inspec 1.0.0 → 1.35.1

data/lib/inspec/dependencies/resolver.rb

@@ -26,7 +26,7 @@ module Inspec
     def self.resolve(dependencies, cache, working_dir, backend)
       reqs = dependencies.map do |dep|
         req = Inspec::Requirement.from_metadata(dep, cache, cwd: working_dir, backend: backend)
-        req || fail("Cannot initialize dependency: #{req}")
+        req || raise("Cannot initialize dependency: #{req}")
       end
       new.resolve(reqs)
     end
@@ -40,7 +40,7 @@ module Inspec
                              else
                                "the dependency information for #{path_string.split(' ').last}"
                              end
-          fail Inspec::DuplicateDep, "The dependency #{dep.name} is listed twice in #{problem_cookbook}"
+          raise Inspec::DuplicateDep, "The dependency #{dep.name} is listed twice in #{problem_cookbook}"
         else
           seen_items_local << dep.name
         end
@@ -65,13 +65,13 @@ module Inspec
                           end
 
         if new_seen_items.key?(dep.resolved_source)
-          fail Inspec::CyclicDependencyError, "Dependency #{dep} would cause a dependency cycle (#{new_path_string})"
+          raise Inspec::CyclicDependencyError, "Dependency #{dep} would cause a dependency cycle (#{new_path_string})"
         else
           new_seen_items[dep.resolved_source] = true
         end
 
         if !dep.source_satisfies_spec?
-          fail Inspec::UnsatisfiedVersionSpecification, "The profile #{dep.name} from #{dep.resolved_source} has a version #{dep.source_version} which doesn't match #{dep.required_version}"
+          raise Inspec::UnsatisfiedVersionSpecification, "The profile #{dep.name} from #{dep.resolved_source} has a version #{dep.source_version} which doesn't match #{dep.required_version}"
         end
 
         Inspec::Log.debug("Adding dependency #{dep.name} (#{dep.resolved_source})")

data/lib/inspec/dsl.rb

@@ -19,7 +19,7 @@ module Inspec::DSL
   alias include_rules include_controls
 
   def require_resource(options = {})
-    fail 'You must specify a specific resource name when calling require_resource()' if options[:resource].nil?
+    raise 'You must specify a specific resource name when calling require_resource()' if options[:resource].nil?
 
     from_profile = options[:profile] || profile_name
     target_name = options[:as] || options[:resource]
@@ -33,12 +33,10 @@ module Inspec::DSL
 
     dep_entry = dependencies.list[profile_id]
     if dep_entry.nil?
-      fail <<EOF
-Cannot load #{profile_id} since it is not listed as a dependency
-of #{bind_context.profile_name}.
+      raise <<EOF
+Cannot load #{profile_id} since it is not listed as a dependency of #{bind_context.profile_name}.
 
 Dependencies available from this context are:
-
     #{dependencies.list.keys.join("\n    ")}
 EOF
     end

data/lib/inspec/env_printer.rb

@@ -5,6 +5,14 @@ require 'shellwords'
 
 module Inspec
   class EnvPrinter
+    attr_reader :shell
+
+    EVAL_COMMANDS = {
+      'bash' => 'eval \"$(inspec env bash)\"',
+      'fish' => 'inspec env fish > ~/.config/fish/completions/inspec.fish',
+      'zsh' => 'eval \"$(inspec env zsh)\"',
+    }.freeze
+
     def initialize(command_class, shell = nil)
       if !shell
         @detected = true
@@ -56,7 +64,7 @@ module Inspec
       puts <<EOF
 # To use this, eval it in your shell
 #
-#    eval "$(inspec env #{@shell})"
+#    #{EVAL_COMMANDS[shell]}
 #
 #
 EOF

data/lib/inspec/exceptions.rb

@@ -0,0 +1,8 @@
+# encoding: utf-8
+# copyright: 2017, Chef Software Inc.
+
+module Inspec
+  module Exceptions
+    class SecretsBackendNotFound < ArgumentError; end
+  end
+end

data/lib/inspec/fetcher.rb

@@ -34,7 +34,7 @@ module Inspec
 
   def self.fetcher(version)
     if version != 1
-      fail 'Only fetcher version 1 is supported!'
+      raise 'Only fetcher version 1 is supported!'
     end
     Inspec::Plugins::Fetcher
   end

data/lib/inspec/file_provider.rb

@@ -17,19 +17,36 @@ module Inspec
       elsif File.exist?(path)
         DirProvider.new(path)
       else
-        fail "No file provider for the provided path: #{path}"
+        raise "No file provider for the provided path: #{path}"
       end
     end
 
     def initialize(_path)
     end
 
+    # List all files that are offered.
+    #
+    # @return [Array[String]] list of file paths that are included
+    def files
+      raise "Fetcher #{self} does not implement `files()`. This is required."
+    end
+
+    # Read the contents of a file. This will typically refer to a text
+    # file reading a string.
+    #
+    # @param _file [String] path of the file to be read
+    # @return [String] contents of the file described
     def read(_file)
-      fail "#{self} does not implement `read(...)`. This is required."
+      raise "#{self} does not implement `read(...)`. This is required."
     end
 
-    def files
-      fail "Fetcher #{self} does not implement `files()`. This is required."
+    # Provide a method for reading binary contents from a file.
+    # It will default to #read if not defined. For most streams that implement
+    # it, it will be the same. For some special cases, it will add change the
+    # way in which encoding of the returned data structure is handled.
+    # Does not work with alias nor alias_method.
+    def binread(file)
+      read(file)
     end
 
     def relative_provider
@@ -65,6 +82,12 @@ module Inspec
       return nil unless File.file?(file)
       File.read(file)
     end
+
+    def binread(file)
+      return nil unless files.include?(file)
+      return nil unless File.file?(file)
+      File.binread(file)
+    end
   end
 
   class ZipProvider < FileProvider
@@ -74,9 +97,10 @@ module Inspec
       @path = path
       @contents = {}
       @files = []
-      ::Zip::InputStream.open(@path) do |io|
+      walk_zip(@path) do |io|
         while (entry = io.get_next_entry)
-          @files.push(entry.name.sub(%r{/+$}, ''))
+          name = entry.name.sub(%r{/+$}, '')
+          @files.push(name) unless name.empty?
         end
       end
     end
@@ -87,10 +111,14 @@ module Inspec
 
     private
 
+    def walk_zip(path, &callback)
+      ::Zip::InputStream.open(path, &callback)
+    end
+
     def read_from_zip(file)
       return nil unless @files.include?(file)
       res = nil
-      ::Zip::InputStream.open(@path) do |io|
+      walk_zip(@path) do |io|
         while (entry = io.get_next_entry)
           next unless file == entry.name
           res = io.read
@@ -108,8 +136,8 @@ module Inspec
       @path = path
       @contents = {}
       @files = []
-      Gem::Package::TarReader.new(Zlib::GzipReader.open(@path)) do |tar|
-        @files = tar.map(&:full_name)
+      walk_tar(@path) do |tar|
+        @files = tar.map(&:full_name).find_all { |x| !x.empty? }
       end
     end
 
@@ -119,11 +147,15 @@ module Inspec
 
     private
 
+    def walk_tar(path, &callback)
+      Gem::Package::TarReader.new(Zlib::GzipReader.open(path), &callback)
+    end
+
     def read_from_tar(file)
       return nil unless @files.include?(file)
       res = nil
       # NB `TarReader` includes `Enumerable` beginning with Ruby 2.x
-      Gem::Package::TarReader.new(Zlib::GzipReader.open(@path)) do |tar|
+      walk_tar(@path) do |tar|
         tar.each do |entry|
           next unless entry.file? && file == entry.full_name
           res = entry.read
@@ -148,7 +180,7 @@ module Inspec
       @parent = parent_provider
       @prefix = get_prefix(parent.files)
       if @prefix.nil?
-        fail "Could not determine path prefix for #{parent}"
+        raise "Could not determine path prefix for #{parent}"
       end
       @files = parent.files.find_all { |x| x.start_with?(prefix) && x != prefix }
                      .map { |x| x[prefix.length..-1] }
@@ -163,6 +195,10 @@ module Inspec
       parent.read(abs_path(file))
     end
 
+    def binread(file)
+      parent.binread(abs_path(file))
+    end
+
     private
 
     def get_prefix(fs)

data/lib/inspec/library_eval_context.rb

@@ -35,7 +35,7 @@ module Inspec
 
       c3 = Class.new do
         include Inspec::DSL::RequireOverride
-        def initialize(require_loader) # rubocop:disable Lint/NestedMethodDefinition
+        def initialize(require_loader)
           @require_loader = require_loader
         end
       end

data/lib/inspec/metadata.rb

@@ -1,20 +1,23 @@
 # encoding: utf-8
-# Copyright 2015 Dominik Richter. All rights reserved.
+# Copyright 2015 Dominik Richter
 # author: Dominik Richter
 # author: Christoph Hartmann
 
 require 'logger'
 require 'rubygems/version'
 require 'rubygems/requirement'
+require 'semverse'
+require 'utils/spdx'
 
 module Inspec
   # Extract metadata.rb information
   class Metadata # rubocop:disable Metrics/ClassLength
     attr_reader :ref
-    attr_accessor :params
+    attr_accessor :params, :content
     def initialize(ref, logger = nil)
       @ref = ref
       @logger = logger || Logger.new(nil)
+      @content = ''
       @params = {}
       @missing_methods = []
     end
@@ -68,6 +71,7 @@ module Inspec
                     os.method(family_check).call
                   )
 
+      # ensure we do have a string if we have a non-nil value eg. 16.06
       release_ok = release.nil? || os[:release] == release
 
       # we want to make sure that all matchers are true
@@ -99,7 +103,7 @@ module Inspec
     end
 
     # return all warn and errors
-    def valid
+    def valid # rubocop:disable Metrics/AbcSize
       errors = []
       warnings = []
 
@@ -107,11 +111,22 @@ module Inspec
         next unless params[field.to_sym].nil?
         errors.push("Missing profile #{field} in #{ref}")
       end
-      %w{ title summary maintainer copyright }.each do |field|
+
+      # if version is set, ensure it is correct
+      if !params[:version].nil? && !valid_version?(params[:version])
+        errors.push('Version needs to be in SemVer format')
+      end
+
+      %w{ title summary maintainer copyright license }.each do |field|
         next unless params[field.to_sym].nil?
         warnings.push("Missing profile #{field} in #{ref}")
       end
 
+      # if version is set, ensure it is in SPDX format
+      if !params[:license].nil? && !Spdx.valid_license?(params[:license])
+        warnings.push("License '#{params[:license]}' needs to be in SPDX format. See https://spdx.org/licenses/.")
+      end
+
       [errors, warnings]
     end
 
@@ -121,6 +136,13 @@ module Inspec
       errors.empty? && unsupported.empty?
     end
 
+    def valid_version?(value)
+      Semverse::Version.new(value)
+      true
+    rescue Semverse::InvalidVersionFormat
+      false
+    end
+
     def method_missing(sth, *args)
       @logger.warn "#{ref} doesn't support: #{sth} #{args}"
       @missing_methods.push(sth)
@@ -143,7 +165,9 @@ module Inspec
 
     def self.finalize_supports_elem(elem, logger)
       case x = elem
-      when Hash then x
+      when Hash
+        x[:release] = x[:release].to_s if x[:release]
+        x
       when Array
         logger.warn(
           'Failed to read supports entry that is an array. Please use '\
@@ -162,7 +186,7 @@ module Inspec
 
     def self.finalize_supports(supports, logger)
       case x = supports
-      when Hash   then [x]
+      when Hash   then [finalize_supports_elem(x, logger)]
       when Array  then x.map { |e| finalize_supports_elem(e, logger) }.compact
       when nil    then []
       else
@@ -174,37 +198,57 @@ module Inspec
       end
     end
 
-    def self.finalize(metadata, profile_id, logger = nil)
+    def self.finalize_name(metadata, profile_id, original_target)
+      # profile_id always overwrites whatever already exists as the name
+      unless profile_id.to_s.empty?
+        metadata.params[:name] = profile_id.to_s
+        return
+      end
+
+      # don't overwrite an existing name
+      return unless metadata.params[:name].nil?
+
+      # if there's a title, there is no need to set a name too
+      return unless metadata.params[:title].nil?
+
+      # create a new name based on the original target if it exists
+      metadata.params[:name] = "tests from #{original_target}" unless original_target.to_s.empty?
+    end
+
+    def self.finalize(metadata, profile_id, options, logger = nil)
       return nil if metadata.nil?
       param = metadata.params || {}
-      param['name'] = profile_id.to_s unless profile_id.to_s.empty?
+      options ||= {}
       param['version'] = param['version'].to_s unless param['version'].nil?
       metadata.params = symbolize_keys(param)
       metadata.params[:supports] = finalize_supports(metadata.params[:supports], logger)
+      finalize_name(metadata, profile_id, options[:target])
 
       metadata
     end
 
-    def self.from_yaml(ref, contents, profile_id, logger = nil)
+    def self.from_yaml(ref, content, profile_id, logger = nil)
       res = Metadata.new(ref, logger)
-      res.params = YAML.load(contents)
-      finalize(res, profile_id, logger)
+      res.params = YAML.load(content)
+      res.content = content
+      finalize(res, profile_id, {}, logger)
     end
 
-    def self.from_ruby(ref, contents, profile_id, logger = nil)
+    def self.from_ruby(ref, content, profile_id, logger = nil)
       res = Metadata.new(ref, logger)
-      res.instance_eval(contents, ref, 1)
-      finalize(res, profile_id, logger)
+      res.instance_eval(content, ref, 1)
+      res.content = content
+      finalize(res, profile_id, {}, logger)
     end
 
-    def self.from_ref(ref, contents, profile_id, logger = nil)
+    def self.from_ref(ref, content, profile_id, logger = nil)
       # NOTE there doesn't have to exist an actual file, it may come from an
-      # archive (i.e., contents)
+      # archive (i.e., content)
       case File.basename(ref)
       when 'inspec.yml'
-        from_yaml(ref, contents, profile_id, logger)
+        from_yaml(ref, content, profile_id, logger)
       when 'metadata.rb'
-        from_ruby(ref, contents, profile_id, logger)
+        from_ruby(ref, content, profile_id, logger)
       else
         logger ||= Logger.new(nil)
         logger.error "Don't know how to handle metadata in #{ref}"

data/lib/inspec/method_source.rb

@@ -0,0 +1,24 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  module MethodSource
+    def self.code_at(location, source_reader)
+      # TODO: logger for these cases
+      return '' if location.nil? || location[:ref].nil? || location[:line].nil?
+      return '' unless source_reader && source_reader.target
+
+      # TODO: Non-controls still need more detection
+      ref = location[:ref]
+      ref = ref.sub(source_reader.target.prefix, '')
+      src = source_reader.tests[ref]
+      return '' if src.nil?
+
+      ::MethodSource.expression_at(src.lines, location[:line]).force_encoding('utf-8')
+    rescue SyntaxError => e
+      raise ::MethodSource::SourceNotFoundError,
+            "Could not parse source at #{location[:ref]}:#{location[:line]}: #{e.message}"
+    end
+  end
+end

data/lib/inspec/objects/attribute.rb

@@ -21,6 +21,18 @@ module Inspec
       @opts[:default]
     end
 
+    def title
+      @opts[:title]
+    end
+
+    def description
+      @opts[:description]
+    end
+
+    def ruby_var_identifier
+      'attr_' + @name.downcase.strip.gsub(/\s+/, '-').gsub(/[^\w-]/, '')
+    end
+
     def to_hash
       {
         name: @name,
@@ -28,6 +40,15 @@ module Inspec
       }
     end
 
+    def to_ruby
+      res = ["#{ruby_var_identifier} = attribute('#{@name}',{"]
+      res.push "  title: '#{title}'," unless title.to_s.empty?
+      res.push "  default: '#{default}'," unless default.to_s.empty?
+      res.push "  description: '#{description}'," unless description.to_s.empty?
+      res.push '})'
+      res.join("\n")
+    end
+
     def to_s
       "Attribute #{@name} with #{@value}"
     end

data/lib/inspec/objects/control.rb

@@ -2,24 +2,30 @@
 
 module Inspec
   class Control
-    attr_accessor :id, :title, :desc, :impact, :tests
+    attr_accessor :id, :title, :desc, :impact, :tests, :tags
     def initialize
       @tests = []
+      @tags = []
     end
 
     def add_test(t)
       @tests.push(t)
     end
 
+    def add_tag(t)
+      @tags.push(t)
+    end
+
     def to_hash
-      { id: id, title: title, desc: desc, impact: impact, tests: tests.map(&:to_hash) }
+      { id: id, title: title, desc: desc, impact: impact, tests: tests.map(&:to_hash), tags: tags.map(&:to_hash) }
     end
 
     def to_ruby
       res = ["control #{id.inspect} do"]
       res.push "  title #{title.inspect}" unless title.to_s.empty?
-      res.push "  desc  #{desc.inspect}" unless desc.to_s.empty?
+      res.push "  desc  #{prettyprint_text(desc, 2)}" unless desc.to_s.empty?
       res.push "  impact #{impact}" unless impact.nil?
+      tags.each { |t| res.push(indent(t.to_ruby, 2)) }
       tests.each { |t| res.push(indent(t.to_ruby, 2)) }
       res.push 'end'
       res.join("\n")
@@ -27,6 +33,18 @@ module Inspec
 
     private
 
+    # Pretty-print a text block of InSpec code
+    #
+    # @param s [String] should not be empty
+    # @param depth [Int] indentation length for multiline text blocks
+    # @return [String] pretty-printed textblock
+    def prettyprint_text(s, depth)
+      txt = s.to_s.inspect.gsub('\n', "\n")
+      return txt if !txt.include?("\n")
+      middle = indent(txt[1..-2], depth+2)
+      txt[0] + "\n" + middle + "\n" + ' '*depth + txt[-1]
+    end
+
     def indent(txt, d)
       dt = ' '*d
       dt + txt.gsub("\n", "\n"+dt)

data/lib/inspec/objects/each_loop.rb

@@ -2,7 +2,8 @@
 
 module Inspec
   class EachLoop < List
-    attr_reader :tests, :variables
+    attr_reader :variables
+    attr_accessor :tests
     def initialize
       super
       @tests = []

data/lib/inspec/objects/list.rb

@@ -3,7 +3,7 @@
 module Inspec
   class List < Value
     def map
-      fail 'Inspec::List.map needs to be called with a block' unless block_given?
+      raise 'Inspec::List.map needs to be called with a block' unless block_given?
       t = List.new
       t.qualifier = [['x']]
       yield(t)

data/lib/inspec/objects/or_test.rb

@@ -5,15 +5,30 @@ module Inspec
     attr_reader :tests
     def initialize(tests)
       @tests = tests
+      @negated = false
     end
 
     def skip
       nil
     end
 
+    def negate!
+      @negated = !@negated
+    end
+
     def to_ruby
-      all_tests = @tests.map(&:to_ruby).join("\n").gsub("\n", "\n  ")
-      format("describe.one do\n  %s\nend", all_tests)
+      if @negated
+        # We don't use the describe.one wrapper when negated because:
+        # !(test1 || test2)     same as    (!test1 && !test2)    where && is implicit in inspec
+        all_tests = @tests.map { |test|
+          test.negate!
+          test
+        }.map(&:to_ruby).join("\n")
+        return all_tests
+      else
+        all_tests = @tests.map(&:to_ruby).join("\n").gsub("\n", "\n  ")
+        return format("describe.one do\n  %s\nend", all_tests)
+      end
     end
 
     def to_hash

data/lib/inspec/objects/tag.rb

@@ -0,0 +1,27 @@
+# encoding:utf-8
+
+module Inspec
+  class Tag
+    attr_accessor :key, :value
+
+    def initialize(key, value)
+      @key = key
+      @value = value
+    end
+
+    def to_hash
+      {
+        name: key,
+        value: value,
+      }
+    end
+
+    def to_ruby
+      "tag #{key.inspect}: #{value.inspect}"
+    end
+
+    def to_s
+      "Tag #{key} with #{value}"
+    end
+  end
+end

data/lib/inspec/objects/test.rb

@@ -53,7 +53,7 @@ module Inspec
           # this will go in its()
           xres = last_call
         else
-          res += '.' + ruby_qualifier(last)
+          res += '.' + ruby_qualifier(last) unless last_call.empty?
         end
       end
 
@@ -66,13 +66,14 @@ module Inspec
       res, xtra = describe_chain
       itsy = xtra.nil? ? 'it' : 'its(' + xtra.to_s.inspect + ')'
       naughty = @negated ? '_not' : ''
-      xpect = defined?(@expectation) ? expectation.inspect : ''
-      if matcher == 'match'
-        # without this, xpect values like / \/zones\// will not be parsed properly
-        xpect = "(#{xpect})"
-      elsif xpect != ''
-        xpect = ' ' + xpect
-      end
+      xpect = if !defined?(@expectation)
+                ''
+              elsif @expectation.class == Regexp
+                # without this, xpect values like / \/zones\// will not be parsed properly
+                "(#{@expectation.inspect})"
+              elsif xpect != ''
+                ' ' + expectation.inspect
+              end
       format("%sdescribe %s do\n  %s { should%s %s%s }\nend",
              vars, res, itsy, naughty, matcher, xpect)
     end

data/lib/inspec/objects.rb

@@ -2,6 +2,7 @@
 
 module Inspec
   autoload :Attribute, 'inspec/objects/attribute'
+  autoload :Tag, 'inspec/objects/tag'
   autoload :Control, 'inspec/objects/control'
   autoload :EachLoop, 'inspec/objects/each_loop'
   autoload :List, 'inspec/objects/list'