inspec 1.31.0 → 1.45.9

data/inspec.gemspec

@@ -24,9 +24,9 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.required_ruby_version = '>= 2.1'
+  spec.required_ruby_version = '>= 2.3'
 
-  spec.add_dependency 'train', '>=0.24.0', '<1.0'
+  spec.add_dependency 'train', '~> 0.29', '>= 0.29.1'
   spec.add_dependency 'thor', '~> 0.19'
   spec.add_dependency 'json', '>= 1.8', '< 3.0'
   spec.add_dependency 'rainbow', '~> 2'
@@ -40,7 +40,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'sslshake', '~> 1.2'
   spec.add_dependency 'parallel', '~> 1.9'
   spec.add_dependency 'faraday', '>=0.9.0'
-  spec.add_dependency 'toml', '~> 0.1'
+  spec.add_dependency 'tomlrb', '~> 1.2'
   spec.add_dependency 'addressable', '~> 2.4'
   spec.add_dependency 'parslet', '~> 1.5'
   spec.add_dependency 'semverse'

data/lib/bundles/inspec-artifact/cli.rb

@@ -79,17 +79,17 @@ module Artifact
   KEY_BITS=2048
   KEY_ALG=OpenSSL::PKey::RSA
 
-  INSPEC_PROFILE_VERSION_1='INSPEC-PROFILE-1'.freeze
-  INSPEC_REPORT_VERSION_1='INSPEC-REPORT-1'.freeze
+  INSPEC_PROFILE_VERSION_1='INSPEC-PROFILE-1'
+  INSPEC_REPORT_VERSION_1='INSPEC-REPORT-1'
 
   ARTIFACT_DIGEST=OpenSSL::Digest::SHA512
-  ARTIFACT_DIGEST_NAME='SHA512'.freeze
+  ARTIFACT_DIGEST_NAME='SHA512'
 
   VALID_PROFILE_VERSIONS=Set.new [INSPEC_PROFILE_VERSION_1]
   VALID_PROFILE_DIGESTS=Set.new [ARTIFACT_DIGEST_NAME]
 
-  SIGNED_PROFILE_SUFFIX='iaf'.freeze
-  SIGNED_REPORT_SUFFIX='iar'.freeze
+  SIGNED_PROFILE_SUFFIX='iaf'
+  SIGNED_REPORT_SUFFIX='iar'
 
   # rubocop:disable Metrics/ClassLength
   class CLI < Inspec::BaseCLI

data/lib/bundles/inspec-compliance/README.md

@@ -2,18 +2,17 @@
 
 This extensions offers the following features:
 
- - list available profiles in Chef Compliance
- - execute profiles directly from Chef Compliance locally
- - upload a local profile to Chef Compliance
+ - list available profiles in Chef Automate/Chef Compliance
+ - execute profiles directly from Chef Automate/Chef Compliance locally
+ - upload a local profile to Chef Automate/Chef Compliance
 
 To use the CLI, this InSpec add-on adds the following commands:
 
- * `$ inspec compliance login` - authentication of the API token against Chef Compliance
- * `$ inspec compliance login_automate` - authentication of the API token against Chef Automate
- * `$ inspec compliance profiles` - list all available Chef Compliance profiles
- * `$ inspec exec compliance://profile` - runs a Chef Compliance profile
- * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Compliance
- * `$ inspec compliance logout` - logout of Chef Compliance
+ * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
+ * `$ inspec compliance profiles` - list all available Compliance profiles
+ * `$ inspec exec compliance://profile` - runs a Compliance profile
+ * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
+ * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
 
 Compliance profiles can be executed in two mays:
 
@@ -31,8 +30,7 @@ Commands:
   inspec compliance download PROFILE  # downloads a profile from Chef Compliance
   inspec compliance exec PROFILE      # executes a Chef Compliance profile
   inspec compliance help [COMMAND]    # Describe subcommands or one specific subcommand
-  inspec compliance login SERVER      # Log in to a Chef Compliance SERVER
-  inspec compliance login_automate SERVER   # Log in to an Automate SERVER
+  inspec compliance login SERVER      # Log in to a Chef Automate/Chef Compliance SERVER
   inspec compliance logout            # user logout from Chef Compliance
   inspec compliance profiles          # list all available profiles in Chef Compliance
   inspec compliance upload PATH       # uploads a local profile to Chef Compliance
@@ -41,29 +39,22 @@ Commands:
 
 ### Login with Chef Automate
 
-You need a Chef Automate server up and running. Compliance features need to [be activated](https://docs.chef.io/install_chef_automate.html#compliance), too.
-
-Now, you need a user token. You can retrieve that via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
+You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
 
 ```
-inspec compliance login_automate https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --usertoken 'zuop..._KzE'
+$ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
 ```
 
 ### Login with Chef Compliance
 
-Before you start using the compliance plugin, you need a running [Chef Compliance](https://www.chef.io/compliance/) server. Please login and gather the access token:
+You will need an access token for authentication. You can retrieve one via:
 
 ![Chef Compliance Token](images/cc-token.png)
 
 You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
 
 ```
-# login to chef compliance server
 $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
-
-# display the chef compliance server version
-$ inspec compliance version
-Chef Compliance version: 1.0.11
 ```
 
 ### List available profiles via Chef Compliance / Automate
@@ -131,7 +122,7 @@ Available profiles:
  * cis/cis-ubuntu14.04lts-level2
 ```
 
-### Run a profile from Chef Compliance / Automate on Workstation
+### Run a profile from Chef Compliance / Chef Automate on Workstation
 
 ```
 $ inspec exec compliance://admin/profile
@@ -148,6 +139,17 @@ Finished in 0.02862 seconds (files took 0.62628 seconds to load)
 5 examples, 0 failures, 1 pending
 ```
 
+Exec a specific version(2.0.1) of a profile when logged in with Automate:
+
+```
+$ inspec exec compliance://admin/apache-baseline#2.0.1
+```
+
+Download a specific version(2.0.2) of a profile when logged in with Automate:
+```
+$ inspec compliance download compliance://admin/apache-baseline#2.0.2
+```
+
 ### To Logout from Chef Compliance
 
 ```

data/lib/bundles/inspec-compliance/api/login.rb

@@ -0,0 +1,152 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Ricter
+# author: Jerry Aldrich
+
+module Compliance
+  class API
+    module Login
+      class CannotDetermineServerType < StandardError; end
+
+      def login(options)
+        raise ArgumentError, 'Please specify a server using `inspec compliance login https://SERVER`' unless options['server']
+
+        options['server'] = URI("https://#{options['server']}").to_s if URI(options['server']).scheme.nil?
+
+        options['server_type'] = Compliance::API.determine_server_type(options['server'], options['insecure'])
+
+        case options['server_type']
+        when :automate
+          config = Login::AutomateServer.login(options)
+        when :compliance
+          config = Login::ComplianceServer.login(options)
+        else
+          raise CannotDetermineServerType, "Unable to determine if #{options['server']} is a Chef Automate or Chef Compliance server"
+        end
+
+        puts "Stored configuration for Chef #{config['server_type'].capitalize}: #{config['server']}' with user: '#{config['user']}'"
+      end
+
+      module AutomateServer
+        def self.login(options)
+          verify_thor_options(options)
+
+          options['url'] = options['server'] + '/compliance'
+          token = options['dctoken'] || options['token']
+          store_access_token(options, token)
+        end
+
+        def self.store_access_token(options, token)
+          token_type = if options['token']
+                         'usertoken'
+                       else
+                         'dctoken'
+                       end
+
+          config = Compliance::Configuration.new
+
+          config.clean
+
+          config['automate'] = {}
+          config['automate']['ent'] = options['ent']
+          config['automate']['token_type'] = token_type
+          config['server'] = options['url']
+          config['user'] = options['user']
+          config['insecure'] = options['insecure'] || false
+          config['server_type'] = options['server_type'].to_s
+          config['token'] = token
+          config['version'] = Compliance::API.version(config)
+
+          config.store
+          config
+        end
+
+        # Automate login requires `--ent`, `--user`, and either `--token` or `--dctoken`
+        def self.verify_thor_options(o)
+          error_msg = []
+
+          error_msg.push('Please specify a user using `--user=\'USER\'`') if o['user'].nil?
+          error_msg.push('Please specify an enterprise using `--ent=\'automate\'`') if o['ent'].nil?
+
+          if o['token'].nil? && o['dctoken'].nil?
+            error_msg.push('Please specify a token using `--token=\'AUTOMATE_TOKEN\'` or `--dctoken=\'DATA_COLLECTOR_TOKEN\'`')
+          end
+
+          raise ArgumentError, error_msg.join("\n") unless error_msg.empty?
+        end
+      end
+
+      module ComplianceServer
+        def self.login(options)
+          compliance_verify_thor_options(options)
+
+          options['url'] = options['server'] + '/api'
+
+          if options['user'] && options['token']
+            compliance_store_access_token(options, options['token'])
+          elsif options['user'] && options['password']
+            compliance_login_user_pass(options)
+          elsif options['refresh_token']
+            compliance_login_refresh_token(options)
+          end
+        end
+
+        def self.compliance_login_user_pass(options)
+          success, msg, token = Compliance::API.get_token_via_password(
+            options['url'],
+            options['user'],
+            options['password'],
+            options['insecure'],
+          )
+
+          raise msg unless success
+          compliance_store_access_token(options, token)
+        end
+
+        def self.compliance_login_refresh_token(options)
+          success, msg, token = Compliance::API.get_token_via_refresh_token(
+            options['url'],
+            options['refresh_token'],
+            options['insecure'],
+          )
+
+          raise msg unless success
+          compliance_store_access_token(options, token)
+        end
+
+        def self.compliance_store_access_token(options, token)
+          config = Compliance::Configuration.new
+          config.clean
+
+          config['user'] = options['user'] if options['user']
+          config['server'] = options['url']
+          config['insecure'] = options['insecure'] || false
+          config['server_type'] = options['server_type'].to_s
+          config['token'] = token
+          config['version'] = Compliance::API.version(config)
+
+          config.store
+          config
+        end
+
+        # Compliance login requires `--user` or `--refresh_token`
+        # If `--user` then either `--password`, `--token`, or `--refresh-token`, is required
+        def self.compliance_verify_thor_options(o)
+          error_msg = []
+
+          error_msg.push('Please specify a server using `inspec compliance login https://SERVER`') if o['server'].nil?
+
+          if o['user'].nil? && o['refresh_token'].nil?
+            error_msg.push('Please specify a `--user=\'USER\'` or a `--refresh-token=\'TOKEN\'`')
+          end
+
+          if o['user'] && o['password'].nil? && o['token'].nil? && o['refresh_token'].nil?
+            error_msg.push('Please specify either a `--password`, `--token`, or `--refresh-token`')
+          end
+
+          raise ArgumentError, error_msg.join("\n") unless error_msg.empty?
+        end
+      end
+    end
+  end
+end

data/lib/bundles/inspec-compliance/api.rb

@@ -5,21 +5,28 @@
 require 'net/http'
 require 'uri'
 
+require_relative 'api/login'
+
 module Compliance
-  class ServerConfigurationMissing < StandardError
-  end
+  class ServerConfigurationMissing < StandardError; end
 
   # API Implementation does not hold any state by itself,
   # everything will be stored in local Configuration store
   class API # rubocop:disable Metrics/ClassLength
+    extend Compliance::API::Login
+
     # return all compliance profiles available for the user
+    # the user is either specified in the options hash or by default
+    # the username of the account is used that is logged in
     def self.profiles(config)
+      owner = config['owner'] || config['user']
+
       # Chef Compliance
       if is_compliance_server?(config)
         url = "#{config['server']}/user/compliance"
       # Chef Automate
       elsif is_automate_server?(config)
-        url = "#{config['server']}/profiles/#{config['user']}"
+        url = "#{config['server']}/profiles/#{owner}"
       else
         raise ServerConfigurationMissing
       end
@@ -42,9 +49,8 @@ module Compliance
         elsif is_automate_server_pre_080?(config)
           mapped_profiles = profiles.values.flatten
         else
-          owner_id = config['user']
           mapped_profiles = profiles.map { |e|
-            e['owner_id'] = owner_id
+            e['owner_id'] = owner
             e
           }
         end
@@ -82,10 +88,19 @@ module Compliance
 
     # verifies that a profile
     def self.exist?(config, profile)
-      _msg, profiles = Compliance::API.profiles(config)
+      owner, id, ver = profile_split(profile)
+
+      # ensure that we do not manipulate the configuration object
+      user_config = config.dup
+      user_config['owner'] = owner
+      _msg, profiles = Compliance::API.profiles(user_config)
+
       if !profiles.empty?
-        index = profiles.index { |p| "#{p['owner_id']}/#{p['name']}" == profile }
-        !index.nil? && index >= 0
+        profiles.any? do |p|
+          p['owner_id'] == owner &&
+            p['name'] == id &&
+            (ver.nil? || p['version'] == ver)
+        end
       else
         false
       end
@@ -97,10 +112,10 @@ module Compliance
         url = "#{config['server']}/owners/#{owner}/compliance/#{profile_name}/tar"
       # Chef Automate pre 0.8.0
       elsif is_automate_server_pre_080?(config)
-        url = "#{config['server']}/#{config['user']}"
+        url = "#{config['server']}/#{owner}"
       # Chef Automate
       else
-        url = "#{config['server']}/profiles/#{config['user']}"
+        url = "#{config['server']}/profiles/#{owner}"
       end
 
       headers = get_headers(config)
@@ -179,14 +194,21 @@ module Compliance
     end
 
     def self.target_url(config, profile)
-      if is_automate_server?(config)
-        owner, id = profile.split('/')
-        target = "#{config['server']}/profiles/#{owner}/#{id}/tar"
+      owner, id, ver = profile_split(profile)
+
+      return "#{config['server']}/owners/#{owner}/compliance/#{id}/tar" unless is_automate_server?(config)
+
+      if ver.nil?
+        "#{config['server']}/profiles/#{owner}/#{id}/tar"
       else
-        owner, id = profile.split('/')
-        target = "#{config['server']}/owners/#{owner}/compliance/#{id}/tar"
+        "#{config['server']}/profiles/#{owner}/#{id}/version/#{ver}/tar"
       end
-      target
+    end
+
+    def self.profile_split(profile)
+      owner, id = profile.split('/')
+      id, version = id.split('#')
+      [owner, id, version]
     end
 
     # returns a parsed url for `admin/profile` or `compliance://admin/profile`
@@ -227,5 +249,13 @@ module Compliance
       return nil unless config['version'].is_a?(Hash)
       config['version']['version']
     end
+
+    def self.determine_server_type(url, insecure)
+      if Compliance::HTTP.get(url + '/compliance/version', nil, insecure).code == '401'
+        :automate
+      elsif Compliance::HTTP.get(url + '/api/version', nil, insecure).code == '200'
+        :compliance
+      end
+    end
   end
 end