mirror of
https://github.com/inspec/inspec
synced 2024-11-23 21:23:29 +00:00
237 lines
8.7 KiB
Ruby
237 lines
8.7 KiB
Ruby
require "functional/helper"
|
|
require "tmpdir"
|
|
|
|
describe "example inheritance profile" do
|
|
include FunctionalHelper
|
|
|
|
before do
|
|
skip_windows!
|
|
end
|
|
|
|
it "can vendor profile dependencies" do
|
|
prepare_examples("inheritance") do |dir|
|
|
out = inspec("vendor " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.stdout.must_include "Dependencies for profile #{dir} successfully vendored to #{dir}/vendor"
|
|
out.exit_status.must_equal 0
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
end
|
|
end
|
|
|
|
it "can vendor profile dependencies with a relative path" do
|
|
prepare_examples("inheritance") do |dir|
|
|
relative_path = File.join(dir, "../", File.basename(dir))
|
|
out = inspec("vendor " + relative_path + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
Dir.glob(File.join(dir, "vendor", "*")).wont_be_empty
|
|
end
|
|
end
|
|
|
|
it "can vendor profile dependencies with a backslash in path on Windows" do
|
|
return unless is_windows?
|
|
prepare_examples("inheritance") do |dir|
|
|
dir_with_backslash = File.join(dir, '..\\', File.basename(dir))
|
|
out = inspec("vendor " + dir_with_backslash + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
Dir.glob(File.join(dir, "vendor", "*")).wont_be_empty
|
|
end
|
|
end
|
|
|
|
it "can vendor profile dependencies from the profile path" do
|
|
prepare_examples("inheritance") do |dir|
|
|
out = inspec("vendor --overwrite", "cd #{dir} &&")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
# this fixes the osx /var symlink to /private/var causing this test to fail
|
|
out.stdout.gsub!("/private/var", "/var")
|
|
out.stdout.must_include "Dependencies for profile #{dir} successfully vendored to #{dir}/vendor"
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
end
|
|
end
|
|
|
|
it "can vendor profile dependencies from git" do
|
|
git_depends_path = File.join(profile_path, "git-depends")
|
|
|
|
Dir.mktmpdir do |tmpdir|
|
|
FileUtils.cp_r(git_depends_path + "/.", tmpdir)
|
|
File.exist?(File.join(tmpdir, "vendor")).must_equal false
|
|
|
|
out = inspec("vendor " + tmpdir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
out.stdout.must_include "Dependencies for profile #{tmpdir} successfully vendored to #{tmpdir}/vendor"
|
|
|
|
File.exist?(File.join(tmpdir, "vendor")).must_equal true
|
|
File.exist?(File.join(tmpdir, "inspec.lock")).must_equal true
|
|
# Check that our vendor directory exists
|
|
Dir.glob(File.join(tmpdir, "vendor", "*")).length.must_equal 1
|
|
# Check that our vendor directory has contents
|
|
Dir.glob(File.join(tmpdir, "vendor", "*", "*")).length.must_be :>=, 8
|
|
end
|
|
end
|
|
|
|
it "ensure nothing is loaded from external source if vendored profile is used" do
|
|
prepare_examples("meta-profile") do |dir|
|
|
out = inspec("vendor " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
|
|
out = inspec("exec " + dir + " -l debug --no-create-lockfile")
|
|
out.stderr.must_equal ""
|
|
out.stdout.must_include 'Using cached dependency for {:url=>"https://github.com/dev-sec/ssh-baseline/archive/master.tar.gz"'
|
|
out.stdout.must_include 'Using cached dependency for {:url=>"https://github.com/dev-sec/ssl-baseline/archive/master.tar.gz"'
|
|
out.stdout.must_include 'Using cached dependency for {:url=>"https://github.com/chris-rock/windows-patch-benchmark/archive/master.tar.gz"'
|
|
out.stdout.wont_include "Fetching URL:"
|
|
out.stdout.wont_include "Fetched archive moved to:"
|
|
end
|
|
end
|
|
|
|
it "ensure json/check command do not fetch remote profiles if vendored" do
|
|
prepare_examples("profile") do |dir|
|
|
out = inspec("vendor " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
out = inspec("json " + dir + " --output " + dst.path)
|
|
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
hm = JSON.load(File.read(dst.path))
|
|
hm["name"].must_equal "profile"
|
|
hm["controls"].length.must_be :>=, 4
|
|
|
|
# out.stdout.scan(/Copy .* to cache directory/).length.must_equal 3
|
|
# out.stdout.scan(/Dependency does not exist in the cache/).length.must_equal 1
|
|
out.stdout.scan(/Fetching URL:/).length.must_equal 0
|
|
|
|
# execute check command
|
|
out = inspec("check " + dir + " -l debug")
|
|
# stderr may have warnings included; only test if something went wrong
|
|
out.stderr.must_equal("") if out.exit_status != 0
|
|
out.exit_status.must_equal 0
|
|
|
|
out.stdout.scan(/Fetching URL:/).length.must_equal 0
|
|
end
|
|
end
|
|
|
|
it "use lockfile in tarball" do
|
|
prepare_examples("meta-profile") do |dir|
|
|
# ensure the profile is vendored and packaged as tar
|
|
out = inspec("vendor " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
out = inspec("archive " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
# execute json command
|
|
out = inspec("json meta-profile-0.2.0.tar.gz -l debug")
|
|
# stderr may have warnings included; only test if something went wrong
|
|
out.stderr.must_equal("") if out.exit_status != 0
|
|
out.exit_status.must_equal 0
|
|
|
|
out.stdout.scan(/Fetching URL:/).length.must_equal 0
|
|
end
|
|
end
|
|
|
|
it "can move vendor files into custom vendor cache" do
|
|
prepare_examples("meta-profile") do |dir|
|
|
out = inspec("vendor " + dir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
File.exist?(File.join(dir, "vendor")).must_equal true
|
|
File.exist?(File.join(dir, "inspec.lock")).must_equal true
|
|
File.exist?(File.join(dir, "vendor_cache")).must_equal false
|
|
|
|
# Run `inspec exec` to create vendor cache
|
|
inspec("exec " + dir + " --vendor-cache " + dir + "/vendor_cache")
|
|
|
|
File.exist?(File.join(dir, "vendor_cache")).must_equal true
|
|
vendor_files = Dir.entries("#{dir}/vendor/").sort
|
|
vendor_cache_files = Dir.entries("#{dir}/vendor_cache/").sort
|
|
vendor_files.must_equal vendor_cache_files
|
|
end
|
|
end
|
|
|
|
it "vendors profiles when using a local path" do
|
|
local_depends_path = File.join(profile_path, "local-depends")
|
|
dir_profile_path = File.join(profile_path, "complete-profile")
|
|
tar_profile_path = File.join(profile_path,
|
|
"archived-profiles",
|
|
"tar_profile-1.0.0.tar.gz"
|
|
)
|
|
zip_profile_path = File.join(profile_path,
|
|
"archived-profiles",
|
|
"zip_profile-1.0.0.zip"
|
|
)
|
|
|
|
Dir.mktmpdir do |tmpdir|
|
|
[dir_profile_path, tar_profile_path, zip_profile_path].each do |profile|
|
|
included_tmpdir = File.join(tmpdir, File.basename(profile))
|
|
FileUtils.cp_r(profile, included_tmpdir)
|
|
end
|
|
|
|
profile_tmpdir = File.join(tmpdir, File.basename(local_depends_path))
|
|
FileUtils.cp_r(local_depends_path + "/.", profile_tmpdir)
|
|
|
|
out = inspec("vendor " + profile_tmpdir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
vendor_list = Dir.glob(File.join(profile_tmpdir, "vendor", "*"))
|
|
vendor_list.length.must_equal 3
|
|
vendor_list.each do |entry|
|
|
# confirm archives were extracted into folders
|
|
File.directory?(entry).must_equal true
|
|
Dir.glob(File.join(entry, "*")).length.must_be(:>=, 1)
|
|
end
|
|
end
|
|
end
|
|
|
|
it "extracts archives in vendor directory when present" do
|
|
archive_depends_path = File.join(profile_path, "archive-depends")
|
|
|
|
Dir.mktmpdir do |tmpdir|
|
|
FileUtils.cp_r(archive_depends_path + "/.", tmpdir)
|
|
|
|
out = inspec("vendor " + tmpdir + " --overwrite")
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
|
|
Dir.glob(File.join(tmpdir, "vendor", "*")).each do |file|
|
|
file.wont_match(/(\.tar.*$|\.zip$)/)
|
|
end
|
|
end
|
|
end
|
|
|
|
it "can vendor profile with required inputs" do
|
|
archive_depends_path = File.join(profile_path, "profile-with-required-inputs")
|
|
|
|
Dir.mktmpdir do |tmpdir|
|
|
FileUtils.cp_r(archive_depends_path + "/.", tmpdir)
|
|
|
|
out = inspec("vendor " + tmpdir)
|
|
out.stderr.must_equal ""
|
|
out.exit_status.must_equal 0
|
|
end
|
|
end
|
|
end
|