search

dev-sec / cis-dil-benchmark

CIS Distribution Independent Linux Benchmark - InSpec Profile
Apache License 2.0
149 stars 92 forks source link

Inspec 4 warning #70

Closed micheelengronne closed 4 years ago

micheelengronne commented 4 years ago

Inspec 4 uses value instead of default

micheelengronne commented 4 years ago

It fails because of a rubocop syntax update.

micheelengronne commented 4 years ago

bundler: command not found: inspec

Ok, the CI needs debugging.

chris-rock commented 4 years ago

I think we need to pin to gem 'inspec', '~> 3'. Due to licensing we cannot use inspec 4.

micheelengronne commented 4 years ago

I know the license problem.

But, Inspec 3 is not maintained anymore.

The chef license concerns the inspec-bin gem only.

Inspec source code is still opensource (Apache2) as well as the inspec gem.

If you compile yourself a binary (or a script) to use the inspec gem you are not subject to the chef license.

I think we should maintain the profile for Inspec 4 as Inspec 3 is EOL.

chris-rock commented 4 years ago

We stay backwards-compatible with InSpec 3 for now. Your change works in InSpec 3 too. Once ready, dev-sec will switch to https://github.com/cinc-project/auditor

micheelengronne commented 4 years ago

Thanks a bunch for auditor. I didn't know it. I compile my own gem. I will give it a try.

chris-rock commented 4 years ago

Until then I recommend to just stick with InSpec 3 in this CI

micheelengronne commented 4 years ago

Ok, I see that the gem is currently not maintained https://rubygems.org/gems/cinc-auditor-bin and does not follow the Inspec rythm. I will stick with my own compiled Inspec gem and try to make backward compatible contributions.

chris-rock commented 4 years ago

@micheelengronne I fixed the CI in latest master, can you please rebase?

micheelengronne commented 4 years ago

Thanks a lot. Can you do the corresponding release ? I like SemVer :)