ERROR: Chef InSpec cannot execute without accepting the license

dvaske10 commented 5 years ago

Hi all,

i have issue with Inspec provisioner requesting license to be accepted

==> amazon-ebs: Provisioning with Inspec... ==> amazon-ebs: Executing Inspec: inspec exec https://github.com/dev-sec/linux-baseline --backend ssh --host 127.0.0.1 --key-files /var/folders/yv/6qt4nd_d5p38xqbc79mnrpfc0000gn/T/packer-provisioner-inspec.295736621.key --user X --port 52762 --input-file /var/folders/yv/6qt4nd_d5p38xqbc79mnrpfc0000gn/T/packer-provisioner-inspec.300311720.yml --chef-license accept amazon-ebs: [2019-09-24T14:58:20+02:00] ERROR: Chef InSpec cannot execute without accepting the license ==> amazon-ebs: Terminating the source AWS instance...

This is my InSpec part of configuration (AWS ubuntu 18.04 AMI) which i took from official documentation. Note: i tried without extra argument first but i got same error.

 "provisioners": [

    {
      "type": "inspec",
      "profile": "https://github.com/dev-sec/linux-baseline",
      "extra_arguments": [ "--chef-license accept"]
    }

  ]

DId anyone had this issue, and if yes how to resolve it?

Thanks in advance, Dejan

mahsoud commented 5 years ago

 Should set via env vars, something like

        {
            "type": "windows-shell",
            "environment_vars" : ["CHEF_LICENSE=accept-no-persist"],
            "inline": [
                "inspec exec C:\\base-0.1.0.tar.gz --reporter cli junit:results.xml"
            ]
        },

dvaske10 commented 5 years ago

Thanks @mahsoud . It's working now. We are not using "windows-shell" provisioner but i used your hint to add "inspec_env_vars" in "inspec" provisioner, so License is accepted now.

  "provisioners": [

    {
      "type": "inspec",
      "profile": "https://github.com/dev-sec/linux-baseline",
      "inspec_env_vars": [ "CHEF_LICENSE=accept"]
    }
  ]

Packer Output:

==> amazon-ebs: Provisioning with Inspec...
==> amazon-ebs: Executing Inspec: inspec exec https://github.com/dev-sec/linux-baseline --backend ssh --host 127.0.0.1 --key-files /var/folders/yv/6qt4nd_d5p38xqbc79mnrpfc0000gn/T/packer-provisioner-inspec.344277197.key --user X --port 52454 --input-file /var/folders/yv/6qt4nd_d5p38xqbc79mnrpfc0000gn/T/packer-provisioner-inspec.377805768.yml
    amazon-ebs: +---------------------------------------------+
    amazon-ebs: ✔ 1 product license accepted.
    amazon-ebs: +---------------------------------------------+
    amazon-ebs: [2019-10-14T15:45:44+02:00] WARN: URL target https://github.com/dev-sec/linux-baseline transformed to https://github.com/dev-sec/linux-baseline/archive/master.tar.gz. Consider using the git fetcher
    amazon-ebs:
    amazon-ebs: Profile: DevSec Linux Security Baseline (linux-baseline)
    amazon-ebs: Version: 2.3.0
    amazon-ebs: Target:  ssh://X@127.0.0.1:52454
    amazon-ebs:
    amazon-ebs:   ✔  os-01: Trusted hosts login
    amazon-ebs:      ✔  File /etc/hosts.equiv should not exist
    amazon-ebs:   ✔  os-02: Check owner and permissions for /etc/shadow
    amazon-ebs:      ✔  File /etc/shadow should exist
    amazon-ebs:      ✔  File /etc/shadow should be file
    amazon-ebs:      ✔  File /etc/shadow should be owned by "root"
    amazon-ebs:      ✔  File /etc/shadow should not be executable
...

@SwampDragons This config change is mandatory in order to use Inspec provisioner. Maybe it can be automated in next packer releases not to use env variable or to update documentation to reflect above setting

https://www.packer.io/docs/provisioners/inspec.html

Thanks, Dejan

ghost commented 4 years ago

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

hashicorp / packer

ERROR: Chef InSpec cannot execute without accepting the license #8147