inspec 1.0.0 → 1.35.1

data/lib/inspec/rule.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Dominik Richter
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -39,7 +38,6 @@ module Inspec
 
       # not changeable by the user:
       @__block = block
-      @__code = __get_block_source(&block)
       @__source_location = __get_block_source_location(&block)
       @__rule_id = id
       @__profile_id = profile_id
@@ -231,24 +229,22 @@ module Inspec
       end
     end
 
-    # Idio(ma)tic unindent
-    # TODO: replace this
+    # Idio(ma)tic unindent, behaves similar to Ruby2.3 curly heredocs.
+    # Find the shortest indentation of non-empty lines and strip that from every line
+    # See: https://bugs.ruby-lang.org/issues/9098
+    #
+    # It is implemented here to support pre-Ruby2.3 with this feature and
+    # to not force non-programmers to understand heredocs.
+    #
+    # Please note: tabs are not supported! (they will be removed but they are not
+    # treated the same as in Ruby2.3 heredocs)
     #
     # @param [String] text string which needs to be unindented
-    # @return [String] input with indentation removed
+    # @return [String] input with indentation removed; '' if input is nil
     def unindent(text)
       return '' if text.nil?
-      text.strip.split("\n").map(&:strip)
-          .map { |x| x.empty? ? "\n" : x }
-          .join(' ')
-    end
-
-    # get the rule's source code
-    def __get_block_source(&block)
-      return '' unless block_given?
-      block.source.to_s
-    rescue MethodSource::SourceNotFoundError
-      ''
+      len = text.split("\n").reject { |l| l.strip.empty? }.map { |x| x.index(/[^\s]/) }.compact.min
+      text.gsub(/^[[:blank:]]{#{len}}/, '').strip
     end
 
     # get the source location of the block

data/lib/inspec/runner.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Dominik Richter
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -80,7 +79,12 @@ module Inspec
         @test_collector.add_profile(profile)
         write_lockfile(profile) if @create_lockfile
         profile.locked_dependencies
-        profile.load_libraries
+        profile_context = profile.load_libraries
+
+        profile_context.dependencies.list.values.each do |requirement|
+          @test_collector.add_profile(requirement.profile)
+        end
+
         @attributes |= profile.runner_context.attributes
         all_controls += profile.collect_tests
       end
@@ -114,17 +118,24 @@ module Inspec
 
     # determine all attributes before the execution, fetch data from secrets backend
     def load_attributes(options)
-      attributes = {}
-      # read endpoints for secrets eg. yml file
-      secrets_targets = options['attrs']
-      unless secrets_targets.nil?
-        secrets_targets.each do |target|
-          secrets = Inspec::SecretsBackend.resolve(target)
-          # merge hash values
-          attributes = attributes.merge(secrets.attributes) unless secrets.nil? || secrets.attributes.nil?
+      options[:attributes] ||= {}
+
+      secrets_targets = options[:attrs]
+      return options[:attributes] if secrets_targets.nil?
+
+      secrets_targets.each do |target|
+        secrets = Inspec::SecretsBackend.resolve(target)
+        if secrets.nil?
+          raise Inspec::Exceptions::SecretsBackendNotFound,
+                "Unable to find a parser for attributes file #{target}. " \
+                'Check to make sure the file exists and has the appropriate extension.'
         end
+
+        next if secrets.attributes.nil?
+        options[:attributes].merge!(secrets.attributes)
       end
-      options['attributes'] = attributes
+
+      options[:attributes]
     end
 
     #
@@ -159,7 +170,7 @@ module Inspec
                                            backend: @backend,
                                            controls: @controls,
                                            attributes: @conf[:attributes])
-      fail "Could not resolve #{target} to valid input." if profile.nil?
+      raise "Could not resolve #{target} to valid input." if profile.nil?
       @target_profiles << profile if supports_profile?(profile)
     end
 
@@ -167,13 +178,13 @@ module Inspec
       return true if @ignore_supports
 
       if !profile.supports_runtime?
-        fail 'This profile requires InSpec version '\
+        raise 'This profile requires InSpec version '\
              "#{profile.metadata.inspec_requirement}. You are running "\
              "InSpec v#{Inspec::VERSION}.\n"
       end
 
       if !profile.supports_os?
-        fail "This OS/platform (#{@backend.os[:name]}) is not supported by this profile."
+        raise "This OS/platform (#{@backend.os[:name]}) is not supported by this profile."
       end
 
       true
@@ -242,7 +253,7 @@ module Inspec
           # otherwise return all working tests
           return ok_tests
         else
-          fail "A rule was registered with #{method_name.inspect}, "\
+          raise "A rule was registered with #{method_name.inspect}, "\
                "which isn't understood and cannot be processed."
         end
       end

data/lib/inspec/runner_rspec.rb

@@ -103,6 +103,7 @@ module Inspec
       'json' => 'InspecRspecJson',
       'json-rspec' => 'InspecRspecVanilla',
       'cli' => 'InspecRspecCli',
+      'junit' => 'InspecRspecJUnit',
     }.freeze
 
     # Configure the output formatter and stream to be used with RSpec.

data/lib/inspec/runtime_profile.rb

@@ -0,0 +1,26 @@
+# encoding: utf-8
+# Copyright 2017 Chef Software
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  class RuntimeProfile
+    attr_reader :files
+
+    def initialize(profile)
+      @src = profile.source_reader
+      @files = @src.data_files.keys.map do |k|
+        k.sub('files' + File::SEPARATOR, '')
+      end
+    end
+
+    # Retrieve a profile file's contents
+    #
+    # @param name [String] the name of the file
+    # @return [String] contents of the file of RuntimeError if missing
+    def file(name)
+      @src.data_files[File.join('files', name)] ||
+        raise("Cannot find file #{name} in profile.")
+    end
+  end
+end

data/lib/inspec/schema.rb

@@ -0,0 +1,185 @@
+# encoding: utf-8
+require 'json'
+
+module Inspec
+  class Schema # rubocop:disable Metrics/ClassLength
+    STATISTICS = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'duration' => { 'type' => 'number' },
+      },
+    }.freeze
+
+    PLATFORM = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'name' => { 'type' => 'string' },
+        'release' => { 'type' => 'string' },
+      },
+    }.freeze
+
+    # Tags are open right, with simple key-value associations and not restrictions
+    TAGS = { 'type' => 'object' }.freeze
+
+    RESULT = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'status' => { 'type' => 'string' },
+        'code_desc' => { 'type' => 'string' },
+        'run_time' => { 'type' => 'number' },
+        'start_time' => { 'type' => 'string' },
+        'skip_message' => { 'type' => 'string', 'optional' => true },
+        'resource' => { 'type' => 'string', 'optional' => true },
+      },
+    }.freeze
+
+    REF = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'ref' => { 'type' => 'string' },
+        # TODO: One of these needs to be deprecated
+        'uri' => { 'type' => 'string', 'optional' => true },
+        'url' => { 'type' => 'string', 'optional' => true },
+      },
+    }.freeze
+    REFS = { 'type' => 'array', 'items' => REF }.freeze
+
+    CONTROL = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'id' => { 'type' => 'string' },
+        'title' => { 'type' => %w{string null} },
+        'desc' => { 'type' => %w{string null} },
+        'impact' => { 'type' => 'number' },
+        'refs' => REFS,
+        'tags' => TAGS,
+        'code' => { 'type' => 'string' },
+        'source_location' => {
+          'type' => 'object',
+          'properties' => {
+            'ref' => { 'type' => 'string' },
+            'line' => { 'type' => 'number' },
+          },
+        },
+        'results' => { 'type' => 'array', 'items' => RESULT },
+      },
+    }.freeze
+
+    SUPPORTS = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'os-family' => { 'type' => 'string', 'optional' => true },
+      },
+    }.freeze
+
+    CONTROL_GROUP = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'id' => { 'type' => 'string' },
+        'title' => { 'type' => 'string', 'optional' => true },
+        'controls' => { 'type' => 'array', 'items' => { 'type' => 'string' } },
+      },
+    }.freeze
+
+    PROFILE = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'name' => { 'type' => 'string' },
+        'version' => { 'type' => 'string', 'optional' => true },
+        'sha256' => { 'type' => 'string', 'optional' => false },
+
+        'title' => { 'type' => 'string', 'optional' => true },
+        'maintainer' => { 'type' => 'string', 'optional' => true },
+        'copyright' => { 'type' => 'string', 'optional' => true },
+        'copyright_email' => { 'type' => 'string', 'optional' => true },
+        'license' => { 'type' => 'string', 'optional' => true },
+        'summary' => { 'type' => 'string', 'optional' => true },
+
+        'supports' => {
+          'type' => 'array',
+          'items' => SUPPORTS,
+          'optional' => true,
+        },
+        'controls' => {
+          'type' => 'array',
+          'items' => CONTROL,
+        },
+        'groups' => {
+          'type' => 'array',
+          'items' => CONTROL_GROUP,
+        },
+        'attributes' => {
+          'type' => 'array',
+          # TODO: more detailed specification needed
+        },
+      },
+    }.freeze
+
+    EXEC_JSON = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'platform' => PLATFORM,
+        'profiles' => {
+          'type' => 'array',
+          'items' => PROFILE,
+        },
+        'statistics' => STATISTICS,
+        'version' => { 'type' => 'string' },
+
+        # DEPRECATED PROPERTIES!! These will be removed with the next major version bump
+        'controls' => 'array',
+        'other_checks' => 'array',
+      },
+    }.freeze
+
+    MIN_CONTROL = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'id' => { 'type' => 'string' },
+        'profile_id' => { 'type' => %w{string null} },
+        'status' => { 'type' => 'string' },
+        'code_desc' => { 'type' => 'string' },
+        'skip_message' => { 'type' => 'string', 'optional' => true },
+        'resource' => { 'type' => 'string', 'optional' => true },
+      },
+    }.freeze
+
+    EXEC_JSONMIN = {
+      'type' => 'object',
+      'additionalProperties' => false,
+      'properties' => {
+        'statistics' => STATISTICS,
+        'version' => { 'type' => 'string' },
+        'controls' => {
+          'type' => 'array',
+          'items' => MIN_CONTROL,
+        },
+      },
+    }.freeze
+
+    LIST = {
+      'exec-json' => EXEC_JSON,
+      'exec-jsonmin' => EXEC_JSONMIN,
+    }.freeze
+
+    def self.names
+      LIST.keys
+    end
+
+    def self.json(name)
+      v = LIST[name] ||
+          raise("Cannot find schema #{name.inspect}.")
+      JSON.dump(v)
+    end
+  end
+end

data/lib/inspec/secrets/yaml.rb

@@ -9,7 +9,7 @@ module Secrets
     attr_reader :attributes
 
     def self.resolve(target)
-      unless target.is_a?(String) && File.file?(target) && target.end_with?('.yml')
+      unless target.is_a?(String) && File.file?(target) && ['.yml', '.yaml'].include?(File.extname(target).downcase)
         return nil
       end
       new(target)
@@ -18,6 +18,13 @@ module Secrets
     # array of yaml file paths
     def initialize(target)
       @attributes = ::YAML.load_file(target)
+
+      if @attributes == false || !@attributes.is_a?(Hash)
+        Inspec::Log.warn("#{self.class} unable to parse #{target}: invalid YAML or contents is not a Hash")
+        @attributes = nil
+      end
+    rescue => e
+      raise "Error reading Inspec attributes: #{e}"
     end
   end
 end

data/lib/inspec/secrets.rb

@@ -10,7 +10,7 @@ module Inspec
 
   def self.secrets(version)
     if version != 1
-      fail 'Only secrets version 1 is supported!'
+      raise 'Only secrets version 1 is supported!'
     end
     Inspec::Plugins::Secret
   end

data/lib/inspec/shell.rb

@@ -9,7 +9,7 @@ module Inspec
   # A pry based shell for inspec. Given a runner (with a configured backend and
   # all that jazz), this shell will produce a pry shell from which you can run
   # inspec/ruby commands that will be run within the context of the runner.
-  class Shell
+  class Shell # rubocop:disable Metrics/ClassLength
     def initialize(runner)
       @runner = runner
     end
@@ -42,6 +42,8 @@ module Inspec
       # Add a help menu as the default intro
       Pry.hooks.add_hook(:before_session, 'inspec_intro') do
         intro
+        print_target_info
+        puts
       end
 
       # Track the rules currently registered and what their merge count is.
@@ -79,7 +81,7 @@ module Inspec
       # determine min whitespace that can be removed
       min = nil
       example.lines.each do |line|
-        if line.strip.length > 0 # ignore empty lines
+        if !line.strip.empty? # ignore empty lines
           line_whitespace = line.length - line.lstrip.length
           min = line_whitespace if min.nil? || line_whitespace < min
         end
@@ -94,10 +96,20 @@ module Inspec
       puts
     end
 
-    def help(resource = nil)
-      if resource.nil?
+    def print_target_info
+      ctx = @runner.backend
+      puts <<EOF
+You are currently running on:
+
+    OS platform:  #{mark ctx.os[:name] || 'unknown'}
+    OS family:  #{mark ctx.os[:family] || 'unknown'}
+    OS release: #{mark ctx.os[:release] || 'unknown'}
+EOF
+    end
+
+    def help(topic = nil)
+      if topic.nil?
 
-        ctx = @runner.backend
         puts <<EOF
 
 Available commands:
@@ -105,46 +117,104 @@ Available commands:
     `[resource]` - run resource on target machine
     `help resources` - show all available resources that can be used as commands
     `help [resource]` - information about a specific resource
+    `help matchers` - show information about common matchers
     `exit` - exit the InSpec shell
 
 You can use resources in this environment to test the target machine. For example:
 
     command('uname -a').stdout
-    file('/proc/cpuinfo').content => "value",
-
-You are currently running on:
-
-    OS platform:  #{mark ctx.os[:name] || 'unknown'}
-    OS family:  #{mark ctx.os[:family] || 'unknown'}
-    OS release: #{mark ctx.os[:release] || 'unknown'}
+    file('/proc/cpuinfo').content => "value"
 
+#{print_target_info}
 EOF
-      elsif resource == 'resources'
-        resources
-      elsif !Inspec::Resource.registry[resource].nil?
+      elsif topic == 'resources'
+        resources.sort.each do |resource|
+          puts " - #{resource}"
+        end
+      elsif topic == 'matchers'
+        print_matchers_help
+      elsif !Inspec::Resource.registry[topic].nil?
         puts <<EOF
-#{mark 'Name:'} #{resource}
+#{mark 'Name:'} #{topic}
 
 #{mark 'Description:'}
 
-#{Inspec::Resource.registry[resource].desc}
+#{Inspec::Resource.registry[topic].desc}
 
 #{mark 'Example:'}
-#{print_example(Inspec::Resource.registry[resource].example)}
+#{print_example(Inspec::Resource.registry[topic].example)}
 
 #{mark 'Web Reference:'}
 
-https://github.com/chef/inspec/blob/master/docs/resources.rst##{resource}
+https://www.inspec.io/docs/reference/resources/#{topic}
 
 EOF
       else
-        puts 'Only the following resources are available:'
-        resources
+        puts "The resource #{topic} does not exist. For a list of valid resources, type: help resources"
       end
     end
 
     def resources
-      puts Inspec::Resource.registry.keys.join(' ')
+      Inspec::Resource.registry.keys
+    end
+
+    def print_matchers_help
+      puts <<-EOL
+Matchers are used to compare resource values to expectations. While some
+resources implement their own custom matchers, the following matchers are
+common amongst all resources:
+
+#{mark 'be'}
+
+The #{mark 'be'} matcher can be used to compare numeric values.
+
+   its('size') { should be >= 10 }
+
+#{mark 'cmp'}
+
+The #{mark 'cmp'} matcher is like #{mark 'eq'} but less restrictive. It will try
+to fit the resource value to the expectation.
+
+"Protocol" likely returns a string, but cmp will ensure it's a number before
+comparing:
+
+  its('Protocol') { should cmp 2 }
+  its('Protocol') { should cmp '2' }
+
+"users" may return an array, but if it contains only one item, cmp will compare
+it as a string or number as needed:
+
+  its('users') { should cmp 'root' }
+
+cmp is not case-sensitive:
+
+  its('log_format') { should cmp 'raw' }
+  its('log_format') { should cmp 'RAW' }
+
+#{mark 'eq'}
+
+The #{mark 'eq'} matcher tests for exact equality of two values. Value type
+(string, number, etc.) is important and must be the same. For a less-restrictive
+comparison matcher, use the #{mark 'cmp'} matcher.
+
+  its('RSAAuthentication') { should_not eq 'no' }
+
+#{mark 'include'}
+
+The #{mark 'include'} matcher tests to see if a value is included in a list.
+
+  its('users') { should include 'my_user' }
+
+#{mark 'match'}
+
+The #{mark 'match'} matcher can be used to test a string for a match using a
+regular expression.
+
+  its('content') { should_not match /^MyKey:\\s+some value/ }
+
+For more examples, see: https://www.inspec.io/docs/reference/matchers/
+
+      EOL
     end
   end
 end

data/lib/inspec/source_reader.rb

@@ -19,7 +19,7 @@ module Inspec
 
   def self.source_reader(version)
     if version != 1
-      fail 'Only source readers version 1 is supported!'
+      raise 'Only source readers version 1 is supported!'
     end
     Inspec::Plugins::SourceReader
   end

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.35.1'.freeze
 end

data/lib/inspec.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Dominik Richter
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -8,6 +7,7 @@ libdir = File.dirname(__FILE__)
 $LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
 
 require 'inspec/version'
+require 'inspec/exceptions'
 require 'inspec/profile'
 require 'inspec/rspec_json_formatter'
 require 'inspec/rule'