Adds cops to detect Chef Vault usage. #762

scottvidmar · 2020-09-24T18:03:45Z

Added two cops to detect Chef Vault usage in the Effortless module:

DependsChefVault (checks for depends 'chef-vault' in metadata.rb)
ChefVaultUsage (scans cookbooks for calls to ChefVault methods and constants)

Description

Chef Vault cannot be used while utilizing the Effortless pattern. These cops detect depends statements in metadata.rb and usage of methods and constants related to Chef Vault.

Related Issue

#346

Types of changes

Bug fix (non-breaking change which fixes an issue)
[x ] New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

[x ] I have read the CONTRIBUTING document.
[x ] I have run the pre-merge tests locally and they pass.
[x ] I have updated the documentation accordingly.
[x ] I have added tests to cover my changes.
[x ] All new and existing tests passed.
[x ] All commits have been signed-off for the Developer Certificate of Origin.

Testing

$ bundle exec rake style; bundle exec rake validate_config; bundle exec rspec spec -f p
bundle exec cookstyle
Inspecting 454 files
......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

454 files inspected, no offenses detected
Checking that all cops are defined in config/cookstyle.yml:
All Cops found in the config. Good work.
Run options: include {:focus=>true}

All examples were filtered out; ignoring {:focus=>true}

Randomized with seed 17373
.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Finished in 1.44 seconds (files took 1.24 seconds to load)
793 examples, 0 failures

Randomized with seed 17373

Fixed typo in comment in cookstyle.yml Signed-off-by: Scott Vidmar <svidmar@chef.io>

Signed-off-by: Scott Vidmar <svidmar@chef.io>

tas50 · 2020-09-24T18:35:15Z

lib/rubocop/cop/chef/effortless/chef_vault_used.rb

+              (str "chef-vault"))
+          PATTERN
+
+          def_node_matcher :include?, <<-PATTERN


Since the string is the same on these you could turn them into a single matcher { :require :include_recipe :chef_gem}. It's probably a bit faster to process a single matcher.

Awesome! I didn't realize I could do that. Updated!

Signed-off-by: Scott Vidmar <svidmar@chef.io>

scottvidmar · 2020-09-24T18:49:04Z

Updated with PR comments, tests below:

$ bundle exec rake style; bundle exec rake validate_config; bundle exec rspec spec -f p
bundle exec cookstyle
Inspecting 454 files
......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

454 files inspected, no offenses detected
Checking that all cops are defined in config/cookstyle.yml:
All Cops found in the config. Good work.
Run options: include {:focus=>true}

All examples were filtered out; ignoring {:focus=>true}

Randomized with seed 18395
.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Finished in 1.27 seconds (files took 1.15 seconds to load)
793 examples, 0 failures

Randomized with seed 18395

phiggins · 2020-09-25T00:39:52Z

docs/cops_chefeffortless.md

+
+### References
+
+* [https://rubystyle.guide#chefeffortlessdependschefvault](ttps://rubystyle.guide#chefeffortlessdependschefvault)


Suggested change

* [https://rubystyle.guide#chefeffortlessdependschefvault](ttps://rubystyle.guide#chefeffortlessdependschefvault)

* [https://rubystyle.guide#chefeffortlessdependschefvault](https://rubystyle.guide#chefeffortlessdependschefvault)

Good catch! Fixed that up.

phiggins · 2020-09-25T00:40:41Z

docs/cops_chefeffortless.md

+
+### References
+
+* [https://rubystyle.guide#chefeffortlessdependschefvault](ttps://rubystyle.guide#chefeffortlessdependschefvault)


Suggested change

* [https://rubystyle.guide#chefeffortlessdependschefvault](ttps://rubystyle.guide#chefeffortlessdependschefvault)

* [https://rubystyle.guide#chefeffortlessdependschefvault](https://rubystyle.guide#chefeffortlessdependschefvault)

Fixed this one up! Thanks!

Signed-off-by: Scott Vidmar <svidmar@chef.io>

tas50

A few minor changes

tas50 · 2020-09-26T15:19:09Z

config/cookstyle.yml

+  Description: Cookbook uses Chef Vault, which cannot be used in the Effortless Infra pattern
+  StyleGuide: '#chefeffortlesscookbookuseschefvault'
+  Enabled: false
+  VersionAdded: '6.19.2'


Suggested change

VersionAdded: '6.19.2'

VersionAdded: '6.19'

tas50 · 2020-09-26T15:19:17Z

config/cookstyle.yml

+  Description: Cookbook depends on Chef Vault, which cannot be used in the Effortless Infra pattern
+  StyleGuide: '#chefeffortlesscookbookdependschefvault'
+  Enabled: false
+  VersionAdded: '6.19.2'


Suggested change

VersionAdded: '6.19.2'

VersionAdded: '6.19'

tas50 · 2020-09-26T15:19:58Z

lib/rubocop/cop/chef/effortless/depends_chef_vault.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2019, Chef Software Inc.


Suggested change

# Copyright:: 2019, Chef Software Inc.

# Copyright:: 2020, Chef Software Inc.

Might as well toss an author block up there as well to give yourself some street cred

tas50 · 2020-09-26T15:20:24Z

lib/rubocop/cop/chef/effortless/chef_vault_used.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2019, Chef Software Inc.


Suggested change

# Copyright:: 2019, Chef Software Inc.

# Copyright:: 2020, Chef Software Inc.

tas50 · 2020-09-26T15:21:33Z

lib/rubocop/cop/chef/effortless/chef_vault_used.rb

+  module Cop
+    module Chef
+      module ChefEffortless
+        # Cookbook:: Chef Vault does not work with Effortless


Suggested change

# Cookbook:: Chef Vault does not work with Effortless

# Chef Vault is not compatible with the Chef Infra Effortless pattern due to its reliance on Data Bags to store secrets.

Fixed that up.

tas50 · 2020-09-26T15:22:03Z

lib/rubocop/cop/chef/effortless/depends_chef_vault.rb

+  module Cop
+    module Chef
+      module ChefEffortless
+        # Cookbook:: metadata.rb Chef Vault does not work with Effortless


Suggested change

# Cookbook:: metadata.rb Chef Vault does not work with Effortless

# Chef Vault is not compatible with the Chef Infra Effortless pattern due to its reliance on Data Bags to store secrets.

Ack! Sorry, that was careless of me. Fixed.

tas50 · 2020-09-26T15:23:04Z

lib/rubocop/cop/chef/effortless/depends_chef_vault.rb

+        #   depends 'chef-vault'
+        #
+        class DependsChefVault < Base
+          MSG = 'Chef Vault usage is not supported in the Effortless pattern'


Suggested change

MSG = 'Chef Vault usage is not supported in the Effortless pattern'

MSG = 'Chef Vault usage is not supported in the Effortless pattern'

RESTRICT_ON_SEND = [:depends].freeze

Good call! Done!

- Correct copyright statements to 2020. - Update version added to 6.19, not 6.19.2 - Add author statements. Signed-off-by: Scott Vidmar <svidmar@chef.io>

scottvidmar · 2020-09-28T15:58:05Z

Should have all changes requested incorporated:

$ bundle exec rake style; bundle exec rake validate_config; bundle exec rspec spec -f p
bundle exec cookstyle
Inspecting 454 files
......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

454 files inspected, no offenses detected
Checking that all cops are defined in config/cookstyle.yml:
All Cops found in the config. Good work.
Run options: include {:focus=>true}

All examples were filtered out; ignoring {:focus=>true}

Randomized with seed 43876
.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Finished in 1.23 seconds (files took 1.2 seconds to load)
793 examples, 0 failures

Randomized with seed 43876

Scott Vidmar added 3 commits September 24, 2020 10:06

Add effortless cops for Chef Vault.

36687f1

Fixed typo in comment in cookstyle.yml Signed-off-by: Scott Vidmar <svidmar@chef.io>

Add Effortless cops to detect Chef Vault usage

652c3db

Signed-off-by: Scott Vidmar <svidmar@chef.io>

Add new line at end of depends_chef_vault_spec.rb for style purposes

a364fab

Signed-off-by: Scott Vidmar <svidmar@chef.io>

scottvidmar requested review from a team as code owners September 24, 2020 18:03

Make use of RESTRICT_ON_SEND

1515aac

Signed-off-by: Scott Vidmar <svidmar@chef.io>

tas50 reviewed Sep 24, 2020

View reviewed changes

Combine AST checks in chef_vault_used.rb for extra perf

809ac77

Signed-off-by: Scott Vidmar <svidmar@chef.io>

phiggins reviewed Sep 25, 2020

View reviewed changes

Fix typos in cops_chefeffortless.md

5e5a0ad

Signed-off-by: Scott Vidmar <svidmar@chef.io>

tas50 suggested changes Sep 26, 2020

View reviewed changes

Fix issues in PR for Chef Vault cops.

b5a4c79

- Correct copyright statements to 2020. - Update version added to 6.19, not 6.19.2 - Add author statements. Signed-off-by: Scott Vidmar <svidmar@chef.io>

tas50 merged commit e0b0f68 into chef:master Sep 28, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds cops to detect Chef Vault usage. #762

Adds cops to detect Chef Vault usage. #762

scottvidmar commented Sep 24, 2020

tas50 Sep 24, 2020

scottvidmar Sep 24, 2020

scottvidmar commented Sep 24, 2020

phiggins Sep 25, 2020

scottvidmar Sep 25, 2020

phiggins Sep 25, 2020

scottvidmar Sep 25, 2020

tas50 left a comment

tas50 Sep 26, 2020

tas50 Sep 26, 2020

tas50 Sep 26, 2020

tas50 Sep 26, 2020

tas50 Sep 26, 2020

tas50 Sep 26, 2020

scottvidmar Sep 28, 2020

tas50 Sep 26, 2020

scottvidmar Sep 28, 2020

tas50 Sep 26, 2020

scottvidmar Sep 28, 2020

scottvidmar commented Sep 28, 2020


		### References

		* [https://rubystyle.guide#chefeffortlessdependschefvault](ttps://rubystyle.guide#chefeffortlessdependschefvault)

	# Copyright:: 2019, Chef Software Inc.
	# Copyright:: 2020, Chef Software Inc.

	# Cookbook:: Chef Vault does not work with Effortless
	# Chef Vault is not compatible with the Chef Infra Effortless pattern due to its reliance on Data Bags to store secrets.

	# Cookbook:: metadata.rb Chef Vault does not work with Effortless
	# Chef Vault is not compatible with the Chef Infra Effortless pattern due to its reliance on Data Bags to store secrets.

	MSG = 'Chef Vault usage is not supported in the Effortless pattern'
	MSG = 'Chef Vault usage is not supported in the Effortless pattern'
	RESTRICT_ON_SEND = [:depends].freeze

Adds cops to detect Chef Vault usage. #762

Adds cops to detect Chef Vault usage. #762

Conversation

scottvidmar commented Sep 24, 2020

Description

Related Issue

Types of changes

Checklist:

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scottvidmar commented Sep 24, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tas50 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scottvidmar commented Sep 28, 2020