inspec 1.0.0 → 1.35.1

data/lib/inspec/plugins/fetcher.rb

@@ -3,7 +3,6 @@
 # author: Christoph Hartmann
 require 'utils/plugin_registry'
 require 'inspec/file_provider'
-require 'digest'
 
 module Inspec
   module Plugins
@@ -36,7 +35,7 @@ module Inspec
       # profile.
       #
       def archive_path
-        fail "Fetcher #{self} does not implement `archive_path()`. This is required."
+        raise "Fetcher #{self} does not implement `archive_path()`. This is required."
       end
 
       #
@@ -49,7 +48,7 @@ module Inspec
       # /foo/bar/baz.zip
       #
       def fetch(_path)
-        fail "Fetcher #{self} does not implement `fetch()`. This is required."
+        raise "Fetcher #{self} does not implement `fetch()`. This is required."
       end
 
       #
@@ -59,14 +58,14 @@ module Inspec
       # tag will be resolved to an exact revision.
       #
       def resolved_source
-        fail "Fetcher #{self} does not implement `resolved_source()`. This is required for terminal fetchers."
+        raise "Fetcher #{self} does not implement `resolved_source()`. This is required for terminal fetchers."
       end
 
       #
       # The unique key based on the content of the remote archive.
       #
       def cache_key
-        fail "Fetcher #{self} does not implement `cache_key()`. This is required for terminal fetchers."
+        raise "Fetcher #{self} does not implement `cache_key()`. This is required for terminal fetchers."
       end
 
       #

data/lib/inspec/plugins/resource.rb

@@ -38,7 +38,6 @@ module Inspec
     end
 
     def __register(name, obj)
-      # rubocop:disable Lint/NestedMethodDefinition
       cl = Class.new(obj) do
         def initialize(backend, name, *args)
           # attach the backend to this instance
@@ -59,7 +58,7 @@ module Inspec
         end
 
         def resource_skipped
-          @resource_skipped
+          @resource_skipped if defined?(@resource_skipped)
         end
 
         def skip_resource(message)

data/lib/inspec/plugins/source_reader.rb

@@ -15,7 +15,7 @@ module Inspec
       #
       # @return [Inspec::Metadata] profile metadata
       def metadata
-        fail "SourceReader #{self} does not implement `metadata()`. This method is required"
+        raise "SourceReader #{self} does not implement `metadata()`. This method is required"
       end
 
       # Retrieve this profile's tests
@@ -26,14 +26,14 @@ module Inspec
       #
       # @return [Hash] Collection with references pointing to test contents
       def tests
-        fail "SourceReader #{self} does not implement `tests()`. This method is required"
+        raise "SourceReader #{self} does not implement `tests()`. This method is required"
       end
 
       # Retrieve this profile's libraries
       #
       # @return [Hash] Collection with references pointing to library contents
       def libraries
-        fail "SourceReader #{self} does not implement `libraries()`. This method is required"
+        raise "SourceReader #{self} does not implement `libraries()`. This method is required"
       end
     end
   end

data/lib/inspec/plugins.rb

@@ -51,7 +51,7 @@ module Inspec
     def load(name)
       path = @registry[name]
       if path.nil?
-        fail "Couldn't find plugin #{name}. Searching in #{@home}"
+        raise "Couldn't find plugin #{name}. Searching in #{@home}"
       end
       # puts "Loading plugin #{name} from #{path}"
       require path

data/lib/inspec/polyfill.rb

@@ -2,7 +2,6 @@
 # copyright: 2016, Chef Software Inc.
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 class Struct
   unless instance_methods.include? :to_h

data/lib/inspec/profile.rb

@@ -1,9 +1,10 @@
 # encoding: utf-8
-# Copyright 2015 Dominik Richter. All rights reserved.
+# Copyright 2015 Dominik Richter
 # author: Dominik Richter
 # author: Christoph Hartmann
 
 require 'forwardable'
+require 'openssl'
 require 'inspec/polyfill'
 require 'inspec/cached_fetcher'
 require 'inspec/file_provider'
@@ -13,6 +14,8 @@ require 'inspec/backend'
 require 'inspec/rule'
 require 'inspec/log'
 require 'inspec/profile_context'
+require 'inspec/runtime_profile'
+require 'inspec/method_source'
 require 'inspec/dependencies/cache'
 require 'inspec/dependencies/lockfile'
 require 'inspec/dependencies/dependency_set'
@@ -21,26 +24,56 @@ module Inspec
   class Profile # rubocop:disable Metrics/ClassLength
     extend Forwardable
 
-    def self.resolve_target(target, cache = nil)
-      Inspec::CachedFetcher.new(target, cache || Cache.new)
+    def self.resolve_target(target, cache)
+      Inspec::Log.debug "Resolve #{target} into cache #{cache.path}"
+      Inspec::CachedFetcher.new(target, cache)
+    end
+
+    # Check if the profile contains a vendored cache, move content into global cache
+    # TODO: use relative file provider
+    # TODO: use source reader for Cache as well
+    def self.copy_deps_into_cache(file_provider, opts)
+      # filter content
+      cache = file_provider.files.find_all do |entry|
+        entry.start_with?('vendor')
+      end
+      content = Hash[cache.map { |x| [x, file_provider.binread(x)] }]
+      keys = content.keys
+      keys.each do |key|
+        next if content[key].nil?
+        # remove prefix
+        rel = Pathname.new(key).relative_path_from(Pathname.new('vendor')).to_s
+        tar = Pathname.new(opts[:cache].path).join(rel)
+
+        FileUtils.mkdir_p tar.dirname.to_s
+        Inspec::Log.debug "Copy #{tar} to cache directory"
+        File.binwrite(tar.to_s, content[key])
+      end
     end
 
     def self.for_path(path, opts)
       file_provider = FileProvider.for_path(path)
-      reader = Inspec::SourceReader.resolve(file_provider.relative_provider)
+      rp = file_provider.relative_provider
+
+      # copy embedded dependecies into global cache
+      copy_deps_into_cache(rp, opts) unless opts[:cache].nil?
+
+      reader = Inspec::SourceReader.resolve(rp)
       if reader.nil?
-        fail("Don't understand inspec profile in #{path}, it " \
+        raise("Don't understand inspec profile in #{path}, it " \
              "doesn't look like a supported profile structure.")
       end
       new(reader, opts)
     end
 
     def self.for_fetcher(fetcher, opts)
+      opts[:cache] = opts[:cache] || Cache.new
       path, writable = fetcher.fetch
       for_path(path, opts.merge(target: fetcher.target, writable: writable))
     end
 
     def self.for_target(target, opts = {})
+      opts[:cache] = opts[:cache] || Cache.new
       fetcher = resolve_target(target, opts[:cache])
       for_fetcher(fetcher, opts)
     end
@@ -52,21 +85,26 @@ module Inspec
 
     # rubocop:disable Metrics/AbcSize
     def initialize(source_reader, options = {})
-      @target = options.delete(:target)
+      @source_reader = source_reader
+      @target = options[:target]
       @logger = options[:logger] || Logger.new(nil)
       @locked_dependencies = options[:dependencies]
       @controls = options[:controls] || []
       @writable = options[:writable] || false
       @profile_id = options[:id]
       @cache = options[:cache] || Cache.new
-      @backend = options[:backend] || Inspec::Backend.create(options)
-      @source_reader = source_reader
+      @backend = options[:backend] || Inspec::Backend.create(options.select { |k, _| k != 'target' })
+      @attr_values = options[:attributes]
       @tests_collected = false
       @libraries_loaded = false
-      Metadata.finalize(@source_reader.metadata, @profile_id)
-      @runner_context = options[:profile_context] || Inspec::ProfileContext.for_profile(self,
-                                                                                        @backend,
-                                                                                        options[:attributes])
+      Metadata.finalize(@source_reader.metadata, @profile_id, options)
+
+      @runtime_profile = RuntimeProfile.new(self)
+      @backend.profile = @runtime_profile
+
+      @runner_context =
+        options[:profile_context] ||
+        Inspec::ProfileContext.for_profile(self, @backend, @attr_values)
     end
 
     def name
@@ -77,7 +115,7 @@ module Inspec
       metadata.params[:version]
     end
 
-    def writable? # rubocop:disable Style/TrivialAccessors
+    def writable?
       @writable
     end
 
@@ -172,10 +210,11 @@ module Inspec
 
       # add information about the required attributes
       res[:attributes] = res[:attributes].map(&:to_hash) unless res[:attributes].nil? || res[:attributes].empty?
+      res[:sha256] = sha256
       res
     end
 
-    # Check if the profile is internall well-structured. The logger will be
+    # Check if the profile is internally well-structured. The logger will be
     # used to print information on errors and warnings which are found.
     #
     # @return [Boolean] true if no errors were found, false otherwise
@@ -287,8 +326,6 @@ module Inspec
 
       # display all files that will be part of the archive
       @logger.debug 'Add the following files to archive:'
-      root_path = @source_reader.target.prefix
-      files = @source_reader.target.files
       files.each { |f| @logger.debug '    ' + f }
 
       if opts[:zip]
@@ -312,13 +349,21 @@ module Inspec
     end
 
     def lockfile_exists?
-      File.exist?(lockfile_path)
+      @source_reader.target.files.include?('inspec.lock')
     end
 
     def lockfile_path
       File.join(cwd, 'inspec.lock')
     end
 
+    def root_path
+      @source_reader.target.prefix
+    end
+
+    def files
+      @source_reader.target.files
+    end
+
     #
     # TODO(ssd): Relative path handling really needs to be carefully
     # thought through, especially with respect to relative paths in
@@ -330,7 +375,7 @@ module Inspec
 
     def lockfile
       @lockfile ||= if lockfile_exists?
-                      Inspec::Lockfile.from_file(lockfile_path)
+                      Inspec::Lockfile.from_content(@source_reader.target.read('inspec.lock'))
                     else
                       generate_lockfile
                     end
@@ -350,7 +395,27 @@ module Inspec
     end
 
     def load_dependencies
-      Inspec::DependencySet.from_lockfile(lockfile, cwd, @cache, @backend)
+      Inspec::DependencySet.from_lockfile(lockfile, cwd, @cache, @backend, { attributes: @attr_values })
+    end
+
+    # Calculate this profile's SHA256 checksum. Includes metadata, dependencies,
+    # libraries, data files, and controls.
+    #
+    # @return [Type] description of returned object
+    def sha256
+      # get all dependency checksums
+      deps = Hash[locked_dependencies.list.map { |k, v| [k, v.profile.sha256] }]
+
+      res = OpenSSL::Digest::SHA256.new
+      files = source_reader.tests.to_a + source_reader.libraries.to_a +
+              source_reader.data_files.to_a +
+              [['inspec.yml', source_reader.metadata.content]] +
+              [['inspec.lock.deps', YAML.dump(deps)]]
+
+      files.sort { |a, b| a[0] <=> b[0] }
+           .map { |f| res << f[0] << "\0" << f[1] << "\0" }
+
+      res.digest.unpack('H*')[0]
     end
 
     private
@@ -366,11 +431,14 @@ module Inspec
       end
 
       name = params[:name] ||
-             fail('Cannot create an archive without a profile name! Please '\
+             raise('Cannot create an archive without a profile name! Please '\
                   'specify the name in metadata or use --output to create the archive.')
+      version = params[:version] ||
+                raise('Cannot create an archive without a profile version! Please '\
+                     'specify the version in metadata or use --output to create the archive.')
       ext = opts[:zip] ? 'zip' : 'tar.gz'
       slug = name.downcase.strip.tr(' ', '-').gsub(/[^\w-]/, '_')
-      Pathname.new(Dir.pwd).join("#{slug}.#{ext}")
+      Pathname.new(Dir.pwd).join("#{slug}-#{version}.#{ext}")
     end
 
     def load_params
@@ -404,6 +472,7 @@ module Inspec
 
     def load_rule(rule, file, controls, groups)
       id = Inspec::Rule.rule_id(rule)
+      location = rule.instance_variable_get(:@__source_location)
       controls[id] = {
         title: rule.title,
         desc: rule.desc,
@@ -411,8 +480,8 @@ module Inspec
         refs: rule.ref,
         tags: rule.tag,
         checks: Inspec::Rule.checks(rule),
-        code: rule.instance_variable_get(:@__code),
-        source_location: rule.instance_variable_get(:@__source_location),
+        code: Inspec::MethodSource.code_at(location, source_reader),
+        source_location: location,
       }
 
       groups[file] ||= {

data/lib/inspec/profile_context.rb

@@ -21,7 +21,7 @@ module Inspec
     attr_accessor :rules
     def initialize(profile_id, backend, conf)
       if backend.nil?
-        fail 'ProfileContext is initiated with a backend == nil. ' \
+        raise 'ProfileContext is initiated with a backend == nil. ' \
              'This is a backend error which must be fixed upstream.'
       end
       @profile_id = profile_id

data/lib/inspec/profile_vendor.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'inspec/profile'
+
+module Inspec
+  class ProfileVendor
+    attr_reader :profile_path
+
+    def initialize(path)
+      @profile_path = Pathname.new(path)
+    end
+
+    def vendor!
+      vendor_dependencies
+    end
+
+    # The URL fetcher uses a Tempfile to retrieve the vendored
+    # profile, which creates a file that is only readable by
+    # the current user. In most circumstances, this is likely OK.
+    # However, in environments like a Habitat package, these files
+    # need to be readable by all users or the Habitat Supervisor
+    # may not be able to start InSpec correctly.
+    #
+    # This method makes sure all vendored files are mode 644 for this
+    # use case. This method is not called by default - the caller
+    # vendoring the profile must make the decision as to whether this
+    # is necessary.
+    def make_readable
+      Dir.glob("#{cache_path}/**/*") do |e|
+        FileUtils.chmod(0644, e) if File.file?(e)
+      end
+    end
+
+    def cache_path
+      profile_path.join('vendor')
+    end
+
+    def lockfile
+      profile_path.join('inspec.lock')
+    end
+
+    private
+
+    def profile
+      @profile ||= Inspec::Profile.for_target(profile_path.to_s, profile_opts)
+    end
+
+    def profile_opts
+      {
+        cache: Inspec::Cache.new(cache_path.to_s),
+        backend: Inspec::Backend.create(target: 'mock://'),
+      }
+    end
+
+    def vendor_dependencies
+      delete_vendored_data
+      File.write(lockfile, profile.generate_lockfile.to_yaml)
+    end
+
+    def delete_vendored_data
+      FileUtils.rm_rf(cache_path) if cache_path.exist?
+      File.delete(lockfile) if lockfile.exist?
+    end
+  end
+end

data/lib/inspec/resource.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 require 'inspec/plugins'
@@ -39,7 +38,7 @@ module Inspec
                             profile_context.subcontext_by_name(profile_name)
                           end
 
-          fail ProfileNotFound, "Cannot find profile named: #{profile_name}" if inner_context.nil?
+          raise ProfileNotFound, "Cannot find profile named: #{profile_name}" if inner_context.nil?
           inner_context.resource_registry[resource_name]
         end
 
@@ -48,6 +47,10 @@ module Inspec
             r.new(backend, id.to_s, *args)
           end
         end
+
+        define_method :inspec do
+          backend
+        end
       end
     end
   end
@@ -64,11 +67,12 @@ module Inspec
 
   def self.validate_resource_dsl_version!(version)
     if version != 1
-      fail 'Only resource version 1 is supported!'
+      raise 'Only resource version 1 is supported!'
     end
   end
 end
 
+require 'resources/aide_conf'
 require 'resources/apache'
 require 'resources/apache_conf'
 require 'resources/apt'
@@ -79,13 +83,21 @@ require 'resources/bash'
 require 'resources/bond'
 require 'resources/bridge'
 require 'resources/command'
+require 'resources/crontab'
+require 'resources/dh_params'
 require 'resources/directory'
+require 'resources/docker'
+require 'resources/docker_image'
+require 'resources/docker_container'
 require 'resources/etc_group'
+require 'resources/etc_hosts'
 require 'resources/file'
 require 'resources/gem'
 require 'resources/groups'
 require 'resources/grub_conf'
 require 'resources/host'
+require 'resources/http'
+require 'resources/iis_app'
 require 'resources/iis_site'
 require 'resources/inetd_conf'
 require 'resources/interface'
@@ -93,6 +105,7 @@ require 'resources/iptables'
 require 'resources/json'
 require 'resources/kernel_module'
 require 'resources/kernel_parameter'
+require 'resources/key_rsa'
 require 'resources/limits_conf'
 require 'resources/login_def'
 require 'resources/mount'
@@ -100,14 +113,19 @@ require 'resources/mssql_session'
 require 'resources/mysql'
 require 'resources/mysql_conf'
 require 'resources/mysql_session'
+require 'resources/nginx_conf'
 require 'resources/npm'
 require 'resources/ntp_conf'
 require 'resources/oneget'
+require 'resources/oracledb_session'
 require 'resources/os'
 require 'resources/os_env'
 require 'resources/package'
+require 'resources/packages'
 require 'resources/parse_config'
 require 'resources/passwd'
+require 'resources/postgres_hba_conf'
+require 'resources/postgres_ident_conf'
 require 'resources/pip'
 require 'resources/port'
 require 'resources/postgres'
@@ -115,6 +133,7 @@ require 'resources/postgres_conf'
 require 'resources/postgres_session'
 require 'resources/powershell'
 require 'resources/processes'
+require 'resources/rabbitmq_conf'
 require 'resources/registry_key'
 require 'resources/security_policy'
 require 'resources/service'
@@ -122,15 +141,22 @@ require 'resources/shadow'
 require 'resources/ssl'
 require 'resources/ssh_conf'
 require 'resources/sys_info'
+require 'resources/toml'
 require 'resources/users'
 require 'resources/vbscript'
+require 'resources/virtualization'
 require 'resources/windows_feature'
+require 'resources/windows_task'
 require 'resources/xinetd'
 require 'resources/wmi'
+require 'resources/x509_certificate'
 require 'resources/yum'
+require 'resources/zfs_dataset'
+require 'resources/zfs_pool'
 
 # file formats, depend on json implementation
 require 'resources/json'
 require 'resources/yaml'
 require 'resources/csv'
 require 'resources/ini'
+require 'resources/xml'