Ensure min version of inspec is used #237
Conversation
There was a problem hiding this comment.
I think there's a larger issue here... PR #235 highlights it. We made backward-incompatible changes to InSpec, and now the audit cookbook isn't backward compatible either. We're going to need to get #235 in ASAP and then decide how best to proceed.
I also think this type of change leads to a bad UX given that we made changes to the audit cookbook to not install InSpec if it's already installed. So if a user is happily running with a particular version of InSpec (that either they installed, or we provided via the Chef Omnibus installation), and they pull in a newer audit cookbook, they're just going to break.
We may actually want to get on a Zoom and discuss this as a larger issue.
| Chef::Log.info "Initialize InSpec #{::Inspec::VERSION}" | ||
| Chef::Log.info "Using InSpec #{::Inspec::VERSION}" | ||
|
|
||
| if Gem::Version.new(Inspec::VERSION) < Gem::Version.new('1.24.0') |
There was a problem hiding this comment.
I'd store this in a constant somewhere near the top since the version string is used in two places: the comparison and the log message. That way we only have to change it in one location.
|
|
||
| if Gem::Version.new(Inspec::VERSION) < Gem::Version.new('1.24.0') | ||
| Chef::Log.error "This audit cookbook version requires InSpec 1.24.0 or newer, aborting compliance scan..." | ||
| return {} |
There was a problem hiding this comment.
I'd honestly raise this as an exception. People will miss the log message and wonder why they're losing data.
There was a problem hiding this comment.
I agree on @adamleff proposal. It is better to fail early
|
With Chef 13 we need to work with the version that is shipped with Chef. We may need to shim parts if we really require it here. Otherwise we need to raise the requirement for Chef client version |
|
Just double-checked all inspec versions in Chef 13: Therefore lets use the minimum version of 1.25.1. This allows us to establish a clear path for customers:
|
|
I am going to bump the requirement to 1.25.1 to ensure everything works with that version. We may need to add some shims later. |
chris-rock
force-pushed
the
ap/inspec-version-check
branch
2 times, most recently
from
b5347fd to
10fd099
Compare
Signed-off-by: Alex Pop <apop@chef.io>
chris-rock
force-pushed
the
ap/inspec-version-check
branch
from
10fd099 to
61d37f6
Compare
Signed-off-by: Christoph Hartmann <chris@lollyrock.com>
chris-rock
force-pushed
the
ap/inspec-version-check
branch
from
89f277c to
b1789a0
Compare
With the cookbook no longer specifying an inspec_version in attributes, it's important to ensure a compatible inspec is used.
I'm tempted to bump the required version to at least
1.25.0because of this: inspec/inspec#1816or should I make it 1.26 or 1.27?