cisagov / ScubaGear

Automation to assess the state of your M365 tenant against CISA's baselines
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
1.7k stars 222 forks source link

Setup.ps1 Enforcing link to OPA version that doesn't exist #340

Closed alabashtaur closed 1 year ago

alabashtaur commented 1 year ago

🐛 Summary

What's wrong? Please be specific.

Executing the Setup.ps1 script fails b/c it's now tied to the OPA execution. SCuBA supports 0.42.1 version of OPA but the site has removed that version and replaced it with 0.42.2. The Setup.ps1 script is attempting to download the old version and failing to complete execution.

To reproduce

Steps to reproduce the behavior:

  1. Without having the 0.42.1 version of the OPA windows executable in the working directory execute Setup.ps1

Expected behavior

The script will run to completion, including the download of the latest required OPA version.

Any helpful log output or screenshots

Paste the results here:

PS Microsoft.PowerShell.Core\FileSystem::\\Mac\Home\Desktop\ScubaGear-0.3.0> .\SetUp.ps1
Setting PSGallery repository to trusted.
DEBUG: PowerShellGet:2.2.5 already has latest installed.
DEBUG: MicrosoftTeams:5.2.0 already has latest installed.
DEBUG: ExchangeOnlineManagement:3.1.0 already has latest installed.
DEBUG: Microsoft.Online.SharePoint.PowerShell:16.0.23612.12000 already has latest installed.
 PnP.PowerShell:1.12.0 updated to version 1.12.0.
DEBUG: Microsoft.PowerApps.Administration.PowerShell:2.0.165 already has latest installed.
DEBUG: Microsoft.PowerApps.PowerShell:1.0.32 already has latest installed.
DEBUG: Microsoft.Graph.Applications:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Authentication:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.DeviceManagement:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.DeviceManagement.Administration:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.DeviceManagement.Enrolment:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Devices.CorporateManagement:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Groups:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Identity.DirectoryManagement:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Identity.Governance:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Identity.SignIns:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Planner:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Teams:1.27.0 already has latest installed.
DEBUG: Microsoft.Graph.Users:1.27.0 already has latest installed.
DEBUG: powershell-yaml:0.4.7 already has latest installed.
Downloading https://openpolicyagent.org/downloads/v0.42.1/opa_windows_amd64.exe
\\Mac\Home\Desktop\ScubaGear-0.3.0\SetUp.ps1 : An error occurred: cannot call OPA download script
At line:1 char:1
+ .\SetUp.ps1
+ ~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,SetUp.ps1
Screenshot 2023-05-19 at 1 37 58 PM
buidav commented 1 year ago

Hello, Thank you for opening an issue for this. Some sort of other error is occurring as even though the direct link on the website is omitted. https://openpolicyagent.org/downloads/v0.42.1/opa_windows_amd64.exe is still a valid download link.

I just retested this and SetUp.ps1 is still executing successfully on my end. The actual error is being hidden and we'll have to better introduce better error logging of OPA.ps1 when #215 is addressed.

Downloading any OPA executable version directly from the OPA website after 0.42.1 should still work with tool. We've tested until up to version 0.5.0. To prevent the download error from throwing in SetUp.ps1 you can omit the OPA download from the SetUp.ps1 script by adding the -NoOPA switch. This switch omits the call to OPA.ps1 which is the script that does the actual download.

.\SetUp.ps1 -NoOPA

As for why the original error is occurring this could be related to Running the tool behind some proxies.
This could also be caused by another error in the OPA.ps1 download script but we'll have to add the better error logging in #215 to see it.