inspec 2.1.0 → 2.1.10

data/lib/resources/csv.rb

@@ -1,60 +1,56 @@
-# encoding: utf-8
-
-# Parses a csv document
-# This implementation was inspired by a blog post
-# @see http://technicalpickles.com/posts/parsing-csv-with-ruby
-module Inspec::Resources
-  class CsvConfig < JsonConfig
-    name 'csv'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    supports platform: 'esx'
-    supports platform: 'cisco'
-    desc 'Use the csv InSpec audit resource to test configuration data in a CSV file.'
-    example "
-      describe csv('example.csv') do
-        its('name') { should eq(['John', 'Alice']) }
-      end
-    "
-
-    # override the parse method from JsonConfig
-    # Assuming a header row of name,col1,col2, it will output an array of hashes like so:
-    #    [
-    #      { 'name' => 'row1', 'col1' => 'value1', 'col2' => 'value2' },
-    #      { 'name' => 'row2', 'col1' => 'value3', 'col2' => 'value4' }
-    #    ]
-    def parse(content)
-      require 'csv'
-
-      # convert empty field to nil
-      CSV::Converters[:blank_to_nil] = lambda do |field|
-        field && field.empty? ? nil : field
-      end
-
-      # implicit conversion of values
-      csv = CSV.new(content, headers: true, converters: [:all, :blank_to_nil])
-
-      # convert to hash
-      csv.to_a.map(&:to_hash)
-    rescue => e
-      raise Inspec::Exceptions::ResourceFailed, "Unable to parse CSV: #{e.message}"
-    end
-
-    # override the value method from JsonConfig
-    # The format of the CSV hash as created by #parse is very different
-    # than what the YAML, JSON, and INI resources create, so using the
-    # #value method from JsonConfig (which uses ObjectTraverser.extract_value)
-    # doesn't make sense here.
-    def value(key)
-      @params.map { |x| x[key.first.to_s] }.compact
-    end
-
-    private
-
-    # used by JsonConfig to build up a full to_s method
-    # based on whether a file path, content, or command was supplied.
-    def resource_base_name
-      'CSV'
-    end
-  end
-end
+# encoding: utf-8
+
+# Parses a csv document
+# This implementation was inspired by a blog post
+# @see http://technicalpickles.com/posts/parsing-csv-with-ruby
+module Inspec::Resources
+  class CsvConfig < JsonConfig
+    name 'csv'
+    desc 'Use the csv InSpec audit resource to test configuration data in a CSV file.'
+    example "
+      describe csv('example.csv') do
+        its('name') { should eq(['John', 'Alice']) }
+      end
+    "
+
+    # override the parse method from JsonConfig
+    # Assuming a header row of name,col1,col2, it will output an array of hashes like so:
+    #    [
+    #      { 'name' => 'row1', 'col1' => 'value1', 'col2' => 'value2' },
+    #      { 'name' => 'row2', 'col1' => 'value3', 'col2' => 'value4' }
+    #    ]
+    def parse(content)
+      require 'csv'
+
+      # convert empty field to nil
+      CSV::Converters[:blank_to_nil] = lambda do |field|
+        field && field.empty? ? nil : field
+      end
+
+      # implicit conversion of values
+      csv = CSV.new(content, headers: true, converters: [:all, :blank_to_nil])
+
+      # convert to hash
+      csv.to_a.map(&:to_hash)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse CSV: #{e.message}"
+    end
+
+    # override the value method from JsonConfig
+    # The format of the CSV hash as created by #parse is very different
+    # than what the YAML, JSON, and INI resources create, so using the
+    # #value method from JsonConfig (which uses ObjectTraverser.extract_value)
+    # doesn't make sense here.
+    def value(key)
+      @params.map { |x| x[key.first.to_s] }.compact
+    end
+
+    private
+
+    # used by JsonConfig to build up a full to_s method
+    # based on whether a file path, content, or command was supplied.
+    def resource_base_name
+      'CSV'
+    end
+  end
+end

data/lib/resources/dh_params.rb

@@ -1,82 +1,77 @@
-# encoding: utf-8
-
-require 'openssl'
-
-class DhParams < Inspec.resource(1)
-  name 'dh_params'
-  supports platform: 'unix'
-  desc '
-    Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH)
-    parameters.
-  '
-
-  example "
-    describe dh_params('/path/to/file.dh_pem') do
-      it { should be_dh_params }
-      it { should be_valid }
-      its('generator') { should eq 2 }
-      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
-      its('prime_length') { should eq 2048 }
-      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
-      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
-    end
-  "
-
-  def initialize(filename)
-    @dh_params_path = filename
-    file = inspec.file(@dh_params_path)
-    return skip_resource "Unable to find DH parameters file #{@dh_params_path}" unless file.exist?
-
-    begin
-      @dh_params = OpenSSL::PKey::DH.new file.content
-    rescue
-      @dh_params = nil
-      return skip_resource "Unable to load DH parameters #{@dh_params_path}"
-    end
-  end
-
-  # it { should be_dh_params }
-  def dh_params?
-    !@dh_params.nil?
-  end
-
-  # its('generator') { should eq 2 }
-  def generator
-    return if @dh_params.nil?
-    @dh_params.g.to_i
-  end
-
-  # its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
-  def modulus
-    return if @dh_params.nil?
-    '00:' + @dh_params.p.to_s(16).downcase.scan(/.{2}/).join(':')
-  end
-
-  # its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
-  def pem
-    return if @dh_params.nil?
-    @dh_params.to_pem
-  end
-
-  # its('prime_length') { should be 2048 }
-  def prime_length
-    return if @dh_params.nil?
-    @dh_params.p.num_bits
-  end
-
-  # its('text') { should eq 'human-readable-text' }
-  def text
-    return if @dh_params.nil?
-    @dh_params.to_text
-  end
-
-  # it { should be_valid }
-  def valid?
-    return if @dh_params.nil?
-    @dh_params.params_ok?
-  end
-
-  def to_s
-    "dh_params #{@dh_params_path}"
-  end
-end
+# encoding: utf-8
+
+require 'openssl'
+require 'utils/file_reader'
+
+class DhParams < Inspec.resource(1)
+  name 'dh_params'
+  supports platform: 'unix'
+  desc '
+    Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH)
+    parameters.
+  '
+
+  example "
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_dh_params }
+      it { should be_valid }
+      its('generator') { should eq 2 }
+      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+      its('prime_length') { should eq 2048 }
+      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
+    end
+  "
+
+  include FileReader
+
+  def initialize(filename)
+    @dh_params_path = filename
+    @dh_params = OpenSSL::PKey::DH.new read_file_content(@dh_params_path)
+  end
+
+  # it { should be_dh_params }
+  def dh_params?
+    !@dh_params.nil?
+  end
+
+  # its('generator') { should eq 2 }
+  def generator
+    return if @dh_params.nil?
+    @dh_params.g.to_i
+  end
+
+  # its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+  def modulus
+    return if @dh_params.nil?
+    '00:' + @dh_params.p.to_s(16).downcase.scan(/.{2}/).join(':')
+  end
+
+  # its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+  def pem
+    return if @dh_params.nil?
+    @dh_params.to_pem
+  end
+
+  # its('prime_length') { should be 2048 }
+  def prime_length
+    return if @dh_params.nil?
+    @dh_params.p.num_bits
+  end
+
+  # its('text') { should eq 'human-readable-text' }
+  def text
+    return if @dh_params.nil?
+    @dh_params.to_text
+  end
+
+  # it { should be_valid }
+  def valid?
+    return if @dh_params.nil?
+    @dh_params.params_ok?
+  end
+
+  def to_s
+    "dh_params #{@dh_params_path}"
+  end
+end

data/lib/resources/directory.rb

@@ -1,25 +1,25 @@
-# encoding: utf-8
-
-require 'resources/file'
-
-module Inspec::Resources
-  class Directory < FileResource
-    name 'directory'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the directory InSpec audit resource to test if the file type is a directory. This is equivalent to using the file InSpec audit resource and the be_directory matcher, but provides a simpler and more direct way to test directories. All of the matchers available to file may be used with directory.'
-    example "
-      describe directory('path') do
-        it { should be_directory }
-      end
-    "
-
-    def exist?
-      file.exist? && file.directory?
-    end
-
-    def to_s
-      "Directory #{source_path}"
-    end
-  end
-end
+# encoding: utf-8
+
+require 'resources/file'
+
+module Inspec::Resources
+  class Directory < FileResource
+    name 'directory'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the directory InSpec audit resource to test if the file type is a directory. This is equivalent to using the file InSpec audit resource and the be_directory matcher, but provides a simpler and more direct way to test directories. All of the matchers available to file may be used with directory.'
+    example "
+      describe directory('path') do
+        it { should be_directory }
+      end
+    "
+
+    def exist?
+      file.exist? && file.directory?
+    end
+
+    def to_s
+      "Directory #{source_path}"
+    end
+  end
+end

data/lib/resources/docker.rb

@@ -1,236 +1,236 @@
-# encoding: utf-8
-#
-# Copyright 2017, Christoph Hartmann
-#
-
-require 'utils/filter'
-require 'hashie/mash'
-
-module Inspec::Resources
-  class DockerContainerFilter
-    # use filtertable for containers
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:commands,       field: 'command')
-          .add(:ids,            field: 'id')
-          .add(:images,         field: 'image')
-          .add(:labels,         field: 'labels')
-          .add(:local_volumes,  field: 'localvolumes')
-          .add(:mounts,         field: 'mounts')
-          .add(:names,          field: 'names')
-          .add(:networks,       field: 'networks')
-          .add(:ports,          field: 'ports')
-          .add(:running_for,    field: 'runningfor')
-          .add(:sizes,          field: 'size')
-          .add(:status,         field: 'status')
-          .add(:exists?) { |x| !x.entries.empty? }
-          .add(:running?) { |x|
-            x.where { status.downcase.start_with?('up') }
-          }
-    filter.connect(self, :containers)
-
-    attr_reader :containers
-    def initialize(containers)
-      @containers = containers
-    end
-  end
-
-  class DockerImageFilter
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:ids,              field: 'id')
-          .add(:repositories,     field: 'repository')
-          .add(:tags,             field: 'tag')
-          .add(:sizes,            field: 'size')
-          .add(:digests,          field: 'digest')
-          .add(:created,          field: 'createdat')
-          .add(:created_since,    field: 'createdsize')
-          .add(:exists?) { |x| !x.entries.empty? }
-    filter.connect(self, :images)
-
-    attr_reader :images
-    def initialize(images)
-      @images = images
-    end
-  end
-
-  class DockerServiceFilter
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:ids,              field: 'id')
-          .add(:names,            field: 'name')
-          .add(:modes,            field: 'mode')
-          .add(:replicas,         field: 'replicas')
-          .add(:images,           field: 'image')
-          .add(:ports,            field: 'ports')
-          .add(:exists?) { |x| !x.entries.empty? }
-    filter.connect(self, :services)
-
-    attr_reader :services
-    def initialize(services)
-      @services = services
-    end
-  end
-
-  # This resource helps to parse information from the docker host
-  # For compatability with Serverspec we also offer the following resouses:
-  # - docker_container
-  # - docker_image
-  class Docker < Inspec.resource(1)
-    name 'docker'
-    supports platform: 'unix'
-    desc "
-      A resource to retrieve information about docker
-    "
-
-    example "
-      describe docker.containers do
-        its('images') { should_not include 'u12:latest' }
-      end
-
-      describe docker.images do
-        its('repositories') { should_not include 'inssecure_image' }
-      end
-
-      describe docker.services do
-        its('images') { should_not include 'inssecure_image' }
-      end
-
-      describe docker.version do
-        its('Server.Version') { should cmp >= '1.12'}
-        its('Client.Version') { should cmp >= '1.12'}
-      end
-
-      describe docker.object(id) do
-        its('Configuration.Path') { should eq 'value' }
-      end
-
-      docker.containers.ids.each do |id|
-        # call docker inspect for a specific container id
-        describe docker.object(id) do
-          its(%w(HostConfig Privileged)) { should cmp false }
-          its(%w(HostConfig Privileged)) { should_not cmp true }
-        end
-      end
-    "
-
-    def containers
-      DockerContainerFilter.new(parse_containers)
-    end
-
-    def images
-      DockerImageFilter.new(parse_images)
-    end
-
-    def services
-      DockerServiceFilter.new(parse_services)
-    end
-
-    def version
-      return @version if defined?(@version)
-      data = {}
-      cmd = inspec.command('docker version --format \'{{ json . }}\'')
-      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
-      @version = Hashie::Mash.new(data)
-    rescue JSON::ParserError => _e
-      return Hashie::Mash.new({})
-    end
-
-    def info
-      return @info if defined?(@info)
-      data = {}
-      # docke info format is only supported for Docker 17.03+
-      cmd = inspec.command('docker info --format \'{{ json . }}\'')
-      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
-      @info = Hashie::Mash.new(data)
-    rescue JSON::ParserError => _e
-      return Hashie::Mash.new({})
-    end
-
-    # returns information about docker objects
-    def object(id)
-      return @inspect if defined?(@inspect)
-      data = JSON.parse(inspec.command("docker inspect #{id}").stdout)
-      data = data[0] if data.is_a?(Array)
-      @inspect = Hashie::Mash.new(data)
-    rescue JSON::ParserError => _e
-      return Hashie::Mash.new({})
-    end
-
-    def to_s
-      'Docker Host'
-    end
-
-    private
-
-    def parse_json_command(labels, subcommand)
-      # build command
-      format = labels.map { |label| "\"#{label}\": {{json .#{label}}}" }
-      raw = inspec.command("docker #{subcommand} --format '{#{format.join(', ')}}'").stdout
-      output = []
-      # since docker is not outputting valid json, we need to parse each row
-      raw.each_line { |entry|
-        # convert all keys to lower_case to work well with ruby and filter table
-        j = JSON.parse(entry).map { |k, v|
-          [k.downcase, v]
-        }.to_h
-
-        # ensure all keys are there
-        j = ensure_keys(j, labels)
-
-        # strip off any linked container names
-        # Depending on how it was linked, the actual container name may come before
-        # or after the link information, so we'll just look for the first name that
-        # does not include a slash since that is not a valid character in a container name
-        j['names'] = j['names'].split(',').find { |c| !c.include?('/') } if j.key?('names')
-
-        output.push(j)
-      }
-      output
-    rescue JSON::ParserError => _e
-      warn "Could not parse `docker #{subcommand}` output"
-      []
-    end
-
-    def parse_containers
-      # @see https://github.com/moby/moby/issues/20625, works for docker 1.13+
-      # raw_containers = inspec.command('docker ps -a --no-trunc --format \'{{ json . }}\'').stdout
-      # therefore we stick with older approach
-      labels = %w{Command CreatedAt ID Image Labels Mounts Names Ports RunningFor Size Status}
-
-      # Networks LocalVolumes work with 1.13+ only
-      if !version.empty? && Gem::Version.new(version['Client']['Version']) >= Gem::Version.new('1.13')
-        labels.push('Networks')
-        labels.push('LocalVolumes')
-      end
-      parse_json_command(labels, 'ps -a --no-trunc')
-    end
-
-    def parse_services
-      parse_json_command(%w{ID Name Mode Replicas Image Ports}, 'service ls')
-    end
-
-    def ensure_keys(entry, labels)
-      labels.each { |key|
-        entry[key.downcase] = nil if !entry.key?(key.downcase)
-      }
-      entry
-    end
-
-    def parse_images
-      # docker does not support the `json .` function here, therefore we need to emulate that behavior.
-      raw_images = inspec.command('docker images -a --no-trunc --format \'{ "id": {{json .ID}}, "repository": {{json .Repository}}, "tag": {{json .Tag}}, "size": {{json .Size}}, "digest": {{json .Digest}}, "createdat": {{json .CreatedAt}}, "createdsize": {{json .CreatedSince}} }\'').stdout
-      c_images = []
-      raw_images.each_line { |entry|
-        c_images.push(JSON.parse(entry))
-      }
-      c_images
-    rescue JSON::ParserError => _e
-      warn 'Could not parse `docker images` output'
-      []
-    end
-  end
-end
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+
+require 'utils/filter'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class DockerContainerFilter
+    # use filtertable for containers
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:commands,       field: 'command')
+          .add(:ids,            field: 'id')
+          .add(:images,         field: 'image')
+          .add(:labels,         field: 'labels')
+          .add(:local_volumes,  field: 'localvolumes')
+          .add(:mounts,         field: 'mounts')
+          .add(:names,          field: 'names')
+          .add(:networks,       field: 'networks')
+          .add(:ports,          field: 'ports')
+          .add(:running_for,    field: 'runningfor')
+          .add(:sizes,          field: 'size')
+          .add(:status,         field: 'status')
+          .add(:exists?) { |x| !x.entries.empty? }
+          .add(:running?) { |x|
+            x.where { status.downcase.start_with?('up') }
+          }
+    filter.connect(self, :containers)
+
+    attr_reader :containers
+    def initialize(containers)
+      @containers = containers
+    end
+  end
+
+  class DockerImageFilter
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:ids,              field: 'id')
+          .add(:repositories,     field: 'repository')
+          .add(:tags,             field: 'tag')
+          .add(:sizes,            field: 'size')
+          .add(:digests,          field: 'digest')
+          .add(:created,          field: 'createdat')
+          .add(:created_since,    field: 'createdsize')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :images)
+
+    attr_reader :images
+    def initialize(images)
+      @images = images
+    end
+  end
+
+  class DockerServiceFilter
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:ids,              field: 'id')
+          .add(:names,            field: 'name')
+          .add(:modes,            field: 'mode')
+          .add(:replicas,         field: 'replicas')
+          .add(:images,           field: 'image')
+          .add(:ports,            field: 'ports')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :services)
+
+    attr_reader :services
+    def initialize(services)
+      @services = services
+    end
+  end
+
+  # This resource helps to parse information from the docker host
+  # For compatability with Serverspec we also offer the following resouses:
+  # - docker_container
+  # - docker_image
+  class Docker < Inspec.resource(1)
+    name 'docker'
+    supports platform: 'unix'
+    desc "
+      A resource to retrieve information about docker
+    "
+
+    example "
+      describe docker.containers do
+        its('images') { should_not include 'u12:latest' }
+      end
+
+      describe docker.images do
+        its('repositories') { should_not include 'inssecure_image' }
+      end
+
+      describe docker.services do
+        its('images') { should_not include 'inssecure_image' }
+      end
+
+      describe docker.version do
+        its('Server.Version') { should cmp >= '1.12'}
+        its('Client.Version') { should cmp >= '1.12'}
+      end
+
+      describe docker.object(id) do
+        its('Configuration.Path') { should eq 'value' }
+      end
+
+      docker.containers.ids.each do |id|
+        # call docker inspect for a specific container id
+        describe docker.object(id) do
+          its(%w(HostConfig Privileged)) { should cmp false }
+          its(%w(HostConfig Privileged)) { should_not cmp true }
+        end
+      end
+    "
+
+    def containers
+      DockerContainerFilter.new(parse_containers)
+    end
+
+    def images
+      DockerImageFilter.new(parse_images)
+    end
+
+    def services
+      DockerServiceFilter.new(parse_services)
+    end
+
+    def version
+      return @version if defined?(@version)
+      data = {}
+      cmd = inspec.command('docker version --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @version = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def info
+      return @info if defined?(@info)
+      data = {}
+      # docke info format is only supported for Docker 17.03+
+      cmd = inspec.command('docker info --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @info = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    # returns information about docker objects
+    def object(id)
+      return @inspect if defined?(@inspect)
+      data = JSON.parse(inspec.command("docker inspect #{id}").stdout)
+      data = data[0] if data.is_a?(Array)
+      @inspect = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def to_s
+      'Docker Host'
+    end
+
+    private
+
+    def parse_json_command(labels, subcommand)
+      # build command
+      format = labels.map { |label| "\"#{label}\": {{json .#{label}}}" }
+      raw = inspec.command("docker #{subcommand} --format '{#{format.join(', ')}}'").stdout
+      output = []
+      # since docker is not outputting valid json, we need to parse each row
+      raw.each_line { |entry|
+        # convert all keys to lower_case to work well with ruby and filter table
+        j = JSON.parse(entry).map { |k, v|
+          [k.downcase, v]
+        }.to_h
+
+        # ensure all keys are there
+        j = ensure_keys(j, labels)
+
+        # strip off any linked container names
+        # Depending on how it was linked, the actual container name may come before
+        # or after the link information, so we'll just look for the first name that
+        # does not include a slash since that is not a valid character in a container name
+        j['names'] = j['names'].split(',').find { |c| !c.include?('/') } if j.key?('names')
+
+        output.push(j)
+      }
+      output
+    rescue JSON::ParserError => _e
+      warn "Could not parse `docker #{subcommand}` output"
+      []
+    end
+
+    def parse_containers
+      # @see https://github.com/moby/moby/issues/20625, works for docker 1.13+
+      # raw_containers = inspec.command('docker ps -a --no-trunc --format \'{{ json . }}\'').stdout
+      # therefore we stick with older approach
+      labels = %w{Command CreatedAt ID Image Labels Mounts Names Ports RunningFor Size Status}
+
+      # Networks LocalVolumes work with 1.13+ only
+      if !version.empty? && Gem::Version.new(version['Client']['Version']) >= Gem::Version.new('1.13')
+        labels.push('Networks')
+        labels.push('LocalVolumes')
+      end
+      parse_json_command(labels, 'ps -a --no-trunc')
+    end
+
+    def parse_services
+      parse_json_command(%w{ID Name Mode Replicas Image Ports}, 'service ls')
+    end
+
+    def ensure_keys(entry, labels)
+      labels.each { |key|
+        entry[key.downcase] = nil if !entry.key?(key.downcase)
+      }
+      entry
+    end
+
+    def parse_images
+      # docker does not support the `json .` function here, therefore we need to emulate that behavior.
+      raw_images = inspec.command('docker images -a --no-trunc --format \'{ "id": {{json .ID}}, "repository": {{json .Repository}}, "tag": {{json .Tag}}, "size": {{json .Size}}, "digest": {{json .Digest}}, "createdat": {{json .CreatedAt}}, "createdsize": {{json .CreatedSince}} }\'').stdout
+      c_images = []
+      raw_images.each_line { |entry|
+        c_images.push(JSON.parse(entry))
+      }
+      c_images
+    rescue JSON::ParserError => _e
+      warn 'Could not parse `docker images` output'
+      []
+    end
+  end
+end