{"action":"created","issue":{"url":"https://api.github.com/repos/chef/inspec/issues/1283","repository_url":"https://api.github.com/repos/chef/inspec","labels_url":"https://api.github.com/repos/chef/inspec/issues/1283/labels{/name}","comments_url":"https://api.github.com/repos/chef/inspec/issues/1283/comments","events_url":"https://api.github.com/repos/chef/inspec/issues/1283/events","html_url":"https://github.com/chef/inspec/issues/1283","id":187758479,"number":1283,"title":"Vendor dependent profiles in archive","user":{"login":"chris-rock","id":1178413,"avatar_url":"https://avatars.githubusercontent.com/u/1178413?v=3","gravatar_id":"","url":"https://api.github.com/users/chris-rock","html_url":"https://github.com/chris-rock","followers_url":"https://api.github.com/users/chris-rock/followers","following_url":"https://api.github.com/users/chris-rock/following{/other_user}","gists_url":"https://api.github.com/users/chris-rock/gists{/gist_id}","starred_url":"https://api.github.com/users/chris-rock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chris-rock/subscriptions","organizations_url":"https://api.github.com/users/chris-rock/orgs","repos_url":"https://api.github.com/users/chris-rock/repos","events_url":"https://api.github.com/users/chris-rock/events{/privacy}","received_events_url":"https://api.github.com/users/chris-rock/received_events","type":"User","site_admin":false},"labels":[{"id":253920985,"url":"https://api.github.com/repos/chef/inspec/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":293393202,"url":"https://api.github.com/repos/chef/inspec/labels/RFC","name":"RFC","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-11-07T16:28:50Z","updated_at":"2016-11-09T20:04:39Z","closed_at":null,"body":"### Description\r\n\r\nLets assume we have a meta-profile like https://github.com/chris-rock/acme-inspec-profile\r\n\r\n```\r\nacme-inspec-profile\r\n├── LICENSE\r\n├── README.md\r\n├── controls\r\n│   ├── hardening.rb\r\n│   ├── patch.rb\r\n│   └── ssl.rb\r\n└── inspec.yml\r\n```\r\n\r\nThat depends on a couple of other profiles:\r\n\r\n```\r\nname: acme-inspec-profile\r\n...\r\ndepends:\r\n  - name: linux-patch-benchmark\r\n    git: https://github.com/dev-sec/linux-patch-benchmark.git\r\n  - name: windows-patch-benchmark\r\n    git: https://github.com/dev-sec/windows-patch-benchmark.git\r\n  - name: os-hardening\r\n    git: https://github.com/dev-sec/tests-os-hardening.git\r\n  - name: ssh-hardening\r\n    git: https://github.com/dev-sec/tests-ssh-hardening.git\r\n  - name: ssl-benchmark\r\n    git: https://github.com/dev-sec/ssl-benchmark.git\r\n```\r\n\r\nNow we can use InSpec to archive the profile:\r\n\r\n```\r\ninspec archive /Users/chartmann/Development/Demo/InSpec-1.0-Webinar/acme-inspec-profile\r\nI, [2016-11-07T11:12:42.366206 #52646]  INFO -- : Checking profile in /Users/chartmann/Development/Demo/InSpec-1.0-Webinar/acme-inspec-profile\r\nI, [2016-11-07T11:12:42.366280 #52646]  INFO -- : Metadata OK.\r\n`command(ssh).exist?` is not suported on your OS: \r\nI, [2016-11-07T11:12:43.383553 #52646]  INFO -- : Found 120 controls.\r\nW, [2016-11-07T11:12:43.383748 #52646]  WARN -- : Control verify-kb has no description\r\nW, [2016-11-07T11:12:43.383777 #52646]  WARN -- : Control important-count has no description\r\nW, [2016-11-07T11:12:43.383789 #52646]  WARN -- : Control important-patches has no description\r\nW, [2016-11-07T11:12:43.383799 #52646]  WARN -- : Control important-patches has no tests defined\r\nW, [2016-11-07T11:12:43.383819 #52646]  WARN -- : Control optional-count has no description\r\nW, [2016-11-07T11:12:43.383829 #52646]  WARN -- : Control optional-patches has no description\r\nW, [2016-11-07T11:12:43.383837 #52646]  WARN -- : Control optional-patches has no tests defined\r\nW, [2016-11-07T11:12:43.383846 #52646]  WARN -- : Control verify-patches has no description\r\nW, [2016-11-07T11:12:43.383879 #52646]  WARN -- : Control patches has no description\r\nW, [2016-11-07T11:12:43.383888 #52646]  WARN -- : Control patches has no tests defined\r\nI, [2016-11-07T11:12:43.384120 #52646]  INFO -- : Generate archive /Users/chartmann/Development/compliance/inspec/acme-inspec-profile.tar.gz.\r\nI, [2016-11-07T11:12:43.392569 #52646]  INFO -- : Finished archive generation.\r\n```\r\n\r\nOnly the profile is packaged, not the dependencies.\r\n\r\n```\r\n$ tar -tvf acme-inspec-profile.tar.gz \r\ndrwxr-xr-x  0 wheel  wheel       0 Nov  7 11:12 controls\r\n-rw-r--r--  0 wheel  wheel     724 Nov  7 11:12 controls/hardening.rb\r\n-rw-r--r--  0 wheel  wheel     758 Nov  7 11:12 controls/patch.rb\r\n-rw-r--r--  0 wheel  wheel    1256 Nov  7 11:12 controls/ssl.rb\r\n-rw-r--r--  0 wheel  wheel     731 Nov  7 11:12 inspec.yml\r\n-rw-r--r--  0 wheel  wheel   11357 Nov  7 11:12 LICENSE\r\n-rw-r--r--  0 wheel  wheel      49 Nov  7 11:12 README.md\r\n```\r\n\r\nI still need all dependencies available and accessible at their location during runtime\r\n\r\n### InSpec and Platform Version\r\n\r\n1.4.1\r\n\r\n### Possible Solutions\r\n\r\nWe create a `vendor` directory, that included a dependent profiles:\r\n\r\n```\r\nacme-inspec-profile\r\n├── LICENSE\r\n├── README.md\r\n├── controls\r\n│   ├── hardening.rb\r\n│   ├── patch.rb\r\n│   └── ssl.rb\r\n├── inspec.lock\r\n├── inspec.yml\r\n└── vendor\r\n    ├── 0312593fd472be25966685615f83bc31098fc113\r\n    │   ├── LICENSE\r\n    │   ├── README.md\r\n    │   ├── controls\r\n    │   │   └── patches.rb\r\n    │   ├── inspec.yml\r\n    │   └── libraries\r\n    │       └── linux_updates.rb\r\n    ├── 75754b9b3fe45c601f0fa0036b01c61c8b8e26d9\r\n    │   ├── Gemfile\r\n    │   ├── README.md\r\n    │   ├── controls\r\n    │   │   ├── ssh_spec.rb\r\n    │   │   └── sshd_spec.rb\r\n    │   ├── inspec.yml\r\n    │   └── libraries\r\n    │       └── ssh_crypto.rb\r\n    ├── c183d08eb25638e7f5eac97e521640ea314c8e3d\r\n    │   ├── CONTRIBUTING.md\r\n    │   ├── LICENSE\r\n    │   ├── README.md\r\n    │   ├── controls\r\n    │   │   └── patches.rb\r\n    │   ├── inspec.yml\r\n    │   └── libraries\r\n    │       └── windows_updates.rb\r\n    ├── da3a1b6ce8a845d6818152a824e123c2445c355f\r\n    │   ├── CHANGELOG.md\r\n    │   ├── Gemfile\r\n    │   ├── README.md\r\n    │   ├── Rakefile\r\n    │   ├── controls\r\n    │   │   ├── os_spec.rb\r\n    │   │   ├── package_spec.rb\r\n    │   │   └── sysctl_spec.rb\r\n    │   └── inspec.yml\r\n    └── e17486c864434c818f96ca13edd2c5a420100a45\r\n        ├── README.md\r\n        ├── controls\r\n        │   └── ssl_test.rb\r\n        └── inspec.yml\r\n```\r\n\r\nThe `inspec.lock` references the sha sums:\r\n\r\n```\r\n---\r\nlockfile_version: 1\r\ndepends:\r\n- name: linux-patch-benchmark\r\n  resolved_source:\r\n    git: https://github.com/dev-sec/linux-patch-benchmark.git\r\n    ref: 0312593fd472be25966685615f83bc31098fc113\r\n  version_constraints: \">= 0\"\r\n- name: windows-patch-benchmark\r\n  resolved_source:\r\n    git: https://github.com/dev-sec/windows-patch-benchmark.git\r\n    ref: c183d08eb25638e7f5eac97e521640ea314c8e3d\r\n  version_constraints: \">= 0\"\r\n- name: os-hardening\r\n  resolved_source:\r\n    git: https://github.com/dev-sec/tests-os-hardening.git\r\n    ref: da3a1b6ce8a845d6818152a824e123c2445c355f\r\n  version_constraints: \">= 0\"\r\n- name: ssh-hardening\r\n  resolved_source:\r\n    git: https://github.com/dev-sec/tests-ssh-hardening.git\r\n    ref: 75754b9b3fe45c601f0fa0036b01c61c8b8e26d9\r\n  version_constraints: \">= 0\"\r\n- name: ssl-benchmark\r\n  resolved_source:\r\n    git: https://github.com/dev-sec/ssl-benchmark.git\r\n    ref: e17486c864434c818f96ca13edd2c5a420100a45\r\n  version_constraints: \">= 0\"\r\n```\r\n\r\nThe archive will include the `vendor` directory as well as the `inspec.lock` file. If the archive includes a `vendor` directory, InSpec tries to fetch the profile from that location during `inspec exec` phase.\r\n\r\n### Stacktrace\r\n\r\nPlease include the stacktrace output or link to a gist of it, if there is one.\r\n"},"comment":{"url":"https://api.github.com/repos/chef/inspec/issues/comments/259512095","html_url":"https://github.com/chef/inspec/issues/1283#issuecomment-259512095","issue_url":"https://api.github.com/repos/chef/inspec/issues/1283","id":259512095,"user":{"login":"username-is-already-taken2","id":13700297,"avatar_url":"https://avatars.githubusercontent.com/u/13700297?v=3","gravatar_id":"","url":"https://api.github.com/users/username-is-already-taken2","html_url":"https://github.com/username-is-already-taken2","followers_url":"https://api.github.com/users/username-is-already-taken2/followers","following_url":"https://api.github.com/users/username-is-already-taken2/following{/other_user}","gists_url":"https://api.github.com/users/username-is-already-taken2/gists{/gist_id}","starred_url":"https://api.github.com/users/username-is-already-taken2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/username-is-already-taken2/subscriptions","organizations_url":"https://api.github.com/users/username-is-already-taken2/orgs","repos_url":"https://api.github.com/users/username-is-already-taken2/repos","events_url":"https://api.github.com/users/username-is-already-taken2/events{/privacy}","received_events_url":"https://api.github.com/users/username-is-already-taken2/received_events","type":"User","site_admin":false},"created_at":"2016-11-09T20:04:39Z","updated_at":"2016-11-09T20:04:39Z","body":"Looks good"}}
{"actor":{"display_login":"username-is-already-taken2"}}