inspec 1.0.0 → 1.35.1

data/lib/fetchers/git.rb

@@ -24,7 +24,7 @@ module Fetchers
   # you got to this file during debugging, you may want to look at the
   # omnibus source for hints.
   #
-  class Git < Inspec.fetcher(1)
+  class Git < Inspec.fetcher(1) # rubocop:disable ClassLength
     name 'git'
     priority 200
 
@@ -44,6 +44,8 @@ module Fetchers
 
     def fetch(dir)
       @repo_directory = dir
+      FileUtils.mkdir_p(dir) unless Dir.exist?(dir)
+
       if cloned?
         checkout
       else
@@ -86,7 +88,7 @@ module Fetchers
       cmd = shellout("git ls-remote \"#{@remote_url}\" \"#{ref_name}*\"")
       ref = parse_ls_remote(cmd.stdout, ref_name)
       if !ref
-        fail "Unable to resolve #{ref_name} to a specific git commit for #{@remote_url}"
+        raise "Unable to resolve #{ref_name} to a specific git commit for #{@remote_url}"
       end
       ref
     end

data/lib/fetchers/local.rb

@@ -2,6 +2,8 @@
 # author: Dominik Richter
 # author: Christoph Hartmann
 
+require 'openssl'
+
 module Fetchers
   class Local < Inspec.fetcher(1)
     name 'local'
@@ -65,7 +67,8 @@ module Fetchers
 
     def sha256
       return nil if File.directory?(@target)
-      @archive_shasum ||= Digest::SHA256.hexdigest File.read(@target)
+      @archive_shasum ||=
+        OpenSSL::Digest::SHA256.digest(File.read(@target)).unpack('H*')[0]
     end
 
     def resolved_source

data/lib/fetchers/url.rb

@@ -3,12 +3,12 @@
 # author: Christoph Hartmann
 
 require 'uri'
-require 'digest'
+require 'openssl'
 require 'tempfile'
 require 'open-uri'
 
 module Fetchers
-  class Url < Inspec.fetcher(1)
+  class Url < Inspec.fetcher(1) # rubocop:disable Metrics/ClassLength
     MIME_TYPES = {
       'application/x-zip-compressed' => '.zip',
       'application/zip' => '.zip',
@@ -37,8 +37,8 @@ module Fetchers
       nil
     end
 
-    # Transforms a browser github url to github tar url
-    # We distinguish between three different Github URL types:
+    # Transforms a browser github/bitbucket url to github/bitbucket tar url
+    # We distinguish between three different Github/Bitbucket URL types:
     #  - Master URL
     #  - Branch URL
     #  - Commit URL
@@ -46,22 +46,39 @@ module Fetchers
     # master url:
     # https://github.com/nathenharvey/tmp_compliance_profile/ is transformed to
     # https://github.com/nathenharvey/tmp_compliance_profile/archive/master.tar.gz
+    # https://bitbucket.org/username/repo is transformed to
+    # https://bitbucket.org/username/repo/get/master.tar.gz
     #
-    # github branch:
+    # branch:
     # https://github.com/hardening-io/tests-os-hardening/tree/2.0 is transformed to
     # https://github.com/hardening-io/tests-os-hardening/archive/2.0.tar.gz
+    # https://bitbucket.org/username/repo/branch/branchname is transformed to
+    # https://bitbucket.org/username/repo/get/newbranch.tar.gz
     #
-    # github commit:
+    # commit:
     # https://github.com/hardening-io/tests-os-hardening/tree/48bd4388ddffde68badd83aefa654e7af3231876
     # is transformed to
     # https://github.com/hardening-io/tests-os-hardening/archive/48bd4388ddffde68badd83aefa654e7af3231876.tar.gz
+    # https://bitbucket.org/username/repo/commits/95ce1f83d5bbe9eec34c5973f6894617e8d6d8cc is transformed to
+    # https://bitbucket.org/username/repo/get/95ce1f83d5bbe9eec34c5973f6894617e8d6d8cc.tar.gz
+
     GITHUB_URL_REGEX = %r{^https?://(www\.)?github\.com/(?<user>[\w-]+)/(?<repo>[\w-]+)(\.git)?(/)?$}
     GITHUB_URL_WITH_TREE_REGEX = %r{^https?://(www\.)?github\.com/(?<user>[\w-]+)/(?<repo>[\w-]+)/tree/(?<commit>[\w\.]+)(/)?$}
+    BITBUCKET_URL_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)(\.git)?(/)?$}
+    BITBUCKET_URL_BRANCH_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)/branch/(?<branch>[\w\.]+)(/)?$}
+    BITBUCKET_URL_COMMIT_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)/commits/(?<commit>[\w\.]+)(/)?$}
+
     def self.transform(target)
       transformed_target = if m = GITHUB_URL_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
                              "https://github.com/#{m[:user]}/#{m[:repo]}/archive/master.tar.gz"
                            elsif m = GITHUB_URL_WITH_TREE_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
                              "https://github.com/#{m[:user]}/#{m[:repo]}/archive/#{m[:commit]}.tar.gz"
+                           elsif m = BITBUCKET_URL_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
+                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/master.tar.gz"
+                           elsif m = BITBUCKET_URL_BRANCH_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
+                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/#{m[:branch]}.tar.gz"
+                           elsif m = BITBUCKET_URL_COMMIT_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
+                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/#{m[:commit]}.tar.gz"
                            end
 
       if transformed_target
@@ -79,6 +96,8 @@ module Fetchers
       @insecure = opts['insecure']
       @token = opts['token']
       @config = opts
+      @archive_path = nil
+      @temp_archive_path = nil
     end
 
     def fetch(path)
@@ -101,7 +120,7 @@ module Fetchers
 
     def sha256
       file = @archive_path || temp_archive_path
-      Digest::SHA256.hexdigest File.read(file)
+      OpenSSL::Digest::SHA256.digest(File.read(file)).unpack('H*')[0]
     end
 
     def file_type_from_remote(remote)
@@ -124,9 +143,6 @@ module Fetchers
     def download_archive_to_temp
       return @temp_archive_path if ! @temp_archive_path.nil?
       Inspec::Log.debug("Fetching URL: #{@target}")
-      http_opts = {}
-      http_opts['ssl_verify_mode'.to_sym] = OpenSSL::SSL::VERIFY_NONE if @insecure
-      http_opts['Authorization'] = "Bearer #{@token}" if @token
       remote = open(@target, http_opts)
       @archive_type = file_type_from_remote(remote) # side effect :(
       archive = Tempfile.new(['inspec-dl-', @archive_type])
@@ -141,10 +157,48 @@ module Fetchers
     def download_archive(path)
       download_archive_to_temp
       final_path = "#{path}#{@archive_type}"
+      FileUtils.mkdir_p(File.dirname(final_path))
       FileUtils.mv(temp_archive_path, final_path)
       Inspec::Log.debug("Fetched archive moved to: #{final_path}")
       @temp_archive_path = nil
       final_path
     end
+
+    def http_opts
+      opts = {}
+      opts[:ssl_verify_mode] = OpenSSL::SSL::VERIFY_NONE if @insecure
+
+      if @config['server_type'] == 'automate'
+        opts['chef-delivery-enterprise'] = @config['automate']['ent']
+        if @config['automate']['token_type'] == 'dctoken'
+          opts['x-data-collector-token'] = @config['token']
+        else
+          opts['chef-delivery-user'] = @config['user']
+          opts['chef-delivery-token'] = @config['token']
+        end
+      elsif @token
+        opts['Authorization'] = "Bearer #{@token}"
+      end
+
+      # Do not send any headers that have nil values.
+      # Net::HTTP does not gracefully handle this situation.
+      check_for_missing_values!(opts)
+
+      opts
+    end
+
+    def check_for_missing_values!(opts)
+      keys_missing_values = opts.keys.delete_if do |k|
+        if opts[k].nil?
+          false
+        elsif opts[k].respond_to?(:empty?) && opts[k].empty?
+          false
+        else
+          true
+        end
+      end
+      raise 'Unable to fetch profile - the following HTTP headers have no value: ' \
+        "#{keys_missing_values.join(', ')}" unless keys_missing_values.empty?
+    end
   end
 end

data/lib/inspec/archive/tar.rb

@@ -17,7 +17,7 @@ module Inspec::Archive
                 tar.mkdir(input_filename, stat.mode)
               else
                 tar.add_file_simple(input_filename, stat.mode, stat.size) do |io|
-                  io.write(File.read(path))
+                  io.write(File.binread(path))
                 end
               end
             end

data/lib/inspec/backend.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Dominik Richter
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -8,6 +7,27 @@ require 'train'
 
 module Inspec
   module Backend
+    module Base
+      attr_accessor :profile
+
+      # Provide a shorthand to retrieve the inspec version from within a profile
+      #
+      # @return [String] inspec version
+      def version
+        Inspec::VERSION
+      end
+
+      # Ruby internal for printing a nice name for this class
+      def to_s
+        'Inspec::Backend::Class'
+      end
+
+      # Ruby internal for pretty-printing a summary for this class
+      def inspect
+        "Inspec::Backend::Class @transport=#{backend.class}"
+      end
+    end
+
     # Create the transport backend with aggregated resources.
     #
     # @param [Hash] config for the transport backend
@@ -17,18 +37,21 @@ module Inspec
       name = Train.validate_backend(conf)
       transport = Train.create(name, conf)
       if transport.nil?
-        fail "Can't find transport backend '#{name}'."
+        raise "Can't find transport backend '#{name}'."
       end
 
       connection = transport.connection
       if connection.nil?
-        fail "Can't connect to transport backend '#{name}'."
+        raise "Can't connect to transport backend '#{name}'."
       end
 
       cls = Class.new do
+        include Base
+
         define_method :backend do
           connection
         end
+
         Inspec::Resource.registry.each do |id, r|
           define_method id.to_sym do |*args|
             r.new(self, id.to_s, *args)

data/lib/inspec/base_cli.rb

@@ -4,6 +4,7 @@
 
 require 'thor'
 require 'inspec/log'
+require 'inspec/profile_vendor'
 
 module Inspec
   class BaseCLI < Thor # rubocop:disable Metrics/ClassLength
@@ -18,7 +19,7 @@ module Inspec
         desc: 'Specify the login port for a remote scan.'
       option :user, type: :string,
         desc: 'The login user for a remote scan.'
-      option :password, type: :string,
+      option :password, type: :string, lazy_default: -1,
         desc: 'Login password for a remote scan, if required.'
       option :key_files, aliases: :i, type: :array,
         desc: 'Login key or certificate file for a remote scan.'
@@ -26,20 +27,24 @@ module Inspec
         desc: 'Login path to use when connecting to the target (WinRM).'
       option :sudo, type: :boolean,
         desc: 'Run scans with sudo. Only activates on Unix and non-root user.'
-      option :sudo_password, type: :string,
+      option :sudo_password, type: :string, lazy_default: -1,
         desc: 'Specify a sudo password, if it is required.'
       option :sudo_options, type: :string,
         desc: 'Additional sudo options for a remote scan.'
       option :sudo_command, type: :string,
         desc: 'Alternate command for sudo.'
+      option :shell, type: :boolean,
+        desc: 'Run scans in a subshell. Only activates on Unix.'
+      option :shell_options, type: :string,
+        desc: 'Additional shell options.'
+      option :shell_command, type: :string,
+        desc: 'Specify a particular shell to use.'
       option :ssl, type: :boolean,
         desc: 'Use SSL for transport layer encryption (WinRM).'
       option :self_signed, type: :boolean,
         desc: 'Allow remote scans with self-signed certificates (WinRM).'
       option :json_config, type: :string,
         desc: 'Read configuration from JSON file (`-` reads from stdin).'
-      option :log_level, aliases: :l, type: :string,
-        desc: 'Set the log level: info (default), debug, warn, error'
     end
 
     def self.profile_options
@@ -53,7 +58,7 @@ module Inspec
       option :controls, type: :array,
         desc: 'A list of controls to run. Ignore all other tests.'
       option :format, type: :string,
-        desc: 'Which formatter to use: cli, progress, documentation, json, json-min'
+        desc: 'Which formatter to use: cli, progress, documentation, json, json-min, junit'
       option :color, type: :boolean, default: true,
         desc: 'Use colors in output.'
       option :attrs, type: :array,
@@ -76,7 +81,7 @@ module Inspec
       runner = Inspec::Runner.new(o)
       targets.each { |target| runner.add_target(target) }
       exit runner.run
-    rescue RuntimeError, Train::UserError => e
+    rescue ArgumentError, RuntimeError, Train::UserError => e
       $stderr.puts e.message
       exit 1
     end
@@ -95,6 +100,23 @@ module Inspec
     end
 
     def opts
+      o = merged_opts
+
+      # Due to limitations in Thor it is not possible to set an argument to be
+      # both optional and its value to be mandatory. E.g. the user supplying
+      # the --password argument is optional and not always required, but
+      # whenever it is used, it requires a value. Handle options that were
+      # defined above and require a value here:
+      %w{password sudo-password}.each do |v|
+        id = v.tr('-', '_').to_sym
+        next unless o[id] == -1
+        raise ArgumentError, "Please provide a value for --#{v}. For example: --#{v}=hello."
+      end
+
+      o
+    end
+
+    def merged_opts
       # argv overrides json
       Thor::CoreExt::HashWithIndifferentAccess.new(options_json.merge(options))
     end
@@ -138,10 +160,25 @@ module Inspec
         $stderr.puts exception.message
         exit(1)
       else
-        raise exception # rubocop:disable Style/SignalException
+        raise exception
       end
     end
 
+    def vendor_deps(path, opts)
+      profile_path = path || Dir.pwd
+      profile_vendor = Inspec::ProfileVendor.new(profile_path)
+
+      if (profile_vendor.cache_path.exist? || profile_vendor.lockfile.exist?) && !opts[:overwrite]
+        puts 'Profile is already vendored. Use --overwrite.'
+        return false
+      end
+
+      profile_vendor.vendor!
+      puts "Dependencies for profile #{profile_path} successfully vendored to #{profile_vendor.cache_path}"
+    rescue StandardError => e
+      pretty_handle_exception(e)
+    end
+
     def configure_logger(o)
       #
       # TODO(ssd): This is a big gross, but this configures the

data/lib/inspec/cached_fetcher.rb

@@ -12,7 +12,7 @@ module Inspec
       @fetcher = Inspec::Fetcher.resolve(target)
 
       if @fetcher.nil?
-        fail("Could not fetch inspec profile in #{target.inspect}.")
+        raise("Could not fetch inspec profile in #{target.inspect}.")
       end
 
       @cache = cache
@@ -50,7 +50,7 @@ module Inspec
     def assert_cache_sanity!
       if target.respond_to?(:key?) && target.key?(:sha256)
         if fetcher.resolved_source[:sha256] != target[:sha256]
-          fail <<EOF
+          raise <<EOF
 The remote source #{fetcher} no longer has the requested content:
 
 Request Content Hash: #{target[:sha256]}

data/lib/inspec/cli.rb

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 # encoding: utf-8
-# Copyright 2015 Dominik Richter. All rights reserved.
+# Copyright 2015 Dominik Richter
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -9,10 +9,12 @@ require 'thor'
 require 'json'
 require 'pp'
 require 'utils/json_log'
+require 'utils/latest_version'
 require 'inspec/base_cli'
 require 'inspec/plugins'
 require 'inspec/runner_mock'
 require 'inspec/env_printer'
+require 'inspec/schema'
 
 class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
   class_option :log_level, aliases: :l, type: :string,
@@ -34,6 +36,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
     diagnose
     o = opts.dup
     o[:ignore_supports] = true
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
 
     profile = Inspec::Profile.for_target(target, o)
     dst = o[:output].to_s
@@ -58,8 +61,8 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
   def check(path) # rubocop:disable Metrics/AbcSize
     diagnose
     o = opts.dup
-    # configure_logger(o) # we do not need a logger for check yet
     o[:ignore_supports] = true # we check for integrity only
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
 
     # run check
     profile = Inspec::Profile.for_target(path, o)
@@ -103,14 +106,12 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
     pretty_handle_exception(e)
   end
 
-  desc 'vendor', 'Download all dependencies and generate a lockfile'
+  desc 'vendor PATH', 'Download all dependencies and generate a lockfile in a `vendor` directory'
+  option :overwrite, type: :boolean, default: false,
+    desc: 'Overwrite existing vendored dependencies and lockfile.'
   def vendor(path = nil)
-    configure_logger(opts)
-    profile = Inspec::Profile.for_target('./', opts.merge(cache: Inspec::Cache.new(path)))
-    lockfile = profile.generate_lockfile
-    File.write('inspec.lock', lockfile.to_yaml)
-  rescue StandardError => e
-    pretty_handle_exception(e)
+    o = opts.dup
+    vendor_deps(path, o)
   end
 
   desc 'archive PATH', 'archive a profile to tar.gz (default) or zip'
@@ -131,12 +132,13 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
     o = opts.dup
     o[:logger] = Logger.new(STDOUT)
     o[:logger].level = get_log_level(o.log_level)
+    o[:backend] = Inspec::Backend.create(target: 'mock://')
 
     profile = Inspec::Profile.for_target(path, o)
     result = profile.check
 
     if result && !opts[:ignore_errors] == false
-      @logger.info 'Profile check failed. Please fix the profile before generating an archive.'
+      o[:logger].info 'Profile check failed. Please fix the profile before generating an archive.'
       return exit 1
     end
 
@@ -184,7 +186,7 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
   option :command, aliases: :c,
     desc: 'A single command string to run instead of launching the shell'
   option :format, type: :string, default: nil, hide: true,
-    desc: 'Which formatter to use: cli, progress, documentation, json, json-min'
+    desc: 'Which formatter to use: cli, progress, documentation, json, json-min, junit'
   def shell_func
     diagnose
     o = opts.dup
@@ -220,10 +222,30 @@ class Inspec::InspecCLI < Inspec::BaseCLI # rubocop:disable Metrics/ClassLength
     pretty_handle_exception(e)
   end
 
+  desc 'schema NAME', 'print the JSON schema', hide: true
+  def schema(name)
+    puts Inspec::Schema.json(name)
+  rescue StandardError => e
+    puts e
+    puts "Valid schemas are #{Inspec::Schema.names.join(', ')}"
+  end
+
   desc 'version', 'prints the version of this tool'
+  option :format, type: :string
   def version
-    puts Inspec::VERSION
+    if opts['format'] == 'json'
+      v = { version: Inspec::VERSION }
+      puts v.to_json
+    else
+      puts Inspec::VERSION
+      # display outdated version
+      latest = LatestInSpecVersion.new.latest
+      if Gem::Version.new(Inspec::VERSION) < Gem::Version.new(latest)
+        puts "\nYour version of InSpec is out of date! The latest version is #{latest}."
+      end
+    end
   end
+  map %w{-v --version} => :version
 
   private
 

data/lib/inspec/completions/fish.sh.erb

@@ -0,0 +1,34 @@
+function __fish_inspec_no_command --description 'Test if inspec has yet to be given the main command'
+  set -l cmd (commandline -opc)
+  test (count $cmd) -eq 1
+end
+
+function __fish_inspec_using_command
+  set -l cmd (commandline -opc)
+  set -q cmd[2]; and test "$argv[1]" = $cmd[2]
+end
+
+function __fish_inspec_using_command_and_no_subcommand
+  set -l cmd (commandline -opc)
+  test (count $cmd) -eq 2; and test "$argv[1]" = "$cmd[2]"
+end
+
+function __fish_inspec_using_subcommand --argument-names cmd_main cmd_sub
+    set -l cmd (commandline -opc)
+    set -q cmd[3]; and test "$cmd_main" = $cmd[2] -a "$cmd_sub" = $cmd[3]
+end
+
+<% top_level_commands_with_descriptions.each do |command_and_description| %>
+  <% command, description = command_and_description.split(':') %>
+  <% description.gsub!(/\\/, '') %>
+  # <%= command %> commands
+  complete -c inspec -f -n '__fish_inspec_no_command' -a <%= command %> -d "<%= description %>"
+  # <%= command %> help
+  complete -c inspec -f -n '__fish_inspec_using_command help' -a <%= command %> -d "<%= description %>"
+
+  <% (subcommands_with_commands_and_descriptions[command] || []).each do |command_and_description| %>
+    <% subcommand, description = command_and_description.split(':') %>
+    <% description.gsub!(/\\/, '') %>
+    complete -c inspec -f -n '__fish_inspec_using_command_and_no_subcommand <%= command %>' -a <%= subcommand %> -d "<%= description %>"
+  <% end %>
+<% end %>

data/lib/inspec/control_eval_context.rb

@@ -35,8 +35,6 @@ module Inspec
     # @param profile_context [Inspec::ProfileContext]
     # @param outer_dsl [OuterDSLClass]
     # @return [ProfileContextClass]
-    #
-    # rubocop:disable Lint/NestedMethodDefinition
     def self.create(profile_context, resources_dsl) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
       rule_class = rule_context(resources_dsl)
       profile_context_owner = profile_context

data/lib/inspec/dependencies/cache.rb

@@ -1,5 +1,4 @@
 # encoding: utf-8
-require 'digest'
 require 'fileutils'
 
 module Inspec

data/lib/inspec/dependencies/dependency_set.rb

@@ -14,9 +14,9 @@ module Inspec
     # @param cwd [String] Current working directory for relative path includes
     # @param vendor_path [String] Path to the vendor directory
     #
-    def self.from_lockfile(lockfile, cwd, cache, backend)
+    def self.from_lockfile(lockfile, cwd, cache, backend, opts = {})
       dep_tree = lockfile.deps.map do |dep|
-        Inspec::Requirement.from_lock_entry(dep, cwd, cache, backend)
+        Inspec::Requirement.from_lock_entry(dep, cwd, cache, backend, opts)
       end
 
       dep_list = flatten_dep_tree(dep_tree)

data/lib/inspec/dependencies/lockfile.rb

@@ -15,17 +15,23 @@ module Inspec
       new(lockfile_content)
     end
 
-    def self.from_file(path)
-      parsed_content = YAML.load(File.read(path))
+    def self.from_content(content)
+      parsed_content = YAML.load(content)
       version = parsed_content['lockfile_version']
-      fail "No lockfile_version set in #{path}!" if version.nil?
+      raise "No lockfile_version set in #{path}!" if version.nil?
       validate_lockfile_version!(version.to_i)
       new(parsed_content)
     end
 
+    def self.from_file(path)
+      content = File.read(path)
+      from_content(content)
+    end
+
+    # rubocop:disable Style/GuardClause
     def self.validate_lockfile_version!(version)
       if version < MINIMUM_SUPPORTED_VERSION
-        fail <<EOF
+        raise <<EOF
 This lockfile specifies a lockfile_version of #{version} which is
 lower than the minimum supported version #{MINIMUM_SUPPORTED_VERSION}.
 
@@ -34,7 +40,7 @@ Please create a new lockfile for this project by running:
     inspec vendor
 EOF
       elsif version > CURRENT_LOCKFILE_VERSION
-        fail <<EOF
+        raise <<EOF
 This lockfile claims to be version #{version} which is greater than
 the most recent lockfile version(#{CURRENT_LOCKFILE_VERSION}).
 
@@ -43,6 +49,7 @@ used to create the lockfile.
 EOF
       end
     end
+    # rubocop:enable Style/GuardClause
 
     attr_reader :version, :deps
     def initialize(lockfile_content_hash)
@@ -75,7 +82,7 @@ EOF
       else
         # If we've gotten here, there is likely a mistake in the
         # lockfile version validation in the constructor.
-        fail "No lockfile parser for version #{version}"
+        raise "No lockfile parser for version #{version}"
       end
     end
 

data/lib/inspec/dependencies/requirement.rb

@@ -1,7 +1,6 @@
 # encoding: utf-8
 require 'inspec/cached_fetcher'
 require 'inspec/dependencies/dependency_set'
-require 'digest'
 
 module Inspec
   #
@@ -10,20 +9,20 @@ module Inspec
   #
   class Requirement
     def self.from_metadata(dep, cache, opts)
-      fail 'Cannot load empty dependency.' if dep.nil? || dep.empty?
+      raise 'Cannot load empty dependency.' if dep.nil? || dep.empty?
       new(dep[:name], dep[:version], cache, opts[:cwd], opts.merge(dep))
     end
 
-    def self.from_lock_entry(entry, cwd, cache, backend)
+    def self.from_lock_entry(entry, cwd, cache, backend, opts = {})
       req = new(entry[:name],
                 entry[:version_constraints],
                 cache,
                 cwd,
-                entry[:resolved_source].merge(backend: backend))
+                entry[:resolved_source].merge(backend: backend).merge(opts))
 
       locked_deps = []
       Array(entry[:dependencies]).each do |dep_entry|
-        locked_deps << Inspec::Requirement.from_lock_entry(dep_entry, cwd, cache, backend)
+        locked_deps << Inspec::Requirement.from_lock_entry(dep_entry, cwd, cache, backend, opts)
       end
       req.lock_deps(locked_deps)
       req
@@ -85,6 +84,7 @@ module Inspec
       @fetcher ||= Inspec::CachedFetcher.new(opts, @cache)
     end
 
+    # load dependencies of the dependency
     def dependencies
       @dependencies ||= profile.metadata.dependencies.map do |r|
         Inspec::Requirement.from_metadata(r, @cache, cwd: @cwd, backend: @backend)
@@ -95,9 +95,9 @@ module Inspec
       name
     end
 
+    # load the profile for the requirement
     def profile
       return @profile if ! @profile.nil?
-
       opts = @opts.dup
       opts[:backend] = @backend
       if !@dependencies.nil?