inspec 2.1.59 → 2.1.67

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d57f969266c045b09307eba2c128be6fbb77e3f7
-  data.tar.gz: 3feecd806c8a21b6f8ce3e37287e7905d0df86d9
+  metadata.gz: 3b433c23e0f104009667cb51b6b8ab4a81e01b63
+  data.tar.gz: 58c72645fab1bbf25e56338f522ba55f6ca51bbf
 SHA512:
-  metadata.gz: cfd2b0a9cabfe3838b27d03c5dca5bd67bcca64c10e8bf48b628318a0fbe6cf118c98309f71ac0fce2fba65b10f06b28e821eeeb47b438b7f2559a00c6d29679
-  data.tar.gz: 5d61ddf3ddb8126c490c1536c28c99b1a6b93615b78c6a7a17023b86133a2818b6e673cd5ff21400441c9c07a4c925b61fec730ac88318d2f4bee571fdf5c678
+  metadata.gz: ed147a0607f35c18186214bada157514130cd1000b31967b8c7f6ab861b7459e01ebfa9b57cb139d77d2aed80ba5d9e33d06eb5dad0c9f39f75dd6e01708f688
+  data.tar.gz: 3c2b47a3378ce52eaceac205a34d387ab9b301a752a7906decc8e29720876be0d13bbe17cc7fd414ae0ed0f88b6c533eebe22bacd089cbbd6624344c7d770a9c

data/CHANGELOG.md

@@ -1,28 +1,47 @@
 # Change Log
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 2.1.59 -->
-## [v2.1.59](https://github.com/chef/inspec/tree/v2.1.59) (2018-04-26)
+<!-- latest_release 2.1.67 -->
+## [v2.1.67](https://github.com/chef/inspec/tree/v2.1.67) (2018-05-03)
 
 #### Bug Fixes
-- Catch exceptions in control blocks and fail the control [#2987](https://github.com/chef/inspec/pull/2987) ([clintoncwolfe](https://github.com/clintoncwolfe))
+- Add A2 support for profile compliance depends [#3014](https://github.com/chef/inspec/pull/3014) ([jquick](https://github.com/jquick))
 <!-- latest_release -->
 
-<!-- release_rollup since=2.1.54 -->
-### Changes since 2.1.54 release
+<!-- release_rollup since=2.1.59 -->
+### Changes since 2.1.59 release
+
+#### New Features
+-  #2810 - Add check if aws s3 bucket is encrypted. [#2937](https://github.com/chef/inspec/pull/2937) ([UranusBytes](https://github.com/UranusBytes)) <!-- 2.1.64 -->
 
 #### Bug Fixes
-- Catch exceptions in control blocks and fail the control [#2987](https://github.com/chef/inspec/pull/2987) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.1.59 -->
+- Add A2 support for profile compliance depends [#3014](https://github.com/chef/inspec/pull/3014) ([jquick](https://github.com/jquick)) <!-- 2.1.67 -->
+- nginx_conf resource: Fix include paths with quotes [#2726](https://github.com/chef/inspec/pull/2726) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.1.63 -->
+
+#### Enhancements
+- Split inspec into a core gem. [#3008](https://github.com/chef/inspec/pull/3008) ([miah](https://github.com/miah)) <!-- 2.1.65 -->
+- Refactors Terraform plan to break out steps [#2996](https://github.com/chef/inspec/pull/2996) ([dmccown](https://github.com/dmccown)) <!-- 2.1.61 -->
 
 #### Merged Pull Requests
-- os_env resource returns only user&#39;s environment variable on Windows [#2945](https://github.com/chef/inspec/pull/2945) ([omar-irizarry](https://github.com/omar-irizarry)) <!-- 2.1.58 -->
-- Fix case where res is nil in etc_group [#2984](https://github.com/chef/inspec/pull/2984) ([chris-rock](https://github.com/chris-rock)) <!-- 2.1.57 -->
-- Makes JSON resource enumerable, despite method_missing magic [#2910](https://github.com/chef/inspec/pull/2910) ([TheLonelyGhost](https://github.com/TheLonelyGhost)) <!-- 2.1.56 -->
+- Add inspec-core gem to expeditor release [#3018](https://github.com/chef/inspec/pull/3018) ([jquick](https://github.com/jquick)) <!-- 2.1.66 -->
+- cmp should recognise a string being a negative int [#3007](https://github.com/chef/inspec/pull/3007) ([james-stocks](https://github.com/james-stocks)) <!-- 2.1.62 -->
+- Update Habitat plan [#3000](https://github.com/chef/inspec/pull/3000) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.1.60 -->
+<!-- release_rollup -->
+
+<!-- latest_stable_release -->
+## [v2.1.59](https://github.com/chef/inspec/tree/v2.1.59) (2018-04-26)
 
 #### Enhancements
-- Update shadow#to_s to return @path instead of hardcoded `/etc/shadow` [#2978](https://github.com/chef/inspec/pull/2978) ([miah](https://github.com/miah)) <!-- 2.1.55 -->
-<!-- release_rollup -->
+- Update shadow#to_s to return @path instead of hardcoded `/etc/shadow` [#2978](https://github.com/chef/inspec/pull/2978) ([miah](https://github.com/miah))
+
+#### Bug Fixes
+- Catch exceptions in control blocks and fail the control [#2987](https://github.com/chef/inspec/pull/2987) ([clintoncwolfe](https://github.com/clintoncwolfe))
 
+#### Merged Pull Requests
+- Makes JSON resource enumerable, despite method_missing magic [#2910](https://github.com/chef/inspec/pull/2910) ([TheLonelyGhost](https://github.com/TheLonelyGhost))
+- Fix case where res is nil in etc_group [#2984](https://github.com/chef/inspec/pull/2984) ([chris-rock](https://github.com/chris-rock))
+- os_env resource returns only user&#39;s environment variable on Windows [#2945](https://github.com/chef/inspec/pull/2945) ([omar-irizarry](https://github.com/omar-irizarry))
 <!-- latest_stable_release -->
+
 ## [v2.1.54](https://github.com/chef/inspec/tree/v2.1.54) (2018-04-19)
 
 #### New Features
@@ -43,7 +62,6 @@
 
 #### Merged Pull Requests
 - Add A2 support to the inspec-compliance toolset [#2963](https://github.com/chef/inspec/pull/2963) ([jquick](https://github.com/jquick))
-<!-- latest_stable_release -->
 
 ## [v2.1.43](https://github.com/chef/inspec/tree/v2.1.43) (2018-04-12)
 

data/Gemfile

@@ -1,6 +1,6 @@
 # encoding: utf-8
 source 'https://rubygems.org'
-gemspec
+gemspec name: 'inspec'
 
 if Gem::Version.new(RUBY_VERSION) < Gem::Version.new('2.2.2')
   gem 'json', '~> 1.8'

data/README.md

@@ -424,6 +424,12 @@ Use the rake task `bundle exec rake test:aws` to test the AWS resources against
 
 Please see [TESTING_AGAINST_AWS.md](./test/integration/aws/TESTING_AGAINST_AWS.md) for details on how to setup the needed AWS accounts to perform testing.
 
+### Azure Tests
+
+Use the rake task `bundle exec rake test:azure` to test the Azure resources against an Azure account.
+
+Please see [TESTING_AGAINST_AZURE.md](./test/integration/aws/TESTING_AGAINST_AZURE.md) for details on how to setup the needed Azure accounts to perform testing.
+
 ## License
 
 |                |                                           |

data/Rakefile

@@ -2,13 +2,15 @@
 # encoding: utf-8
 
 require 'bundler'
-require 'bundler/gem_tasks'
+require 'bundler/gem_helper'
 require 'rake/testtask'
 require 'passgen'
 require 'train'
 require_relative 'tasks/maintainers'
 require_relative 'tasks/spdx'
 
+Bundler::GemHelper.install_tasks name: 'inspec'
+
 def prompt(message)
   print(message)
   STDIN.gets.chomp
@@ -152,15 +154,30 @@ namespace :test do
   namespace :azure do
     # Specify the directory for the integration tests
     integration_dir = File.join(project_dir, 'test', 'integration', 'azure')
+    tf_vars_file = File.join(integration_dir, 'build', 'terraform.tfvars')
     attribute_file = File.join(integration_dir, '.attribute.yml')
 
     task :setup, :tf_workspace do |t, args|
       tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
       abort("You must either call the top-level test:azure task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
-      puts '----> Setup'
+
+      puts '----> Setup Terraform Workspace'
+
       sh("cd #{integration_dir}/build/ && terraform init -upgrade")
       sh("cd #{integration_dir}/build/ && terraform workspace new #{tf_workspace}")
 
+      Rake::Task["test:azure:vars"].execute
+      Rake::Task["test:azure:plan"].execute
+      Rake::Task["test:azure:apply"].execute
+    end
+
+    desc "Generate terraform.tfvars file"
+    task :vars do |t, args|
+
+      next if File.exist?(tf_vars_file)
+
+      puts '----> Generating Vars'
+
       # Generate Azure crendentials
       connection = Train.create('azure').connection
       creds = connection.options
@@ -172,23 +189,43 @@ namespace :test do
       # Use the first 4 characters of the storage account to create a suffix
       suffix = sa_name[0..3]
 
-      # Create the plan that can be applied to Azure
-      cmd  = ""
-      cmd += "cd #{integration_dir}/build/ && terraform plan -out inspec-azure.plan"
-      cmd += " -var 'subscription_id=#{creds[:subscription_id]}' "
-      cmd += " -var 'client_id=#{creds[:client_id]}' "
-      cmd += " -var 'client_secret=#{creds[:client_secret]}' "
-      cmd += " -var 'tenant_id=#{creds[:tenant_id]}' "
-      cmd += " -var 'storage_account_name=#{sa_name}' "
-      cmd += " -var 'admin_password=#{admin_password}' "
-      cmd += " -var 'suffix=#{suffix}' "
-      sh(cmd)
-
-      # Apply the plan on Azure
-      cmd = "cd #{integration_dir}/build/ && terraform apply inspec-azure.plan"
-      sh(cmd)
-
-      # Dump TF outputs to InSpec attributes file
+      content = <<~VARS
+        subscription_id = "#{creds[:subscription_id]}"
+        client_id = "#{creds[:client_id]}"
+        client_secret = "#{creds[:client_secret]}"
+        tenant_id = "#{creds[:tenant_id]}"
+        storage_account_name = "#{sa_name}"
+        admin_password = "#{admin_password}"
+        suffix = "#{suffix}"
+      VARS
+
+      content << "location = \"#{ENV['AZURE_LOCATION']}\"\n" if ENV['AZURE_LOCATION']
+
+      File.write(tf_vars_file, content)
+    end
+
+    desc "generate plan from state using terraform.tfvars file"
+    task :plan, [:tf_workspace] => [:vars] do |t, args|
+      tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+      abort("You must set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
+
+      puts '----> Generating Plan'
+
+      result = sh("cd #{integration_dir}/build/ && terraform workspace select #{tf_workspace}")
+
+      sh("cd #{integration_dir}/build/ && terraform plan -out inspec-azure.plan")
+    end
+
+    desc "apply terraform plan"
+    task :apply, [:tf_workspace] => [:plan] do |t, args|
+      tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+      abort("You must set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
+      puts '----> Applying Plan'
+
+      sh("cd #{integration_dir}/build/ && terraform workspace select #{tf_workspace}")
+
+      sh("cd #{integration_dir}/build/ && terraform apply inspec-azure.plan")
+
       Rake::Task["test:azure:dump_attrs"].execute
     end
 
@@ -197,7 +234,7 @@ namespace :test do
         raw_output = File.read(attribute_file)
         yaml_output = raw_output.gsub(" = ", " : ")
         File.open(attribute_file, "w") {|file| file.puts yaml_output}
-      end
+    end
 
     task :run do
       puts '----> Run'
@@ -209,23 +246,11 @@ namespace :test do
       abort("You must either call the top-level test:azure task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
       puts '----> Cleanup'
 
-      connection = Train.create('azure').connection
-      creds = connection.options
-
-      cmd  = ""
-      cmd += "cd #{integration_dir}/build/ && terraform destroy -force "
-      cmd += " -var 'subscription_id=#{creds[:subscription_id]}' "
-      cmd += " -var 'client_id=#{creds[:client_id]}' "
-      cmd += " -var 'client_secret=#{creds[:client_secret]}' "
-      cmd += " -var 'tenant_id=#{creds[:tenant_id]}' "
-      cmd += " -var 'storage_account_name=dummy' "
-      cmd += " -var 'admin_password=dummy' "
-      cmd += " -var 'suffix=dummy' "
-
-      sh(cmd)
+      sh("cd #{integration_dir}/build/ && terraform destroy -force ")
 
       sh("cd #{integration_dir}/build/ && terraform workspace select default")
       sh("cd #{integration_dir}/build && terraform workspace delete #{tf_workspace}")
+      File.delete(tf_vars_file)
     end
   end
 

data/docs/resources/aws_s3_bucket.md.erb

@@ -132,3 +132,9 @@ Note: This resource does not detect insecure object ACLs.
 The `have_access_logging_enabled` matcher tests if access logging is enabled for the s3 bucket.
 
     it { should have_access_logging_enabled }
+
+### have\_default\_encryption\_enabled
+
+The `have_default_encryption_enabled` matcher tests if default encryption is enabled for the s3 bucket.
+
+    it { should have_default_encryption_enabled }

data/docs/resources/filesystem.md.erb

@@ -20,7 +20,7 @@ A `filesystem` resource block declares tests for disk space in a partition:
 where
 
 * `filesystem('/')` states that the resource will look at the root (/) partition.
-* `size` is measured in megabytes (MB).
+* `size` is measured in kilobytes (KB).
 
 <br>
 
@@ -28,7 +28,7 @@ where
 
 The following examples show how to use this InSpec audit resource.
 
-### Test if the root partition is greater than 32000 MB
+### Test if the root partition is greater than 32000 KB
 
     describe filesystem('/') do
       its('size') { should be >= 32000 }

data/lib/bundles/inspec-compliance/target.rb

@@ -62,7 +62,8 @@ module Compliance
       config['token'] = Compliance::API.get_token(config)
 
       # Needed for automate2 post request
-      config['profile'] = Compliance::API.profile_split(profile)
+      profile_stub = profile || target[:compliance]
+      config['profile'] = Compliance::API.profile_split(profile_stub)
 
       new(profile_fetch_url, config)
     rescue URI::Error => _e

data/lib/fetchers/url.rb

@@ -157,6 +157,12 @@ module Fetchers
       opts = http_opts
       opts[:use_ssl] = uri.scheme == 'https'
 
+      if @insecure
+        opts[:verify_mode] = OpenSSL::SSL::VERIFY_NONE
+      else
+        opts[:verify_mode] = OpenSSL::SSL::VERIFY_PEER
+      end
+
       req = Net::HTTP::Post.new(uri)
       opts.each do |key, value|
         req.add_field(key, value)

data/lib/inspec/resource.rb

@@ -78,13 +78,16 @@ end
 require 'utils/filter'
 
 # AWS resources are included via their own file.
-require 'resource_support/aws'
+require 'resource_support/aws' if Gem.loaded_specs.key?('aws-sdk')
+
+if Gem.loaded_specs.key?('azure_mgmt_resources')
+  require 'resources/azure/azure_backend.rb'
+  require 'resources/azure/azure_generic_resource.rb'
+  require 'resources/azure/azure_resource_group.rb'
+  require 'resources/azure/azure_virtual_machine.rb'
+  require 'resources/azure/azure_virtual_machine_data_disk.rb'
+end
 
-require 'resources/azure/azure_backend.rb'
-require 'resources/azure/azure_generic_resource.rb'
-require 'resources/azure/azure_resource_group.rb'
-require 'resources/azure/azure_virtual_machine.rb'
-require 'resources/azure/azure_virtual_machine_data_disk.rb'
 require 'resources/aide_conf'
 require 'resources/apache'
 require 'resources/apache_conf'

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '2.1.59'
+  VERSION = '2.1.67'
 end

data/lib/matchers/matchers.rb

@@ -211,7 +211,7 @@ end
 RSpec::Matchers.define :cmp do |first_expected| # rubocop:disable Metrics/BlockLength
 
   def integer?(value)
-    !(value =~ /\A0+\Z|\A[1-9]\d*\Z/).nil?
+    !(value =~ /\A-?0+\Z|\A-?[1-9]\d*\Z/).nil?
   end
 
   def float?(value)

data/lib/resources/aws/aws_s3_bucket.rb

@@ -10,7 +10,7 @@ class AwsS3Bucket < Inspec.resource(1)
   supports platform: 'aws'
 
   include AwsSingularResourceMixin
-  attr_reader :bucket_name, :has_access_logging_enabled, :region
+  attr_reader :bucket_name, :has_default_encryption_enabled, :has_access_logging_enabled, :region
 
   def to_s
     "S3 Bucket #{@bucket_name}"
@@ -35,8 +35,13 @@ class AwsS3Bucket < Inspec.resource(1)
       bucket_policy.any? { |s| s.effect == 'Allow' && s.principal == '*' }
   end
 
+  def has_default_encryption_enabled?
+    return false unless @exists
+    @has_default_encryption_enabled ||= fetch_bucket_encryption_configuration
+  end
+
   def has_access_logging_enabled?
-    return unless @exists
+    return false unless @exists
     catch_aws_errors do
       @has_access_logging_enabled ||= !BackendFactory.create(inspec_runner).get_bucket_logging(bucket: bucket_name).logging_enabled.nil?
     end
@@ -89,6 +94,19 @@ class AwsS3Bucket < Inspec.resource(1)
     end
   end
 
+  def fetch_bucket_encryption_configuration
+    @has_default_encryption_enabled ||= catch_aws_errors do
+      begin
+        !BackendFactory.create(inspec_runner)
+                       .get_bucket_encryption(bucket: bucket_name)
+                       .server_side_encryption_configuration
+                       .nil?
+      rescue Aws::S3::Errors::ServerSideEncryptionConfigurationNotFoundError
+        false
+      end
+    end
+  end
+
   # Uses the SDK API to really talk to AWS
   class Backend
     class AwsClientApi < AwsBackendBase
@@ -110,6 +128,10 @@ class AwsS3Bucket < Inspec.resource(1)
       def get_bucket_logging(query)
         aws_service_client.get_bucket_logging(query)
       end
+
+      def get_bucket_encryption(query)
+        aws_service_client.get_bucket_encryption(query)
+      end
     end
   end
 end

data/lib/utils/find_files.rb

@@ -17,17 +17,20 @@ module FindFiles
 
   # ignores errors
   def find_files(path, opts = {})
-    find_files_or_error(path, opts) || []
+    find_files_or_warn(path, opts) || []
   end
 
-  def find_files_or_error(path, opts = {})
+  def find_files_or_warn(path, opts = {})
     depth = opts[:depth]
     type = TYPES[opts[:type].to_sym] if opts[:type]
 
-    cmd = "sh -c \'find #{path}"
+    # If `path` contains a `'` we must modify how we quote the `sh -c` argument
+    quote = path.include?("'") ? '"' : '\''
+
+    cmd = "sh -c #{quote}find #{path}"
     cmd += " -type #{type}" unless type.nil?
     cmd += " -maxdepth #{depth.to_i}" if depth.to_i > 0
-    cmd += "\'"
+    cmd += quote
 
     result = inspec.command(cmd)
     exit_status = result.exit_status

data/lib/utils/nginx_parser.rb

@@ -33,12 +33,32 @@ class NginxParser < Parslet::Parser
     standard_identifier | quoted_identifier
   }
 
-  rule(:value) {
-    ((match('[#;{]').absent? >> any) >> (
+  rule(:standard_value) {
+    ((match(/[#;{'"]/).absent? >> any) >> (
       str('\\') >> any | match('[#;{]|\s').absent? >> any
     ).repeat).as(:value) >> space.repeat
   }
 
+  rule(:single_quoted_value) {
+    str("'") >> (
+      str('\\') >> any | str("'").absent? >> any
+    ).repeat.as(:value) >> str("'") >> space.repeat
+  }
+
+  rule(:double_quoted_value) {
+    str('"') >> (
+      str('\\') >> any | str('"').absent? >> any
+    ).repeat.as(:value) >> str('"') >> space.repeat
+  }
+
+  rule(:quoted_value) {
+    single_quoted_value | double_quoted_value
+  }
+
+  rule(:value) {
+    standard_value | quoted_value
+  }
+
   rule(:values) {
     value.repeat >> space.maybe
   }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec
 version: !ruby/object:Gem::Version
-  version: 2.1.59
+  version: 2.1.67
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-26 00:00:00.000000000 Z
+date: 2018-05-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train