inspec 1.0.0 → 1.35.1

data/docs/ruby_usage.md

@@ -152,3 +152,53 @@ describe command('ls -al /') do
   its('exit_status') { should eq 0 }
 end
 ```
+
+## Shelling out in tests
+
+When writing tests you can not use standard ruby methods to shellout as it tries to execute those commands locally.
+However, the `command` resource has a `.stdout` method that will allow you to manipulate the results.
+Using the above example, you could check the writes on several subdirectories.
+
+### Example 1:
+```ruby
+$ inspec shell
+Welcome to the interactive InSpec Shell
+To find out how to use it, type: help
+
+inspec> output=command('echo test').stdout
+=> "test\n"
+inspec> describe command('echo test') do
+inspec>   its('stdout') { should eq output }
+inspec> end
+
+Profile: inspec-shell
+Version: (not specified)
+
+  Command echo
+     ✔  test stdout should eq "test\n"
+
+Test Summary: 1 successful, 0 failures, 0 skipped
+```
+
+### Example 2:
+```ruby
+$ inspec shell
+Welcome to the interactive InSpec Shell
+To find out how to use it, type: help
+
+inspec> dirs = command('ls -d /home/gordon/git/inspec/docs').stdout.split("\n")
+=> ["/home/gordon/git/inspec/docs"]
+inspec> dirs.each do |dir|
+inspec>   describe directory(dir) do
+inspec>     its('mode') { should cmp '0775' }
+inspec>   end
+inspec> end
+
+Profile: inspec-shell
+Version: (not specified)
+
+  File /home/gordon/git/inspec/docs/
+     ✔  mode should cmp == "0775"
+
+Test Summary: 1 successful, 0 failures, 0 skipped
+```

data/docs/shared/matcher_cmp.md.erb

@@ -28,12 +28,10 @@ vs:
 
 Ignoring case sensitivity:
 
-.. code-block:: ruby
-
-   describe some_resource do
-     its('setting') { should cmp 'raw' }
-     its('setting') { should cmp 'RAW' }
-   end
+    describe some_resource do
+      its('setting') { should cmp 'raw' }
+      its('setting') { should cmp 'RAW' }
+    end
 
 Printing octal values:
 

data/examples/inheritance/README.md

@@ -7,13 +7,59 @@ This example shows the use of InSpec [profile](../../docs/profiles.rst) inherita
 InSpec ships with built-in features to verify a profile structure.
 
 ```bash
-$ inspec check examples/inheritance --profiles-path examples
+$ inspec check examples/inheritance
 ```
 
 ## Execute a profile
 
-To run a profile on a local machine use `inspec exec /path/to/profile`.
+To run a profile on a local machine use `inspec exec /path/to/profile`. All dependencies are automatically resolved.
 
 ```bash
-$ inspec exec examples/inheritance --profiles-path examples
+$ inspec exec examples/inheritance
+```
+
+## Set attributes for dependent profiles
+
+Without setting attributes, an `inspec exec` would return the following:
+
+```
+$ inspec git:(master) ✗ b inspec exec examples/inheritance
+
+Profile: InSpec example inheritance (inheritance)
+Version: 1.0.0
+Target:  local://
+
+
+  ○  gordon-1.0: Verify the version number of Gordon (1 skipped)
+     ○  Can't find file "/tmp/gordon/config.yaml"
+     ✔  File  content should match nil
+  ✔  ssh-1: Allow only SSH Protocol 2
+     ✔  File /bin/sh should be owned by "root"
+
+  File /tmp
+     ✔  should be directory
+  alice should
+     ✖  eq "bob"
+
+     expected: "bob"
+          got: "alice"
+
+     (compared using ==)
+
+  should eq
+     ✖  "secret"
+
+     expected: "secret"
+          got: nil
+
+     (compared using ==)
+
+
+Test Summary: 3 successful, 2 failures, 1 skipped
+```
+
+To pass in attributes, just call:
+
+```
+$ inspec exec examples/inheritance --attrs examples/profile-attribute.yml
 ```

data/examples/inheritance/controls/example.rb

@@ -1,7 +1,7 @@
 # encoding: utf-8
 # copyright: 2016, Chef Software, Inc.
-# license: All rights reserved
 
+# manipulate controls of `profile`
 include_controls 'profile' do
   skip_control 'tmp-1.0'
 
@@ -9,3 +9,6 @@ include_controls 'profile' do
     impact 0.0
   end
 end
+
+# load all controls of `profile-attribute`
+include_controls 'profile-attribute'

data/examples/inheritance/inspec.yml

@@ -3,7 +3,7 @@ title: InSpec example inheritance
 maintainer: Chef Software, Inc.
 copyright: Chef Software, Inc.
 copyright_email: support@chef.io
-license: Apache 2 license
+license: Apache-2.0
 summary: Demonstrates the use of InSpec profile inheritance
 version: 1.0.0
 supports:
@@ -11,3 +11,5 @@ supports:
 depends:
   - name: profile
     path: ../profile
+  - name: profile-attribute
+    path: ../profile-attribute

data/examples/meta-profile/README.md

@@ -5,7 +5,33 @@ from non-local sources such as Git or an HTTP url. This feature can
 be used to build up a environment-wide profile that is based on more
 specific profiles managed by others.
 
-# WARNING
+InSpec supports multiple profile locations:
 
-This profile likely does not work yet. It exists as a target for
-ongoing development work.
+```
+depends:
+  # defaults to supermarket
+  - name: hardening/ssh-hardening  
+  # remote tar or zip file
+  - name: os-hardening
+    url: https://github.com/dev-sec/tests-os-hardening/archive/master.zip
+  # git
+  - git: https://github.com/dev-sec/ssl-baseline.git
+  - name: windows-patch-benchmark
+    git: https://github.com/chris-rock/windows-patch-benchmark.git
+  # Chef Compliance
+  - name: linux
+    compliance: base/linux
+```
+
+You could use those dependencies in your `example.rb`:
+
+```
+
+include_controls 'hardening/ssh-hardening'
+include_controls 'os-hardening'
+include_controls 'ssl-baseline'
+include_controls 'linux'
+include_controls 'windows-patch-benchmark'
+```
+
+Further details are described in our [InSpec Docs](https://www.inspec.io/docs/reference/profiles/)

data/examples/meta-profile/controls/example.rb

@@ -1,8 +1,13 @@
 # encoding: utf-8
 # copyright: 2015, The Authors
-# license: All rights reserved
-include_controls 'ssh-hardening'
-include_controls 'os-hardening'
-include_controls 'ssl-benchmark'
-include_controls 'linux'
+
+# import full profile
+include_controls 'dev-sec/ssh-baseline'
+
+# select only individual controls
+include_controls 'ssl-baseline' do
+  control "tls1.2"
+end
+
+# inspec knows that it cannot run Windows tests on Linux
 include_controls 'windows-patch-benchmark'

data/examples/meta-profile/inspec.yml

@@ -3,15 +3,11 @@ title: Meta Compliance Profile
 maintainer: InSpec Authors
 copyright: InSpec Authors
 copyright_email: support@chef.io
-license: Apache 2
+license: Apache-2.0
 summary: InSpec Profile that is only consuming dependencies
 version: 0.2.0
 depends:
-  - name: hardening/ssh-hardening  # defaults to supermarket
-  - name: os-hardening
-    url: https://github.com/dev-sec/tests-os-hardening/archive/master.zip
-  - git: https://github.com/dev-sec/ssl-benchmark.git
+  - name: dev-sec/ssh-baseline  # defaults to supermarket
+  - url: https://github.com/dev-sec/ssl-baseline
   - name: windows-patch-benchmark
-    git: https://github.com/chris-rock/windows-patch-benchmark.git
-  - name: linux
-    compliance: base/linux
+    url: https://github.com/chris-rock/windows-patch-benchmark

data/examples/profile/README.md

@@ -1,6 +1,6 @@
 # Example InSpec Profile
 
-This example shows the implementation of an InSpec [profile](../../docs/profiles.rst).
+This example shows the implementation of an InSpec [profile](../../docs/profiles.md).
 
 ## Verify a profile
 

data/examples/profile/controls/example.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Chef Software, Inc.
-# license: All rights reserved
 
 title '/tmp profile'
 

data/examples/profile/controls/gordon.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2016, Chef Software, Inc.
-# license: All rights reserved
 
 title 'Gordon Config Checks'
 

data/examples/profile/inspec.yml

@@ -3,7 +3,7 @@ title: InSpec Example Profile
 maintainer: Chef Software, Inc.
 copyright: Chef Software, Inc.
 copyright_email: support@chef.io
-license: Apache 2 license
+license: Apache-2.0
 summary: Demonstrates the use of InSpec Compliance Profile
 version: 1.0.0
 supports:

data/examples/profile-attribute/inspec.yml

@@ -3,6 +3,6 @@ title: InSpec Profile
 maintainer: The Authors
 copyright: The Authors
 copyright_email: you@example.com
-license: All Rights Reserved
+license: Apache-2.0
 summary: An InSpec Compliance Profile
 version: 0.1.0

data/examples/profile-sensitive/README.md

@@ -0,0 +1,29 @@
+# Example InSpec Profile with Sensitive failures
+
+This profile demostrates resources flagged as sensitive
+
+## Usage
+
+```
+$ inspec exec examples/profile-sensitive
+....
+
+  bob should
+   ∅  eq "billy"
+
+   expected: "billy"
+        got: "bob"
+
+   (compared using ==)
+
+  sensitivepassword should
+     ∅  eq "secret"
+     *** sensitive output suppressed ***
+  bob should
+     ✔  eq "bob"
+  sensitivepassword should
+     ✔  eq "sensitivepassword"
+
+Test Summary: 2 successful, 2 failures, 0 skipped
+
+```

data/examples/profile-sensitive/controls/sensitive-failures.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+
+describe 'bob' do
+  it { should eq 'billy' }
+end
+
+describe 'sensitivepassword', :sensitive do
+  it { should eq 'secret' }
+end

data/examples/profile-sensitive/controls/sensitive.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+
+describe 'bob' do
+  it { should eq 'bob' }
+end
+
+describe 'sensitivepassword', :sensitive do
+  it { should eq 'sensitivepassword' }
+end

data/examples/profile-sensitive/inspec.yml

@@ -0,0 +1,8 @@
+name: profile-sensitive
+title: InSpec Sensitive Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0

data/inspec.gemspec

@@ -24,7 +24,9 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'train', '>=0.19.1', '<1.0'
+  spec.required_ruby_version = '>= 2.1'
+
+  spec.add_dependency 'train', '~> 0.26'
   spec.add_dependency 'thor', '~> 0.19'
   spec.add_dependency 'json', '>= 1.8', '< 3.0'
   spec.add_dependency 'rainbow', '~> 2'
@@ -35,6 +37,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'pry', '~> 0'
   spec.add_dependency 'hashie', '~> 3.4'
   spec.add_dependency 'mixlib-log'
-  spec.add_dependency 'sslshake', '~> 1'
+  spec.add_dependency 'sslshake', '~> 1.2'
   spec.add_dependency 'parallel', '~> 1.9'
+  spec.add_dependency 'faraday', '>=0.9.0'
+  spec.add_dependency 'toml', '~> 0.1'
+  spec.add_dependency 'addressable', '~> 2.4'
+  spec.add_dependency 'parslet', '~> 1.5'
+  spec.add_dependency 'semverse'
+  spec.add_dependency 'htmlentities'
 end

data/lib/bundles/inspec-artifact/README.md

@@ -0,0 +1 @@
+# TODO

data/lib/bundles/inspec-artifact/cli.rb

@@ -0,0 +1,284 @@
+# encoding: utf-8
+# frozen_string_literal: true
+require 'base64'
+require 'openssl'
+require 'pathname'
+require 'set'
+require 'tempfile'
+require 'yaml'
+
+# Notes:
+#
+# Generate keys
+#   The initial implementation uses 2048 bit RSA key pairs (public + private).
+#   Public keys must be available for a customer to install and verify an artifact.
+#   Private keys should be stored in a secure location and NOT be distributed.
+#     (They're only for creating artifacts).
+#
+#
+# .IAF file format
+#   .iaf = "Inspec Artifact File", easy to rename if you'd like something more appropriate.
+#   The iaf file wraps a binary artifact with some metadata. The first implementation
+#   looks like this:
+#
+# INSPEC-PROFILE-1
+# name_of_signing_key
+# algorithm
+# signature
+# <empty line>
+# binary-blob
+# <eof>
+#
+# Let's look at each line:
+# INSPEC-PROFILE-1:
+#   This is the artifact version descriptor. It should't change unless the
+#   format of the archive changes.
+#
+# name_of_signing_key
+#   The name of the public key that can be used to verify an artifact
+#
+# algorithm
+#   The digest used to sign, I picked SHA512 to start with.
+#   If we support multiple digests, we'll need to have the verify() method
+#   support each digest.
+#
+# signature
+#   The result of passing the binary artifact through the digest algorithm above.
+#   Result is base64 encoded.
+#
+# <empty line>
+#   We use an empty line to separate artifact header from artifact body (binary blob).
+#   The artifact body can be anything you like.
+#
+# binary-blob
+#   A binary blob, most likely a .tar.gz or tar.xz file. We'll need to pick one and
+#   stick with it as part of the "INSPEC-PROFILE-1" artifact version. If we change block
+#   format, the artifact version descriptor must be incremented, and the sign()
+#   and verify() methods must be updated to support a newer version.
+#
+#
+# Key revocation
+#   This implementation doesn't support key revocation. However, a customer
+#   can remove the public cert file before installation, and artifacts will then
+#   fail verification.
+#
+# Key locations
+#   This implementation uses the current working directory to find public and
+#   private keys. We should establish a common key directory (similar to /hab/cache/keys
+#   or ~/.hab/cache/keys in Habitat).
+#
+# Extracting artifacts outside of Inspec
+#   As in Habitat, the artifact format for Inspec allows the use of common
+#   Unix tools to read the header and body of an artifact.
+# To extract the header from a .iaf:
+#        sed '/^$/q' foo.iaf
+# To extract the raw content from a .iaf:
+#        sed '1,/^$/d' foo.iaf
+
+module Artifact
+  KEY_BITS=2048
+  KEY_ALG=OpenSSL::PKey::RSA
+
+  INSPEC_PROFILE_VERSION_1='INSPEC-PROFILE-1'.freeze
+  INSPEC_REPORT_VERSION_1='INSPEC-REPORT-1'.freeze
+
+  ARTIFACT_DIGEST=OpenSSL::Digest::SHA512
+  ARTIFACT_DIGEST_NAME='SHA512'.freeze
+
+  VALID_PROFILE_VERSIONS=Set.new [INSPEC_PROFILE_VERSION_1]
+  VALID_PROFILE_DIGESTS=Set.new [ARTIFACT_DIGEST_NAME]
+
+  SIGNED_PROFILE_SUFFIX='iaf'.freeze
+  SIGNED_REPORT_SUFFIX='iar'.freeze
+
+  # rubocop:disable Metrics/ClassLength
+  class CLI < Inspec::BaseCLI
+    namespace 'artifact'
+
+    # TODO: find another solution, once https://github.com/erikhuda/thor/issues/261 is fixed
+    def self.banner(command, _namespace = nil, _subcommand = false)
+      "#{basename} #{subcommand_prefix} #{command.usage}"
+    end
+
+    def self.subcommand_prefix
+      namespace
+    end
+
+    desc 'generate', 'Generate a RSA key pair for signing and verification'
+    option :keyname, type: :string, required: true,
+      desc: 'Desriptive name of key'
+    option :keydir, type: :string, default: './',
+      desc: 'Directory to search for keys'
+    def generate_keys
+      puts 'Generating keys'
+      keygen
+    end
+
+    desc 'sign-profile', 'Create a signed .iaf artifact'
+    option :profile, type: :string, required: true,
+      desc: 'Path to profile directory'
+    option :keyname, type: :string, required: true,
+      desc: 'Desriptive name of key'
+    def sign_profile
+      profile_sign
+    end
+
+    desc 'verify-profile', 'Verify a signed .iaf artifact'
+    option :infile, type: :string, required: true,
+        desc: '.iaf file to verify'
+    def verify_profile
+      profile_verify
+    end
+
+    desc 'install-profile', 'Verify and install a signed .iaf artifact'
+    option :infile, type: :string, required: true,
+        desc: '.iaf file to install'
+    option :destdir, type: :string, required: true,
+      desc: 'Installation directory'
+    def install_profile
+      profile_install
+    end
+
+    private
+
+    def keygen
+      key = KEY_ALG.new KEY_BITS
+      puts 'Generating private key'
+      open "#{options['keyname']}.pem.key", 'w' do |io| io.write key.to_pem end
+      puts 'Generating public key'
+      open "#{options['keyname']}.pem.pub", 'w' do |io| io.write key.public_key.to_pem end
+    end
+
+    def read_profile_metadata(path_to_profile)
+      begin
+        p = Pathname.new(path_to_profile)
+        p = p.join('inspec.yml')
+        if not p.exist?
+          raise "#{path_to_profile} doesn't appear to be a valid Inspec profile"
+        end
+        yaml = YAML.load_file(p.to_s)
+        yaml = yaml.to_hash
+
+        if not yaml.key? 'name'
+          raise 'Profile is invalid, name is not defined'
+        end
+
+        if not yaml.key? 'version'
+          raise 'Profile is invalid, version is not defined'
+        end
+      rescue => e
+        # rewrap it and pass it up to the CLI
+        raise "Error reading Inspec profile metadata: #{e}"
+      end
+
+      yaml
+    end
+
+    def profile_compress(path_to_profile, profile_md, workdir)
+      profile_name = profile_md['name']
+      profile_version = profile_md['version']
+      outfile_name = "#{workdir}/#{profile_name}-#{profile_version}.tar.gz"
+      `tar czf #{outfile_name} -C #{path_to_profile} .`
+      outfile_name
+    end
+
+    def profile_sign
+      Dir.mktmpdir do |workdir|
+        puts "Signing #{options['profile']} with key #{options['keyname']}"
+        path_to_profile = options['profile']
+        profile_md = read_profile_metadata(path_to_profile)
+        artifact_filename = "#{profile_md['name']}-#{profile_md['version']}.#{SIGNED_PROFILE_SUFFIX}"
+        tarfile = profile_compress(path_to_profile, profile_md, workdir)
+        content = IO.binread(tarfile)
+        signing_key = KEY_ALG.new File.read "#{options['keyname']}.pem.key"
+        sha = ARTIFACT_DIGEST.new
+        signature = signing_key.sign sha, content
+        # convert the signature to Base64
+        signature_base64 = Base64.encode64(signature)
+        tar_content = IO.binread(tarfile)
+        File.open(artifact_filename, 'wb') do |f|
+          f.puts(INSPEC_PROFILE_VERSION_1)
+          f.puts(options['keyname'])
+          f.puts(ARTIFACT_DIGEST_NAME)
+          f.puts(signature_base64)
+          f.puts('') # newline separates artifact header with body
+          f.write(tar_content)
+        end
+        puts "Successfully generated #{artifact_filename}"
+      end
+    end
+
+    def valid_header?(file_alg, file_version, file_keyname)
+      public_keyfile = "#{file_keyname}.pem.pub"
+      puts "Looking for #{public_keyfile} to verify artifact"
+      if not File.exist? public_keyfile
+        raise "Can't find #{public_keyfile}"
+      end
+
+      if not VALID_PROFILE_DIGESTS.member? file_alg
+        raise 'Invalid artifact digest algorithm detected'
+      end
+
+      if not VALID_PROFILE_VERSIONS.member? file_version
+        raise 'Invalid artifact version detected'
+      end
+    end
+
+    def verify(file_to_verifiy, &content_block)
+      f = File.open(file_to_verifiy, 'r')
+      file_version = f.readline.strip!
+      file_keyname = f.readline.strip!
+      file_alg = f.readline.strip!
+
+      file_sig = ''
+      # the signature is multi-line
+      while (line = f.readline) != "\n"
+        file_sig += line
+      end
+      file_sig.strip!
+      f.close
+
+      valid_header?(file_alg, file_version, file_keyname)
+
+      public_keyfile = "#{file_keyname}.pem.pub"
+      verification_key = KEY_ALG.new File.read public_keyfile
+
+      f = File.open(file_to_verifiy, 'r')
+      while f.readline != "\n" do end
+      content = f.read
+
+      signature = Base64.decode64(file_sig)
+      digest = ARTIFACT_DIGEST.new
+      if verification_key.verify digest, signature, content
+        content_block.yield(content)
+      else
+        puts 'Artifact is invalid'
+      end
+    end
+
+    def profile_verify
+      file_to_verifiy = options['infile']
+      puts "Verifying #{file_to_verifiy}"
+      verify(file_to_verifiy) do ||
+        puts 'Artifact is valid'
+      end
+    end
+
+    def profile_install
+      puts 'Installing profile'
+      file_to_verifiy = options['infile']
+      dest_dir = options['destdir']
+      verify(file_to_verifiy) do |content|
+        Dir.mktmpdir do |workdir|
+          tmpfile = Pathname.new(workdir).join('artifact_to_install.tar.gz')
+          File.write(tmpfile, content)
+          puts "Installing to #{dest_dir}"
+          `tar xzf #{tmpfile} -C #{dest_dir}`
+        end
+      end
+    end
+  end
+
+  # register the subcommand to Inspec CLI registry
+  Inspec::Plugins::CLI.add_subcommand(Artifact::CLI, 'artifact', 'artifact SUBCOMMAND ...', 'Sign, verify and install artifacts', {})
+end

data/lib/bundles/inspec-artifact.rb

@@ -0,0 +1,7 @@
+# encoding: utf-8
+# author: Dave Parfitt
+
+libdir = File.dirname(__FILE__)
+$LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
+
+require 'inspec-artifact/cli'