aspera-cli 4.27.0 → 4.27.2

data/lib/aspera/keychain/encrypted_hash.rb

@@ -5,7 +5,8 @@ require 'aspera/environment'
 require 'aspera/log'
 require 'aspera/assert'
 require 'aspera/keychain/base'
-require 'symmetric_encryption/core'
+require 'aspera/yaml'
+require 'openssl'
 require 'yaml'
 
 module Aspera
@@ -16,30 +17,47 @@ module Aspera
       DEFAULT_CIPHER_NAME = 'aes-256-cbc'
       FILE_TYPE = 'encrypted_hash_vault'
       FILE_KEYS = %w[version type cipher data].sort.freeze
-      private_constant :LEGACY_CIPHER_NAME, :DEFAULT_CIPHER_NAME, :FILE_TYPE, :FILE_KEYS
+      FILE_KEYS_KDF = (%w[kdf] + FILE_KEYS).sort.freeze
+      # PBKDF2 parameters for new vaults
+      KDF_ITERATIONS = 200_000
+      KDF_DIGEST = 'SHA256'
+      KDF_SALT_BYTES = 16
+      private_constant :LEGACY_CIPHER_NAME, :DEFAULT_CIPHER_NAME, :FILE_TYPE, :FILE_KEYS, :FILE_KEYS_KDF,
+        :KDF_ITERATIONS, :KDF_DIGEST, :KDF_SALT_BYTES
+
       def initialize(file:, password:)
         super()
-        Aspera.assert_type(file, String){'path to vault file'}
+        Aspera.assert_type(file, String) { 'path to vault file' }
         @path = file
+        Log.dump(:vault_file, @path)
         @all_secrets = {}
         @cipher_name = DEFAULT_CIPHER_NAME
+        @kdf_params = nil
+        # true when the vault was created by v4.26.0 (password padded with zeros, no KDF)
+        @legacy_key = false
         vault_encrypted_data = nil
+        Log.dump(:vault_file, File.expand_path(@path))
         if File.exist?(@path)
           vault_file = File.read(@path)
           if vault_file.start_with?('---')
             vault_info = YAML.parse(vault_file).to_ruby
-            Aspera.assert(vault_info.keys.sort == FILE_KEYS, 'Invalid vault file')
+            sorted_keys = vault_info.keys.sort
+            Aspera.assert(sorted_keys == FILE_KEYS || sorted_keys == FILE_KEYS_KDF) { "Invalid vault file: #{@path}: #{sorted_keys}" }
             @cipher_name = vault_info['cipher']
+            @kdf_params  = vault_info['kdf']
+            # vault created before PBKDF2 was introduced (v4.26.0 format: no kdf field)
+            @legacy_key = @kdf_params.nil?
             vault_encrypted_data = vault_info['data']
           else
-            # legacy vault file
+            # legacy vault file (binary, pre-YAML format)
             @cipher_name = LEGACY_CIPHER_NAME
+            @legacy_key = true
             vault_encrypted_data = File.read(@path, mode: 'rb')
           end
         end
         # setting password also creates the cipher
         @cipher = cipher(password)
-        @all_secrets = YAML.load_stream(@cipher.decrypt(vault_encrypted_data)).first if !vault_encrypted_data.nil?
+        @all_secrets = Yaml.safe_load(@cipher.decrypt(vault_encrypted_data)) || {} if !vault_encrypted_data.nil?
       end
 
       def info
@@ -48,12 +66,12 @@ module Aspera
         }
       end
 
-      def list
+      def all
         result = []
         @all_secrets.each do |label, values|
           normal = values.symbolize_keys
           normal[:label] = label
-          CONTENT_KEYS.each{ |k| normal[k] = '' unless normal.key?(k)}
+          CONTENT_KEYS.each { |k| normal[k] = '' unless normal.key?(k) }
           result.push(normal)
         end
         return result
@@ -64,13 +82,13 @@ module Aspera
       def set(options)
         validate_set(options)
         label = options.delete(:label)
-        Aspera.assert(!@all_secrets.key?(label)){"secret #{label} already exist, delete first"}
+        Aspera.assert(!@all_secrets.key?(label)) { "secret #{label} already exist, delete first" }
         @all_secrets[label] = options.symbolize_keys
         save
       end
 
       def get(label:, exception: true)
-        Aspera.assert(@all_secrets.key?(label)){"Label not found: #{label}"} if exception
+        Aspera.assert(@all_secrets.key?(label)) { "Label not found: #{label}" } if exception
         result = @all_secrets[label].clone
         result[:label] = label if result.is_a?(Hash)
         return result
@@ -82,28 +100,85 @@ module Aspera
       end
 
       def change_password(password)
+        # Generate new KDF params so a password change also re-salts the vault
+        @kdf_params = nil
         @cipher = cipher(password)
         save
       end
 
       private
 
-      # set the password and cipher
+      # Minimal cipher wrapper using OpenSSL, compatible with the SymmetricEncryption
+      # binary format: a 6-byte header "@EnC\x00\x00" followed by AES ciphertext
+      # produced with a zero IV (encoding: :none, no random IV in header).
+      class OsslCipher
+        HEADER = "@EnC\x00\x00".b.freeze
+        HEADER_SIZE = HEADER.bytesize
+
+        def initialize(cipher_name, key)
+          @cipher_name = cipher_name
+          @key         = key
+        end
+
+        def encrypt(plaintext)
+          c = OpenSSL::Cipher.new(@cipher_name)
+          c.encrypt
+          c.key = @key
+          c.iv  = "\x00".b * c.iv_len
+          HEADER + c.update(plaintext.b) + c.final
+        end
+
+        def decrypt(ciphertext)
+          body = ciphertext.b[HEADER_SIZE..]
+          c = OpenSSL::Cipher.new(@cipher_name)
+          c.decrypt
+          c.key = @key
+          c.iv  = "\x00".b * c.iv_len
+          (c.update(body) + c.final).force_encoding(Encoding::UTF_8)
+        end
+      end
+
+      # Derive an AES key from +new_password+.
+      # @legacy_key is true for vaults created by v4.26.0 or earlier (no kdf field):
+      #   key = password truncated/zero-padded to key_bytes (same as symmetric-encryption did).
+      # Otherwise PBKDF2 is used. When @kdf_params is nil (new vault or password change)
+      # a fresh salt is generated; when already set (existing vault) it is reused.
       def cipher(new_password)
-        # number of bits in second position
         key_bytes = @cipher_name.split('-')[1].to_i / Environment::BITS_PER_BYTE
-        # derive key from passphrase, add trailing zeros
-        key = "#{new_password}#{"\x0" * key_bytes}"[0..(key_bytes - 1)]
-        Log.log.trace1{"secret=[#{key}],#{key.length}"}
-        SymmetricEncryption.cipher = SymmetricEncryption::Cipher.new(cipher_name: @cipher_name, key: key, encoding: :none)
+        key =
+          if @legacy_key
+            # Replicate the v4.26.0 key derivation: password + NUL padding, truncated to key_bytes
+            (new_password + ("\x00" * key_bytes))[0, key_bytes]
+          else
+            if @kdf_params.nil?
+              # New vault or password change: generate a fresh salt
+              salt = OpenSSL::Random.random_bytes(KDF_SALT_BYTES)
+              @kdf_params = {
+                'algo'       => 'PBKDF2',
+                'digest'     => KDF_DIGEST,
+                'iterations' => KDF_ITERATIONS,
+                'salt'       => [salt].pack('m0') # base64, no newlines
+              }
+            end
+            salt = @kdf_params['salt'].unpack1('m0')
+            OpenSSL::KDF.pbkdf2_hmac(
+              new_password,
+              salt:       salt,
+              iterations: @kdf_params['iterations'],
+              length:     key_bytes,
+              hash:       @kdf_params['digest']
+            )
+          end
+        OsslCipher.new(@cipher_name, key)
       end
 
       # save current data to file with format
       def save
         vault_info = {
-          'version' => '1.0.0',
+          'version' => '1.1.0',
           'type'    => FILE_TYPE,
           'cipher'  => @cipher_name,
+          'kdf'     => @kdf_params,
           'data'    => @cipher.encrypt(YAML.dump(@all_secrets))
         }
         File.write(@path, YAML.dump(vault_info))

data/lib/aspera/keychain/factory.rb

@@ -2,9 +2,9 @@
 
 module Aspera
   module Keychain
-    # Manage secrets in a Hashicorp Vault
+    # Factory to create vault/keychain instances
     class Factory
-      LIST = %i[file system vault].freeze
+      LIST = %i[file system vault 1password].freeze
       class << self
         # Create a vault instance
         # @param info     [Hash]   vault options
@@ -12,13 +12,13 @@ module Aspera
         # @param folder   [String] folder to store the vault (if needed)
         # @param password [String] password to open the vault
         def create(info, name, folder, password)
-          Aspera.assert_hash_all(info, Symbol, String){'vault info shall have only string values'}
+          Aspera.assert_hash_all(info, Symbol, String) { 'vault info shall have only string values' }
           info = info.symbolize_keys
           vault_type = info.delete(:type)
-          Aspera.assert_values(vault_type, LIST.map(&:to_s)){'vault.type'}
+          Aspera.assert_values(vault_type, LIST.map(&:to_s)) { 'vault.type' }
           case vault_type
           when 'file'
-            info[:file] = name || 'vault.bin'
+            info[:file] = info.delete(:name) || 'vault.bin' if info.key?(:name)
             info[:file] = File.join(folder, info[:file]) unless File.absolute_path?(info[:file])
             Aspera.assert(!password.nil?, 'please provide password')
             info[:password] = password
@@ -37,6 +37,18 @@ module Aspera
             require 'aspera/keychain/hashicorp_vault'
             info[:token] ||= password
             Keychain::HashicorpVault.new(**info)
+          when '1password'
+            source = info.delete(:source) || 'api'
+            Aspera.assert_values(source, %w[api cli]) { 'vault.source' }
+            case source
+            when 'api'
+              require 'aspera/keychain/one_password_api'
+              info[:token] ||= password
+              Keychain::OnePasswordApi.new(**info)
+            when 'cli'
+              require 'aspera/keychain/one_password_cli'
+              Keychain::OnePasswordCli.new(**info)
+            end
           else Aspera.error_unexpected_value(vault_type)
           end
         end

data/lib/aspera/keychain/hashicorp_vault.rb

@@ -29,7 +29,7 @@ module Aspera
         }
       end
 
-      def list
+      def all
         metadata_path = STORE_PATH.sub('/data/', '/metadata/')
         return Vault.logical.list(metadata_path).filter_map do |label|
           get(label: label).merge(label: label)

data/lib/aspera/keychain/macos_security.rb

@@ -44,14 +44,14 @@ module Aspera
               uri = URI.parse(url)
               Aspera.assert(uri.scheme.eql?('https'), 'only https')
               options[:protocol] = 'htps' # cspell: disable-line
-              Aspera.assert(!uri.host.nil?, type: Error){'host required in URL'}
+              Aspera.assert(!uri.host.nil?, type: Error) { 'host required in URL' }
               options[:server] = uri.host
               options[:path] = uri.path unless ['', '/'].include?(uri.path)
               options[:port] = uri.port unless uri.port.eql?(443) && !url.include?(':443/')
             end
             command_args = [SECURITY_UTILITY, command]
             options&.each do |k, v|
-              Aspera.assert(supported.key?(k)){"unknown option: #{k}"}
+              Aspera.assert(supported.key?(k)) { "unknown option: #{k}" }
               next if v.nil?
               command_args.push("-#{supported[k]}")
               command_args.push(v.shellescape) unless v.empty?
@@ -61,7 +61,7 @@ module Aspera
           end
 
           def key_chains(output)
-            output.split("\n").collect{ |line| new(line.strip.gsub(/^"|"$/, ''))}
+            output.split("\n").collect { |line| new(line.strip.gsub(/^"|"$/, '')) }
           end
 
           def default
@@ -73,12 +73,12 @@ module Aspera
           end
 
           def list(options = {})
-            Aspera.assert_values(options[:domain], DOMAINS, type: ParameterError){'domain'} unless options[:domain].nil?
+            Aspera.assert_values(options[:domain], DOMAINS, type: ParameterError) { 'domain' } unless options[:domain].nil?
             key_chains(execute('list-keychains', options, LIST_OPTIONS))
           end
 
           def by_name(name)
-            list.find{ |kc| kc.path.end_with?("/#{name}.keychain-db")}
+            list.find { |kc| kc.path.end_with?("/#{name}.keychain-db") }
           end
         end
         attr_reader :path
@@ -92,11 +92,11 @@ module Aspera
         end
 
         def password(operation, pass_type, options)
-          Aspera.assert_values(operation, %i[add find delete]){'operation'}
-          Aspera.assert_values(pass_type, %i[generic internet]){'pass_type'}
+          Aspera.assert_values(operation, %i[add find delete]) { 'operation' }
+          Aspera.assert_values(pass_type, %i[generic internet]) { 'pass_type' }
           Aspera.assert_type(options, Hash)
           missing = (operation.eql?(:add) ? %i[account service password] : %i[label]) - options.keys
-          Aspera.assert(missing.empty?){"missing options: #{missing}"}
+          Aspera.assert(missing.empty?) { "missing options: #{missing}" }
           options[:getpass] = '' if operation.eql?(:find)
           output = self.class.execute("#{operation}-#{pass_type}-password", options, ADD_PASS_OPTIONS, @path)
           raise output.gsub(/^.*: /, '') if output.start_with?('security: ')
@@ -128,7 +128,7 @@ module Aspera
         super()
         @keychain_name = name.nil? ? 'default keychain' : name
         @keychain = name.nil? ? MacosSecurity::Keychain.default : MacosSecurity::Keychain.by_name(name)
-        Aspera.assert(!@keychain.nil?){"no such keychain #{name}"}
+        Aspera.assert(!@keychain.nil?) { "no such keychain #{name}" }
       end
 
       def info
@@ -137,9 +137,9 @@ module Aspera
         }
       end
 
-      def list
+      def all
         # the only way to list is `dump-keychain` which triggers security alert
-        raise Error, 'list not implemented, use macos keychain app'
+        raise Error, 'overview not implemented, use macos keychain app'
       end
 
       def set(options)
@@ -150,22 +150,20 @@ module Aspera
         )
       end
 
-      def get(options)
-        Aspera.assert_type(options, Hash){'options'}
-        unsupported = options.keys - %i[label]
-        Aspera.assert(unsupported.empty?){"unsupported options: #{unsupported}"}
-        info = @keychain.password(:find, :generic, label: options[:label])
-        Aspera.assert(!info.nil?, type: Error){'not found'}
-        result = options.clone
-        result[:secret] = info['password']
-        result[:description] = info['icmt'] # cspell: disable-line
-        return result
+      def get(label:, exception: true)
+        info = @keychain.password(:find, :generic, label: label)
+        if info.nil?
+          raise "Secret '#{label}' not found" if exception
+          return
+        end
+        return {
+          label:       label,
+          password:    info['password'],
+          description: info['icmt'] # cspell: disable-line
+        }
       end
 
-      def delete(options)
-        Aspera.assert_type(options, Hash){'options'}
-        unsupported = options.keys - %i[label]
-        Aspera.assert(unsupported.empty?){"unsupported options: #{unsupported}"}
+      def delete(label:)
         raise Error, 'delete not implemented, use macos keychain app'
       end
     end

data/lib/aspera/keychain/one_password_api.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'aspera/rest'
+require 'aspera/keychain/one_password_base'
+
+module Aspera
+  module Keychain
+    # Manage secrets using the 1Password Connect REST API
+    # https://developer.1password.com/docs/connect/connect-api-reference/
+    class OnePasswordApi < Base
+      include OnePasswordBase
+
+      # @param url      [String] Base URL of the 1Password Connect server (e.g. http://localhost:8080)
+      # @param token    [String] Bearer token (Connect token or service-account token)
+      # @param vault_id [String] ID of the 1Password vault to operate on
+      def initialize(url:, token:, vault_id:)
+        super()
+        @vault_id = vault_id
+        @api = Rest.new(
+          base_url: url,
+          headers:  {'Authorization' => "Bearer #{token}"}
+        )
+      end
+
+      def info
+        {
+          url:      @api.base_url,
+          vault_id: @vault_id
+        }
+      end
+
+      def all
+        items = @api.read("v1/vaults/#{@vault_id}/items")
+        return items.map do |item|
+          item_to_secret(@api.read("v1/vaults/#{@vault_id}/items/#{item['id']}")).merge(id: item['id'])
+        end
+      end
+
+      def ids
+        @api.read("v1/vaults/#{@vault_id}/items").map { |item| {id: item['id'], label: item['title']} }
+      end
+
+      def set(options)
+        validate_set(options)
+        @api.create("v1/vaults/#{@vault_id}/items", build_item(options))
+        nil
+      end
+
+      def get(label:, id: nil, exception: true)
+        iid = id || resolve_id(label, exception: exception)
+        return if iid.nil?
+        return item_to_secret(@api.read("v1/vaults/#{@vault_id}/items/#{iid}")).merge(id: iid)
+      end
+
+      def delete(label:, id: nil)
+        iid = id || resolve_id(label, exception: true)
+        @api.delete("v1/vaults/#{@vault_id}/items/#{iid}")
+        nil
+      end
+
+      private
+
+      # Resolve an item id from its title; raises if ambiguous or missing
+      def resolve_id(label, exception: true)
+        items = @api.read("v1/vaults/#{@vault_id}/items", {filter: "title eq \"#{label}\""})
+        raise "Multiple secrets found with label '#{label}': use id to disambiguate" if items.length > 1
+        raise "Secret '#{label}' not found" if items.empty? && exception
+        items.first&.fetch('id')
+      end
+
+      def build_item(options)
+        fields = []
+        fields << {'id' => FIELD_USERNAME, 'type' => 'STRING',    'value' => options[:username]}    if options[:username]
+        fields << {'id' => FIELD_PASSWORD, 'type' => 'CONCEALED', 'value' => options[:password]}    if options[:password]
+        fields << {'id' => FIELD_URL,      'type' => 'URL',       'value' => options[:url]}         if options[:url]
+        fields << {'id' => FIELD_NOTES_ID, 'type' => 'STRING',    'value' => options[:description]} if options[:description]
+        {
+          'title'    => options[:label],
+          'category' => ITEM_CATEGORY.upcase,
+          'vault'    => {'id' => @vault_id},
+          'fields'   => fields
+        }
+      end
+    end
+  end
+end

data/lib/aspera/keychain/one_password_base.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'aspera/keychain/base'
+
+module Aspera
+  module Keychain
+    # Shared field constants and item_to_secret conversion for 1Password backends.
+    # Both the REST (Connect) and CLI (`op`) backends use the same JSON item schema.
+    module OnePasswordBase
+      FIELD_USERNAME = 'username'
+      FIELD_PASSWORD = 'password'
+      FIELD_URL      = 'url'
+      FIELD_NOTES_ID = 'notesPlain'
+      ITEM_CATEGORY  = 'Login'
+
+      private_constant :FIELD_USERNAME, :FIELD_PASSWORD, :FIELD_URL, :FIELD_NOTES_ID, :ITEM_CATEGORY
+
+      private
+
+      # Convert a 1Password item JSON object to a keychain secret Hash.
+      # Accepts both API Connect items (field keyed by 'id') and CLI items
+      # (field keyed by 'id' falling back to 'label').
+      def item_to_secret(item)
+        fields = Array(item['fields']).to_h { |f| [f['id'] || f['label'], f['value']] }
+        secret = {label: item['title']}
+        secret[:username]    = fields[FIELD_USERNAME] unless fields[FIELD_USERNAME].nil?
+        secret[:password]    = fields[FIELD_PASSWORD] unless fields[FIELD_PASSWORD].nil?
+        secret[:url]         = fields[FIELD_URL]      unless fields[FIELD_URL].nil?
+        secret[:description] = fields[FIELD_NOTES_ID] unless fields[FIELD_NOTES_ID].nil?
+        return secret
+      end
+    end
+  end
+end

data/lib/aspera/keychain/one_password_cli.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require 'aspera/environment'
+require 'aspera/keychain/one_password_base'
+require 'json'
+
+module Aspera
+  module Keychain
+    # Manage secrets using the 1Password CLI (`op`)
+    # https://developer.1password.com/docs/cli/
+    class OnePasswordCli < Base
+      include OnePasswordBase
+
+      OP_EXECUTABLE = 'op'
+      private_constant :OP_EXECUTABLE
+
+      # @param vault   [String, nil] Name or ID of the 1Password vault (optional, uses default vault if omitted)
+      # @param account [String, nil] Account shorthand for `op` (optional, uses default account if omitted)
+      def initialize(vault: nil, account: nil)
+        super()
+        @vault   = vault
+        @account = account
+      end
+
+      def info
+        h = {}
+        h[:vault]   = @vault   unless @vault.nil?
+        h[:account] = @account unless @account.nil?
+        h
+      end
+
+      def all
+        items = op_json('item', 'list', '--categories', ITEM_CATEGORY)
+        return items.map do |item|
+          item_to_secret(op_json('item', 'get', item['id'])).merge(id: item['id'])
+        end
+      end
+
+      def ids
+        op_json('item', 'list', '--categories', ITEM_CATEGORY).map { |item| {id: item['id'], label: item['title']} }
+      end
+
+      def set(options)
+        validate_set(options)
+        args = ['item', 'create', '--category', ITEM_CATEGORY, "--title=#{options[:label]}"]
+        args << "#{FIELD_USERNAME}=#{options[:username]}"           if options[:username]
+        args << "#{FIELD_PASSWORD}[password]=#{options[:password]}" if options[:password]
+        args << "#{FIELD_URL}[url]=#{options[:url]}"                if options[:url]
+        args << "#{FIELD_NOTES_ID}=#{options[:description]}"        if options[:description]
+        op_run(*args)
+        nil
+      end
+
+      def get(label:, id: nil, exception: true)
+        identifier = id || label
+        stdout, _stderr, status = op_capture('item', 'get', identifier, '--format=json')
+        if !status.success?
+          raise "Secret '#{label}' not found" if exception
+          return
+        end
+        full = JSON.parse(stdout)
+        return item_to_secret(full).merge(id: full['id'])
+      end
+
+      def delete(label:, id: nil)
+        op_run('item', 'delete', id || label)
+        nil
+      end
+
+      private
+
+      def common_flags
+        flags = []
+        flags.push('--vault',   @vault)   unless @vault.nil?
+        flags.push('--account', @account) unless @account.nil?
+        flags
+      end
+
+      def op_json(*args)
+        stdout, = op_capture(*args, '--format=json', exception: true)
+        JSON.parse(stdout)
+      end
+
+      def op_run(*args)
+        op_capture(*args, exception: true)
+        nil
+      end
+
+      def op_capture(*args, exception: true)
+        Environment.instance.class.secure_execute(
+          OP_EXECUTABLE, *args, *common_flags,
+          mode: :capture,
+          exception: exception
+        )
+      end
+    end
+  end
+end

data/lib/aspera/link_header.rb

@@ -20,7 +20,7 @@ module Aspera
 
       # Retrieve an attribute value by name, case-insensitively.
       def [](key)
-        pair = @attr_pairs.detect{ |k, _v| k.casecmp?(key)}
+        pair = @attr_pairs.detect { |k, _v| k.casecmp?(key) }
         pair&.last
       end
     end
@@ -37,7 +37,7 @@ module Aspera
     # @param rel [String]
     # @return [String, nil]
     def find_href(rel: 'next')
-      @links.detect{ |link| link['rel']&.casecmp?(rel)}&.href
+      @links.detect { |link| link['rel']&.casecmp?(rel) }&.href
     end
 
     class << self