inspec 2.2.41 → 2.2.50

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 3d55e24934410cb4a4eca689c5125ba03a5dbe18711856fdeb8e6aaafbcaf7b3
4
- data.tar.gz: 6571c1a3d486c2b20e6a1ba706ccca8f143872ba504e408e3c311cc4a36f3fcb
3
+ metadata.gz: 18a37b35268f58619b53379d49c9abecf4cd2173ed4f8d007718d98f7438da7d
4
+ data.tar.gz: 176561770b98d46ffc5f69ec38ebd0eef169ef9ad770ec921fa1ad16a45d6a92
5
5
  SHA512:
6
- metadata.gz: 540657cfc1af9cbcf611b5c7346a2b14a138b033bb94ba7272042f772cc4fa7ec6691b91d14b2f50b1618488699f2658d72198bfe5a187adef68622977dc8515
7
- data.tar.gz: 33faa8dd7576c7914e4419956440e7e74faa4bb476d5a3607952767244a1d73ca27ba1d7e655065f6438f51075ccdc9776c5edc67c8e3dda3110aa83ed0b4240
6
+ metadata.gz: 61c08ae2ca27909e61c788616caf71f9c079d12f10fdd773cdef79cabd5d70b73b569519bac3981e1b68cf478b9cf7215fe773cd15d98063210c53b323e36ae2
7
+ data.tar.gz: 6b54b6a415680bec602497fecc81905bdf0a5ad8b31831014d03a8433b1b48c359f56b3e38c0bac9eaf3c71f5e9a9695f88bd545c6f1390ade4c7157d3f97e91
@@ -1,9 +1,29 @@
1
1
  # Change Log
2
2
  <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
3
- <!-- latest_release -->
3
+ <!-- latest_release 2.2.50 -->
4
+ ## [v2.2.50](https://github.com/inspec/inspec/tree/v2.2.50) (2018-07-26)
5
+
6
+ #### Enhancements
7
+ - Since /proc/xen is an empty dir in Amazon Linux, inspec falsely detects docker instances as platform=&#39;xen&#39; [#3243](https://github.com/inspec/inspec/pull/3243) ([woneill](https://github.com/woneill))
4
8
  <!-- latest_release -->
5
9
 
6
- <!-- release_rollup -->
10
+ <!-- release_rollup since=2.2.41 -->
11
+ ### Changes since 2.2.41 release
12
+
13
+ #### New Features
14
+ - windows_feature resource: Add DISM support [#3224](https://github.com/inspec/inspec/pull/3224) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.47 -->
15
+
16
+ #### Enhancements
17
+ - Since /proc/xen is an empty dir in Amazon Linux, inspec falsely detects docker instances as platform=&#39;xen&#39; [#3243](https://github.com/inspec/inspec/pull/3243) ([woneill](https://github.com/woneill)) <!-- 2.2.50 -->
18
+ - alpine resource: Fix small style issues [#3238](https://github.com/inspec/inspec/pull/3238) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.45 -->
19
+ - Add extra fault checking to git fetcher [#3239](https://github.com/inspec/inspec/pull/3239) ([james-stocks](https://github.com/james-stocks)) <!-- 2.2.44 -->
20
+
21
+ #### Merged Pull Requests
22
+ - Fix for profile version not being included in the compliance upload c… [#3252](https://github.com/inspec/inspec/pull/3252) ([devoptimist](https://github.com/devoptimist)) <!-- 2.2.49 -->
23
+ - Satisfy RuboCop by adding `x` bit to `bin/inspec` [#3249](https://github.com/inspec/inspec/pull/3249) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.48 -->
24
+ - cli: Downcase supermarket tool name to match URL [#3242](https://github.com/inspec/inspec/pull/3242) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.46 -->
25
+ - Fix the unit tests ssl issue [#3251](https://github.com/inspec/inspec/pull/3251) ([jquick](https://github.com/jquick)) <!-- 2.2.43 -->
26
+ - update README.md to fix travis and appveyor&#39;s badges. [#3244](https://github.com/inspec/inspec/pull/3244) ([takahashim](https://github.com/takahashim)) <!-- 2.2.42 -->
7
27
  <!-- release_rollup -->
8
28
 
9
29
  <!-- latest_stable_release -->
data/README.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # InSpec: Inspect Your Infrastructure
2
2
 
3
3
  [![Slack](https://community-slack.chef.io/badge.svg)](https://community-slack.chef.io/)
4
- [![Build Status Master](https://travis-ci.org/chef/inspec.svg?branch=master)](https://travis-ci.org/chef/inspec)
5
- [![Build Status Master](https://ci.appveyor.com/api/projects/status/github/chef/inspec?branch=master&svg=true&passingText=master%20-%20Ok&pendingText=master%20-%20Pending&failingText=master%20-%20Failing)](https://ci.appveyor.com/project/Chef/inspec/branch/master)
4
+ [![Build Status Master](https://travis-ci.org/inspec/inspec.svg?branch=master)](https://travis-ci.org/inspec/inspec)
5
+ [![Build Status Master](https://ci.appveyor.com/api/projects/status/github/inspec/inspec?branch=master&svg=true&passingText=master%20-%20Ok&pendingText=master%20-%20Pending&failingText=master%20-%20Failing)](https://ci.appveyor.com/project/Chef/inspec/branch/master)
6
6
 
7
7
  InSpec is an open-source testing framework for infrastructure with a human- and machine-readable language for specifying compliance, security and policy requirements.
8
8
 
data/bin/inspec CHANGED
File without changes
@@ -28,9 +28,21 @@ where
28
28
 
29
29
  The following examples show how to use this InSpec audit resource.
30
30
 
31
- ### Test the DHCP Server feature
31
+ ### Test the DHCP feature (Attempts PowerShell then DISM)
32
32
 
33
- describe windows_feature('DHCP Server') do
33
+ describe windows_feature('DHCP') do
34
+ it{ should be_installed }
35
+ end
36
+
37
+ ### Test the IIS-WebServer feature using DISM
38
+
39
+ describe windows_feature('IIS-WebServer', DISM) do
40
+ it{ should be_installed }
41
+ end
42
+
43
+ ### Test the NetFx3 feature using DISM
44
+
45
+ describe windows_feature('NetFx3', :dism) do
34
46
  it{ should be_installed }
35
47
  end
36
48
 
@@ -173,9 +173,12 @@ module Compliance
173
173
  # read profile name from inspec.yml
174
174
  profile_name = profile.params[:name]
175
175
 
176
+ # read profile version from inspec.yml
177
+ profile_version = profile.params[:version]
178
+
176
179
  # check that the profile is not uploaded already,
177
180
  # confirm upload to the user (overwrite with --force)
178
- if Compliance::API.exist?(config, "#{config['owner']}/#{profile_name}") && !options['overwrite']
181
+ if Compliance::API.exist?(config, "#{config['owner']}/#{profile_name}##{profile_version}") && !options['overwrite']
179
182
  error.call('Profile exists on the server, use --overwrite')
180
183
  end
181
184
 
@@ -38,7 +38,8 @@ module Supermarket
38
38
  def self.info(profile, supermarket_url = SUPERMARKET_URL)
39
39
  _tool_owner, tool_name = profile_name("supermarket://#{profile}")
40
40
  return if tool_name.nil? || tool_name.empty?
41
- url = "#{supermarket_url}/api/v1/tools/#{tool_name}"
41
+ # Tool name in Supermarket URL is downcased so we need to downcase
42
+ url = "#{supermarket_url}/api/v1/tools/#{tool_name.downcase}"
42
43
  _success, data = get(url, {})
43
44
  JSON.parse(data) if !data.nil?
44
45
  rescue JSON::ParserError
@@ -48,7 +49,11 @@ module Supermarket
48
49
  # compares a profile with the supermarket tool info
49
50
  def self.same?(profile, supermarket_tool, supermarket_url = SUPERMARKET_URL)
50
51
  tool_owner, tool_name = profile_name(profile)
51
- tool = "#{supermarket_url}/api/v1/tools/#{tool_name}"
52
+
53
+ raise "Could not parse tool name from #{profile}" if tool_name.nil?
54
+
55
+ # Tool name in Supermarket URL is downcased so we need to downcase
56
+ tool = "#{supermarket_url}/api/v1/tools/#{tool_name.downcase}"
52
57
  supermarket_tool['tool_owner'] == tool_owner && supermarket_tool['tool'] == tool
53
58
  end
54
59
 
@@ -83,7 +83,9 @@ module Fetchers
83
83
  end
84
84
 
85
85
  def resolve_ref(ref_name)
86
- cmd = shellout("git ls-remote \"#{@remote_url}\" \"#{ref_name}*\"")
86
+ command_string = "git ls-remote \"#{@remote_url}\" \"#{ref_name}*\""
87
+ cmd = shellout(command_string)
88
+ raise "Error running '#{command_string}': #{cmd.stderr}" unless cmd.stderr == ''
87
89
  ref = parse_ls_remote(cmd.stdout, ref_name)
88
90
  if !ref
89
91
  raise "Unable to resolve #{ref_name} to a specific git commit for #{@remote_url}"
@@ -4,5 +4,5 @@
4
4
  # author: Christoph Hartmann
5
5
 
6
6
  module Inspec
7
- VERSION = '2.2.41'
7
+ VERSION = '2.2.50'
8
8
  end
@@ -19,10 +19,7 @@ module Inspec::Resources
19
19
  its('version') { should eq 1.9.5 }
20
20
  end
21
21
  "
22
- # rubocop:disable Metrics/AbcSize
23
- # rubocop:disable Metrics/CyclomaticComplexity
24
- # rubocop:disable Metrics/PerceivedComplexity
25
- def initialize(package_name, opts = {})
22
+ def initialize(package_name, opts = {}) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
26
23
  @package_name = package_name
27
24
  @name = @package_name
28
25
  @cache = nil
@@ -54,9 +51,6 @@ module Inspec::Resources
54
51
 
55
52
  evaluate_missing_requirements
56
53
  end
57
- # rubocop:enable Metrics/AbcSize
58
- # rubocop:enable Metrics/CyclomaticComplexity
59
- # rubocop:enable Metrics/PerceivedComplexity
60
54
 
61
55
  # returns true if the package is installed
62
56
  def installed?(_provider = nil, _version = nil)
@@ -67,15 +67,15 @@ module Inspec::Resources
67
67
  # - Additional edge cases likely should not change the above assumptions
68
68
  # but rather be additive - btm
69
69
  def detect_xen
70
- return false unless inspec.file('/proc/xen').exist?
71
- @virtualization_data[:system] = 'xen'
72
- @virtualization_data[:role] = 'guest'
73
-
74
70
  # This file should exist on most Xen systems, normally empty for guests
75
- if inspec.file('/proc/xen/capabilities').exist? &&
76
- inspec.file('/proc/xen/capabilities').content =~ /control_d/i # rubocop:disable Layout/MultilineOperationIndentation
71
+ return false unless inspec.file('/proc/xen/capabilities').exist?
72
+ @virtualization_data[:system] = 'xen'
73
+ if inspec.file('/proc/xen/capabilities').content =~ /control_d/i
77
74
  @virtualization_data[:role] = 'host'
75
+ else
76
+ @virtualization_data[:role] = 'guest'
78
77
  end
78
+
79
79
  true
80
80
  end
81
81
 
@@ -1,84 +1,126 @@
1
1
  # encoding: utf-8
2
2
 
3
- # check for a Windows feature
4
- # Usage:
5
- # describe windows_feature('DHCP Server') do
6
- # it{ should be_installed }
7
- # end
8
- #
9
- # deprecated serverspec syntax:
10
- # describe windows_feature('IIS-Webserver') do
11
- # it{ should be_installed.by("dism") }
12
- # end
13
- #
14
- # describe windows_feature('Web-Webserver') do
15
- # it{ should be_installed.by("powershell") }
16
- # end
17
- #
18
- # This implementation uses the Get-WindowsFeature commandlet:
19
- # Get-WindowsFeature | Where-Object {$_.Name -eq 'XPS Viewer' -or $_.DisplayName -eq 'XPS Viewe
20
- # r'} | Select-Object -Property Name,DisplayName,Description,Installed,InstallState | ConvertTo-Json
21
- # {
22
- # "Name": "XPS-Viewer",
23
- # "DisplayName": "XPS Viewer",
24
- # "Description": "The XPS Viewer is used to read, set permissions for, and digitally sign XPS documents.",
25
- # "Installed": false,
26
- # "InstallState": 0
27
- # }
28
3
  module Inspec::Resources
29
4
  class WindowsFeature < Inspec.resource(1)
30
5
  name 'windows_feature'
31
6
  supports platform: 'windows'
32
7
  desc 'Use the windows_feature InSpec audit resource to test features on Microsoft Windows.'
33
- example "
34
- describe windows_feature('dhcp') do
8
+ example <<-EOX
9
+ # By default this resource will use Get-WindowsFeature.
10
+ # Failing that, it will use DISM.
11
+
12
+ # Get-WindowsFeature Example
13
+ describe windows_feature('Web-WebServer', :powershell) do
14
+ it { should be_installed }
15
+ end
16
+
17
+ # DISM Example
18
+ describe windows_feature('IIS-WebServer', :dism) do
19
+ it { should be_installed }
20
+ end
21
+
22
+ # Try PowerShell then DISM Example
23
+ describe windows_feature('IIS-WebServer') do
35
24
  it { should be_installed }
36
25
  end
37
- "
26
+ EOX
38
27
 
39
- def initialize(feature)
28
+ def initialize(feature, method = nil)
40
29
  @feature = feature
30
+ @method = method
41
31
  @cache = nil
42
-
43
- # verify that this resource is only supported on Windows
44
- return skip_resource 'The `windows_feature` resource is not supported on your OS.' if !inspec.os.windows?
45
32
  end
46
33
 
47
34
  # returns true if the package is installed
48
- def installed?(_provider = nil, _version = nil)
35
+ def installed?
49
36
  info[:installed] == true
50
37
  end
51
38
 
52
39
  # returns the package description
53
40
  def info
54
41
  return @cache if !@cache.nil?
55
- features_cmd = "Get-WindowsFeature | Where-Object {$_.Name -eq '#{@feature}' -or $_.DisplayName -eq '#{@feature}'} | Select-Object -Property Name,DisplayName,Description,Installed,InstallState | ConvertTo-Json"
56
- cmd = inspec.command(features_cmd)
57
42
 
58
- @cache = {
59
- name: @feature,
60
- type: 'windows-feature',
61
- }
62
-
63
- # cannot rely on exit code for now, successful command returns exit code 1
64
- # return nil if cmd.exit_status != 0
65
- # try to parse json
66
- begin
67
- params = JSON.parse(cmd.stdout)
68
- rescue JSON::ParserError => _e
69
- return @cache
43
+ case @method
44
+ when :powershell
45
+ @cache = info_via_powershell(@feature)
46
+ if @cache[:error]
47
+ # TODO: Allow handling `Inspec::Exception` outside of initialize
48
+ # See: https://github.com/inspec/inspec/issues/3237
49
+ # The below will fail the resource regardless of what is raised
50
+ raise Inspec::Exceptions::ResourceFailed, @cache[:error]
51
+ end
52
+ when :dism
53
+ @cache = info_via_dism(@feature)
54
+ else
55
+ @cache = info_via_powershell(@feature)
56
+ @cache = info_via_dism(@feature) if @cache[:error]
70
57
  end
71
58
 
72
- @cache = {
73
- name: params['Name'],
74
- description: params['Description'],
75
- installed: params['Installed'],
76
- type: 'windows-feature',
77
- }
59
+ @cache
78
60
  end
79
61
 
80
62
  def to_s
81
63
  "Windows Feature '#{@feature}'"
82
64
  end
65
+
66
+ private
67
+
68
+ def info_via_dism(feature)
69
+ dism_command = "dism /online /get-featureinfo /featurename:#{feature}"
70
+ cmd = inspec.command(dism_command)
71
+
72
+ if cmd.exit_status != 0
73
+ feature_info = {
74
+ name: feature,
75
+ description: 'N/A',
76
+ installed: false,
77
+ }
78
+ else
79
+ result = cmd.stdout
80
+ feature_name_regex = /Feature Name : (.*)(\r\n|\n)/
81
+ description_regex = /Description : (.*)(\r\n|\n)/
82
+ feature_info = {
83
+ name: result.match(feature_name_regex).captures[0].chomp,
84
+ description: result.match(description_regex).captures[0].chomp,
85
+ installed: true,
86
+ }
87
+ end
88
+
89
+ feature_info[:method] = :dism
90
+ feature_info
91
+ end
92
+
93
+ def info_via_powershell(feature)
94
+ features_cmd = "Get-WindowsFeature | Where-Object {$_.Name -eq '#{feature}' -or $_.DisplayName -eq '#{feature}'} | Select-Object -Property Name,DisplayName,Description,Installed,InstallState | ConvertTo-Json"
95
+ cmd = inspec.command(features_cmd)
96
+
97
+ feature_info = {}
98
+
99
+ # The `Get-WindowsFeature` command is not available on the Windows
100
+ # non-server OS. This attempts to use the `dism` command to get the info.
101
+ if cmd.stderr =~ /The term 'Get-WindowsFeature' is not recognized/
102
+ feature_info[:name] = feature
103
+ feature_info[:error] = 'Could not find `Get-WindowsFeature`'
104
+ else
105
+ # We cannot rely on `cmd.exit_status != 0` because by default the
106
+ # command will exit 1 even on success. So, if we cannot parse the JSON
107
+ # we know that the feature is not installed.
108
+ begin
109
+ result = JSON.parse(cmd.stdout)
110
+
111
+ feature_info = {
112
+ name: result['Name'],
113
+ description: result['Description'],
114
+ installed: result['Installed'],
115
+ }
116
+ rescue JSON::ParserError => _e
117
+ feature_info[:name] = feature
118
+ feature_info[:installed] = false
119
+ end
120
+ end
121
+
122
+ feature_info[:method] = :powershell
123
+ feature_info
124
+ end
83
125
  end
84
126
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: inspec
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.2.41
4
+ version: 2.2.50
5
5
  platform: ruby
6
6
  authors:
7
7
  - Dominik Richter
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2018-07-20 00:00:00.000000000 Z
11
+ date: 2018-07-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: train