Install inspec from source

.kitchen.yml

@@ -87,3 +87,14 @@ suites:
         token: <%= ENV['COMPLIANCE_ACCESSTOKEN'] %>
         owner: admin
         profiles: *profiles
+
+  - name: inspec_package # compliance direct reporting
+    run_list:
+      - recipe[audit::default]
+    attributes:
+      audit:
+        inspec_package_source: 'https://packages.chef.io/stable/el/6/inspec-1.4.1-1.el6.x86_64.rpm'
+        inspec_package_libpath: '/opt/inspec/embedded/lib/ruby/gems/2.3.0/gems/inspec-1.4.1/lib'
+        profiles:
+          - name: ssh-hardening
+            url: https://github.com/dev-sec/tests-ssh-hardening

attributes/default.rb

@@ -24,7 +24,8 @@
 
 # Used in cases where the desired install of inspec is via package instead of gem
 # Default to false, set to true if needed. Setting to true will skip the inspec recipe and use inspec_package recipe
-default['audit']['inspec_package'] = false
+default['audit']['inspec_package_source'] = nil
+default['audit']['inspec_package_libpath'] = nil
 
 # collector possible values: chef-server, chef-compliance, chef-visibility, chef-server-visibility, json-file
 # chef-visibility requires inspec version 0.27.1 or above

libraries/compliance.rb

@@ -2,6 +2,12 @@
 
 # load all the inspec and compliance bundle requirements
 def load_inspec_libs
+
+  if node['audit']['inspec_package_source']
+    libpath = node['audit']['inspec_package_libpath']
+    $LOAD_PATH.unshift(libpath) unless $LOAD_PATH.include?(libpath)
+  end
+
   require 'inspec'
   if Inspec::VERSION != node['audit']['inspec_version'] && node['audit']['inspec_version'] !='latest'
     Chef::Log.warn "Wrong version of inspec (#{Inspec::VERSION}), please "\

recipes/default.rb

@@ -17,9 +17,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-if node['audit']['inspec_package']
+if node['audit']['inspec_package_source']
   include_recipe 'audit::inspec_package'
 else
   include_recipe 'audit::inspec'
-  load_audit_handler
 end
+
+load_audit_handler

recipes/inspec_package.rb

@@ -17,12 +17,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-chef_ingredient 'inspec' do
-  version node['audit']['inspec_version'] if node['audit']['inspec_version'] != 'latest'
-  accept_license true
-  action :upgrade
+package 'inspec' do
+  source "/tmp/#{File.basename(node['audit']['inspec_package_source'])}"
+  action :nothing
 end
 
-load_inspec_libs
+remote_file "/tmp/#{File.basename(node['audit']['inspec_package_source'])}" do
+  source node['audit']['inspec_package_source']
+  notifies :upgrade, 'package[inspec]', :immediately
+end
 
-load_audit_handler
+load_inspec_libs