inspec 0.9.0

data/docs/template.rst

@@ -0,0 +1,51 @@
+resource_name
+=====================================================
+Use the ``resource_name`` audit resource to xxxxx.
+
+Syntax
+-----------------------------------------------------
+A ``resource_name`` audit resource block declares xxxxx. For example:
+
+.. code-block:: ruby
+
+   describe xxxxx(xxxxx) do
+     it { should xxxxx }
+   end
+
+where
+
+* ``xxxxx`` must specify xxxxx
+* xxxxx
+* ``xxxxx`` is a valid matcher for this audit resource
+
+Matchers
+-----------------------------------------------------
+This audit resource has the following matchers.
+
+xxxxx
++++++++++++++++++++++++++++++++++++++++++++++++++++++
+The ``xxxxx`` matcher tests if xxxxx. For example:
+
+.. code-block:: ruby
+
+   it { should xxxxx }
+
+xxxxx
++++++++++++++++++++++++++++++++++++++++++++++++++++++
+The ``xxxxx`` matcher tests if xxxxx. For example:
+
+.. code-block:: ruby
+
+   it { should xxxxx }
+
+Examples
+-----------------------------------------------------
+The following examples show how to use this audit resource in a recipe.
+
+**xxxxx**
+
+xxxxx
+
+**xxxxx**
+
+xxxxx

data/examples/test-kitchen/.kitchen.yml

@@ -0,0 +1,20 @@
+---
+driver:
+  name: vagrant
+
+provisioner:
+  name: chef_solo
+
+verifier:
+  name: inspec
+
+platforms:
+  - name: centos-7.1
+  - name: ubuntu-12.04
+  - name: ubuntu-14.04
+
+suites:
+  - name: default
+    run_list:
+      - recipe[prepare]
+    attributes:

data/examples/test-kitchen/Berksfile

@@ -0,0 +1,3 @@
+source 'https://supermarket.chef.io'
+
+metadata

data/examples/test-kitchen/Gemfile

@@ -0,0 +1,21 @@
+# encoding: utf-8
+source 'https://rubygems.org'
+
+gem 'inspec', path: '../../.'
+gem 'train', git: 'git@github.com:chef/train.git'
+
+group :test do
+  gem 'bundler', '~> 1.5'
+  gem 'minitest', '~> 5.5'
+  gem 'rake', '~> 10'
+  gem 'rubocop', '~> 0.33.0'
+  gem 'simplecov', '~> 0.10'
+end
+
+group :integration do
+  gem 'berkshelf', '~> 4.0'
+  gem 'test-kitchen', '~> 1.4'
+  gem 'kitchen-vagrant'
+  gem 'kitchen-inspec', git: 'git@github.com:chef/kitchen-inspec.git'
+  gem 'concurrent-ruby', '~> 0.9'
+end

data/examples/test-kitchen/README.md

@@ -0,0 +1,27 @@
+# InSpec Test-Kitchen Example
+
+This example demonstrates a complete roundtrip via [Test-Kitchen](http://kitchen.ci/).
+
+```bash
+# install all dependencies
+$ bundle install
+# show all available tests
+$ bundle exec kitchen list
+Instance             Driver   Provisioner  Verifier  Transport  Last Action
+default-centos-71    Vagrant  ChefSolo     InSpec    Ssh        <Not Created>
+default-ubuntu-1204  Vagrant  ChefSolo     InSpec    Ssh        <Not Created>
+default-ubuntu-1404  Vagrant  ChefSolo     InSpec    Ssh        <Not Created>
+
+# Now we are ready to run a complete test
+$ bundle exec kitchen test default-ubuntu-1404
+-----> Starting Kitchen (v1.4.2)
+-----> Verifying <default-ubuntu-1404>...
+
+...
+
+Finished in 0.03241 seconds (files took 0.22475 seconds to load)
+5 examples, 0 failures
+
+       Finished verifying <default-ubuntu-1404> (0m0.16s).
+-----> Kitchen is finished. (0m0.82s)
+```

data/examples/test-kitchen/metadata.rb

@@ -0,0 +1,7 @@
+name 'prepare'
+maintainer 'Chef Software, Inc.'
+maintainer_email 'support@chef.io'
+description 'This cookbook prepares the test operating systems'
+version '1.0.0'
+depends 'apt'
+depends 'yum'

data/examples/test-kitchen/recipes/default.rb

@@ -0,0 +1,6 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# install nginx
+include_recipe('prepare::nginx')

data/examples/test-kitchen/recipes/nginx.rb

@@ -0,0 +1,30 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# install repositories for nginx
+case node['platform']
+when 'ubuntu'
+  include_recipe('apt')
+  # if ubuntu, install
+  apt_repository 'nginx-php' do
+    uri 'ppa:nginx/stable'
+    distribution node['lsb']['codename']
+  end
+when 'centos'
+  # add repo for Centos 7
+  yum_repository 'nginx' do
+    description 'Nginx Repo'
+    baseurl 'http://nginx.org/packages/centos/7/x86_64'
+    gpgkey 'http://nginx.org/keys/nginx_signing.key'
+    action :create
+  end
+end
+
+# install nginx package
+package 'nginx'
+
+# start the service
+service 'nginx' do
+  action :start
+end

data/examples/test-kitchen/test/integration/default/web_spec.rb

@@ -0,0 +1,28 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# use basic tests
+describe package('nginx') do
+  it { should be_installed }
+end
+
+# extend tests with metadata
+rule '01' do
+  impact 0.7
+  title 'Verify nginx service'
+  desc 'Ensures nginx service is up and running'
+  describe service('nginx') do
+    it { should be_enabled }
+    it { should be_installed }
+    it { should be_running }
+  end
+end
+
+# implement os dependent tests
+web_user = 'www-data'
+web_user = 'nginx' if os[:family] == 'centos'
+
+describe user(web_user) do
+  it { should exist }
+end

data/inspec.gemspec

@@ -0,0 +1,30 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'inspec/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'inspec'
+  spec.version       = Inspec::VERSION
+  spec.authors       = ['Dominik Richter']
+  spec.email         = ['dominik.richter@gmail.com']
+  spec.summary       = 'Validate Inspec compliance checks'
+  spec.description   = 'Validate Inspec compliance checks.'
+  spec.homepage      = 'https://github.com/chef/inspec'
+  spec.license       = 'Apache 2.0'
+
+  spec.files         = `hash git 2>/dev/null && git ls-files -z`.split("\x0").find_all { |x| x !~ /^\.delivery/ }
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'r-train', '~> 0.9'
+  spec.add_dependency 'thor', '~> 0.19'
+  spec.add_dependency 'json', '~> 1.8'
+  spec.add_dependency 'rainbow', '~> 2'
+  spec.add_dependency 'method_source', '~> 0.8'
+  spec.add_dependency 'rubyzip', '~> 1.1'
+  spec.add_dependency 'rspec', '~> 3.3'
+  spec.add_dependency 'rspec-its', '~> 1.2'
+  spec.add_dependency 'pry', '~> 0.10'
+end

data/lib/inspec.rb

@@ -0,0 +1,20 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+Encoding.default_external = Encoding::UTF_8
+Encoding.default_internal = Encoding::UTF_8
+
+libdir = File.dirname(__FILE__)
+$LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
+
+require 'inspec/version'
+require 'inspec/profile'
+require 'inspec/resource'
+require 'inspec/rspec_json_formatter'
+require 'inspec/rule'
+require 'inspec/runner'
+require 'inspec/shell'
+require 'matchers/matchers'

data/lib/inspec/backend.rb

@@ -0,0 +1,42 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'train'
+
+module Inspec
+  module Backend
+    # Create the transport backend with aggregated resources.
+    #
+    # @param [Hash] config for the transport backend
+    # @return [TransportBackend] enriched transport instance
+    def self.create(config)
+      conf = Train.target_config(config)
+      name = conf[:backend] || :local
+      transport = Train.create(name, conf)
+      if transport.nil?
+        fail "Can't find transport backend '#{name}'."
+      end
+
+      connection = transport.connection
+      if connection.nil?
+        fail "Can't connect to transport backend '#{name}'."
+      end
+
+      cls = Class.new do
+        define_method :backend do
+          connection
+        end
+        Inspec::Resource.registry.each do |id, r|
+          define_method id.to_sym do |*args|
+            r.new(self, id.to_s, *args)
+          end
+        end
+      end
+
+      cls.new
+    end
+  end
+end

data/lib/inspec/dsl.rb

@@ -0,0 +1,151 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec::DSL
+  def require_controls(id, &block)
+    ::Inspec::DSL.load_spec_files_for_profile self, id, false, &block
+  end
+
+  def include_controls(id, &block)
+    ::Inspec::DSL.load_spec_files_for_profile self, id, true, &block
+  end
+
+  alias_method :require_rules, :require_controls
+  alias_method :include_rules, :include_controls
+
+  # Register a given rule with RSpec and
+  # let it run. This happens after everything
+  # else is merged in.
+  def self.execute_rule(r, profile_id)
+    checks = r.instance_variable_get(:@checks)
+    fid = InspecBaseRule.full_id(r, profile_id)
+    checks.each do |m, a, b|
+      # check if the resource is skippable and skipped
+      if a.is_a?(Array) && !a.empty? &&
+         a[0].respond_to?(:resource_skipped) &&
+         !a[0].resource_skipped.nil?
+        cres = ::Inspec::Rule.__send__(m, *a) do
+          it a[0].resource_skipped
+        end
+      else
+        # execute the method
+        cres = ::Inspec::Rule.__send__(m, *a, &b)
+      end
+      if m == 'describe'
+        set_rspec_ids(cres, fid)
+      end
+    end
+  end
+
+  private
+
+  # merge two rules completely; all defined
+  # fields from src will be overwritten in dst
+  def self.merge_rules(dst, src)
+    InspecBaseRule.merge dst, src
+  end
+
+  # Attach an ID attribute to the
+  # metadata of all examples
+  # TODO: remove this once IDs are in rspec-core
+  def self.set_rspec_ids(obj, id)
+    obj.examples.each {|ex|
+      ex.metadata[:id] = id
+    }
+    obj.children.each {|c|
+      set_rspec_ids(c, id)
+    }
+  end
+
+  def self.load_spec_file_for_profile(profile_id, file, rule_registry, only_ifs)
+    raw = File.read(file)
+    # TODO: error-handling
+
+    ctx = Inspec::ProfileContext.new(profile_id, rule_registry, only_ifs)
+    ctx.instance_eval(raw, file, 1)
+  end
+
+  def self.load_spec_files_for_profile(bind_context, profile_id, include_all, &block)
+    # get all spec files
+    files = get_spec_files_for_profile profile_id
+    # load all rules from spec files
+    rule_registry = {}
+    # TODO: handling of only_ifs
+    only_ifs = []
+    files.each do |file|
+      load_spec_file_for_profile(profile_id, file, rule_registry, only_ifs)
+    end
+
+    # interpret the block and create a set of rules from it
+    block_registry = {}
+    if block_given?
+      ctx = Inspec::ProfileContext.new(profile_id, block_registry, only_ifs)
+      ctx.instance_eval(&block)
+    end
+
+    # if all rules are not included, select only the ones
+    # that were defined in the block
+    unless include_all
+      remove = rule_registry.keys - block_registry.keys
+      remove.each { |key| rule_registry.delete(key) }
+    end
+
+    # merge the rules in the block_registry (adjustments) with
+    # the rules in the rule_registry (included)
+    block_registry.each do |id, r|
+      org = rule_registry[id]
+      if org.nil?
+        # TODO: print error because we write alter a rule that doesn't exist
+      elsif r.nil?
+        rule_registry.delete(id)
+      else
+        merge_rules(org, r)
+      end
+    end
+
+    # finally register all combined rules
+    rule_registry.each do |_id, rule|
+      bind_context.__register_rule rule
+    end
+  end
+
+  def self.get_spec_files_for_profile(id)
+    base_path = '/etc/inspec/tests'
+    path = File.join(base_path, id)
+    # find all files to be included
+    files = []
+    if File.directory? path
+      # include all library paths, if they exist
+      libdir = File.join(path, 'lib')
+      if File.directory? libdir and !$LOAD_PATH.include?(libdir)
+        $LOAD_PATH.unshift(libdir)
+      end
+      files = Dir[File.join(path, 'spec', '*_spec.rb')]
+    end
+    files
+  end
+end
+
+module Inspec::GlobalDSL
+  def __register_rule(r)
+    # make sure the profile id is attached to the rule
+    ::Inspec::DSL.execute_rule(r, __profile_id)
+  end
+
+  def __unregister_rule(_id)
+  end
+end
+
+module Inspec::DSLHelper
+  def self.bind_dsl(scope)
+    (class << scope; self; end).class_exec do
+      include Inspec::DSL
+      include Inspec::GlobalDSL
+    end
+  end
+end
+
+::Inspec::DSLHelper.bind_dsl(self)