Document Serverspec Migration

[chris-rock]

Description

InSpec inherits a lot of similarities to Serverspec, especially the Syntax is very similar and most Serverspec resources are available in InSpec as well #514

Nevertheless, InSpec and Serverspec have some differences

• InSpec is promoting a flat test structure instead of nested describe blocks
• No clear guide is available that helps users to easily migrate: Question: Where is the serverspec migration guide? #514
• We should add a warning, if we detect Serverspec syntax that we do not support (e.g. nested describes)

InSpec and Platform Version

InSpec 0.26.0

[rmoriz]

The big issue with inspec is its incompatibility with common rspec patterns, not only nested describe blocks but also common things like let.

You should point users to at least three chef-cookbooks that, in your opinion, provide a good overview about the use of inspec in real-life. Sadly, "complicated" cookbooks that show advanced real-life usage of chef, seem still to use serverspec (e.g. Jenkins, iptables)

[chris-rock]

@rmoriz thanks for highlighting this. Can you elaborate, on why you need let?

Good examples for InSpec tests are:

• https://github.com/dev-sec/tests-os-hardening
• https://github.com/dev-sec/tests-ssh-hardening
• https://github.com/dev-sec/tests-nginx-hardening
• https://github.com/dev-sec/tests-apache-hardening

Those are used in

• https://github.com/dev-sec/chef-os-hardening
• https://github.com/dev-sec/chef-ssh-hardening
• https://github.com/dev-sec/chef-nginx-hardening
• https://github.com/dev-sec/chef-apache-hardening

[rmoriz]

@chris-rock let's say we have to verify the installation of a given android-ndk release, like "11c" - Usually I would specify the version number in one place and re-use the variable in subsequent tests, so once we upgrade, I only need to change one variable.

I know your hardening cookbooks but they are not "full lifecycle" cookbooks with a complexcity and "wrappability" like the mentioned iptables and jenkins cookbooks.

[chris-rock]

@rmoriz Got you. Why not use a plain ruby variable? I just try to understand, what the need is. Implementation details are following the understanding of the need ;-)

[chris-rock]

@rmoriz also have a look at:

• https://github.com/chef-cookbooks/tomcat
• https://github.com/chef-cookbooks/memcached
• https://github.com/chef-cookbooks/docker