ansible-vault 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c64c35022f30a4f3c587291beec7db13bbde45c8
-  data.tar.gz: a67022fa1b3d67df377f9eb1fdf926f428d67235
+  metadata.gz: 1561653af6b72805f9ee3b499283f31ebe7707b1
+  data.tar.gz: 5825d44806493f47c5d65c5b7861e90a498288cb
 SHA512:
-  metadata.gz: d143eb2573573c5f83adf5e373f440c2d5207d2cc4933c13f1d58bcdd8a1a4f2cd60aa6f0babbafe60fc9487bde28207007a600cc25c686353f0ffcfb2b9b2b5
-  data.tar.gz: 696b412c876e520bba00d1884db687c5ad63f118cd23adfd624681e06095534c988ebdc422a07b6f503156b7298a4efb9fb183e2c8b2cefc62d6d203c424c8a2
+  metadata.gz: a7b7efd82f58ffd4787e01a0abb89be74b61d5442d7a8a754f0fc4217915dc4b3d00879b5c8658b5e466fedcdec5473275d6e4bb0300dfd6759974a1343b1ae8
+  data.tar.gz: 08aab745f2914dcde6eda24c5f713d6c7577512c8758248d93cdd0a95ae89126bfa96aa9e2a47ff25c00cdcb952abd0d4c2559207627734fea9153ed4bccd046

data/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## v 0.2.0
+* Added checks for nil/blank passwords (#4)
+* Added the ability to check if a file is encrypted (#3)
+
+## v 0.1.0 Initial Release
+* Implemented Read and write commands

data/README.md

@@ -68,8 +68,18 @@ release a new version, update the version number in `version.rb`, and then run
 git commits and tags, and push the `.gem` file to
 [rubygems.org](https://rubygems.org).
 
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at
-https://github.com/tpickett66/ansible-vault-rb.
+https://github.com/tpickett66/ansible-vault-rb. This project is intended to be
+a safe, welcoming space for collaboration, and contributors are expected to
+adhere to the [Contributor Covenant](http://contributor-covenant.org) code of
+conduct.
+
+
+## License
+
+The gem is available as open source under the terms of the
+[MIT License](http://opensource.org/licenses/MIT).
 

data/lib/ansible/vault.rb

@@ -10,34 +10,56 @@ require 'ansible/vault/version'
 module Ansible
   # The top level class for interacting with Vault files.
   class Vault
-    # Read and decrypt the plaintext contents of a vault
+    # The standard header for Ansible's current vault format
+    FILE_HEADER = "$ANSIBLE_VAULT;1.1;AES256".freeze
+
+    # Indicate if the file at the supplied path appeard to be encrypted by
+    # Ansible Vault
+    #
+    # @param path [String, Pathname]
+    def self.encrypted?(path)
+      FileReader.new(path.to_s).encrypted?
+    end
+
+    # Read and decrypt, if necessary, the contents of a vault
+    #
+    # If the file does not appear to be encrypted the file is simply read.
     #
-    # @param path [String] The path to the file to read
+    # @param path [String, Pathname] The path to the file to read
     # @param password [String] The password for the file
+    # @param options [Hash] Additional options, see {#initialize} for details
     # @return [String] The plaintext contents of the vault, this is marked for
     #   zeroing before the GC reaps the object. Any data extracted/parsed from
     #   this string should be similarly wiped from memory when no longer used.
-    def self.read(path:, password:)
-      new(path: path, password: password).read
+    def self.read(path:, password:, **options)
+      new(path: path, password: password, **options).read
     end
 
     # Encrypt plaintext using the supplied and write it to the specified location
     #
-    # @param path [String] The path to the file to write, truncated before writing
+    # @param path [String, Pathname] The path to the file to write, truncated
+    #   before writing
     # @param password [String] The password for the file
     # @param plaintext [String] The secrets to be protected
+    # @param options [Hash] Additional options, see {#initialize} for details
     # @return [File] The closed file handle the vault was written to
-    def self.write(path:, password:, plaintext:)
-      new(path: path, password: password, plaintext: plaintext).write
+    def self.write(path:, password:, plaintext:, **options)
+      new(path: path, password: password, plaintext: plaintext, **options).write
     end
 
     # Build a new Vault
     #
-    # @param path [String] The path to the file to read
+    # @param path [String, Pathname] The path to the file to read
     # @param password [String] The password for the file
-    def initialize(path:, password:, plaintext: :none)
+    # @param options [Hash] Additional options
+    # @param plaintext [String] The plaintext of the file to be written when
+    #   encrypting
+    # @option options [Boolean] :allow_blank_password Allow nil and empty string
+    #   passwords, defaults to false.
+    def initialize(path:, password:, plaintext: :none, **options)
+      @path = path.to_s
       @path = path
-      @password = password.shred_later
+      @password = validate_password(password, options).shred_later
       @plaintext = plaintext
       @plaintext.shred_later if String === @plaintext
     end
@@ -64,13 +86,27 @@ module Ansible
 
     # Extract the plaintext from a previously written vault file
     #
+    # If the file does not appear to be encrypted the raw contents will be
+    # returned.
+    #
     # @return [String] The plaintext contents of the vault, this is marked for
     #   zeroing before the GC reaps the object. Any data extracted/parsed from
     #   this string should be similarly wiped from memory when no longer used.
     def read
       file = FileReader.new(@path)
+      return File.read(@path) unless file.encrypted?
       decryptor = Decryptor.new(password: @password, file: file)
       decryptor.plaintext
     end
+
+    private
+
+    def validate_password(password, options)
+      if !options[:allow_blank_password] && (password.nil? || password.strip.empty?)
+        raise BlankPassword, 'A nil or empty string password was supplied!' \
+          'If this is expected set the allow_blank_password option.'
+      end
+      password or ''
+    end
   end
 end

data/lib/ansible/vault/error.rb

@@ -3,5 +3,6 @@ module Ansible
     class Error < StandardError; end
     class MissingSalt < Error; end
     class HMACMismatch < Error; end
+    class BlankPassword < Error; end
   end
 end

data/lib/ansible/vault/file_reader.rb

@@ -46,10 +46,23 @@ module Ansible
         @salt
       end
 
+      # Indicates if the file is in the encrypted format or not
+      #
+      # @return [Boolean]
+      def encrypted?
+        decode_body unless defined?(@salt)
+        # The header not matching is a dead giveaway that the file isn't what
+        # we're expecting. That, however, probably isn't enough so we'll check
+        # the HMAC for presence and length since it's very unlikely that
+        # decoding the file body will result in multiple chunks AND the second
+        # one being the correct length for a SHA256 HMAC.
+        @header == FILE_HEADER && !@hmac.nil? && @hmac.bytesize == 64
+      end
+
       private
 
       def decode_body
-        salt, @hmac, ciphertext = BinASCII.unhexlify(@body).split("\n")
+        salt, @hmac, ciphertext = BinASCII.unhexlify(@body).split("\n", 3)
         @ciphertext = BinASCII.unhexlify(ciphertext)
         @salt = BinASCII.unhexlify(salt)
       end

data/lib/ansible/vault/file_writer.rb

@@ -16,9 +16,6 @@ module Ansible
       attr_reader :path
       attr_accessor :ciphertext, :hmac, :salt
 
-      # The standard header for Ansible's current vault format
-      HEADER = "$ANSIBLE_VAULT;1.1;AES256\n".freeze
-
       # Construct a new FileWriter
       #
       # @param [String] path The path to write the file out to.
@@ -31,7 +28,7 @@ module Ansible
       # @return [File] The closed file handle used to write the data out.
       def write
         File.open(path, 'w') { |file|
-          file.write(HEADER)
+          file.write(FILE_HEADER + "\n")
           file.write(encoded_body)
         }
       end

data/lib/ansible/vault/version.rb

@@ -1,5 +1,5 @@
 module Ansible
   class Vault
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ansible-vault
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Tyler Pickett
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-13 00:00:00.000000000 Z
+date: 2016-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oroku_saki
@@ -119,6 +119,7 @@ files:
 - ".gitignore"
 - ".rspec"
 - ".travis.yml"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Guardfile