Implement RFC: Harmonize profile location targets

[chris-rock]

Cookbook version

2.x

Scenario:

It should be easy for customer to copy profile locations from inspec.yml to chef attributes. In inspec/inspec#1227 we defined the target format for audit cookbook. We change from

"profiles" => {
    # org / profile name from Chef Compliance
    "base/linux" => true,
    # supermarket url
    "brewinc/ssh-hardening" => {
      # location where inspec will fetch the profile from
      "source" => "supermarket://hardening/ssh-hardening"
    },
    # local Windows path
    "brewinc/win2012_audit" => {
      # filesystem path
      "source" => "E:/profiles/win2012_audit"
    },
    # github url
    "brewinc/tmp_compliance_profile" => {
      "source" => "https://github.com/nathenharvey/tmp_compliance_profile"
    },
    # disable profile
    "brewinc/tmp_compliance_profile-master" => {
      "source" => "/tmp/tmp_compliance_profile-master",
      "disabled" => true
    }
  }

to

{
  "profiles": [
    {
      "name": "hardening/ssh-hardening"
    },
    {
      "name": "os-hardening",
      "url": "https://github.com/dev-sec/tests-os-hardening/archive/master.zip"
    },
    {
      "git": "https://github.com/dev-sec/tests-ssh-hardening.git"
    },
    {
      "git": "https://github.com/dev-sec/tests-os-hardening.git"
    }
  ]
}

[vjeffrey]

profiles = {
  "profiles": [
    {
      "name": "hardening/ssh-hardening"
    },
    {
      "name": "os-hardening",
      "url": "https://github.com/dev-sec/tests-os-hardening/archive/master.zip"
    },
    {
      "git": "https://github.com/dev-sec/tests-ssh-hardening.git"
    },
    {
      "git": "https://github.com/dev-sec/tests-os-hardening.git"
    }
  ]
}

profiles_array = []

profiles[:profiles].each { |profile| profiles_array.push(profile[:url] || profile[:git]) }

profiles[:profiles].each { |profile|
  if profile.length == 1 && profile[:name]
    profiles_array.push("supermarket://" + profile[:name])
  end
}

profiles[:profiles].each { |profile|
  if profile.include?(:supermarket_url)
    profiles_array.push(profile[:supermarket_url] + "/" + profile[:name])
  end
}

profiles[:profiles].each { |profile|
  if profile.include?(:compliance_url)
    profiles_array.push(profile[:compliance_url] + "/" + profile[:name])
  end
}


final_profiles = profiles_array.reject { |profile| profile.nil? }

final_profiles = 
 ["https://github.com/dev-sec/tests-os-hardening/archive/master.zip",
 "https://github.com/dev-sec/tests-ssh-hardening.git",
 "https://github.com/dev-sec/tests-os-hardening.git",
 "supermarket://hardening/ssh-hardening"]

[vjeffrey]

i think i'm probably over-complicating this....but does this make sense?

[chris-rock]

Lets not nest profiles. This should be enough:

"profiles": [
    {
      "name": "hardening/ssh-hardening"
    },
    {
      "name": "os-hardening",
      "url": "https://github.com/dev-sec/tests-os-hardening/archive/master.zip"
    },
    {
      "git": "https://github.com/dev-sec/tests-ssh-hardening.git"
    },
    {
      "git": "https://github.com/dev-sec/tests-os-hardening.git"
    }
  ]

I apologize for the extra curly brackets in the original definition