tests)
+      format("%s%s.each do |entry|\n  %s\nend", vars, obj, all_tests)
     end
   end
 end

data/lib/inspec/objects/test.rb

@@ -66,8 +66,14 @@ module Inspec
       res, xtra = describe_chain
       itsy = xtra.nil? ? 'it' : 'its(' + xtra.to_s.inspect + ')'
       naughty = @negated ? '_not' : ''
-      xpect = defined?(@expectation) ? expectation.inspect+' ' : ''
-      format("%sdescribe %s do\n  %s { should%s %s %s}\nend",
+      xpect = defined?(@expectation) ? expectation.inspect : ''
+      if matcher == 'match'
+        # without this, xpect values like / \/zones\// will not be parsed properly
+        xpect = "(#{xpect})"
+      elsif xpect != ''
+        xpect = ' ' + xpect
+      end
+      format("%sdescribe %s do\n  %s { should%s %s%s }\nend",
              vars, res, itsy, naughty, matcher, xpect)
     end
 

data/lib/inspec/plugins/fetcher.rb

@@ -24,6 +24,12 @@ module Inspec
         Inspec::Fetcher
       end
 
+      attr_accessor :target
+
+      def writable?
+        false
+      end
+
       #
       # The path to the archive on disk.  This can be passed to a
       # FileProvider to get access to the files in the fetched
@@ -56,6 +62,13 @@ module Inspec
         fail "Fetcher #{self} does not implement `resolved_source()`. This is required for terminal fetchers."
       end
 
+      #
+      # The unique key based on the content of the remote archive.
+      #
+      def cache_key
+        fail "Fetcher #{self} does not implement `cache_key()`. This is required for terminal fetchers."
+      end
+
       #
       # relative_target is provided to keep compatibility with 3rd
       # party plugins.
@@ -69,18 +82,6 @@ module Inspec
         file_provider = Inspec::FileProvider.for_path(archive_path)
         file_provider.relative_provider
       end
-
-      #
-      # A string based on the components of the resolved source,
-      # suitable for constructing per-source file names.
-      #
-      def cache_key
-        key = ''
-        resolved_source.each do |k, v|
-          key << "#{k}:#{v}"
-        end
-        Digest::SHA256.hexdigest key
-      end
     end
   end
 end

data/lib/inspec/plugins/resource.rb

@@ -72,6 +72,9 @@ module Inspec
       end
 
       # rubocop:enable Lint/NestedMethodDefinition
+      if __resource_registry.key?(name)
+        Inspec::Log.warn("Overwriting resource #{name}. To reference a specific version of #{name} use the resource() method")
+      end
       __resource_registry[name] = cl
     end
   end

data/lib/inspec/profile.rb

@@ -5,7 +5,7 @@
 
 require 'forwardable'
 require 'inspec/polyfill'
-require 'inspec/fetcher'
+require 'inspec/cached_fetcher'
 require 'inspec/file_provider'
 require 'inspec/source_reader'
 require 'inspec/metadata'
@@ -13,7 +13,7 @@ require 'inspec/backend'
 require 'inspec/rule'
 require 'inspec/log'
 require 'inspec/profile_context'
-require 'inspec/dependencies/vendor_index'
+require 'inspec/dependencies/cache'
 require 'inspec/dependencies/lockfile'
 require 'inspec/dependencies/dependency_set'
 
@@ -22,19 +22,7 @@ module Inspec
     extend Forwardable
 
     def self.resolve_target(target, cache = nil)
-      cache ||= VendorIndex.new
-      fetcher = Inspec::Fetcher.resolve(target)
-      if fetcher.nil?
-        fail("Could not fetch inspec profile in #{target.inspect}.")
-      end
-
-      if cache.exists?(fetcher.cache_key)
-        Inspec::Log.debug "Using cached dependency for #{target}"
-        cache.prefered_entry_for(fetcher.cache_key)
-      else
-        fetcher.fetch(cache.base_path_for(fetcher.cache_key))
-        fetcher.archive_path
-      end
+      Inspec::CachedFetcher.new(target, cache || Cache.new)
     end
 
     def self.for_path(path, opts)
@@ -47,12 +35,17 @@ module Inspec
       new(reader, opts)
     end
 
+    def self.for_fetcher(fetcher, opts)
+      path, writable = fetcher.fetch
+      for_path(path, opts.merge(target: fetcher.target, writable: writable))
+    end
+
     def self.for_target(target, opts = {})
-      for_path(resolve_target(target, opts[:cache]), opts.merge(target: target))
+      fetcher = resolve_target(target, opts[:cache])
+      for_fetcher(fetcher, opts)
     end
 
-    attr_reader :source_reader
-    attr_accessor :runner_context
+    attr_reader :source_reader, :backend, :runner_context
     def_delegator :@source_reader, :tests
     def_delegator :@source_reader, :libraries
     def_delegator :@source_reader, :metadata
@@ -63,10 +56,13 @@ module Inspec
       @logger = options[:logger] || Logger.new(nil)
       @locked_dependencies = options[:dependencies]
       @controls = options[:controls] || []
+      @writable = options[:writable] || false
       @profile_id = options[:id]
+      @cache = options[:cache] || Cache.new
       @backend = options[:backend] || Inspec::Backend.create(options)
       @source_reader = source_reader
       @tests_collected = false
+      @libraries_loaded = false
       Metadata.finalize(@source_reader.metadata, @profile_id)
       @runner_context = options[:profile_context] || Inspec::ProfileContext.for_profile(self,
                                                                                         @backend,
@@ -77,6 +73,32 @@ module Inspec
       metadata.params[:name]
     end
 
+    def version
+      metadata.params[:version]
+    end
+
+    def writable? # rubocop:disable Style/TrivialAccessors
+      @writable
+    end
+
+    #
+    # Is this profile is supported on the current platform of the
+    # backend machine and the current inspec version.
+    #
+    # @returns [TrueClass, FalseClass]
+    #
+    def supported?
+      supports_os? && supports_runtime?
+    end
+
+    def supports_os?
+      metadata.supports_transport?(@backend)
+    end
+
+    def supports_runtime?
+      metadata.supports_runtime?
+    end
+
     def params
       @params ||= load_params
     end
@@ -104,6 +126,8 @@ module Inspec
     end
 
     def load_libraries
+      return @runner_context if @libraries_loaded
+
       locked_dependencies.each do |d|
         c = d.load_libraries
         @runner_context.add_resources(c)
@@ -114,6 +138,7 @@ module Inspec
       end
 
       @runner_context.load_libraries(libs)
+      @libraries_loaded = true
       @runner_context
     end
 
@@ -121,19 +146,29 @@ module Inspec
       "Inspec::Profile<#{name}>"
     end
 
-    def info
-      res = params.dup
+    # return info using uncached params
+    def info!
+      info(load_params.dup)
+    end
+
+    def info(res = params.dup)
       # add information about the controls
-      controls = res[:controls].map do |id, rule|
+      res[:controls] = res[:controls].map do |id, rule|
         next if id.to_s.empty?
         data = rule.dup
         data.delete(:checks)
         data[:impact] ||= 0.5
         data[:impact] = 1.0 if data[:impact] > 1.0
         data[:impact] = 0.0 if data[:impact] < 0.0
-        [id, data]
+        data[:id] = id
+        data
+      end.compact
+
+      # resolve hash structure in groups
+      res[:groups] = res[:groups].map do |id, group|
+        group[:id] = id
+        group
       end
-      res[:controls] = Hash[controls.compact]
 
       # add information about the required attributes
       res[:attributes] = res[:attributes].map(&:to_hash) unless res[:attributes].nil? || res[:attributes].empty?
@@ -308,14 +343,14 @@ module Inspec
     # @param vendor_path [String] Path to the on-disk vendor dir
     # @return [Inspec::Lockfile]
     #
-    def generate_lockfile(vendor_path = nil)
-      res = Inspec::DependencySet.new(cwd, vendor_path, nil, @backend)
+    def generate_lockfile
+      res = Inspec::DependencySet.new(cwd, @cache, nil, @backend)
       res.vendor(metadata.dependencies)
       Inspec::Lockfile.from_dependency_set(res)
     end
 
     def load_dependencies
-      Inspec::DependencySet.from_lockfile(lockfile, cwd, nil, @backend)
+      Inspec::DependencySet.from_lockfile(lockfile, cwd, @cache, @backend)
     end
 
     private
@@ -353,6 +388,7 @@ module Inspec
       params[:groups] = groups = {}
       prefix = @source_reader.target.prefix || ''
       tests.each do |rule|
+        next if rule.nil?
         f = load_rule_filepath(prefix, rule)
         load_rule(rule, f, controls, groups)
       end

data/lib/inspec/profile_context.rb

@@ -17,7 +17,8 @@ module Inspec
                                    'attributes' => attributes })
     end
 
-    attr_reader :attributes, :rules, :profile_id, :resource_registry
+    attr_reader :attributes, :profile_id, :resource_registry, :backend
+    attr_accessor :rules
     def initialize(profile_id, backend, conf)
       if backend.nil?
         fail 'ProfileContext is initiated with a backend == nil. ' \
@@ -27,7 +28,8 @@ module Inspec
       @backend = backend
       @conf = conf.dup
       @rules = {}
-      @subcontexts = []
+      @control_subcontexts = []
+      @lib_subcontexts = []
       @require_loader = ::Inspec::RequireLoader.new
       @attributes = []
       # A local resource registry that only contains resources defined
@@ -45,7 +47,7 @@ module Inspec
     end
 
     def to_resources_dsl
-      Inspec::Resource.create_dsl(@backend, @resource_registry)
+      Inspec::Resource.create_dsl(self)
     end
 
     def control_eval_context
@@ -59,20 +61,47 @@ module Inspec
       @control_eval_context = nil
     end
 
-    def all_rules
+    def profile_supports_os?
+      return true if @conf['profile'].nil?
+
+      @conf['profile'].supports_os?
+    end
+
+    def remove_rule(id)
+      @rules[id] = nil if @rules.key?(id)
+      @control_subcontexts.each do |c|
+        c.remove_rule(id)
+      end
+    end
+
+    def all_controls
       ret = @rules.values
-      ret += @subcontexts.map(&:all_rules).flatten
+      ret += @control_subcontexts.map(&:all_rules).flatten
       ret
     end
+    alias all_rules all_controls
+
+    def subcontext_by_name(name)
+      found = @lib_subcontexts.find { |c| c.profile_id == name }
+      if !found
+        @lib_subcontexts.each do |c|
+          found = c.subcontext_by_name(name)
+          break if found
+        end
+      end
+
+      found
+    end
 
     def add_resources(context)
       @resource_registry.merge!(context.resource_registry)
       control_eval_context.add_resources(context)
+      @lib_subcontexts << context
       reload_dsl
     end
 
     def add_subcontext(context)
-      @subcontexts << context
+      @control_subcontexts << context
     end
 
     def load_libraries(libs)
@@ -122,10 +151,17 @@ module Inspec
       @rules.delete(full_id(@profile_id, id))
     end
 
+    attr_reader :current_load
+
     def register_rule(r)
       # get the full ID
-      r.instance_variable_set(:@__file, @current_load[:file])
-      r.instance_variable_set(:@__group_title, @current_load[:title])
+      file = if @current_load.nil?
+               'unknown'
+             else
+               @current_load[:file] || 'unknown'
+             end
+      r.instance_variable_set(:@__file, file)
+      r.instance_variable_set(:@__group_title, current_load[:title])
 
       # add the rule to the registry
       fid = full_id(Inspec::Rule.profile_id(r), Inspec::Rule.rule_id(r))

data/lib/inspec/resource.rb

@@ -6,6 +6,8 @@
 require 'inspec/plugins'
 
 module Inspec
+  class ProfileNotFound < StandardError; end
+
   class Resource
     def self.default_registry
       @default_registry ||= {}
@@ -25,9 +27,22 @@ module Inspec
     #
     # @param backend [BackendRunner] exposing the target to resources
     # @return [ResourcesDSL]
-    def self.create_dsl(backend, my_registry = registry)
-      # need the local name, to use it in the module creation further down
+    def self.create_dsl(profile_context)
+      backend = profile_context.backend
+      my_registry = profile_context.resource_registry
+
       Module.new do
+        define_method :resource_class do |profile_name, resource_name|
+          inner_context = if profile_name == profile_context.profile_id
+                            profile_context
+                          else
+                            profile_context.subcontext_by_name(profile_name)
+                          end
+
+          fail ProfileNotFound, "Cannot find profile named: #{profile_name}" if inner_context.nil?
+          inner_context.resource_registry[resource_name]
+        end
+
         my_registry.each do |id, r|
           define_method id.to_sym do |*args|
             r.new(backend, id.to_s, *args)
@@ -68,7 +83,7 @@ require 'resources/directory'
 require 'resources/etc_group'
 require 'resources/file'
 require 'resources/gem'
-require 'resources/group'
+require 'resources/groups'
 require 'resources/grub_conf'
 require 'resources/host'
 require 'resources/iis_site'