inspec 0.9.7 → 0.9.8

data/inspec.gemspec

@@ -24,7 +24,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'r-train', '~> 0.9'
+  spec.add_dependency 'r-train', '~> 0.9', '>= 0.9.3'
   spec.add_dependency 'thor', '~> 0.19'
   spec.add_dependency 'json', '~> 1.8'
   spec.add_dependency 'rainbow', '~> 2'

data/lib/inspec/archive/tar.rb

@@ -0,0 +1,29 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'rubygems/package'
+
+module Inspec::Archive
+  class TarArchiveGenerator
+    def archive(base_dir, files, archive)
+      File.open(archive, 'wb') do |file|
+        Zlib::GzipWriter.wrap(file) do |gz|
+          Gem::Package::TarWriter.new(gz) do |tar|
+            files.each do |input_filename|
+              path = Pathname.new(base_dir).join(input_filename)
+              stat = File.stat(path)
+              if path.directory?
+                tar.mkdir(input_filename, stat.mode)
+              else
+                tar.add_file_simple(input_filename, stat.mode, stat.size) do |io|
+                  io.write(File.read(path))
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/inspec/archive/zip.rb

@@ -0,0 +1,19 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'rubygems'
+require 'zip'
+require 'pathname'
+
+module Inspec::Archive
+  class ZipArchiveGenerator
+    def archive(base_dir, files, archive)
+      Zip::File.open(archive, Zip::File::CREATE) do |zipfile|
+        files.each do |input_filename|
+          zipfile.add(input_filename, Pathname.new(base_dir).join(input_filename))
+        end
+      end
+    end
+  end
+end

data/lib/inspec/metadata.rb

@@ -7,9 +7,11 @@ require 'logger'
 
 module Inspec
   # Extract metadata.rb information
-  class Metadata
-    attr_reader :params
-    def initialize(logger = nil)
+  class Metadata # rubocop:disable Metrics/ClassLength
+    attr_reader :ref
+    attr_accessor :params
+    def initialize(ref, logger = nil)
+      @ref = ref
       @logger = logger || Logger.new(nil)
       @params = {}
       @missing_methods = []
@@ -35,45 +37,138 @@ module Inspec
     def supports(sth, version = nil)
       params[:supports] ||= []
       params[:supports].push(
+        # do not use hash syntax for `-` to work properly with ruby 1.9.3 parser
         {
-          os:      sth,
+          :'os-name' => sth, # rubocop:disable Style/HashSyntax, Lint/UnneededDisable
           version: version,
         },
       )
     end
 
+    def is_supported(os, entry)
+      name, family, release = support_fields(entry)
+
+      # return true if the backend matches the supported OS's
+      # fields act as masks, i.e. any value configured for os-name, os-family,
+      # or release must be met by the backend; any field that is nil acts as
+      # a glob expression i.e. is true
+
+      # os name is both saved in :family and :name, so check both
+      name_ok = name.nil? ||
+                os[:name] == name || os[:family] == name
+
+      family_check = family.to_s + '?'
+      family_ok = family.nil? || os[:family] == family ||
+                  (
+                    os.respond_to?(family_check) &&
+                    # this call will return true if the family matches
+                    os.method(family_check).call
+                  )
+
+      release_ok = release.nil? || os[:release] == release
+
+      # we want to make sure that all matchers are true
+      name_ok && family_ok && release_ok
+    end
+
+    def support_fields(entry)
+      if entry.is_a?(Hash)
+        try_support = self.class.symbolize_keys(entry)
+        name = try_support[:'os-name'] || try_support[:os]
+        family = try_support[:'os-family']
+        release = try_support[:release]
+      elsif entry.is_a?(String)
+        @logger.warn("Using deprecated `supports` syntax: using `#{entry}` as OS family")
+        family = entry
+      end
+
+      [name, family, release]
+    end
+
+    def supports_transport?(backend)
+      # make sure the supports field is always an array
+      supp = params[:supports]
+      supp = supp.is_a?(Hash) ? [supp] : Array(supp)
+
+      # with no supports specified, always return true, as there are no
+      # constraints on the supported backend; it is equivalent to putting
+      # all fields into accept-all mode
+      return true if supp.empty?
+
+      found = supp.find do |entry|
+        is_supported(backend.os, entry)
+      end
+
+      # finally, if we found a supported entry, we are good to go
+      !found.nil?
+    end
+
     def valid?
       is_valid = true
-      %w{ name title version summary }.each do |field|
+      %w{ name version }.each do |field|
         next unless params[field.to_sym].nil?
-        @logger.error("Missing profile #{field} in metadata.rb")
+        @logger.error("Missing profile #{field} in #{ref}")
         is_valid = false
       end
-      %w{ maintainer copyright }.each do |field|
+      %w{ title summary maintainer copyright }.each do |field|
         next unless params[field.to_sym].nil?
-        @logger.warn("Missing profile #{field} in metadata.rb")
+        @logger.warn("Missing profile #{field} in #{ref}")
         is_valid = false
       end
       is_valid && @missing_methods.empty?
     end
 
     def method_missing(sth, *args)
-      @logger.warn "metadata.rb doesn't support: #{sth} #{args}"
+      @logger.warn "#{ref} doesn't support: #{sth} #{args}"
       @missing_methods.push(sth)
     end
 
-    def self.from_file(path, profile_id, logger = nil)
-      logger ||= Logger.new(nil)
+    def self.symbolize_keys(hash)
+      hash.each_with_object({}) {|(k, v), h|
+        v = symbolize_keys(v) if v.is_a?(Hash)
+        h[k.to_sym] = v
+      }
+    end
+
+    def self.finalize(metadata, profile_id)
+      metadata.params['name'] = profile_id.to_s unless profile_id.to_s.empty?
+      metadata.params = symbolize_keys(metadata.params || {})
+      metadata
+    end
+
+    def self.from_yaml(ref, contents, profile_id, logger = nil)
+      res = Metadata.new(ref, logger)
+      res.params = YAML.load(contents)
+      finalize(res, profile_id)
+    end
+
+    def self.from_ruby(ref, contents, profile_id, logger = nil)
+      res = Metadata.new(ref, logger)
+      res.instance_eval(contents, ref, 1)
+      finalize(res, profile_id)
+    end
 
+    def self.from_ref(ref, contents, profile_id, logger = nil)
+      case File.basename(ref)
+      when 'inspec.yml'
+        from_yaml(ref, contents, profile_id, logger)
+      when 'metadata.rb'
+        from_ruby(ref, contents, profile_id, logger)
+      else
+        logger ||= Logger.new(nil)
+        logger.error "Don't know how to handle metadata in #{ref}"
+        nil
+      end
+    end
+
+    def self.from_file(path, profile_id, logger = nil)
       unless File.file?(path)
+        logger ||= Logger.new(nil)
         logger.error "Can't find metadata file #{path}"
         return nil
       end
 
-      res = Metadata.new(logger)
-      res.instance_eval(File.read(path), path, 1)
-      res.params[:name] = profile_id.to_s unless profile_id.to_s.empty?
-      res
+      from_ref(File.basename(path), File.read(path), profile_id, logger)
     end
   end
 end

data/lib/inspec/profile.rb

@@ -4,6 +4,7 @@
 # author: Christoph Hartmann
 
 require 'inspec/metadata'
+require 'pathname'
 
 module Inspec
   class Profile # rubocop:disable Metrics/ClassLength
@@ -15,11 +16,11 @@ module Inspec
     end
 
     attr_reader :params
-    attr_reader :metadata
+    attr_reader :path
 
     def initialize(options = nil)
       @options = options || {}
-      @profile_id = options[:id] || nil
+
       @params = {}
       @logger = options[:logger] || Logger.new(nil)
 
@@ -28,14 +29,16 @@ module Inspec
       fail "Cannot find directory #{@path}" unless File.directory?(@path)
 
       @metadata = read_metadata
-      @params = @metadata.params unless @metadata.nil?
+      @params = @metadata.params
+      # use the id from parameter, name or fallback to nil
+      @profile_id = options[:id] || params[:name] || nil
 
       @params[:rules] = rules = {}
       @runner = Runner.new(
         id: @profile_id,
         backend: :mock,
       )
-      @runner.add_tests([@path])
+      @runner.add_tests([@path], @options)
       @runner.rules.each do |id, rule|
         file = rule.instance_variable_get(:@__file)
         rules[file] ||= {}
@@ -92,23 +95,23 @@ module Inspec
 
       @logger.info "Checking profile in #{@path}"
 
-      if @params[:name].to_s.empty?
-        error.call('No profile name defined')
-      elsif !(@params[:name].to_s =~ %r{^\S+\/\S+$})
-        error.call('Profile name must be defined as: OWNER/ID')
+      if Pathname.new(path).join('metadata.rb').exist?
+        warn.call('The use of `metadata.rb` is deprecated. Use `inspec.yml`.')
       end
 
-      warn.call('No version defined') if @params[:name].to_s.empty?
-      warn.call('No title defined') if @params[:name].to_s.empty?
-      warn.call('No maintainer defined') if @params[:name].to_s.empty?
-      warn.call('No supports defined') if @params[:name].empty?
-      @logger.info 'Metadata OK.' if no_warnings
+      @logger.info 'Metadata OK.' if @metadata.valid?
 
-      no_warnings = true
-      if @params[:name].empty?
-        warn.call('No rules were found.')
+      # check if the profile is using the old test directory instead of the
+      # new controls directory
+      if Pathname.new(path).join('test').exist? && !Pathname.new(path).join('controls').exist?
+        warn.call('Profile uses deprecated `test` directory, rename it to `controls`')
+      end
+
+      count = rules_count
+      if count == 0
+        warn.call('No controls or tests were defined.')
       else
-        @logger.debug "Found #{@params[:name].length} rules."
+        @logger.info("Found #{count} rules.")
       end
 
       # iterate over hash of groups
@@ -116,6 +119,7 @@ module Inspec
         @logger.debug "Verify all rules in  #{group}"
         rules_array.each do |id, rule|
           error.call('Avoid rules with empty IDs') if id.nil? or id.empty?
+          next if id.start_with? '(generated '
           warn.call("Rule #{id} has no title") if rule[:title].to_s.empty?
           warn.call("Rule #{id} has no description") if rule[:desc].to_s.empty?
           warn.call("Rule #{id} has impact > 1.0") if rule[:impact].to_f > 1.0
@@ -128,11 +132,76 @@ module Inspec
       no_errors
     end
 
+    def rules_count
+      @params[:rules].values.map { |hm| hm.values.length }.inject(:+) || 0
+    end
+
+    # generates a archive of a folder profile
+    def archive(opts) # rubocop:disable Metrics/AbcSize
+      check_result = check
+
+      if check_result && !opts.ignore_errors == false
+        @logger.info 'Profile check failed. Please fix the profile before generating an archive.'
+        return false
+      end
+
+      profile_name = @params[:name]
+
+      opts[:zip] ? ext='zip' : ext='tar.gz'
+      slug = profile_name.downcase.strip.tr(' ', '-').gsub(/[^\w-]/, '_')
+      archive = Pathname.new(File.dirname(__FILE__)).join('../..', "#{slug}.#{ext}")
+
+      # check if file exists otherwise overwrite the archive
+      if archive.exist? && !opts[:overwrite]
+        @logger.info "Archive #{archive} exists already. Use --overwrite."
+        return false
+      end
+
+      # remove existing archive
+      File.delete(archive) if archive.exist?
+
+      @logger.info "Profile check finished. Generate archive #{archive}."
+
+      # find all files
+      files = Dir.glob("#{path}/**/*")
+
+      # filter files that should not be part of the profile
+      # TODO ignore all .files, but add the files to debug output
+
+      # map absolute paths to relative paths
+      files = files.collect { |f| Pathname.new(f).relative_path_from(Pathname.new(path)).to_s }
+
+      # display all files that will be part of the archive
+      @logger.debug 'Add the following files to archive:'
+      files.each { |f|
+        @logger.debug '    ' + f
+      }
+
+      if opts[:zip]
+        # generate zip archive
+        require 'inspec/archive/zip'
+        zag = Inspec::Archive::ZipArchiveGenerator.new
+        zag.archive(path, files, archive)
+      else
+        # generate tar archive
+        require 'inspec/archive/tar'
+        tag = Inspec::Archive::TarArchiveGenerator.new
+        tag.archive(path, files, archive)
+      end
+
+      @logger.info 'Finished archive generation.'
+      true
+    end
+
     private
 
     def read_metadata
-      mpath = File.join(@path, 'metadata.rb')
-      @metadata = Metadata.from_file(mpath, @profile_id, @logger)
+      mpath = Pathname.new(path).join('inspec.yml')
+
+      # fallback to metadata.rb if inspec.yml does not exist
+      # TODO deprecated, will be removed in InSpec 1.0
+      mpath = File.join(@path, 'metadata.rb') if !mpath.exist?
+      Metadata.from_file(mpath, @profile_id, @logger)
     end
   end
 end

data/lib/inspec/profile_context.rb

@@ -19,11 +19,15 @@ module Inspec
       @profile_id = profile_id
       @rules = profile_registry
       @only_ifs = only_ifs
+      @backend = backend
 
-      dsl = create_inner_dsl(backend)
+      reload_dsl
+    end
+
+    def reload_dsl
+      dsl = create_inner_dsl(@backend)
       outer_dsl = create_outer_dsl(dsl)
       ctx = create_context(outer_dsl)
-
       @profile_context = ctx.new
     end
 
@@ -111,7 +115,7 @@ module Inspec
         define_method :describe do |*args, &block|
           path = block.source_location[0]
           line = block.source_location[1]
-          id = "#{File.basename(path)}:#{line} #{SecureRandom.hex}"
+          id = "(generated from #{File.basename(path)}:#{line} #{SecureRandom.hex})"
           rule = rule_class.new(id, {}) do
             describe(*args, &block)
           end
@@ -123,10 +127,12 @@ module Inspec
           nil
         end
 
-        def skip_rule(id)
+        def skip_control(id)
           __unregister_rule id
         end
 
+        alias_method :skip_rule, :skip_control
+
         def only_if(&block)
           return unless block_given?
           @skip_profile = !block.call

data/lib/inspec/resource.rb

@@ -44,6 +44,7 @@ require 'resources/kernel_module'
 require 'resources/kernel_parameter'
 require 'resources/limits_conf'
 require 'resources/login_def'
+require 'resources/mount'
 require 'resources/mysql'
 require 'resources/mysql_conf'
 require 'resources/mysql_session'

data/lib/inspec/runner.rb

@@ -8,6 +8,7 @@ require 'uri'
 require 'inspec/backend'
 require 'inspec/profile_context'
 require 'inspec/targets'
+require 'inspec/metadata'
 # spec requirements
 require 'rspec'
 require 'rspec/its'
@@ -46,10 +47,22 @@ module Inspec
       @backend = Inspec::Backend.create(@conf)
     end
 
-    def add_tests(tests)
+    def add_test_profile(test, ignore_supports = false)
+      assets = Inspec::Targets.resolve(test, @conf)
+      meta_assets = assets.find_all { |a| a[:type] == :metadata }
+      metas = meta_assets.map do |x|
+        Inspec::Metadata.from_ref(x[:ref], x[:content], @profile_id, @conf[:logger])
+      end
+      metas.each do |meta|
+        return [] unless ignore_supports || meta.supports_transport?(@backend)
+      end
+      assets
+    end
+
+    def add_tests(tests, options = {})
       # retrieve the raw ruby code of all tests
       items = tests.map do |test|
-        Inspec::Targets.resolve(test)
+        add_test_profile(test, options[:ignore_supports])
       end.flatten
 
       tests = items.find_all { |i| i[:type] == :test }
@@ -59,8 +72,11 @@ module Inspec
       # will ensure traditional RSpec-isms like `require 'spec_helper'`
       # continue to work.
       tests.flatten.each do |test|
-        test_directory = File.dirname(test[:ref])
-        $LOAD_PATH.unshift test_directory unless $LOAD_PATH.include?(test_directory)
+        # do not load path for virtual files, eg. from zip
+        if !test[:ref].nil?
+          test_directory = File.dirname(test[:ref])
+          $LOAD_PATH.unshift test_directory unless $LOAD_PATH.include?(test_directory)
+        end
       end
 
       # add all tests (raw) to the runtime
@@ -81,6 +97,7 @@ module Inspec
       ctx = create_context
       libs.each do |lib|
         ctx.load(lib[:content].to_s, lib[:ref], lib[:line] || 1)
+        ctx.reload_dsl
       end
 
       # evaluate the test content