asherah 0.3.0-x86_64-darwin → 0.4.3-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19b2444c560043be159c67a8ce073d195efdc97621bf2bc83aa51ccf782e05cf
-  data.tar.gz: d8cc8af342fe2738ff2775f87ac2a5a708a3efc22fd1abc5c1ce31c75bb31abf
+  metadata.gz: 7a868c2f22d3460e16cab1dc32bfbb530020b0bb934253eaa4840e4383ad5eb6
+  data.tar.gz: 1638d09509e0966172646bb547134e147b6270c3271fcb823b2ab7850efe6c4d
 SHA512:
-  metadata.gz: e3306522c79aba79a641be8be76e8dd884717a229cad7ab1f880a3ff1918691e24c6e4021fdc73431446d9dbb8c60d389d260f2358bc07f728f88980609bdbdc
-  data.tar.gz: d3afd3c3a65aa26183328496a75a2e278764b4056516ea8a1fcd5121109aaf07078f8089ff43ed2e125532052dac3da9efa5c50ea826dd12273ed030acec36b6
+  metadata.gz: b8a03518b84decaa19c5e94d51859995feedaa782368851bcea8b3ee037bc9effe3f37386af0592147d120c21bd265f21597b86624353c2c8eeb9394e7be635c
+  data.tar.gz: da8273a14fb347d932b215e19befc2b0b27e70d4be265166294a2f8f74453787216df68546420ea58b8ee8f3640cda597dfe5ca28150c2dcacd4722eb814b46e

data/.rubocop.yml

@@ -32,3 +32,6 @@ Metrics/AbcSize:
 
 Style/GuardClause:
   Enabled: false
+
+Naming/AccessorMethodName:
+  Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## [Unreleased]
 
+## [0.4.3] - 2022-08-31
+
+- Upgrade to use asherah-cobhan v0.4.16
+
+## [0.4.2] - 2022-07-25
+
+- Upgrade to use asherah-cobhan v0.4.15
+- Add `set_env` method to set environment variables for Asherah
+
+## [0.4.1] - 2022-03-25
+
+- Build and release platform gems
+
+## [0.4.0] - 2022-03-25
+
+- Download native file during gem install and verify checksum
+- Upgrade to use asherah-cobhan v0.4.11
+
 ## [0.3.0] - 2022-03-22
 
 - Free up cobhan buffers after encrypt/decrypt to prevent growing heap memory

data/README.md

@@ -1,8 +1,8 @@
 # Asherah
 
-Asherah is a Ruby wrapper around [Asherah Go](https://github.com/godaddy/asherah) application-layer encryption SDK that provides advanced encryption features and defense in depth against compromise. It uses a technique known as "envelope encryption" and supports cloud-agnostic data storage and key management.
+Asherah is a Ruby FFI wrapper around Go version of [Asherah](https://github.com/godaddy/asherah) application-layer encryption SDK. Asherah provides advanced encryption features and defense in depth against compromise. It uses a technique known as "envelope encryption" and supports cloud-agnostic data storage and key management.
 
-Check out the following documentation to get more familiar with its concepts:
+Check out the following documentation to get more familiar with the concepts and configuration options:
 
 - [Design and Architecture](https://github.com/godaddy/asherah/blob/master/docs/DesignAndArchitecture.md)
 - [Key Caching](https://github.com/godaddy/asherah/blob/master/docs/KeyCaching.md)
@@ -10,6 +10,10 @@ Check out the following documentation to get more familiar with its concepts:
 - [Metastore](https://github.com/godaddy/asherah/blob/master/docs/Metastore.md)
 - [System Requirements](https://github.com/godaddy/asherah/blob/master/docs/SystemRequirements.md)
 
+## Supported Platforms
+
+Currently supported platforms are Linux and Darwin operating systems for x64 and arm64 CPU architectures.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -45,7 +49,7 @@ Encrypt some data for a `partition_id`
 
 ```ruby
 partition_id = 'user_1'
-data = 'Some PII data'
+data = 'PII data'
 data_row_record_json = Asherah.encrypt(partition_id, data)
 puts data_row_record_json
 ```
@@ -61,23 +65,22 @@ puts decrypted_data
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+To install this gem onto your local machine, run `rake install`.
 
-## Contributing
-
-Bug reports and pull requests are welcome on GitHub at https://github.com/godaddy/asherah-ruby.
-
-## Releasing new gem version
+To release a new version, update the version number in `version.rb`, create and push a version tag:
 
 ```
-# Create and push a version tag
 git tag -a v$(rake version) -m "Version $(rake version)"
 git push origin v$(rake version)
-
-# Create a release in Github to trigger .github/workflows/publish.yml workflow
-echo "Version $(rake version)"
 ```
 
+And then create a release in Github with title `echo "Version $(rake version)"` that will trigger `.github/workflows/publish.yml` workflow and push the `.gem` file to [rubygems.org](https://rubygems.org):
+
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/godaddy/asherah-ruby.
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](LICENSE.txt).

data/Rakefile

@@ -2,7 +2,6 @@
 
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
-require 'rubygems/package'
 
 RSpec::Core::RakeTask.new(:spec)
 
@@ -10,112 +9,21 @@ require 'rubocop/rake_task'
 
 RuboCop::RakeTask.new
 
-task default: %i[spec rubocop]
-
-ASHERAH_BIN = 'bin/download-asherah.sh'
-DISTRIBUTIONS = {
-  'x86_64-linux' => ['libasherah-x64.so'],
-  'x86_64-darwin' => ['libasherah-x64.dylib'],
-  'aarch64-linux' => ['libasherah-arm64.so'],
-  'arm64-darwin' => ['libasherah-arm64.dylib']
-}.freeze
-
-def current_filename
-  @current_filename ||=
-    begin
-      require 'cobhan'
-      Class.new.extend(Cobhan).library_file_name('libasherah')
-    end
-end
-
-def current_platform
-  @distribution ||= DISTRIBUTIONS.detect { |_k, v| v.include?(current_filename) }
-  @distribution.first
-end
-
-def native_build(platform, native_files)
-  puts "Building gem for #{platform}"
-
-  pkg_dir = File.join(__dir__, 'pkg')
-  FileUtils.mkdir_p(pkg_dir)
-
-  tmp_gem_dir = File.join(__dir__, 'tmp', platform)
-  FileUtils.rm_rf(tmp_gem_dir, verbose: true)
-  FileUtils.mkdir_p(tmp_gem_dir, verbose: true)
-
-  # Copy files to tmp gem dir
-  gemspec = Bundler.load_gemspec('asherah.gemspec')
-  (gemspec.files + [ASHERAH_BIN]).each do |file|
-    dir = File.dirname(file)
-    filename = File.basename(file)
-    FileUtils.mkdir_p(File.join(tmp_gem_dir, dir))
-    FileUtils.copy_file(file, File.join(tmp_gem_dir, dir, filename))
-  end
-
-  # Set platform for native gem build
-  gemspec.platform = Gem::Platform.new(platform)
-
-  native_dir = 'lib/asherah/native'
-  FileUtils.cd(tmp_gem_dir, verbose: true) do
-    FileUtils.mkdir_p(native_dir)
-    native_files.each do |native_file|
-      native_file_path = File.join(native_dir, native_file)
-
-      # Download native file
-      download_asherah_path = File.join(tmp_gem_dir, ASHERAH_BIN)
-      system("#{download_asherah_path} #{native_file}")
-
-      # Add native file in gemspec
-      gemspec.files << native_file_path
-    end
-
-    package = Gem::Package.build(gemspec)
-    FileUtils.mv package, File.join(pkg_dir, package)
+desc 'Download the binary for the current platform'
+task :download do
+  tmp_dir = 'tmp'
+  FileUtils.mkdir_p(tmp_dir)
+  FileUtils.cd(tmp_dir, verbose: true) do
+    system('ruby ../ext/asherah/extconf.rb')
   end
 end
 
-namespace :native do
-  desc 'Build all native gems'
-  task :build do
-    DISTRIBUTIONS.each do |platform, native_files|
-      native_build(platform, native_files)
-    end
-  end
-
-  namespace :build do
-    DISTRIBUTIONS.each do |platform, native_files|
-      desc "Build native gem for #{platform}"
-      task :"#{platform}" do
-        native_build(platform, native_files)
-      end
-    end
-  end
-
-  namespace :current do
-    desc 'Download asherah binary for current platform'
-    task :download do
-      download_asherah_path = File.join(__dir__, ASHERAH_BIN)
-      system("#{download_asherah_path} #{current_filename}")
-    end
-
-    desc 'Build native gem for current platform'
-    task :build do
-      native_build(current_platform, DISTRIBUTIONS[current_platform])
-    end
-
-    desc 'Smoke test native gem for current platform'
-    task smoke: :build do
-      platform = current_platform
-      gemspec = Bundler.load_gemspec('asherah.gemspec')
-      gemspec.platform = Gem::Platform.new(platform)
-
-      sh('gem uninstall asherah')
-      sh("gem install pkg/#{gemspec.file_name}")
-      sh('ruby spec/smoke_test.rb')
-    end
-  end
-end
+task default: %i[spec rubocop]
+task spec: :download
 
+desc 'Print current version'
 task :version do
   puts Asherah::VERSION
 end
+
+Rake.add_rakelib 'tasks'

data/asherah.gemspec

@@ -27,12 +27,13 @@ Gem::Specification.new do |spec|
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject do |f|
-      (f == __FILE__) || f.match(%r{\A(?:(?:bin|test|spec|features)/|\.(?:git|travis|circleci)|appveyor)})
+      (f == __FILE__) || f.match(%r{\A(?:(?:bin|test|spec|features|tasks)/|\.(?:git|travis|circleci)|appveyor)})
     end
   end
   spec.bindir = 'exe'
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
+  spec.extensions = ['ext/asherah/extconf.rb']
 
   spec.add_dependency 'cobhan', '~> 0.2.0'
   spec.add_development_dependency 'dotenv', '~> 2.7.6'

data/ext/asherah/checksums.yml

@@ -0,0 +1,5 @@
+version:                v0.4.16
+libasherah-arm64.so:    14c4734de6bbae936e3504ad9daa31f1081755de017188a46079f0b1d3a14ea1
+libasherah-x64.so:      60d68c030cdc1c792ee002f77f3b4f3f28994b94ed080b2c618d7ee636248a12
+libasherah-arm64.dylib: 5d7b358e1dfd6a1946a6538442856f44a1c122d5ec467b41f6f994eac45c8a2f
+libasherah-x64.dylib:   0b01f69740628869052dabdcc33c69f4a1349e4136c68ce7d859b4eb7800d0a9

data/ext/asherah/extconf.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'mkmf'
+create_makefile('asherah/asherah')
+
+require_relative 'native_file'
+NativeFile.download

data/ext/asherah/native_file.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require 'open-uri'
+require 'fileutils'
+require 'digest'
+require 'yaml'
+require 'cobhan'
+
+# Downloads native file and verifies checksum
+class NativeFile
+  LIB_NAME = 'libasherah'
+  ROOT_DIR = File.expand_path('../../', __dir__)
+  CHECKSUMS_FILE = File.expand_path('checksums.yml', __dir__)
+  CHECKSUMS = YAML.load_file(CHECKSUMS_FILE)
+  VERSION = CHECKSUMS.fetch('version')
+  RETRIES = 3
+  RETRY_DELAY = 1
+
+  class << self
+    def download(
+      file_name: Class.new.extend(Cobhan).library_file_name(LIB_NAME),
+      dir: File.join(ROOT_DIR, 'lib/asherah/native')
+    )
+      file_path = File.join(dir, file_name)
+      if File.exist?(file_path)
+        puts "#{file_path} already exists ... skipping download"
+        return
+      end
+
+      checksum = CHECKSUMS.fetch(file_name) do
+        abort "Unsupported platform #{RUBY_PLATFORM}"
+      end
+
+      content = download_content(file_name)
+
+      sha256 = Digest::SHA256.hexdigest(content)
+      abort "Could not verify checksum of #{file_name}" if sha256 != checksum
+
+      FileUtils.mkdir_p(dir)
+      File.binwrite(file_path, content)
+    end
+
+    private
+
+    def download_content(file_name)
+      tries = 0
+
+      begin
+        tries += 1
+        url = "https://github.com/godaddy/asherah-cobhan/releases/download/#{VERSION}/#{file_name}"
+        puts "Downloading #{url}"
+        URI.parse(url).open.read
+      rescue Net::OpenTimeout, Net::ReadTimeout => e
+        if tries <= RETRIES
+          puts "Got #{e.class}... retrying in #{RETRY_DELAY} seconds"
+          sleep RETRY_DELAY
+          retry
+        else
+          raise e
+        end
+      end
+    end
+  end
+end

data/lib/asherah/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Asherah
-  VERSION = '0.3.0'
+  VERSION = '0.4.3'
 end

data/lib/asherah.rb

@@ -11,6 +11,7 @@ module Asherah
 
   LIB_ROOT_PATH = File.expand_path('asherah/native', __dir__)
   load_library(LIB_ROOT_PATH, 'libasherah', [
+    [:SetEnv, [:pointer], :int32],
     [:SetupJson, [:pointer], :int32],
     [:EncryptToJson, [:pointer, :pointer, :pointer], :int32],
     [:DecryptFromJson, [:pointer, :pointer, :pointer], :int32],
@@ -22,6 +23,22 @@ module Asherah
   BASE64_OVERHEAD = 1.34
 
   class << self
+    # Set environment variables needed by Asherah dependencies for when
+    # Go os.Getenv() doesn't see variables set by C.setenv().
+    # References:
+    #   https://github.com/golang/go/wiki/cgo#environmental-variables
+    #   https://github.com/golang/go/issues/44108
+    #
+    # @yield [Config]
+    # @param env [Hash], Key-value pairs to set Asherah ENV
+    # @return [void]
+    def set_env(env = {})
+      env_buffer = string_to_cbuffer(env.to_json)
+
+      result = SetEnv(env_buffer)
+      Error.check_result!(result, 'SetEnv failed')
+    end
+
     # Configures Asherah
     #
     # @yield [Config]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: asherah
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.3
 platform: x86_64-darwin
 authors:
 - GoDaddy
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-22 00:00:00.000000000 Z
+date: 2022-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cobhan
@@ -100,7 +100,8 @@ description: |
 email:
 - oss@godaddy.com
 executables: []
-extensions: []
+extensions:
+- ext/asherah/extconf.rb
 extra_rdoc_files: []
 files:
 - ".rspec"
@@ -115,6 +116,9 @@ files:
 - Rakefile
 - SECURITY.md
 - asherah.gemspec
+- ext/asherah/checksums.yml
+- ext/asherah/extconf.rb
+- ext/asherah/native_file.rb
 - lib/asherah.rb
 - lib/asherah/config.rb
 - lib/asherah/error.rb