Update Profile to V1R6

.github/workflows/update-profile-json.yml

@@ -0,0 +1,34 @@
+name: Update the Profile JSON
+
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  my-job:
+    name: Update profile.json in the repository
+    runs-on: ubuntu-latest
+    env:
+      CHEF_LICENSE: accept-silent
+    steps:
+      - name: add needed packages
+        run: sudo apt-get install -y jq
+      - name: Check out repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.head_ref }}
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '2.7'
+      - run: bundle install
+      - name: Regenerate current `profile.json`
+        run: |
+          bundle exec inspec json . | jq . > profile.json
+      - name: Update profile.json in the repository
+        uses: stefanzweifel/git-auto-commit-action@v4
+        with:
+          commit_user_name: GitHub Actions
+          commit_user_email: [email protected]
+          commit_message: 'Updating profile.json in the repository'

.github/workflows/verify-container.yml

@@ -0,0 +1,84 @@
+name: Container Testing Matrix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    name: Validate my Profile on Containers
+    runs-on: ubuntu-latest
+    env:
+      LC_ALL: "en_US.UTF-8"
+      VANILLA_IMAGE: "public.ecr.aws/lts/ubuntu:focal"
+      HARDENED_IMAGE: "canonical/ubuntu-pro-stig-20.04:latest"
+      CHEF_LICENSE: "accept-silent"
+    steps:
+      - name: add needed packages
+        run: sudo apt-get install -y jq
+      - name: Checkout InSpec profile repository
+        uses: actions/checkout@v2
+      - name: Clone full repository so we can push
+        run: git fetch --prune --unshallow
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "2.7"
+      - name: Disable ri and rdoc
+        run: 'echo "gem: --no-ri --no-rdoc" >> ~/.gemrc'
+      - name: Bundle install
+        run: bundle install
+      - name: Lint the Inspec profile
+        run: bundle exec inspec check .
+      - name: Build the Hardened Container
+        run: docker build https://repo1.dso.mil/dsop/canonical/ubuntu/ubuntu-pro-cis-stig-20.04.git\#development --tag $HARDENED_IMAGE
+      - name: Start the Vanilla Container
+        run: docker run -itd --rm --name vanilla-ubuntu $VANILLA_IMAGE
+      - name: Start the Hardened Container
+        run: docker run -itd --rm --name hardened-ubuntu $HARDENED_IMAGE
+      - name: Verify both our containers are running
+        run: docker ps -f name=-ubuntu
+      - name: Test Vanilla Container
+        run: inspec exec . --input-file=container.inputs.yml -t docker://vanilla-ubuntu --reporter cli json:vanilla.json || true
+      - name: Test Hardened Container
+        run: inspec exec . --input-file=container.inputs.yml -t docker://hardened-ubuntu --reporter cli json:hardened.json || true
+      - name: Display our Vanilla Summary
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "view summary -i vanilla.json"
+      - name: Display our Hardened Summary
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "view summary -i hardened.json"
+      - name: Ensure the scan meets our Vanilla results threshold
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "validate threshold -i vanilla.json -F container.vanilla.threshold.yml"
+      - name: Ensure the scan meets our Hardened results threshold
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "validate threshold -i hardened.json -F container.hardened.threshold.yml"
+      - name: Generate Vanilla Markdown Report
+        uses: mitre/saf_action@v1
+        with:
+          command_string: generate:threshold -i vanilla.json -c -o vanilla.md
+      - name: Generate Hardened Markdown Report
+        uses: mitre/saf_action@v1
+        with:
+          command_string: generate:threshold -i hardened.json -c -o hardened.md
+      - name: Amend Markdown Reports for readability
+        run: |
+          (echo '```yaml' && cat vanilla.md && echo '```') > vanilla-report.md
+          rm vanilla.md
+          (echo '```yaml' && cat hardened.md && echo '```') > hardened-report.md
+          rm hardened.md
+      - name: Save Test Result JSONs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          path: |
+            vanilla.json
+            hardened.json
+            *-report.md

.github/workflows/verify-ec2.yml

@@ -0,0 +1,77 @@
+name: EC2 Testing Matrix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    name: Validate my profile
+    runs-on: ubuntu-latest
+    env:
+      CHEF_LICENSE: accept-silent
+      KITCHEN_LOCAL_YAML: kitchen.ec2.yml
+      LC_ALL: "en_US.UTF-8"
+      #AWS_REGION: 'us-east-1'
+    strategy:
+      matrix:
+        suite: ["hardened"]
+      fail-fast: false
+    steps:
+      - name: add needed packages
+        run: sudo apt-get install -y jq
+      - name: Configure AWS credentials
+        env:
+          AWS_SG_ID: ${{ secrets.SAF_AWS_SG_ID }}
+          AWS_SUBNET_ID: ${{ secrets.SAF_AWS_SUBNET_ID }}
+          #AWS_REGION: ${{ secrets.SAF_AWS_REGION }}
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.SAF_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.SAF_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.SAF_AWS_REGION }}
+      - name: Check out repository
+        uses: actions/checkout@v2
+      - name: Clone full repository so we can push
+        run: git fetch --prune --unshallow
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "2.7"
+      - name: Disable ri and rdoc
+        run: 'echo "gem: --no-ri --no-rdoc" >> ~/.gemrc'
+      - run: bundle install
+      - name: Regenerate current `profile.json`
+        run: |
+          bundle exec inspec json . | jq . > profile.json
+      - name: Lint the Inspec profile
+        run: bundle exec inspec check .
+      - name: Run kitchen test
+        run: bundle exec kitchen test --destroy=always ${{ matrix.suite }}-ubuntu-2004 || true
+      - name: Display our ${{ matrix.suite }} results summary
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "view summary -i spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.json"
+      - name: Ensure the scan meets our ${{ matrix.suite }} results threshold
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "validate threshold -i spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.json -F ${{ matrix.suite }}.threshold.yml"
+      - name: Generate ${{ matrix.suite }} Markdown Report
+        uses: mitre/saf_action@v1
+        with:
+          command_string: generate:threshold -i spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.json -c -o spec/results/ec2_ubuntu-2004_${{ matrix.suite }}-report.md
+      - name: Generate the ${{ matrix.suite }} Markdown Report
+        uses: mitre/saf_action@v1
+        with:
+          command_string: generate:threshold -i spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.json -c -o spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.md
+      - name: Amend Markdown Reports for readability
+        run: |
+          (echo '```yaml' && cat spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.md && echo '```') > spec/results/ec2_ubuntu-2004_${{ matrix.suite }}-report.md
+          rm spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.md
+      - name: Save Test Result JSONs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v2
+        with:
+          path: spec/results/

.github/workflows/verify-vagrant.yml

@@ -0,0 +1,58 @@
+name: Vagrant Testing Matrix
+on:
+  release:
+    types: [published]
+
+jobs:
+  validate:
+    name: Validate my profile
+    runs-on: macos-12
+    env:
+      CHEF_LICENSE: accept-silent
+      KITCHEN_LOCAL_YAML: kitchen.vagrant.yml
+    strategy:
+      matrix:
+        suite: ["hardened"]
+      fail-fast: false
+    steps:
+      - name: Add jq for output formatting
+        run: brew install jq
+      - name: Check out repository
+        uses: actions/checkout@v2
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "2.7"
+      - name: Disable ri and rdoc
+        run: 'echo "gem: --no-ri --no-rdoc" >> ~/.gemrc'
+      - name: ensure bundler up-to-date
+        run: gem install bundler
+      - run: bundle install
+      - name: Regenerate current `profile.json`
+        run: |
+          bundle exec inspec json . | jq . > profile.json
+      - name: Lint the Inspec profile
+        run: bundle exec inspec check .
+      - name: Run kitchen test
+        run: bundle exec kitchen test --destroy=always ${{ matrix.suite }}-ubuntu-2004 || true
+      - name: Display our ${{ matrix.suite }} results summary
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "view summary -i spec/results/ubuntu-2004_${{ matrix.suite }}.json"
+      - name: Ensure the scan meets our ${{ matrix.suite }} results threshold
+        uses: mitre/saf_action@v1
+        with:
+          command_string: "validate threshold -i spec/results/ubuntu-2004_${{ matrix.suite }}.json -F ${{ matrix.suite }}.threshold.yml"
+      - name: Generate the ${{ matrix.suite }} Markdown Report
+        uses: mitre/saf_action@v1
+        with:
+          command_string: generate:threshold -i spec/results/ec2_ubuntu-2004_${{ matrix.suite }}.json -c -o spec/results/ec2_ubuntu-2004_${{ matrix.suite }}-report.md
+      - name: Amend the ${{ matrix.suite }} Markdown Report for readability
+        run: |
+          sed -i '' '1s/^/```yaml\'$'\n/' spec/results/ec2_ubuntu-2004_${{ matrix.suite }}-report.md 
+          echo '```' | tee -a spec/results/ec2_ubuntu-2004_${{ matrix.suite }}-report.md
+      - name: Save Test Result JSONs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v2
+        with:
+          path: spec/results/

.gitignore

@@ -1,8 +1,4 @@
-.*.sw?
-**/inspec.lock
-**/Puppetfile.lock
 .yardoc
-.beaker
 dist/
 sec_results/
 pkg/
@@ -12,20 +8,13 @@ spec/rp_env/
 .rspec_system/
 .vagrant/
 .bundle/
-Gemfile.lock
 vendor/
 junit/
 log/
 doc/
 .kitchen/
 .tmp/
-reports/
-.github*
 .gemrc
 .rspec*
-CHANGELOG
-Puppet*
-*.csv
 _config*
-inputs.nolong*
-profile.json
+*.pem