inspec 4.18.51 → 4.18.85

data/lib/plugins/README.md

@@ -1,16 +0,0 @@
-# Core Plugins of InSpec
-
-This area contains the plugins that ship with InSpec.  They are automatically detected by the plugin loader.
-
-## inspec-* directories
-
-Each subdirectory here that begins with `inspec-` is intended to be a self-contained plugin project,
-with code, docs, and tests.
-
-## shared directory
-
-This directory contains material that is reusable for core plugins, such as a test helper tuned to assisting
-core plugin testing.
-
-
-

data/lib/plugins/inspec-artifact/lib/inspec-artifact.rb

@@ -1,12 +0,0 @@
-module InspecPlugins
-  module Artifact
-    class Plugin < Inspec.plugin(2)
-      plugin_name :'inspec-artifact'
-
-      cli_command :artifact do
-        require_relative "inspec-artifact/cli"
-        InspecPlugins::Artifact::CLI
-      end
-    end
-  end
-end

data/lib/plugins/inspec-artifact/lib/inspec-artifact/base.rb

@@ -1,170 +0,0 @@
-require "base64"
-require "openssl"
-require "pathname"
-require "set"
-require "tempfile"
-require "yaml"
-require "inspec/dist"
-
-module InspecPlugins
-  module Artifact
-    class Base
-      include Inspec::Dist
-
-      KEY_BITS = 2048
-      KEY_ALG = OpenSSL::PKey::RSA
-
-      INSPEC_PROFILE_VERSION_1 = "INSPEC-PROFILE-1".freeze
-      INSPEC_REPORT_VERSION_1 = "INSPEC-REPORT-1".freeze
-
-      ARTIFACT_DIGEST = OpenSSL::Digest::SHA512
-      ARTIFACT_DIGEST_NAME = "SHA512".freeze
-
-      VALID_PROFILE_VERSIONS = Set.new [INSPEC_PROFILE_VERSION_1]
-      VALID_PROFILE_DIGESTS = Set.new [ARTIFACT_DIGEST_NAME]
-
-      SIGNED_PROFILE_SUFFIX = "iaf".freeze
-      SIGNED_REPORT_SUFFIX = "iar".freeze
-
-      def self.keygen(options)
-        key = KEY_ALG.new KEY_BITS
-        puts "Generating private key"
-        open "#{options["keyname"]}.pem.key", "w" do |io|
-          io.write key.to_pem
-        end
-        puts "Generating public key"
-        open "#{options["keyname"]}.pem.pub", "w" do |io|
-          io.write key.public_key.to_pem
-        end
-      end
-
-      def self.profile_sign(options)
-        artifact = new
-        Dir.mktmpdir do |workdir|
-          puts "Signing #{options["profile"]} with key #{options["keyname"]}"
-          path_to_profile = options["profile"]
-          profile_md = artifact.read_profile_metadata(path_to_profile)
-          artifact_filename = "#{profile_md["name"]}-#{profile_md["version"]}.#{SIGNED_PROFILE_SUFFIX}"
-          tarfile = artifact.profile_compress(path_to_profile, profile_md, workdir)
-          content = IO.binread(tarfile)
-          signing_key = KEY_ALG.new File.read "#{options["keyname"]}.pem.key"
-          sha = ARTIFACT_DIGEST.new
-          signature = signing_key.sign sha, content
-          # convert the signature to Base64
-          signature_base64 = Base64.encode64(signature)
-          tar_content = IO.binread(tarfile)
-          File.open(artifact_filename, "wb") do |f|
-            f.puts(INSPEC_PROFILE_VERSION_1)
-            f.puts(options["keyname"])
-            f.puts(ARTIFACT_DIGEST_NAME)
-            f.puts(signature_base64)
-            f.puts("") # newline separates artifact header with body
-            f.write(tar_content)
-          end
-          puts "Successfully generated #{artifact_filename}"
-        end
-      end
-
-      def self.profile_verify(options)
-        artifact = new
-        file_to_verifiy = options["infile"]
-        puts "Verifying #{file_to_verifiy}"
-        artifact.verify(file_to_verifiy) do ||
-          puts "Artifact is valid"
-        end
-      end
-
-      def self.profile_install(options)
-        artifact = new
-        puts "Installing profile"
-        file_to_verifiy = options["infile"]
-        dest_dir = options["destdir"]
-        artifact.verify(file_to_verifiy) do |content|
-          Dir.mktmpdir do |workdir|
-            tmpfile = Pathname.new(workdir).join("artifact_to_install.tar.gz")
-            File.write(tmpfile, content)
-            puts "Installing to #{dest_dir}"
-            `tar xzf #{tmpfile} -C #{dest_dir}`
-          end
-        end
-      end
-
-      def read_profile_metadata(path_to_profile)
-        begin
-          p = Pathname.new(path_to_profile)
-          p = p.join("inspec.yml")
-          unless p.exist?
-            raise "#{path_to_profile} doesn't appear to be a valid #{PRODUCT_NAME} profile"
-          end
-
-          yaml = YAML.load_file(p.to_s)
-          yaml = yaml.to_hash
-
-          unless yaml.key? "name"
-            raise "Profile is invalid, name is not defined"
-          end
-
-          unless yaml.key? "version"
-            raise "Profile is invalid, version is not defined"
-          end
-        rescue => e
-          # rewrap it and pass it up to the CLI
-          raise "Error reading #{PRODUCT_NAME} profile metadata: #{e}"
-        end
-
-        yaml
-      end
-
-      def profile_compress(path_to_profile, profile_md, workdir)
-        profile_name = profile_md["name"]
-        profile_version = profile_md["version"]
-        outfile_name = "#{workdir}/#{profile_name}-#{profile_version}.tar.gz"
-        `tar czf #{outfile_name} -C #{path_to_profile} .`
-        outfile_name
-      end
-
-      def valid_header?(file_alg, file_version, file_keyname)
-        public_keyfile = "#{file_keyname}.pem.pub"
-        puts "Looking for #{public_keyfile} to verify artifact"
-        unless File.exist? public_keyfile
-          raise "Can't find #{public_keyfile}"
-        end
-
-        raise "Invalid artifact digest algorithm detected" unless VALID_PROFILE_DIGESTS.member?(file_alg)
-        raise "Invalid artifact version detected" unless VALID_PROFILE_VERSIONS.member?(file_version)
-      end
-
-      def verify(file_to_verifiy, &content_block)
-        f = File.open(file_to_verifiy, "r")
-        file_version = f.readline.strip!
-        file_keyname = f.readline.strip!
-        file_alg = f.readline.strip!
-
-        file_sig = ""
-        # the signature is multi-line
-        while (line = f.readline) != "\n"
-          file_sig += line
-        end
-        file_sig.strip!
-        f.close
-
-        valid_header?(file_alg, file_version, file_keyname)
-
-        public_keyfile = "#{file_keyname}.pem.pub"
-        verification_key = KEY_ALG.new File.read public_keyfile
-
-        f = File.open(file_to_verifiy, "r")
-        while f.readline != "\n" do end
-        content = f.read
-
-        signature = Base64.decode64(file_sig)
-        digest = ARTIFACT_DIGEST.new
-        if verification_key.verify digest, signature, content
-          content_block.yield(content)
-        else
-          raise "Artifact is invalid"
-        end
-      end
-    end
-  end
-end

data/lib/plugins/inspec-artifact/lib/inspec-artifact/cli.rb

@@ -1,116 +0,0 @@
-require_relative "base"
-require "inspec/dist"
-
-#
-# Notes:
-#
-# Generate keys
-#   The initial implementation uses 2048 bit RSA key pairs (public + private).
-#   Public keys must be available for a customer to install and verify an artifact.
-#   Private keys should be stored in a secure location and NOT be distributed.
-#     (They're only for creating artifacts).
-#
-#
-# .IAF file format
-#   .iaf = "InSpec Artifact File", easy to rename if you'd like something more appropriate.
-#   The iaf file wraps a binary artifact with some metadata. The first implementation
-#   looks like this:
-#
-# INSPEC-PROFILE-1
-# name_of_signing_key
-# algorithm
-# signature
-# <empty line>
-# binary-blob
-# <eof>
-#
-# Let's look at each line:
-# INSPEC-PROFILE-1:
-#   This is the artifact version descriptor. It should't change unless the
-#   format of the archive changes.
-#
-# name_of_signing_key
-#   The name of the public key that can be used to verify an artifact
-#
-# algorithm
-#   The digest used to sign, I picked SHA512 to start with.
-#   If we support multiple digests, we'll need to have the verify() method
-#   support each digest.
-#
-# signature
-#   The result of passing the binary artifact through the digest algorithm above.
-#   Result is base64 encoded.
-#
-# <empty line>
-#   We use an empty line to separate artifact header from artifact body (binary blob).
-#   The artifact body can be anything you like.
-#
-# binary-blob
-#   A binary blob, most likely a .tar.gz or tar.xz file. We'll need to pick one and
-#   stick with it as part of the "INSPEC-PROFILE-1" artifact version. If we change block
-#   format, the artifact version descriptor must be incremented, and the sign()
-#   and verify() methods must be updated to support a newer version.
-#
-#
-# Key revocation
-#   This implementation doesn't support key revocation. However, a customer
-#   can remove the public cert file before installation, and artifacts will then
-#   fail verification.
-#
-# Key locations
-#   This implementation uses the current working directory to find public and
-#   private keys. We should establish a common key directory (similar to /hab/cache/keys
-#   or ~/.hab/cache/keys in Habitat).
-#
-# Extracting artifacts outside of InSpec
-#   As in Habitat, the artifact format for InSpec allows the use of common
-#   Unix tools to read the header and body of an artifact.
-# To extract the header from a .iaf:
-#        sed '/^$/q' foo.iaf
-# To extract the raw content from a .iaf:
-#        sed '1,/^$/d' foo.iaf
-
-module InspecPlugins
-  module Artifact
-    class CLI < Inspec.plugin(2, :cli_command)
-      include Inspec::Dist
-
-      subcommand_desc "artifact SUBCOMMAND", "Manage #{PRODUCT_NAME} Artifacts"
-
-      desc "generate", "Generate a RSA key pair for signing and verification"
-      option :keyname, type: :string, required: true,
-        desc: "Desriptive name of key"
-      option :keydir, type: :string, default: "./",
-        desc: "Directory to search for keys"
-      def generate_keys
-        puts "Generating keys"
-        InspecPlugins::Artifact::Base.keygen(options)
-      end
-
-      desc "sign-profile", "Create a signed .iaf artifact"
-      option :profile, type: :string, required: true,
-        desc: "Path to profile directory"
-      option :keyname, type: :string, required: true,
-        desc: "Desriptive name of key"
-      def sign_profile
-        InspecPlugins::Artifact::Base.profile_sign(options)
-      end
-
-      desc "verify-profile", "Verify a signed .iaf artifact"
-      option :infile, type: :string, required: true,
-          desc: ".iaf file to verify"
-      def verify_profile
-        InspecPlugins::Artifact::Base.profile_verify(options)
-      end
-
-      desc "install-profile", "Verify and install a signed .iaf artifact"
-      option :infile, type: :string, required: true,
-          desc: ".iaf file to install"
-      option :destdir, type: :string, required: true,
-        desc: "Installation directory"
-      def install_profile
-        InspecPlugins::Artifact::Base.profile_install(options)
-      end
-    end
-  end
-end

data/lib/plugins/inspec-artifact/test/functional/inspec_artifact_test.rb

@@ -1,50 +0,0 @@
-require "fileutils"
-require "plugins/shared/core_plugin_test_helper"
-require "securerandom"
-
-class ArtifactCli < Minitest::Test
-  include CorePluginFunctionalHelper
-
-  def test_generating_archive_keys
-    prepare_examples do |dir|
-      unique_key_name = SecureRandom.uuid
-      out = run_inspec_process("artifact generate --keyname #{unique_key_name}", prefix: "cd #{dir};")
-
-      stdout = out.stdout.force_encoding(Encoding::UTF_8)
-      assert_includes stdout, "Generating private key"
-      assert_includes stdout, "Generating public key"
-
-      assert_exit_code 0, out
-    end
-  end
-
-  def test_verify_and_install_signed_profile
-    prepare_examples do |dir|
-      unique_key_name = SecureRandom.uuid
-      install_dir = File.join(dir, SecureRandom.uuid)
-      FileUtils.mkdir(install_dir)
-
-      # create profile
-      profile = File.join(dir, "artifact-profile")
-      run_inspec_process("init profile artifact-profile", prefix: "cd #{dir};")
-
-      out = run_inspec_process("artifact generate --keyname #{unique_key_name}", prefix: "cd #{dir};")
-      assert_exit_code 0, out
-
-      out = run_inspec_process("artifact sign-profile --profile #{profile} --keyname #{unique_key_name}", prefix: "cd #{dir};")
-      assert_exit_code 0, out
-
-      # The archive install commands do not currently support windows
-      # and use specific linux extract tar commands. Since artifact is
-      # still experimental we are skipping it for now.
-      return if is_windows?
-
-      out = run_inspec_process("artifact install-profile --infile artifact-profile-0.1.0.iaf --destdir #{install_dir}", prefix: "cd #{dir};")
-      assert_exit_code 0, out
-
-      assert_includes out.stdout.force_encoding(Encoding::UTF_8), "Installing to #{install_dir}"
-      assert_includes Dir.entries(install_dir).join, "inspec.yml"
-      assert_exit_code 0, out
-    end
-  end
-end

data/lib/plugins/inspec-compliance/README.md

@@ -1,207 +0,0 @@
-# InSpec Extension for Chef Compliance
-
-This extensions offers the following features:
-
- - list available profiles in Chef Automate/Chef Compliance
- - execute profiles directly from Chef Automate/Chef Compliance locally
- - upload a local profile to Chef Automate/Chef Compliance
-
-To use the CLI, this InSpec add-on adds the following commands:
-
- * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
- * `$ inspec compliance profiles` - list all available Compliance profiles
- * `$ inspec exec compliance://profile` - runs a Compliance profile
- * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
- * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
-
-Compliance profiles can be executed in two ways:
-
-- via compliance exec: `inspec compliance exec profile`
-- via compliance scheme: `inspec exec compliance://profile`
-
-
-## Usage
-
-### Command options
-
-```
-$ inspec compliance
-Commands:
-  inspec compliance download PROFILE  # downloads a profile from Chef Compliance
-  inspec compliance exec PROFILE      # executes a Chef Compliance profile
-  inspec compliance help [COMMAND]    # Describe subcommands or one specific subcommand
-  inspec compliance login SERVER      # Log in to a Chef Automate/Chef Compliance SERVER
-  inspec compliance logout            # user logout from Chef Compliance
-  inspec compliance profiles          # list all available profiles in Chef Compliance
-  inspec compliance upload PATH       # uploads a local profile to Chef Compliance
-  inspec compliance version           # displays the version of the Chef Compliance server
-```
-
-### Login with Chef Automate 2
-
-You will need an API token for authentication. You can retrieve one via the admin section of your A2 web gui.
-
-```
-$ inspec compliance login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
-```
-
-#### Login with Chef Automate 2 via json-config
-
-With automate 2 you can automatically login by passing a json config via `--json-config`
-
-Example:
-```json
-"compliance": {
-    "server" : "https://YOUR_A2_URL",
-    "token" : "YOUR_A2_ADMIN_TOKEN",
-    "user" : "YOUR_A2_USER",
-    "insecure" : true
-}
-```
-
-### Login with Chef Automate
-
-You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
-
-```
-$ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
-```
-
-### Login with Chef Compliance
-
-You will need an access token for authentication. You can retrieve one via:
-
-![Chef Compliance Token](images/cc-token.png)
-
-You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
-
-```
-$ inspec compliance login https://compliance.test --user admin --insecure --token '...'
-```
-
-### List available profiles via Chef Compliance / Automate
-
-```
-$ inspec compliance profiles
-Available profiles:
--------------------
- * base/apache
- * base/linux
- * base/mysql
- * base/postgres
- * base/ssh
- * base/windows
- * cis/cis-centos6-level1
- * cis/cis-centos6-level2
- * cis/cis-centos7-level1
- * cis/cis-centos7-level2
- * cis/cis-rhel7-level1
- * cis/cis-rhel7-level2
- * cis/cis-ubuntu12.04lts-level1
- * cis/cis-ubuntu12.04lts-level2
- * cis/cis-ubuntu14.04lts-level1
- * cis/cis-ubuntu14.04lts-level2
-```
-
-### Upload a profile to Chef Compliance / Automate
-
-```
-$ inspec compliance version
-Chef Compliance version: 1.0.11
-➜  inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec compliance upload examples/profile
-I, [2016-05-06T14:27:20.907547 #37592]  INFO -- : Checking profile in examples/profile
-I, [2016-05-06T14:27:20.907668 #37592]  INFO -- : Metadata OK.
-I, [2016-05-06T14:27:20.968584 #37592]  INFO -- : Found 4 controls.
-I, [2016-05-06T14:27:20.968638 #37592]  INFO -- : Control definitions OK.
-Profile is valid
-Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
-I, [2016-05-06T14:27:21.020017 #37592]  INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
-I, [2016-05-06T14:27:21.024837 #37592]  INFO -- : Finished archive generation.
-Start upload to admin/profile
-Uploading to Chef Compliance
-Successfully uploaded profile
-
-# display all profiles
-$ inspec compliance profiles
-Available profiles:
--------------------
- * admin/profile
- * base/apache
- * base/linux
- * base/mysql
- * base/postgres
- * base/ssh
- * base/windows
- * cis/cis-centos6-level1
- * cis/cis-centos6-level2
- * cis/cis-centos7-level1
- * cis/cis-centos7-level2
- * cis/cis-rhel7-level1
- * cis/cis-rhel7-level2
- * cis/cis-ubuntu12.04lts-level1
- * cis/cis-ubuntu12.04lts-level2
- * cis/cis-ubuntu14.04lts-level1
- * cis/cis-ubuntu14.04lts-level2
-```
-
-### Run a profile from Chef Compliance / Chef Automate on Workstation
-
-```
-$ inspec exec compliance://admin/profile
-.*...
-
-Pending: (Failures listed here are expected and do not affect your suite's status)
-
-  1) example_config Can't find file "/tmp/example/config.yaml"
-     # Not yet implemented
-     # ./lib/inspec/runner.rb:157
-
-
-Finished in 0.02862 seconds (files took 0.62628 seconds to load)
-5 examples, 0 failures, 1 pending
-```
-
-Exec a specific version(2.0.1) of a profile when logged in with Automate:
-
-```
-$ inspec exec compliance://admin/apache-baseline#2.0.1
-```
-
-Download a specific version(2.0.2) of a profile when logged in with Automate:
-```
-$ inspec compliance download compliance://admin/apache-baseline#2.0.2
-```
-
-### To Logout from Chef Compliance
-
-```
-$ inspec compliance logout
-Successfully logged out
-```
-
-## Integration Tests
-
-At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time:
-
- * run `kitchen converge`
- * open https://192.168.251.2 and log in with user `admin` and password `admin`
- * click on user->about and obtain the access token and the refresh token
- * run `kitchen verify` with the required env variables:
-
-```
-# both token need to be set, since the test suite runs for each token type
-export COMPLIANCE_ACCESSTOKEN='mycompliancetoken'
-export COMPLIANCE_REFRESHTOKEN='myrefreshtoken'
-kitchen verify
------> Starting Kitchen (v1.7.3)
------> Verifying <default-ubuntu-1404>...
-       Search `/Users/chartmann/Development/compliance/inspec/lib/bundles/inspec-compliance/test/integration/default` for tests
-..................................
-
-Finished in 6.35 seconds (files took 0.40949 seconds to load)
-34 examples, 0 failures
-
-       Finished verifying <default-ubuntu-1404> (0m6.62s).
------> Kitchen is finished. (0m7.02s)
-zlib(finalizer): the stream was freed prematurely.
-```