inspec 1.0.0 → 1.35.1

data/lib/bundles/inspec-compliance/README.md

@@ -9,8 +9,9 @@ This extensions offers the following features:
 To use the CLI, this InSpec add-on adds the following commands:
 
  * `$ inspec compliance login` - authentication of the API token against Chef Compliance
+ * `$ inspec compliance login_automate` - authentication of the API token against Chef Automate
  * `$ inspec compliance profiles` - list all available Chef Compliance profiles
- * `$ inspec compliance exec profile` - runs a Chef Compliance profile
+ * `$ inspec exec compliance://profile` - runs a Chef Compliance profile
  * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Compliance
  * `$ inspec compliance logout` - logout of Chef Compliance
 
@@ -19,8 +20,37 @@ Compliance profiles can be executed in two mays:
 - via compliance exec: `inspec compliance exec profile`
 - via compliance scheme: `inspec exec compliance://profile`
 
+
 ## Usage
 
+### Command options
+
+```
+$ inspec compliance
+Commands:
+  inspec compliance download PROFILE  # downloads a profile from Chef Compliance
+  inspec compliance exec PROFILE      # executes a Chef Compliance profile
+  inspec compliance help [COMMAND]    # Describe subcommands or one specific subcommand
+  inspec compliance login SERVER      # Log in to a Chef Compliance SERVER
+  inspec compliance login_automate SERVER   # Log in to an Automate SERVER
+  inspec compliance logout            # user logout from Chef Compliance
+  inspec compliance profiles          # list all available profiles in Chef Compliance
+  inspec compliance upload PATH       # uploads a local profile to Chef Compliance
+  inspec compliance version           # displays the version of the Chef Compliance server
+```
+
+### Login with Chef Automate
+
+You need a Chef Automate server up and running. Compliance features need to [be activated](https://docs.chef.io/install_chef_automate.html#compliance), too.
+
+Now, you need a user token. You can retrieve that via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
+
+```
+inspec compliance login_automate https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --usertoken 'zuop..._KzE'
+```
+
+### Login with Chef Compliance
+
 Before you start using the compliance plugin, you need a running [Chef Compliance](https://www.chef.io/compliance/) server. Please login and gather the access token:
 
 ![Chef Compliance Token](images/cc-token.png)
@@ -28,24 +58,17 @@ Before you start using the compliance plugin, you need a running [Chef Complianc
 You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
 
 ```
-$ inspec compliance
-Commands:
-  inspec compliance exec PROFILE    # executes a Chef Compliance profile
-  inspec compliance help [COMMAND]  # Describe subcommands or one specific subcommand
-  inspec compliance login SERVER    # Log in to a Chef Compliance SERVER
-  inspec compliance logout          # user logout from Chef Compliance
-  inspec compliance profiles        # list all available profiles in Chef Compliance
-  inspec compliance upload PATH     # uploads a local profile to Chef Compliance
-  inspec compliance version         # displays the version of the Chef Compliance server
-
 # login to chef compliance server
 $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
 
 # display the chef compliance server version
 $ inspec compliance version
 Chef Compliance version: 1.0.11
+```
+
+### List available profiles via Chef Compliance / Automate
 
-# list available profiles via Chef Compliance
+```
 $ inspec compliance profiles
 Available profiles:
 -------------------
@@ -65,8 +88,11 @@ Available profiles:
  * cis/cis-ubuntu12.04lts-level2
  * cis/cis-ubuntu14.04lts-level1
  * cis/cis-ubuntu14.04lts-level2
+```
+
+### Upload a profile to Chef Compliance / Automate
 
-# upload a profile to chef Compliance
+```
 $ inspec compliance version
 Chef Compliance version: 1.0.11
 ➜  inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec compliance upload examples/profile
@@ -103,8 +129,11 @@ Available profiles:
  * cis/cis-ubuntu12.04lts-level2
  * cis/cis-ubuntu14.04lts-level1
  * cis/cis-ubuntu14.04lts-level2
+```
+
+### Run a profile from Chef Compliance / Automate on Workstation
 
-# run a profile from Chef Compliance locally
+```
 $ inspec exec compliance://admin/profile
 .*...
 
@@ -119,7 +148,7 @@ Finished in 0.02862 seconds (files took 0.62628 seconds to load)
 5 examples, 0 failures, 1 pending
 ```
 
-# Logout from Chef Compliance
+### To Logout from Chef Compliance
 
 ```
 $ inspec compliance logout

data/lib/bundles/inspec-compliance/api.rb

@@ -6,14 +6,26 @@ require 'net/http'
 require 'uri'
 
 module Compliance
+  class ServerConfigurationMissing < StandardError
+  end
+
   # API Implementation does not hold any state by itself,
   # everything will be stored in local Configuration store
-  class API
+  class API # rubocop:disable Metrics/ClassLength
     # return all compliance profiles available for the user
     def self.profiles(config)
-      url = "#{config['server']}/user/compliance"
-      # TODO, api should not be dependent on .supported?
-      response = Compliance::HTTP.get(url, config['token'], config['insecure'], !config.supported?(:oidc))
+      # Chef Compliance
+      if is_compliance_server?(config)
+        url = "#{config['server']}/user/compliance"
+      # Chef Automate
+      elsif is_automate_server?(config)
+        url = "#{config['server']}/profiles/#{config['user']}"
+      else
+        raise ServerConfigurationMissing
+      end
+
+      headers = get_headers(config)
+      response = Compliance::HTTP.get(url, headers, config['insecure'])
       data = response.body
       response_code = response.code
       case response_code
@@ -21,11 +33,21 @@ module Compliance
         msg = 'success'
         profiles = JSON.parse(data)
         # iterate over profiles
-        mapped_profiles = profiles.map do |owner, ps|
-          ps.keys.map do |name|
-            { org: owner, name: name }
-          end
-        end.flatten
+        if is_compliance_server?(config)
+          mapped_profiles = []
+          profiles.values.each { |org|
+            mapped_profiles += org.values
+          }
+        # Chef Automate pre 0.8.0
+        elsif is_automate_server_pre_080?(config)
+          mapped_profiles = profiles.values.flatten
+        else
+          owner_id = config['user']
+          mapped_profiles = profiles.map { |e|
+            e['owner_id'] = owner_id
+            e
+          }
+        end
         return msg, mapped_profiles
       when '401'
         msg = '401 Unauthorized. Please check your token.'
@@ -39,28 +61,30 @@ module Compliance
     # return the server api version
     # NB this method does not use Compliance::Configuration to allow for using
     # it before we know the version (e.g. oidc or not)
-    def self.version(url, insecure)
-      if url.nil?
-        puts "
-Server configuration information is missing.
-Please login using `inspec compliance login https://compliance.test --user admin --insecure --token 'PASTE TOKEN HERE' `
-"
-      else
-        response = Compliance::HTTP.get(url+'/version', nil, insecure)
-        data = response.body
-      end
-      if !data.nil?
-        JSON.parse(data)
-      else
-        {}
-      end
+    def self.version(config)
+      url = config['server']
+      insecure = config['insecure']
+
+      raise ServerConfigurationMissing if url.nil?
+
+      headers = get_headers(config)
+      response = Compliance::HTTP.get(url+'/version', headers, insecure)
+      return {} if response.code == '404'
+
+      data = response.body
+      return {} if data.nil? || data.empty?
+
+      parsed = JSON.parse(data)
+      return {} unless parsed.key?('version') && !parsed['version'].empty?
+
+      parsed
     end
 
     # verifies that a profile
     def self.exist?(config, profile)
       _msg, profiles = Compliance::API.profiles(config)
       if !profiles.empty?
-        index = profiles.index { |p| "#{p[:org]}/#{p[:name]}" == profile }
+        index = profiles.index { |p| "#{p['owner_id']}/#{p['name']}" == profile }
         !index.nil? && index >= 0
       else
         false
@@ -68,13 +92,23 @@ Please login using `inspec compliance login https://compliance.test --user admin
     end
 
     def self.upload(config, owner, profile_name, archive_path)
-      # upload the tar to Chef Compliance
-      url = "#{config['server']}/owners/#{owner}/compliance/#{profile_name}/tar"
-      res = Compliance::HTTP.post_file(url, config['token'], archive_path, config['insecure'], !config.supported?(:oidc))
+      # Chef Compliance
+      if is_compliance_server?(config)
+        url = "#{config['server']}/owners/#{owner}/compliance/#{profile_name}/tar"
+      # Chef Automate pre 0.8.0
+      elsif is_automate_server_pre_080?(config)
+        url = "#{config['server']}/#{config['user']}"
+      # Chef Automate
+      else
+        url = "#{config['server']}/profiles/#{config['user']}"
+      end
+
+      headers = get_headers(config)
+      res = Compliance::HTTP.post_file(url, headers, archive_path, config['insecure'])
       [res.is_a?(Net::HTTPSuccess), res.body]
     end
 
-    # Use username and refresh_toke to get an API access token
+    # Use username and refresh_token to get an API access token
     def self.get_token_via_refresh_token(url, refresh_token, insecure)
       uri = URI.parse("#{url}/login")
       req = Net::HTTP::Post.new(uri.path)
@@ -121,5 +155,77 @@ Please login using `inspec compliance login https://compliance.test --user admin
 
       [success, msg, access_token]
     end
+
+    def self.get_headers(config)
+      token = get_token(config)
+      if is_automate_server?(config)
+        headers = { 'chef-delivery-enterprise' => config['automate']['ent'] }
+        if config['automate']['token_type'] == 'dctoken'
+          headers['x-data-collector-token'] = token
+        else
+          headers['chef-delivery-user'] = config['user']
+          headers['chef-delivery-token'] = token
+        end
+      else
+        headers = { 'Authorization' => "Bearer #{token}" }
+      end
+      headers
+    end
+
+    def self.get_token(config)
+      return config['token'] unless config['refresh_token']
+      _success, _msg, token = get_token_via_refresh_token(config['server'], config['refresh_token'], config['insecure'])
+      token
+    end
+
+    def self.target_url(config, profile)
+      if is_automate_server?(config)
+        owner, id = profile.split('/')
+        target = "#{config['server']}/profiles/#{owner}/#{id}/tar"
+      else
+        owner, id = profile.split('/')
+        target = "#{config['server']}/owners/#{owner}/compliance/#{id}/tar"
+      end
+      target
+    end
+
+    # returns a parsed url for `admin/profile` or `compliance://admin/profile`
+    def self.sanitize_profile_name(profile)
+      if URI(profile).scheme == 'compliance'
+        uri = URI(profile)
+      else
+        uri = URI("compliance://#{profile}")
+      end
+      uri.to_s.sub(%r{^compliance:\/\/}, '')
+    end
+
+    def self.is_compliance_server?(config)
+      config['server_type'] == 'compliance'
+    end
+
+    def self.is_automate_server_pre_080?(config)
+      # Automate versions before 0.8.x do not have a valid version in the config
+      return false unless config['server_type'] == 'automate'
+      server_version_from_config(config).nil?
+    end
+
+    def self.is_automate_server_080_and_later?(config)
+      # Automate versions 0.8.x and later will have a "version" key in the config
+      # that is properly parsed out via server_version_from_config below
+      return false unless config['server_type'] == 'automate'
+      !server_version_from_config(config).nil?
+    end
+
+    def self.is_automate_server?(config)
+      config['server_type'] == 'automate'
+    end
+
+    def self.server_version_from_config(config)
+      # Automate versions 0.8.x and later will have a "version" key in the config
+      # that looks like: "version":{"api":"compliance","version":"0.8.24"}
+      return nil unless config.key?('version')
+      return nil unless config['version'].is_a?(Hash)
+      config['version']['version']
+    end
   end
 end

data/lib/bundles/inspec-compliance/cli.rb

@@ -36,6 +36,7 @@ module Compliance
 
       options['server'] = server
       url = options['server'] + options['apipath']
+
       if !options['user'].nil? && !options['password'].nil?
         # username / password
         _success, msg = login_username_password(url, options['user'], options['password'], options['insecure'])
@@ -56,22 +57,62 @@ module Compliance
       puts '', msg
     end
 
+    desc "login_automate SERVER --insecure --user='USER' --ent='ENT' --usertoken='TOKEN'", 'Log in to an Automate SERVER'
+    long_desc <<-LONGDESC
+      `login_automate` allows you to use InSpec with Chef Automate
+
+      You need to a user-token for communication with Chef Automate. More
+      information about token retrieval for Automate is available at:
+      https://docs.chef.io/api_delivery.html
+    LONGDESC
+    option :dctoken, type: :string,
+      desc: 'Data Collector token'
+    option :usertoken, type: :string,
+      desc: 'Automate user token'
+    option :user, type: :string,
+      desc: 'Automate username'
+    option :ent, type: :string,
+      desc: 'Enterprise for Chef Automate reporting'
+    option :insecure, aliases: :k, type: :boolean,
+      desc: 'Explicitly allows InSpec to perform "insecure" SSL connections and transfers'
+    def login_automate(server) # rubocop:disable Metrics/AbcSize
+      options['server'] = server
+      url = options['server'] + '/compliance'
+
+      if url && !options['user'].nil? && !options['ent'].nil? && (!options['dctoken'].nil? || !options['usertoken'].nil?)
+        msg = login_automate_config(url, options['user'], options['dctoken'], options['usertoken'], options['ent'], options['insecure'])
+        puts '', msg
+        exit 0
+      end
+
+      # parameters are missing if we reach here
+      puts 'Please specify an user using `--user \'USER\'`' if options['user'].nil?
+      puts 'Please specify an enterprise using `--ent \'cd\'`' if options['ent'].nil?
+      puts 'Please specify a token using `--usertoken=\'AUTOMATE_TOKEN\'`' if options['usertoken'].nil? && options['dctoken'].nil?
+      exit 1
+    end
+
     desc 'profiles', 'list all available profiles in Chef Compliance'
+
     def profiles
       config = Compliance::Configuration.new
       return if !loggedin(config)
 
       msg, profiles = Compliance::API.profiles(config)
+      profiles.sort_by! { |hsh| hsh['title'] }
       if !profiles.empty?
         # iterate over profiles
         headline('Available profiles:')
         profiles.each { |profile|
-          li("#{profile[:org]}/#{profile[:name]}")
+          li("#{profile['title']} #{mark_text(profile['owner_id'] + '/' + profile['name'])}")
         }
       else
         puts msg, 'Could not find any profiles'
         exit 1
       end
+    rescue Compliance::ServerConfigurationMissing
+      puts "\nServer configuration information is missing. Please login using `inspec compliance login`"
+      exit 1
     end
 
     desc 'exec PROFILE', 'executes a Chef Compliance profile'
@@ -79,15 +120,43 @@ module Compliance
     def exec(*tests)
       config = Compliance::Configuration.new
       return if !loggedin(config)
-
       # iterate over tests and add compliance scheme
-      tests = tests.map { |t| 'compliance://' + t }
-
+      tests = tests.map { |t| 'compliance://' + Compliance::API.sanitize_profile_name(t) }
       # execute profile from inspec exec implementation
       diagnose
       run_tests(tests, opts)
     end
 
+    desc 'download PROFILE', 'downloads a profile from Chef Compliance'
+    option :name, type: :string,
+      desc: 'Name of the archive filename (file type will be added)'
+    def download(profile_name)
+      o = options.dup
+      configure_logger(o)
+
+      config = Compliance::Configuration.new
+      return if !loggedin(config)
+
+      profile_name = Compliance::API.sanitize_profile_name(profile_name)
+      if Compliance::API.exist?(config, profile_name)
+        puts "Downloading `#{profile_name}`"
+
+        fetcher = Compliance::Fetcher.resolve(
+          {
+            compliance: profile_name,
+          },
+        )
+
+        # we provide a name, the fetcher adds the extension
+        _owner, id = profile_name.split('/')
+        file_name = fetcher.fetch(o.name || id)
+        puts "Profile stored to #{file_name}"
+      else
+        puts "Profile #{profile_name} is not available in Chef Compliance."
+        exit 1
+      end
+    end
+
     desc 'upload PATH', 'uploads a local profile to Chef Compliance'
     option :overwrite, type: :boolean, default: false,
       desc: 'Overwrite existing profile on Chef Compliance.'
@@ -100,6 +169,8 @@ module Compliance
         exit 1
       end
 
+      vendor_deps(path, options) if File.directory?(path)
+
       o = options.dup
       configure_logger(o)
       # check the profile, we only allow to upload valid profiles
@@ -120,7 +191,7 @@ module Compliance
       end
 
       # determine user information
-      if config['token'].nil? || config['user'].nil?
+      if (config['token'].nil? && config['refresh_token'].nil?) || config['user'].nil?
         error.call('Please login via `inspec compliance login`')
       end
 
@@ -144,7 +215,6 @@ module Compliance
       # if it is a directory, tar it to tmp directory
       if File.directory?(path)
         archive_path = Dir::Tmpname.create([profile_name, '.tar.gz']) {}
-        # archive_path = file.path
         puts "Generate temporary profile archive at #{archive_path}"
         profile.archive({ output: archive_path, ignore_errors: false, overwrite: true })
       else
@@ -154,7 +224,8 @@ module Compliance
       puts "Start upload to #{owner}/#{profile_name}"
       pname = ERB::Util.url_encode(profile_name)
 
-      puts 'Uploading to Chef Compliance'
+      Compliance::API.is_automate_server?(config) ? upload_msg = 'Uploading to Chef Automate' : upload_msg = 'Uploading to Chef Compliance'
+      puts upload_msg
       success, msg = Compliance::API.upload(config, owner, pname, archive_path)
 
       if success
@@ -169,24 +240,27 @@ module Compliance
     desc 'version', 'displays the version of the Chef Compliance server'
     def version
       config = Compliance::Configuration.new
-      info = Compliance::API.version(config['server'], config['insecure'])
+      info = Compliance::API.version(config)
       if !info.nil? && info['version']
-        puts "Chef Compliance version: #{info['version']}"
+        puts "Name:    #{info['api']}"
+        puts "Version: #{info['version']}"
       else
         puts 'Could not determine server version.'
         exit 1
       end
+    rescue Compliance::ServerConfigurationMissing
+      puts "\nServer configuration information is missing. Please login using `inspec compliance login`"
+      exit 1
     end
 
     desc 'logout', 'user logout from Chef Compliance'
     def logout
       config = Compliance::Configuration.new
-      unless config.supported?(:oidc) || config['token'].nil?
+      unless config.supported?(:oidc) || config['token'].nil? || config['server_type'] == 'automate'
         config = Compliance::Configuration.new
         url = "#{config['server']}/logout"
         Compliance::API.post(url, config['token'], config['insecure'], !config.supported?(:oidc))
       end
-
       success = config.destroy
 
       if success
@@ -198,14 +272,42 @@ module Compliance
 
     private
 
+    def login_automate_config(url, user, dctoken, usertoken, ent, insecure) # rubocop:disable Metrics/ParameterLists
+      config = Compliance::Configuration.new
+      config.clean
+      config['user'] = user
+      config['server'] = url
+      config['automate'] = {}
+      config['automate']['ent'] = ent
+      config['server_type'] = 'automate'
+      config['insecure'] = insecure
+
+      # determine token method being used
+      if !dctoken.nil?
+        config['token'] = dctoken
+        token_type = 'dctoken'
+        token_msg = 'data collector token'
+      else
+        config['token'] = usertoken
+        token_type = 'usertoken'
+        token_msg = 'automate user token'
+      end
+      config['automate']['token_type'] = token_type
+      config['version'] = Compliance::API.version(config)
+      config.store
+      msg = "Stored configuration for Chef Automate: '#{url}' with user: '#{user}', ent: '#{ent}' and your #{token_msg}"
+      msg
+    end
+
     def login_refreshtoken(url, options)
-      success, msg, access_token = Compliance::API.get_token_via_refresh_token(url, options['refresh_token'], options['insecure'])
+      success, msg, _access_token = Compliance::API.get_token_via_refresh_token(url, options['refresh_token'], options['insecure'])
       if success
         config = Compliance::Configuration.new
+        config.clean
         config['server'] = url
-        config['token'] = access_token
         config['insecure'] = options['insecure']
-        config['version'] = Compliance::API.version(url, options['insecure'])
+        config['server_type'] = 'compliance'
+        config['version'] = Compliance::API.version(config)
         config.store
       end
 
@@ -214,13 +316,15 @@ module Compliance
 
     def login_username_password(url, username, password, insecure)
       config = Compliance::Configuration.new
+      config.clean
       success, msg, api_token = Compliance::API.get_token_via_password(url, username, password, insecure)
       if success
         config['server'] = url
         config['user'] = username
         config['token'] = api_token
         config['insecure'] = insecure
-        config['version'] = Compliance::API.version(url, insecure)
+        config['server_type'] = 'compliance'
+        config['version'] = Compliance::API.version(config)
         config.store
         success = true
       end
@@ -230,11 +334,13 @@ module Compliance
     # saves a user access token (limited time)
     def store_access_token(url, user, token, insecure)
       config = Compliance::Configuration.new
+      config.clean
       config['server'] = url
       config['insecure'] = insecure
       config['user'] = user
       config['token'] = token
-      config['version'] = Compliance::API.version(url, insecure)
+      config['server_type'] = 'compliance'
+      config['version'] = Compliance::API.version(config)
       config.store
 
       [true, 'API access token stored']
@@ -243,22 +349,23 @@ module Compliance
     # saves a refresh token supplied by the user
     def store_refresh_token(url, refresh_token, verify, user, insecure)
       config = Compliance::Configuration.new
+      config.clean
       config['server'] = url
       config['refresh_token'] = refresh_token
       config['user'] = user
       config['insecure'] = insecure
-      config['version'] = Compliance::API.version(url, insecure)
+      config['server_type'] = 'compliance'
+      config['version'] = Compliance::API.version(config)
 
       if !verify
         config.store
         success = true
         msg = 'API refresh token stored'
       else
-        success, msg, access_token = Compliance::API.get_token_via_refresh_token(url, refresh_token, insecure)
+        success, msg, _access_token= Compliance::API.get_token_via_refresh_token(url, refresh_token, insecure)
         if success
-          config['token'] = access_token
           config.store
-          msg = 'API access token verified and stored'
+          msg = 'API access token verified'
         end
       end
 
@@ -267,7 +374,7 @@ module Compliance
 
     def loggedin(config)
       serverknown = !config['server'].nil?
-      puts 'You need to login first with `inspec compliance login`' if !serverknown
+      puts 'You need to login first with `inspec compliance login` or `inspec compliance login_automate`' if !serverknown
       serverknown
     end
   end

data/lib/bundles/inspec-compliance/configuration.rb

@@ -28,6 +28,14 @@ module Compliance
       @config[key] = value
     end
 
+    def key?(key)
+      @config.key?(key)
+    end
+
+    def clean
+      @config = {}
+    end
+
     # return the json data
     def get
       if File.exist?(@config_file)