active_storage_encryption 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f97954b59908255d0d2e09943e111ca33af803ca47d3a9af06a44e23064f725
-  data.tar.gz: 700a8909d6492c8a8a8633c24a15418428c5e740d15adeef2cfcb15dcf872ac9
+  metadata.gz: 6f34184e53ab51b15143acc6fd7bbc2ea0e43a4cc4c0b0d87c065de2631298fb
+  data.tar.gz: 8329f26f7141a0762bb0488995bdf219ff01c00d9b374b4cdecc7af895bded11
 SHA512:
-  metadata.gz: 5eef06c92277075e3b5b9c5b4421f6b8352956b48f29b442d70b777ce737326f0470a728903ae1a42994792deb2d026b30b7497ea01c9ed723965e2e03c0d0d9
-  data.tar.gz: d94575af669034bccf27f41de435c44219f247d71c8d19e3c24d27e0af5301e55e53afccd141e1c5047921880836380aa414f628f4602cafbce82831ceb35d5a
+  metadata.gz: 30d7ba6406ec77a7521cc47ea24b858e0de4502644516c3ea5a54b025e24ffe305b21f4fcf3244f1361c2fbedcc79f8dc8b8ce6a0e0e3558a202e1e21941a295
+  data.tar.gz: 71bf3a1c8ee30daee4bdb43bd8703b2c530e67fb0e68078fc07d208e266d1285c8f390392e6539afaaea839c3fa62e2b2cef46b8a863c4d57409d1ebe399c392

data/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10

data/.github/workflows/ci.yml

@@ -0,0 +1,75 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [ main ]
+
+jobs:
+  lint:
+    name: "Lint"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Note: Appraisals for Rails 7 and Rails 8 differ in minimum Ruby version: 3.1.0+ vs 3.2.2+
+      # So the version of Ruby to use here is the version that is able to run all Appraisals
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.2.2
+          bundler-cache: true
+
+      - name: Lint code for consistent style
+        run: bundle exec standardrb
+
+  test_rails7:
+    name: "Tests (Rails 7)"
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/rails_7.gemfile
+    steps:
+      - name: Install packages
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y curl libjemalloc2 sqlite3
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.2.2
+          bundler-cache: true
+
+      - name: Run tests
+        env:
+          RAILS_ENV: test
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: bin/rails app:test
+
+  test_rails_8:
+    name: "Tests (Rails 8)"
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/rails_8.gemfile
+    steps:
+      - name: Install packages
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y curl libjemalloc2 sqlite3
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.2.2
+          bundler-cache: true
+
+      - name: Run tests
+        env:
+          RAILS_ENV: test
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: bin/rails app:test

data/.gitignore

@@ -0,0 +1,14 @@
+/.bundle/
+/doc/
+/log/*.log
+/pkg/
+/tmp/
+/test/dummy/db/*.sqlite3
+/test/dummy/db/*.sqlite3-*
+/test/dummy/log/*.log
+/test/dummy/storage/
+/test/dummy/tmp/
+
+# The Bundler lockfile should not be cached because its contents is arch-dependent
+Gemfile.lock
+.DS_Store

data/.ruby-version

@@ -0,0 +1 @@
+3.2.2

data/.standard.yml

@@ -0,0 +1 @@
+ruby_version: 3.1

data/Appraisals

@@ -1,7 +1,9 @@
 appraise "rails-7" do
   gem "rails", "< 8.0"
+  gem "stringio"
 end
 
 appraise "rails-8" do
   gem "rails", ">= 8.0"
+  gem "stringio"
 end

data/Gemfile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in active_storage_encryption.gemspec.
+gemspec
+
+# Start debugger with binding.b [https://github.com/ruby/debug]
+# gem "debug", ">= 1.0.0"

data/README.md

@@ -113,6 +113,8 @@ Implementation details:
   * `x-amz-server-side-encryption-customer-key`
   * `x-amz-server-side-encryption-customer-key-MD5`
 
+While S3 allows the `x-amz-server-side-encryption-customer-key-MD5` to be added to the signed URL for PUT, the value of that header gets removed from the signature due to the process called "hoisting" - which occurs during the signing of the URL. So your client _may_ override the encryption key you give it forcibly, by replacing the `x-amz-server-side-encryption-customer-key` and `x-amz-server-side-encryption-customer-key-MD5`. This can produce Blobs encrypted with a key you do not have. If you want to exclude the possibility of this, you need to perform an integrity check on your uploads. The integrity check will fail if the encryption key has been overridden in this manner, and you can then destroy the Blob. This problem has been reported to AWS.
+
 ### EncryptedDiskSevice - Filesystem
 
 Can be used instead of the cloud services in development, or on the server if desired. The service will use AES-256-GCM encryption, with a way to switch to a different/more modern encryption scheme in the future.

data/active_storage_encryption.gemspec

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "lib/active_storage_encryption/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "active_storage_encryption"
+  spec.version = ActiveStorageEncryption::VERSION
+  spec.authors = ["Julik Tarkhanov", "Sebastian van Hesteren"]
+  spec.email = ["me@julik.nl"]
+  spec.homepage = "https://github.com/cheddar-me/active_storage_encryption"
+  spec.summary = "Customer-supplied encryption key support for ActiveStorage blobs."
+  spec.description = "Adds customer-supplied encryption keys to storage services."
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.1.0"
+
+  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the "allowed_push_host"
+  # to allow pushing to a single host or delete this section to allow pushing to any host.
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+
+  # The homepage link on rubygems.org only appears if you add homepage_uri. Just spec.homepage is not enough.
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+
+  # Do not remove any files from the gemspec - tests are useful because people can read them
+  spec.files = Dir.chdir(File.expand_path(__dir__)) do
+    `git ls-files -z`.split("\x0")
+  end
+
+  spec.add_dependency "rails", ">= 7.2.2.1"
+  spec.add_dependency "block_cipher_kit", ">= 0.0.4"
+  spec.add_dependency "serve_byte_range", "~> 1.0"
+  spec.add_dependency "activestorage"
+
+  # Testing with cloud services
+  spec.add_development_dependency "aws-sdk-s3"
+  spec.add_development_dependency "net-http"
+  spec.add_development_dependency "google-cloud-storage"
+
+  # Code formatting, linting and testing
+  spec.add_development_dependency "sqlite3"
+  spec.add_development_dependency "standard", ">= 1.35.1"
+  spec.add_development_dependency "appraisal"
+  spec.add_development_dependency "magic_frozen_string_literal"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "pry"
+end

data/gemfiles/rails_7.gemfile

@@ -3,5 +3,6 @@
 source "https://rubygems.org"
 
 gem "rails", "< 8.0"
+gem "stringio"
 
 gemspec path: "../"

data/gemfiles/rails_7.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    active_storage_encryption (0.2.0)
+    active_storage_encryption (0.3.0)
       activestorage
       block_cipher_kit (>= 0.0.4)
       rails (>= 7.2.2.1)
@@ -81,6 +81,8 @@ GEM
       minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
     appraisal (2.5.0)
       bundler
       rake
@@ -108,14 +110,63 @@ GEM
     bigdecimal (3.1.9)
     block_cipher_kit (0.0.4)
     builder (3.3.0)
+    coderay (1.1.3)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.0)
     crass (1.0.6)
     date (3.4.1)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
     drb (2.2.1)
     erubi (1.13.1)
+    faraday (2.13.0)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     globalid (1.2.1)
       activesupport (>= 6.1)
+    google-apis-core (0.16.0)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.3, < 3.a)
+      mini_mime (~> 1.0)
+      mutex_m
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+    google-apis-iamcredentials_v1 (0.22.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.50.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.8.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.2)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.5.0)
+    google-cloud-storage (1.56.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (~> 0.13)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.1.0)
+    googleauth (1.14.0)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    httpclient (2.9.0)
+      mutex_m
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     io-console (0.8.0)
@@ -125,6 +176,8 @@ GEM
       reline (>= 0.4.2)
     jmespath (1.6.2)
     json (2.10.1)
+    jwt (2.10.1)
+      base64
     language_server-protocol (3.17.0.4)
     lint_roller (1.1.0)
     logger (1.6.6)
@@ -138,8 +191,11 @@ GEM
       net-pop
       net-smtp
     marcel (1.0.4)
+    method_source (1.1.0)
     mini_mime (1.1.5)
     minitest (5.25.4)
+    multi_json (1.15.0)
+    mutex_m (0.3.0)
     net-http (0.6.0)
       uri
     net-imap (0.5.6)
@@ -158,6 +214,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.18.3-x86_64-linux-gnu)
       racc (~> 1.4)
+    os (1.1.4)
     parallel (1.26.3)
     parser (3.3.7.1)
       ast (~> 2.4.1)
@@ -165,9 +222,13 @@ GEM
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
+    pry (0.15.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
     psych (5.2.3)
       date
       stringio
+    public_suffix (6.0.1)
     racc (1.8.1)
     rack (3.1.11)
     rack-session (2.1.0)
@@ -213,6 +274,11 @@ GEM
     regexp_parser (2.10.0)
     reline (0.6.0)
       io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.2)
     rubocop (1.71.2)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
@@ -232,6 +298,11 @@ GEM
     securerandom (0.4.1)
     serve_byte_range (1.0.0)
       rack (>= 1.0)
+    signet (0.19.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
     sqlite3 (2.6.0-arm64-darwin)
     sqlite3 (2.6.0-x86_64-darwin)
     sqlite3 (2.6.0-x86_64-linux-gnu)
@@ -250,8 +321,10 @@ GEM
     stringio (3.1.5)
     thor (1.3.2)
     timeout (0.4.3)
+    trailblazer-option (0.1.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
+    uber (0.1.0)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
@@ -265,6 +338,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-21
+  arm64-darwin-23
   arm64-darwin-24
   x86_64-darwin
   x86_64-linux
@@ -273,12 +347,15 @@ DEPENDENCIES
   active_storage_encryption!
   appraisal
   aws-sdk-s3
+  google-cloud-storage
   magic_frozen_string_literal
   net-http
+  pry
   rails (< 8.0)
   rake
   sqlite3
   standard (>= 1.35.1)
+  stringio
 
 BUNDLED WITH
    2.5.11

data/gemfiles/rails_8.gemfile

@@ -3,5 +3,6 @@
 source "https://rubygems.org"
 
 gem "rails", ">= 8.0"
+gem "stringio"
 
 gemspec path: "../"

data/gemfiles/rails_8.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    active_storage_encryption (0.2.0)
+    active_storage_encryption (0.3.0)
       activestorage
       block_cipher_kit (>= 0.0.4)
       rails (>= 7.2.2.1)
@@ -81,6 +81,8 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
     appraisal (2.5.0)
       bundler
       rake
@@ -108,14 +110,63 @@ GEM
     bigdecimal (3.1.9)
     block_cipher_kit (0.0.4)
     builder (3.3.0)
+    coderay (1.1.3)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.0)
     crass (1.0.6)
     date (3.4.1)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
     drb (2.2.1)
     erubi (1.13.1)
+    faraday (2.13.0)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     globalid (1.2.1)
       activesupport (>= 6.1)
+    google-apis-core (0.16.0)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.3, < 3.a)
+      mini_mime (~> 1.0)
+      mutex_m
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+    google-apis-iamcredentials_v1 (0.22.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.50.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.8.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.2)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.5.0)
+    google-cloud-storage (1.56.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (~> 0.13)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.1.0)
+    googleauth (1.14.0)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    httpclient (2.9.0)
+      mutex_m
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     io-console (0.8.0)
@@ -125,6 +176,8 @@ GEM
       reline (>= 0.4.2)
     jmespath (1.6.2)
     json (2.10.1)
+    jwt (2.10.1)
+      base64
     language_server-protocol (3.17.0.4)
     lint_roller (1.1.0)
     logger (1.6.6)
@@ -138,8 +191,11 @@ GEM
       net-pop
       net-smtp
     marcel (1.0.4)
+    method_source (1.1.0)
     mini_mime (1.1.5)
     minitest (5.25.4)
+    multi_json (1.15.0)
+    mutex_m (0.3.0)
     net-http (0.6.0)
       uri
     net-imap (0.5.6)
@@ -158,6 +214,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.18.3-x86_64-linux-gnu)
       racc (~> 1.4)
+    os (1.1.4)
     parallel (1.26.3)
     parser (3.3.7.1)
       ast (~> 2.4.1)
@@ -165,9 +222,13 @@ GEM
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
+    pry (0.15.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
     psych (5.2.3)
       date
       stringio
+    public_suffix (6.0.1)
     racc (1.8.1)
     rack (3.1.11)
     rack-session (2.1.0)
@@ -213,6 +274,11 @@ GEM
     regexp_parser (2.10.0)
     reline (0.6.0)
       io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.2)
     rubocop (1.71.2)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
@@ -232,6 +298,11 @@ GEM
     securerandom (0.4.1)
     serve_byte_range (1.0.0)
       rack (>= 1.0)
+    signet (0.19.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
     sqlite3 (2.6.0-arm64-darwin)
     sqlite3 (2.6.0-x86_64-darwin)
     sqlite3 (2.6.0-x86_64-linux-gnu)
@@ -250,8 +321,10 @@ GEM
     stringio (3.1.5)
     thor (1.3.2)
     timeout (0.4.3)
+    trailblazer-option (0.1.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
+    uber (0.1.0)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
@@ -265,6 +338,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-21
+  arm64-darwin-23
   arm64-darwin-24
   x86_64-darwin
   x86_64-linux
@@ -273,12 +347,15 @@ DEPENDENCIES
   active_storage_encryption!
   appraisal
   aws-sdk-s3
+  google-cloud-storage
   magic_frozen_string_literal
   net-http
+  pry
   rails (>= 8.0)
   rake
   sqlite3
   standard (>= 1.35.1)
+  stringio
 
 BUNDLED WITH
    2.5.11

data/lib/active_storage/service/encrypted_gcs_service.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# Needed so that Rails can find our service definition. It will perform the following
+# steps. Given an "EncryptedDisk" value of the `service:` key in the YAML, it will:
+#
+# * Force-require a file at "active_storage/service/encrypted_disk", from any path on the $LOAD_PATH
+# * Instantiate a class called "ActiveStorage::Service::EncryptedDiskService"
+require_relative "../../active_storage_encryption"
+class ActiveStorage::Service::EncryptedGCSService < ActiveStorageEncryption::EncryptedGCSService
+end

data/lib/active_storage_encryption/encrypted_blob_proxy_controller.rb

@@ -105,7 +105,7 @@ class ActiveStorageEncryption::EncryptedBlobProxyController < ActionController::
     blob_etag = key.inspect # Strong ETags must be quoted
     status, headers, ranges_body = ServeByteRange.serve_ranges(request.env,
       resource_size: blob_byte_size,
-      etag: blob_etag, # TODO
+      etag: blob_etag,
       resource_content_type: type,
       &streaming_proc)