inspec/etc/features.sig
Nikita Mathur fd4e6d97a6
CHEF-6439 Mandatory Profile Signing (Preview) (#6705)
* Updated exec option to allow unsigned profiles run

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Added method to verify signed profile and to check for signed profile

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Invoked logic on each run to verify profiles if signed else raise sig req error

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Tests cases added to validate behaviour of inspec exec with signed and unsigned profiles with --chef-allow-unsigned flag

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Refactored and moved delete_signing_keys to common helper library for tests

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Updated code comments for more information and clarity on security update of signed profiles inspec exec

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Test cases to validate inspec run with combination of signed and unsigned profiles

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Documented usage of flag --chef-allow-unsigned

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Renamed the flag to run unsigned profiles to --allow-unsigned

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Refactored logic on profile level for profile signing verification

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Renaming the argument variable - from runner_call to silent

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Added profile mandate check for other inspec commands running profile evaluation

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Updated error message for profile sign requirement

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Updated test helper to fix inspec json test

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Fixed inspec json ability to use cli options successfully

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Documentation added for signed profiles mandatory usage with CLI commands

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Flow changes of raising exception when unsigned instead of direct exit

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Renamed unsigned profile flags

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Extracted out allow unsigned condition to config and modified comment info

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Doc update on consent of using signed and unsigned profiles

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Fix in signing mandatin check and added additional check on runner for better error UI for exec command

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Removed repeated allow-unsigned-profile defination from exec_options

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Test fixes

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Enabled feature preview flag for mandatory signing

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Test fixes after feature flag usage for mandatory signing

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Doc changes using feature preview flag for mandatory signing feature

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Inspec exec tests fixes for ENV values and parallel test fix using default option --allow-unsigned-profile false

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Kitchen fix while using signed profiles with inspec

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Unit test fix for profile resource exception

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Virtual profile detection improved

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Move mandatory profile sigining info to sigining page

Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>

* Renamed flag from --allow-unsigned-profile to --allow-unsigned-profiles

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Typo fix in signing doc

Signed-off-by: Nik08 <nikita.mathur@progress.com>

* Trim note in cli.md about mandatory profile signing

Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>

* Docs changes

Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>

* Correct docs regarding exit code 5

Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>

---------

Signed-off-by: Nik08 <nikita.mathur@progress.com>
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>
Co-authored-by: Clinton Wolfe <clintoncwolfe@gmail.com>
Co-authored-by: Ian Maddaus <ian.maddaus@progress.com>
2023-11-09 08:20:43 -05:00

6 lines
350 B
Standard ML

ouQqvzkBxmM7J1cDE6/gsw8bE01+o2XFfDQoobG+n91yyCw0zjRzOUZ/NH+j
xZwB07D8+NNZQ4kYXMCkGXRQqZGq9nasIFfgwMjA4tWTWaE9i3jcL2Q3HOUF
aZ55wGtr5gpQc+pzQktFGRnC6ChmUgCzO2xTpl/h7TlNWIFU3INF8e2QnGqW
+2Xe7KDhY+4cTYKu9PSWfo6cBv71N/t2fbRTYyeCBoukav3fOioitO0aGiWv
RrR8HSomvEQE+9yQanxkyiSjPW93/SCI2rjNq9ouIGXYzTchRkgxH+hZXV1V
CJw+H5I+k9sx3I8on5eXK3Oa0Bd3zGetrXFfQLu83A==