inspec 1.0.0 → 1.35.1

data/lib/bundles/inspec-compliance/http.rb

@@ -9,16 +9,13 @@ module Compliance
   # implements a simple http abstraction on top of Net::HTTP
   class HTTP
     # generic get requires
-    def self.get(url, token, insecure, basic_auth = false)
-      uri = URI.parse(url)
+    def self.get(url, headers = nil, insecure)
+      uri = _parse_url(url)
       req = Net::HTTP::Get.new(uri.path)
-
-      return send_request(uri, req, insecure) if token.nil?
-
-      if basic_auth
-        req.basic_auth(token, '')
-      else
-        req['Authorization'] = "Bearer #{token}"
+      if !headers.nil?
+        headers.each do |key, value|
+          req.add_field(key, value)
+        end
       end
       send_request(uri, req, insecure)
     end
@@ -26,7 +23,7 @@ module Compliance
     # generic post request
     def self.post(url, token, insecure, basic_auth = false)
       # form request
-      uri = URI.parse(url)
+      uri = _parse_url(url)
       req = Net::HTTP::Post.new(uri.path)
       if basic_auth
         req.basic_auth token, ''
@@ -39,9 +36,9 @@ module Compliance
     end
 
     # post a file
-    def self.post_file(url, token, file_path, insecure, basic_auth = false)
-      uri = URI.parse(url)
-      fail "Unable to parse URL: #{url}" if uri.nil? || uri.host.nil?
+    def self.post_file(url, headers, file_path, insecure)
+      uri = _parse_url(url)
+      raise "Unable to parse URL: #{url}" if uri.nil? || uri.host.nil?
       http = Net::HTTP.new(uri.host, uri.port)
 
       # set connection flags
@@ -49,10 +46,8 @@ module Compliance
       http.verify_mode = OpenSSL::SSL::VERIFY_NONE if insecure
 
       req = Net::HTTP::Post.new(uri.path)
-      if basic_auth
-        req.basic_auth token, ''
-      else
-        req['Authorization'] = "Bearer #{token}"
+      headers.each do |key, value|
+        req.add_field(key, value)
       end
 
       req.body_stream=File.open(file_path, 'rb')
@@ -72,11 +67,23 @@ module Compliance
       }
       opts[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if insecure
 
-      fail "Unable to parse URI: #{uri}" if uri.nil? || uri.host.nil?
-      res = Net::HTTP.start(uri.host, uri.port, opts) {|http|
+      raise "Unable to parse URI: #{uri}" if uri.nil? || uri.host.nil?
+      res = Net::HTTP.start(uri.host, uri.port, opts) { |http|
         http.request(req)
       }
       res
+
+    rescue OpenSSL::SSL::SSLError => e
+      raise e unless e.message.include? 'certificate verify failed'
+
+      puts "Error: Failed to connect to #{uri}."
+      puts 'If the server uses a self-signed certificate, please re-run the login command with the --insecure option.'
+      exit 1
+    end
+
+    def self._parse_url(url)
+      url = "https://#{url}" if URI.parse(url).scheme.nil?
+      URI.parse(url)
     end
   end
 end

data/lib/bundles/inspec-compliance/target.rb

@@ -13,8 +13,7 @@ module Compliance
   class Fetcher < Fetchers::Url
     name 'compliance'
     priority 500
-
-    def self.resolve(target)
+    def self.resolve(target) # rubocop:disable PerceivedComplexity, Metrics/CyclomaticComplexity
       uri = if target.is_a?(String) && URI(target).scheme == 'compliance'
               URI(target)
             elsif target.respond_to?(:key?) && target.key?(:compliance)
@@ -23,41 +22,54 @@ module Compliance
 
       return nil if uri.nil?
 
-      # check if we have a compliance token
-      config = Compliance::Configuration.new
-      if config['token'].nil?
-        fail Inspec::FetcherFailure, <<EOF
+      # we have detailed information available in our lockfile, no need to ask the server
+      if target.respond_to?(:key?) && target.key?(:url)
+        profile_fetch_url = target[:url]
+        config = {}
+      else
+        # check if we have a compliance token
+        config = Compliance::Configuration.new
+        if config['token'].nil? && config['refresh_token'].nil?
+          if config['server_type'] == 'automate'
+            server = 'automate'
+            msg = 'inspec compliance login_automate https://your_automate_server --user USER --ent ENT --dctoken DCTOKEN or --usertoken USERTOKEN'
+          else
+            server = 'compliance'
+            msg = "inspec compliance login https://your_compliance_server --user admin --insecure --token 'PASTE TOKEN HERE' "
+          end
+          raise Inspec::FetcherFailure, <<EOF
 
-Cannot fetch #{uri} because your compliance token has not been
+Cannot fetch #{uri} because your #{server} token has not been
 configured.
 
 Please login using
 
-    inspec compliance login https://your_compliance_server --user admin --insecure --token 'PASTE TOKEN HERE'
+    #{msg}
 EOF
-      end
+        end
 
-      # verifies that the target e.g base/ssh exists
-      profile = uri.host + uri.path
-      if !Compliance::API.exist?(config, profile)
-        fail Inpsec::FetcherFailure, "The compliance profile #{profile} was not found on the configured compliance server"
+        # verifies that the target e.g base/ssh exists
+        profile = Compliance::API.sanitize_profile_name(uri)
+        if !Compliance::API.exist?(config, profile)
+          raise Inspec::FetcherFailure, "The compliance profile #{profile} was not found on the configured compliance server"
+        end
+        profile_fetch_url = Compliance::API.target_url(config, profile)
       end
-      new(target_url(profile, config), config)
+      # We need to pass the token to the fetcher
+      config['token'] = Compliance::API.get_token(config)
+      new(profile_fetch_url, config)
     rescue URI::Error => _e
       nil
     end
 
-    def self.target_url(profile, config)
-      owner, id = profile.split('/')
-      "#{config['server']}/owners/#{owner}/compliance/#{id}/tar"
-    end
-
-    #
     # We want to save compliance: in the lockfile rather than url: to
-    # make sure we go back through the ComplianceAPI handling.
-    #
+    # make sure we go back through the Compliance API handling.
     def resolved_source
-      { compliance: supermarket_profile_name }
+      @resolved_source ||= {
+        compliance: compliance_profile_name,
+        url: @target,
+        sha256: sha256,
+      }
     end
 
     def to_s
@@ -66,8 +78,21 @@ EOF
 
     private
 
-    def supermarket_profile_name
-      m = %r{^#{@config['server']}/owners/(?<owner>[^/]+)/compliance/(?<id>[^/]+)/tar$}.match(@target)
+    # determine the owner_id and the profile name from the url
+    def compliance_profile_name
+      m = if Compliance::API.is_automate_server_pre_080?(@config)
+            %r{^#{@config['server']}/(?<owner>[^/]+)/(?<id>[^/]+)/tar$}
+          elsif Compliance::API.is_automate_server_080_and_later?(@config)
+            %r{^#{@config['server']}/profiles/(?<owner>[^/]+)/(?<id>[^/]+)/tar$}
+          else
+            %r{^#{@config['server']}/owners/(?<owner>[^/]+)/compliance/(?<id>[^/]+)/tar$}
+          end.match(@target)
+
+      raise 'Unable to determine compliance profile name. This can be caused by ' \
+        'an incorrect server in your configuration. Try to login to compliance ' \
+        'via the `inspec compliance login` or `inspec compliance login_automate` ' \
+        'commands.' if m.nil?
+
       "#{m[:owner]}/#{m[:id]}"
     end
   end

data/lib/bundles/inspec-habitat/cli.rb

@@ -0,0 +1,31 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'thor'
+
+module Habitat
+  class HabitatProfileCLI < Thor
+    namespace 'habitat profile'
+
+    desc 'create PATH', 'Create a Habitat artifact for the profile found at PATH'
+    option :output_dir, type: :string, required: false,
+      desc: 'Directory in which to save the generated Habitat artifact. Default: current directory'
+    def create(path)
+      Habitat::Profile.create(path, options)
+    end
+
+    desc 'upload PATH', 'Create a Habitat artifact for the profile found at PATH, and upload it to a Habitat Depot'
+    def upload(path)
+      Habitat::Profile.upload(path, options)
+    end
+  end
+
+  class HabitatCLI < Inspec::BaseCLI
+    namespace 'habitat'
+
+    desc 'profile', 'Manage InSpec profiles as Habitat artifacts'
+    subcommand 'profile', HabitatProfileCLI
+  end
+
+  Inspec::Plugins::CLI.add_subcommand(HabitatCLI, 'habitat', 'habitat SUBCOMMAND ...', 'Commands for InSpec + Habitat Integration', {})
+end

data/lib/bundles/inspec-habitat/log.rb

@@ -0,0 +1,10 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'mixlib/log'
+
+module Habitat
+  class Log
+    extend Mixlib::Log
+  end
+end

data/lib/bundles/inspec-habitat/profile.rb

@@ -0,0 +1,372 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'inspec/profile_vendor'
+require 'mixlib/shellout'
+require 'toml'
+
+module Habitat
+  class Profile # rubocop:disable Metrics/ClassLength
+    attr_reader :options, :path, :profile
+
+    def self.create(path, options = {})
+      creator = new(path, options)
+      hart_file = creator.create
+      creator.copy(hart_file)
+    ensure
+      creator.delete_work_dir
+    end
+
+    def self.upload(path, options = {})
+      uploader = new(path, options)
+      uploader.upload
+    ensure
+      uploader.delete_work_dir
+    end
+
+    def initialize(path, options = {})
+      @path    = path
+      @options = options
+
+      log_level = options.fetch('log_level', 'info')
+      Habitat::Log.level(log_level.to_sym)
+    end
+
+    def create
+      Habitat::Log.info("Creating a Habitat artifact for profile: #{path}")
+
+      validate_habitat_installed
+      validate_habitat_origin
+      create_profile_object
+      verify_profile
+      vendor_profile_dependencies
+      copy_profile_to_work_dir
+      create_plan
+      create_run_hook
+      create_settings_file
+      create_default_config
+
+      # returns the path to the .hart file in the work directory
+      build_hart
+    rescue => e
+      Habitat::Log.debug(e.backtrace.join("\n"))
+      exit_with_error(
+        'Unable to generate Habitat artifact.',
+        "#{e.class} -- #{e.message}",
+      )
+    end
+
+    def copy(hart_file)
+      validate_output_dir
+
+      Habitat::Log.info("Copying artifact to #{output_dir}...")
+      copy_hart(hart_file)
+    end
+
+    def upload
+      validate_habitat_auth_token
+      hart_file = create
+      upload_hart(hart_file)
+    rescue => e
+      Habitat::Log.debug(e.backtrace.join("\n"))
+      exit_with_error(
+        'Unable to upload Habitat artifact.',
+        "#{e.class} -- #{e.message}",
+      )
+    end
+
+    def delete_work_dir
+      Habitat::Log.debug("Deleting work directory #{work_dir}")
+      FileUtils.rm_rf(work_dir) if Dir.exist?(work_dir)
+    end
+
+    private
+
+    def create_profile_object
+      @profile = Inspec::Profile.for_target(
+        path,
+        backend: Inspec::Backend.create(target: 'mock://'),
+      )
+    end
+
+    def verify_profile
+      Habitat::Log.info('Checking to see if the profile is valid...')
+
+      unless profile.check[:summary][:valid]
+        exit_with_error('Profile check failed. Please fix the profile before creating a Habitat artifact.')
+      end
+
+      Habitat::Log.info('Profile is valid.')
+    end
+
+    def vendor_profile_dependencies
+      profile_vendor = Inspec::ProfileVendor.new(path)
+      if profile_vendor.lockfile.exist? && profile_vendor.cache_path.exist?
+        Habitat::Log.info("Profile's dependencies are already vendored, skipping vendor process.")
+      else
+        Habitat::Log.info("Vendoring the profile's dependencies...")
+        profile_vendor.vendor!
+
+        Habitat::Log.info('Ensuring all vendored content has read permissions...')
+        profile_vendor.make_readable
+
+        # refresh the profile object since the profile now has new files
+        create_profile_object
+      end
+    end
+
+    def validate_habitat_installed
+      Habitat::Log.info('Checking to see if Habitat is installed...')
+      cmd = Mixlib::ShellOut.new('hab --version')
+      cmd.run_command
+      if cmd.error?
+        exit_with_error('Unable to run Habitat commands.', cmd.stderr)
+      end
+    end
+
+    def validate_habitat_origin
+      if habitat_origin.nil?
+        exit_with_error(
+          'Unable to determine Habitat origin name.',
+          'Run `hab setup` or set the HAB_ORIGIN environment variable.',
+        )
+      end
+    end
+
+    def validate_habitat_auth_token
+      if habitat_auth_token.nil?
+        exit_with_error(
+          'Unable to determine Habitat auth token for publishing.',
+          'Run `hab setup` or set the HAB_AUTH_TOKEN environment variable.',
+        )
+      end
+    end
+
+    def validate_output_dir
+      exit_with_error("Output directory #{output_dir} is not a directory or does not exist.") unless
+        File.directory?(output_dir)
+    end
+
+    def work_dir
+      return @work_dir if @work_dir
+
+      @work_dir ||= Dir.mktmpdir('inspec-habitat-exporter')
+      Dir.mkdir(File.join(@work_dir, 'src'))
+      Dir.mkdir(File.join(@work_dir, 'habitat'))
+      Dir.mkdir(File.join(@work_dir, 'habitat', 'config'))
+      Dir.mkdir(File.join(@work_dir, 'habitat', 'hooks'))
+      Habitat::Log.debug("Generated work directory #{@work_dir}")
+
+      @work_dir
+    end
+
+    def copy_profile_to_work_dir
+      Habitat::Log.info('Copying profile contents to the work directory...')
+      profile.files.each do |f|
+        src = File.join(profile.root_path, f)
+        dst = File.join(work_dir, 'src', f)
+        if File.directory?(f)
+          Habitat::Log.debug("Creating directory #{dst}")
+          FileUtils.mkdir_p(dst)
+        else
+          Habitat::Log.debug("Copying file #{src} to #{dst}")
+          FileUtils.cp_r(src, dst)
+        end
+      end
+    end
+
+    def create_plan
+      plan_file = File.join(work_dir, 'habitat', 'plan.sh')
+      Habitat::Log.info("Generating Habitat plan at #{plan_file}...")
+      File.write(plan_file, plan_contents)
+    end
+
+    def create_run_hook
+      run_hook_file = File.join(work_dir, 'habitat', 'hooks', 'run')
+      Habitat::Log.info("Generating a Habitat run hook at #{run_hook_file}...")
+      File.write(run_hook_file, run_hook_contents)
+    end
+
+    def create_settings_file
+      settings_file = File.join(work_dir, 'habitat', 'config', 'settings.sh')
+      Habitat::Log.info("Generating a settings file at #{settings_file}...")
+      File.write(settings_file, "SLEEP_TIME={{cfg.sleep_time}}\n")
+    end
+
+    def create_default_config
+      default_toml = File.join(work_dir, 'habitat', 'default.toml')
+      Habitat::Log.info("Generating Habitat's default.toml configuration...")
+      File.write(default_toml, 'sleep_time = 300')
+    end
+
+    def build_hart
+      Habitat::Log.info('Building our Habitat artifact...')
+
+      env = {
+        'TERM'               => 'vt100',
+        'HAB_ORIGIN'         => habitat_origin,
+        'HAB_NONINTERACTIVE' => 'true',
+      }
+
+      env['RUST_LOG'] = 'debug' if Habitat::Log.level == :debug
+
+      # TODO: Would love to use Mixlib::ShellOut here, but it doesn't
+      # seem to preserve the STDIN tty, and docker gets angry.
+      Dir.chdir(work_dir) do
+        unless system(env, 'hab pkg build .')
+          exit_with_error('Unable to build the Habitat artifact.')
+        end
+      end
+
+      hart_files = Dir.glob(File.join(work_dir, 'results', '*.hart'))
+
+      if hart_files.length > 1
+        exit_with_error('More than one Habitat artifact was created which was not expected.')
+      elsif hart_files.empty?
+        exit_with_error('No Habitat artifact was created.')
+      end
+
+      hart_files.first
+    end
+
+    def copy_hart(working_dir_hart)
+      hart_basename = File.basename(working_dir_hart)
+      dst = File.join(output_dir, hart_basename)
+      FileUtils.cp(working_dir_hart, dst)
+
+      dst
+    end
+
+    def upload_hart(hart_file)
+      Habitat::Log.info('Uploading the Habitat artifact to our Depot...')
+
+      env = {
+        'TERM'               => 'vt100',
+        'HAB_AUTH_TOKEN'     => habitat_auth_token,
+        'HAB_NONINTERACTIVE' => 'true',
+      }
+
+      env['HAB_DEPOT_URL'] = ENV['HAB_DEPOT_URL'] if ENV['HAB_DEPOT_URL']
+
+      cmd = Mixlib::ShellOut.new("hab pkg upload #{hart_file}", env: env)
+      cmd.run_command
+      if cmd.error?
+        exit_with_error(
+          'Unable to upload Habitat artifact to the Depot.',
+          cmd.stdout,
+          cmd.stderr,
+        )
+      end
+
+      Habitat::Log.info('Upload complete!')
+    end
+
+    def habitat_origin
+      ENV['HAB_ORIGIN'] || habitat_cli_config['origin']
+    end
+
+    def habitat_auth_token
+      ENV['HAB_AUTH_TOKEN'] || habitat_cli_config['auth_token']
+    end
+
+    def habitat_cli_config
+      return @cli_config if @cli_config
+
+      config_file = File.join(ENV['HOME'], '.hab', 'etc', 'cli.toml')
+      return {} unless File.exist?(config_file)
+
+      @cli_config = TOML.load_file(config_file)
+    end
+
+    def output_dir
+      options[:output_dir] || Dir.pwd
+    end
+
+    def exit_with_error(*errors)
+      errors.each do |error_msg|
+        Habitat::Log.error(error_msg)
+      end
+
+      exit 1
+    end
+
+    def package_name
+      "inspec-profile-#{profile.name}"
+    end
+
+    def plan_contents
+      plan = <<-EOL
+pkg_name=#{package_name}
+pkg_version=#{profile.version}
+pkg_origin=#{habitat_origin}
+pkg_deps=(chef/inspec core/ruby core/hab)
+pkg_svc_user=root
+EOL
+
+      plan += "pkg_license='#{profile.metadata.params[:license]}'\n\n" if profile.metadata.params[:license]
+
+      plan += <<-EOL
+
+do_build() {
+  cp -vr $PLAN_CONTEXT/../src/* $HAB_CACHE_SRC_PATH/$pkg_dirname
+}
+
+do_install() {
+  local profile_contents
+  local excludes
+  profile_contents=($(ls))
+  excludes=(habitat results *.hart)
+
+  for item in ${excludes[@]}; do
+    profile_contents=(${profile_contents[@]/$item/})
+  done
+
+  cp -r ${profile_contents[@]} ${pkg_prefix}/dist/
+}
+      EOL
+
+      plan
+    end
+
+    def run_hook_contents
+      <<-EOL
+#!/bin/sh
+
+# redirect stderr to stdout
+# ultimately, we'd like to log this somewhere useful, but due to
+# https://github.com/habitat-sh/habitat/issues/2395, we need to
+# avoid doing that for now.
+exec 2>&1
+
+# InSpec will try to create a .cache directory in the user's home directory
+# so this needs to be someplace writeable by the hab user
+export HOME={{pkg.svc_var_path}}
+
+PROFILE_IDENT="{{pkg.origin}}/{{pkg.name}}"
+RESULTS_DIR="{{pkg.svc_var_path}}/inspec_results"
+RESULTS_FILE="${RESULTS_DIR}/{{pkg.name}}.json"
+
+# Create a directory for inspec formatter output
+mkdir -p {{pkg.svc_var_path}}/inspec_results
+
+while true; do
+  echo "Executing InSpec for ${PROFILE_IDENT}"
+  inspec exec {{pkg.path}}/dist --format=json > ${RESULTS_FILE}
+
+  if [ $? -eq 0 ]; then
+    echo "InSpec run completed successfully."
+  else
+    echo "InSpec run did not complete successfully. If you do not see any errors above,"
+    echo "control failures were detected. Check the InSpec results here for details:"
+    echo ${RESULTS_FILE}
+    echo "Otherwise, troubleshoot any errors shown above."
+  fi
+
+  source {{pkg.svc_config_path}}/settings.sh
+  echo "sleeping for ${SLEEP_TIME} seconds"
+  sleep ${SLEEP_TIME}
+done
+      EOL
+    end
+  end
+end

data/lib/bundles/inspec-habitat.rb

@@ -0,0 +1,12 @@
+# encoding: utf-8
+# author: Adam Leff
+
+libdir = File.dirname(__FILE__)
+$LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
+
+module Habitat
+  autoload :Log,     'inspec-habitat/log'
+  autoload :Profile, 'inspec-habitat/profile'
+end
+
+require 'inspec-habitat/cli'

data/lib/bundles/inspec-init/templates/profile/controls/example.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, The Authors
-# license: All rights reserved
 
 title 'sample section'
 

data/lib/bundles/inspec-init/templates/profile/inspec.yml

@@ -3,6 +3,6 @@ title: InSpec Profile
 maintainer: The Authors
 copyright: The Authors
 copyright_email: you@example.com
-license: All Rights Reserved
+license: Apache-2.0
 summary: An InSpec Compliance Profile
 version: 0.1.0

data/lib/bundles/inspec-supermarket/api.rb

@@ -4,6 +4,7 @@
 # author: Dominik Richter
 
 require 'net/http'
+require 'addressable/uri'
 
 module Supermarket
   class API
@@ -12,7 +13,7 @@ module Supermarket
     # displays a list of profiles
     def self.profiles(supermarket_url = SUPERMARKET_URL)
       url = "#{supermarket_url}/api/v1/tools-search"
-      _success, data = get(url, { q: 'compliance_profile' })
+      _success, data = get(url, { type: 'compliance_profile', items: 100 })
       if !data.nil?
         profiles = JSON.parse(data)
         profiles['items'].map { |x|
@@ -26,9 +27,10 @@ module Supermarket
     end
 
     def self.profile_name(profile)
-      uri = URI(profile)
+      # We use Addressable::URI here because URI has a bug in Ruby 2.1.x where it doesn't allow underscore in host
+      uri = Addressable::URI.parse profile
       [uri.host, uri.path[1..-1]]
-    rescue URI::Error => _e
+    rescue
       nil
     end
 
@@ -50,8 +52,8 @@ module Supermarket
       supermarket_tool['tool_owner'] == tool_owner && supermarket_tool['tool'] == tool
     end
 
-    def self.find(profile, supermarket_url)
-      profiles = Supermarket::API.profiles(supermarket_url=SUPERMARKET_URL)
+    def self.find(profile, supermarket_url = SUPERMARKET_URL)
+      profiles = Supermarket::API.profiles(supermarket_url)
       if !profiles.empty?
         index = profiles.index { |t| same?(profile, t, supermarket_url) }
         # return profile or nil

data/lib/bundles/inspec-supermarket/cli.rb

@@ -22,7 +22,7 @@ module Supermarket
 
       headline('Available profiles:')
       supermarket_profiles.each { |p|
-        li("#{p['tool_owner']}/#{p['slug']}")
+        li("#{p['tool_name']} #{mark_text(p['tool_owner'] + '/' + p['slug'])}")
       }
     end
 
@@ -45,7 +45,7 @@ module Supermarket
         "#{p['tool_owner']}/#{p['slug']}" == profile
       }
 
-      if found.length == 0
+      if found.empty?
         puts "#{mark_text(profile)} is not available on Supermarket"
         return
       end