bosh-openssl 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +36 -0
  3. data/.rspec +3 -0
  4. data/Gemfile +4 -0
  5. data/Gemfile.lock +114 -0
  6. data/README.md +40 -0
  7. data/Rakefile +5 -0
  8. data/bosh-openssl.gemspec +35 -0
  9. data/bosh_manifest.yml +109 -0
  10. data/bosh_manifest_without_secrets.yml +52 -0
  11. data/lib/bosh/cli/commands/certificate.rb +22 -0
  12. data/lib/bosh/cli/commands/password.rb +15 -0
  13. data/lib/bosh/cli/commands/private_key.rb +17 -0
  14. data/lib/bosh/cli/commands/public_key.rb +17 -0
  15. data/lib/bosh/cli/commands/yaml_extensions.rb +39 -0
  16. data/lib/bosh/openssl.rb +15 -0
  17. data/lib/bosh/openssl/helpers.rb +127 -0
  18. data/lib/bosh/openssl/version.rb +5 -0
  19. metadata +214 -0
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: fb368cec57f2a28a6ed2e9205bad6c8c682c9c08
4
+ data.tar.gz: 939491a09ad00e6c050401568ccd135bb538effa
5
+ SHA512:
6
+ metadata.gz: ce2ad8dfc82e2ee44fe18cd4b6cc8873dd510cc6c14fca09e33141f39fa47604e5b5b1c0f04ea737880a1f147ee4ecc95d6337916c16d9bd5270be5b61fc6879
7
+ data.tar.gz: ac8cb71df383625ccb2318a843e2cb76536e6ccd052424586c691eeb480bc00e2e535fa6ad212b578b25830a48c0d7f2236d666fb6e325414aaab7a452ebc030
data/.gitignore ADDED
@@ -0,0 +1,36 @@
1
+ *.gem
2
+ *.rbc
3
+ /.config
4
+ /coverage/
5
+ /InstalledFiles
6
+ /pkg/
7
+ /spec/reports/
8
+ /test/tmp/
9
+ /test/version_tmp/
10
+ /tmp/
11
+
12
+ ## Specific to RubyMotion:
13
+ .dat*
14
+ .repl_history
15
+ build/
16
+
17
+ ## Documentation cache and generated files:
18
+ /.yardoc/
19
+ /_yardoc/
20
+ /doc/
21
+ /rdoc/
22
+
23
+ ## Environment normalisation:
24
+ /.bundle/
25
+ /lib/bundler/man/
26
+
27
+ # for a library or gem, you might want to ignore these files since the code is
28
+ # intended to run in multiple environments; otherwise, check them in:
29
+ # Gemfile.lock
30
+ # .ruby-version
31
+ # .ruby-gemset
32
+
33
+ # unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
34
+ .rvmrc
35
+ .ruby-gemset
36
+ .ruby-version
data/.rspec ADDED
@@ -0,0 +1,3 @@
1
+ --format progress
2
+ --color
3
+ --require spec_helper
data/Gemfile ADDED
@@ -0,0 +1,4 @@
1
+ source 'https://rubygems.org'
2
+
3
+ # Specify your gem's dependencies in bosh-plugin.gemspec
4
+ gemspec
data/Gemfile.lock ADDED
@@ -0,0 +1,114 @@
1
+ PATH
2
+ remote: .
3
+ specs:
4
+ bosh-openssl (0.0.1)
5
+ bosh_cli (>= 1.2682.0)
6
+ bosh_common (>= 1.2682.0)
7
+ git (~> 1.2.6)
8
+ membrane (~> 1.1.0)
9
+ semi_semantic (~> 1.1.0)
10
+ vault (~> 0.1)
11
+
12
+ GEM
13
+ remote: https://rubygems.org/
14
+ specs:
15
+ ast (2.2.0)
16
+ aws-sdk-core (2.2.0)
17
+ jmespath (~> 1.0)
18
+ aws-sdk-resources (2.2.0)
19
+ aws-sdk-core (= 2.2.0)
20
+ blobstore_client (1.3232.0)
21
+ aws-sdk-resources (= 2.2.0)
22
+ bosh_common (~> 1.3232.0)
23
+ httpclient (= 2.7.1)
24
+ multi_json (~> 1.1)
25
+ bosh-template (1.3232.0)
26
+ semi_semantic (~> 1.1.0)
27
+ bosh_cli (1.3232.0)
28
+ blobstore_client (~> 1.3232.0)
29
+ bosh-template (~> 1.3232.0)
30
+ bosh_common (~> 1.3232.0)
31
+ cf-uaa-lib (~> 3.2.1)
32
+ highline (~> 1.6.2)
33
+ httpclient (= 2.7.1)
34
+ json_pure (~> 1.7)
35
+ minitar (~> 0.5.4)
36
+ net-scp (~> 1.1.0)
37
+ net-ssh (= 2.9.2)
38
+ net-ssh-gateway (~> 1.2.0)
39
+ netaddr (~> 1.5.0)
40
+ progressbar (~> 0.9.0)
41
+ sshkey (~> 1.7.0)
42
+ terminal-table (~> 1.4.3)
43
+ bosh_common (1.3232.0)
44
+ logging (~> 1.8.2)
45
+ semi_semantic (~> 1.1.0)
46
+ cf-uaa-lib (3.2.5)
47
+ multi_json
48
+ diff-lcs (1.2.5)
49
+ git (1.2.9.1)
50
+ highline (1.6.21)
51
+ httpclient (2.7.1)
52
+ jmespath (1.2.4)
53
+ json_pure (>= 1.8.1)
54
+ json_pure (1.8.3)
55
+ little-plugger (1.1.4)
56
+ logging (1.8.2)
57
+ little-plugger (>= 1.1.3)
58
+ multi_json (>= 1.8.4)
59
+ membrane (1.1.0)
60
+ minitar (0.5.4)
61
+ multi_json (1.12.0)
62
+ net-scp (1.1.2)
63
+ net-ssh (>= 2.6.5)
64
+ net-ssh (2.9.2)
65
+ net-ssh-gateway (1.2.0)
66
+ net-ssh (>= 2.6.5)
67
+ netaddr (1.5.1)
68
+ parser (2.3.1.0)
69
+ ast (~> 2.2)
70
+ powerpack (0.1.1)
71
+ progressbar (0.9.2)
72
+ rainbow (2.1.0)
73
+ rake (11.1.2)
74
+ rspec (3.1.0)
75
+ rspec-core (~> 3.1.0)
76
+ rspec-expectations (~> 3.1.0)
77
+ rspec-mocks (~> 3.1.0)
78
+ rspec-core (3.1.7)
79
+ rspec-support (~> 3.1.0)
80
+ rspec-expectations (3.1.2)
81
+ diff-lcs (>= 1.2.0, < 2.0)
82
+ rspec-support (~> 3.1.0)
83
+ rspec-its (1.1.0)
84
+ rspec-core (>= 3.0.0)
85
+ rspec-expectations (>= 3.0.0)
86
+ rspec-mocks (3.1.3)
87
+ rspec-support (~> 3.1.0)
88
+ rspec-support (3.1.2)
89
+ rubocop (0.39.0)
90
+ parser (>= 2.3.0.7, < 3.0)
91
+ powerpack (~> 0.1)
92
+ rainbow (>= 1.99.1, < 3.0)
93
+ ruby-progressbar (~> 1.7)
94
+ unicode-display_width (~> 1.0, >= 1.0.1)
95
+ ruby-progressbar (1.8.0)
96
+ semi_semantic (1.1.0)
97
+ sshkey (1.7.0)
98
+ terminal-table (1.4.5)
99
+ unicode-display_width (1.0.5)
100
+ vault (0.4.0)
101
+
102
+ PLATFORMS
103
+ ruby
104
+
105
+ DEPENDENCIES
106
+ bosh-openssl!
107
+ bundler (~> 1.6)
108
+ rake
109
+ rspec (~> 3.1.0)
110
+ rspec-its (~> 1.1.0)
111
+ rubocop
112
+
113
+ BUNDLED WITH
114
+ 1.12.2
data/README.md ADDED
@@ -0,0 +1,40 @@
1
+ # Bosh OpenSSL plugin
2
+ Bosh CLI plugin to retrieve, or generate and store, RSA keys, self-signed certificates, and random password at deploy time.
3
+
4
+ ## What is BOSH?
5
+ BOSH orchestrates initial deployments and ongoing updates that are: predictable, repeatable, reliable, self-healing, infrastructure-agnostic. You can take a look on [BOSH project on GitHub](https://github.com/cloudfoundry/bosh) and read more details in [docs](http://docs.cloudfoundry.org/bosh/).
6
+
7
+ ## How to install
8
+ ```
9
+ gem install bosh-openssl
10
+ ```
11
+
12
+ ## How to use
13
+
14
+ In your BOSH manifest, use the `get_*` helpers to fetch openssl "secrets" from the `~/.bosh/openssl` folder.
15
+
16
+ The first time `get_*` is called it will generate and store the "secret".
17
+
18
+ If you have a valid `VAULT_ADDR` environment variable defined; secrets will be stored
19
+ in your [Vault](https://www.vaultproject.io/) rather than on your file system
20
+
21
+ ```yaml
22
+ properties:
23
+ my_secret: <%= get_password 'my_password' %>
24
+ private_key: <%= get_private_key 'my_key' %>
25
+ public_key: <%= get_public_key 'my_key' %>
26
+ cert: <%= get_certificate 'my_cert', 'my_key', '*.example.com' %>
27
+ cert_with_key: <%= get_certificate_and_key 'my_cert', 'my_key', '*.example.com' %>
28
+ ```
29
+
30
+ ## Contributing
31
+
32
+ 1. Fork it
33
+ 2. Create your feature branch (`git checkout -b my-new-feature`)
34
+ 3. Commit your changes (`git commit -am 'Add some feature'`)
35
+ 4. Push to the branch (`git push origin my-new-feature`)
36
+ 5. Create new Pull Request
37
+
38
+ ## Notes
39
+
40
+ Generated by [BOSH plugin generator](https://github.com/Altoros/bosh-plugin-generator)
data/Rakefile ADDED
@@ -0,0 +1,5 @@
1
+ require "bundler/gem_tasks"
2
+ require "rspec/core/rake_task"
3
+
4
+ task :default => :spec
5
+ RSpec::Core::RakeTask.new
data/bosh-openssl.gemspec ADDED
@@ -0,0 +1,35 @@
1
+ # coding: utf-8
2
+
3
+ lib = File.expand_path('../lib', __FILE__)
4
+ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
5
+ require 'bosh/openssl/version'
6
+
7
+ Gem::Specification.new do |spec|
8
+ spec.name = "bosh-openssl"
9
+ spec.version = Bosh::Openssl::VERSION
10
+ spec.authors = ["Stev Witzel"]
11
+ spec.email = ["switzel@pivotal.io"]
12
+ spec.description = %q{Short description.}
13
+ spec.summary = %q{Short description.}
14
+ spec.homepage = "https://github.com/cloudfoundry/bosh"
15
+
16
+ spec.files = `git ls-files`.split($/)
17
+ spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
18
+ spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
19
+ spec.require_paths = ["lib"]
20
+
21
+ spec.required_ruby_version = '>= 2.0.0'
22
+
23
+ spec.add_runtime_dependency "bosh_cli", ">= 1.2682.0"
24
+ spec.add_runtime_dependency "bosh_common", ">= 1.2682.0"
25
+ spec.add_runtime_dependency "semi_semantic", "~> 1.1.0"
26
+ spec.add_runtime_dependency "membrane", "~> 1.1.0"
27
+ spec.add_runtime_dependency "git", "~> 1.2.6"
28
+ spec.add_runtime_dependency "vault", "~> 0.1"
29
+
30
+ spec.add_development_dependency "bundler", "~> 1.6"
31
+ spec.add_development_dependency "rspec", "~> 3.1.0"
32
+ spec.add_development_dependency "rspec-its", '~> 1.1.0'
33
+ spec.add_development_dependency "rake"
34
+ spec.add_development_dependency "rubocop"
35
+ end
data/bosh_manifest.yml ADDED
@@ -0,0 +1,109 @@
1
+ ---
2
+ name: learn-bosh
3
+ director_uuid: 510ac165-ee99-4c45-8274-1b989e5d5697
4
+
5
+ releases:
6
+ - name: learn-bosh
7
+ version: latest
8
+
9
+ networks:
10
+ - name: default
11
+ subnets:
12
+ - range: 10.244.0.0/28
13
+ reserved: [10.244.0.1]
14
+ static: [10.244.0.2,10.244.0.6,10.244.0.10]
15
+ cloud_properties:
16
+ name: random
17
+
18
+ resource_pools:
19
+ - name: default
20
+ stemcell:
21
+ name: bosh-warden-boshlite-ubuntu-trusty-go_agent
22
+ version: latest
23
+ network: default
24
+ cloud_properties: {}
25
+
26
+ compilation:
27
+ workers: 2
28
+ network: default
29
+ cloud_properties: {}
30
+
31
+ update:
32
+ canaries: 1
33
+ canary_watch_time: 60000
34
+ update_watch_time: 60000
35
+ max_in_flight: 2
36
+
37
+ jobs:
38
+ - name: app
39
+ templates:
40
+ - name: app
41
+ instances: 1
42
+ resource_pool: default
43
+ networks:
44
+ - name: default
45
+ static_ips:
46
+ - 10.244.0.2
47
+ properties:
48
+ properties:
49
+ admin_password: TXCn0Vv3QWQFn1Ik+8IIfw==
50
+ private_key: |
51
+ -----BEGIN RSA PRIVATE KEY-----
52
+ MIIEpAIBAAKCAQEA05YhPcD7+FWysWeKFXSHnqmWnL+hKUbhkWFoIm6xpfFb1AvZ
53
+ /rNGcVKhsKZqabHCEuMoK75WFGQ/qf5cTYTD6Sw2UT88tfh6L6ArS+N5EGo6olZc
54
+ yx0rO4Lx6doEGWo69dZCrCNl320zEi0wtztMtrhAy/2PftZSlmGmIB2I9KXGsvH/
55
+ wDtOD4PtvpS9l+Tncb+taRCsfaKLqKafN0FFP/SSJb1Gz5D6pqNuofHfYgv6sgXc
56
+ 1wgt0xHAPdicSq6MRft23HDK7cIbs7H/s01q/eIDadM0emS6kw8k/3VqoXJlphrp
57
+ wSjS/J95G+DiBcTbIvqSE5HQQ0jToa6Dz0h8vwIDAQABAoIBAQDMdTl/9BlH+n/n
58
+ YDcVznoy/ouUwrRYL69PDcJT64Vs5lMnD6DCt7gtT30BN36CzgvMtocd5hpGMC04
59
+ 9pt5KP8rNdbzIdlnuklP9kWAWrqk+xHXxv56I6CgLEPaBxuI95cr8bSRpM8PXPVJ
60
+ 7jMyDHJv6pJqzIW6Oh6qRIgEZqXuSPUoRTpnNKTUhmXHvoF3v/5hNEHtDhlz4D/X
61
+ CYpoByHT442m+JkJcl9w9F6SXpmjda5vgBxnRrF2/PPR0bW/kZwFpVRij4fHiSO4
62
+ XWlRGqv3YSc678YTuDWbIdB90CsHhbZL7jDPUaSptIWgwd8i+qe+G1c2eLM3PL3F
63
+ 7Xc59BSpAoGBAPE2MPFlhlxbAFrU0h1lhrTOUviS0DYB6QSEWjvcXCTuFIdaUP+N
64
+ xKv5aC0+X3klrF0yU9kH68twHWDywW/36UiA7jAlB8sXEBqiaHnThIOT7wGFbplG
65
+ Nqinqp/FDeoe1b1pS9YMasiZ42IJyzy902J2aFv3CHNb++2EM6cdX7VVAoGBAOCO
66
+ +Lmbqu5YYQrpIOSsdUmQ40LGm5Fm0I75imNr5i6QqfgVmHpLw9KkmQMmQqe/Fi+P
67
+ u7uv9LJ/79AuioQjjuJcA2BWZsM2/DWKJlwLqSzOIIe9Nc2zAzgs23okMmPIQVD1
68
+ vOEUyqL/DpLVylg1pv3a+jNKZ+Sr1DvW2K9l++nDAoGAfniFbOxoaGAmbXmMuXEU
69
+ EhTkGAUSOl8CCCZFEYHWpl5WUSmfsn5okirw3lgHwwNnvm223OJ0VXRxUvW1SrnX
70
+ jPZc7M1dqrRq8ywYT1gB8ONNu6R0etT/r6pJof+17f1A4FEnPBHCo29cc3jjIPP+
71
+ s2+WBDIgMiwWiVB5rLOQDQkCgYEAmGlRdaCrPkQr8VzTn4FRxdGZ/duRAPoYecHy
72
+ 5JH6VAaJ5kC6Ed9UlKZ02Adi3Dm81CEpGTVOzsw4t0Kvbwo3U3mCLSPXcY3jVm9i
73
+ o7yiYS+yMo8AcpGakMkZWegxbzoe4tU3EkmrUz/r40tJn98ibU/v21oX88OQM+EZ
74
+ hsqgVUMCgYAH9LKtpfBfK8Zl3itBr1dpCVt1h2WqL9c4VTwdoAa3hmlTOLm1d+b0
75
+ aZHnWt5QwHJpu8diFNnPNx/BINAv6A7AvAcjWOjQeI93VkvHPx6LsPrf11oau8ui
76
+ 8bzZ+lr23d8tY+PNM7vXJx2fGT32hoqOw0blXsHikUMz7DWHhsh1nQ==
77
+ -----END RSA PRIVATE KEY-----
78
+ public_key: |
79
+ -----BEGIN PUBLIC KEY-----
80
+ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA05YhPcD7+FWysWeKFXSH
81
+ nqmWnL+hKUbhkWFoIm6xpfFb1AvZ/rNGcVKhsKZqabHCEuMoK75WFGQ/qf5cTYTD
82
+ 6Sw2UT88tfh6L6ArS+N5EGo6olZcyx0rO4Lx6doEGWo69dZCrCNl320zEi0wtztM
83
+ trhAy/2PftZSlmGmIB2I9KXGsvH/wDtOD4PtvpS9l+Tncb+taRCsfaKLqKafN0FF
84
+ P/SSJb1Gz5D6pqNuofHfYgv6sgXc1wgt0xHAPdicSq6MRft23HDK7cIbs7H/s01q
85
+ /eIDadM0emS6kw8k/3VqoXJlphrpwSjS/J95G+DiBcTbIvqSE5HQQ0jToa6Dz0h8
86
+ vwIDAQAB
87
+ -----END PUBLIC KEY-----
88
+ cert: |
89
+ -----BEGIN CERTIFICATE-----
90
+ MIIDhzCCAm+gAwIBAgIBADANBgkqhkiG9w0BAQUFADA6MQswCQYDVQQGEwJCRTEN
91
+ MAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwEVGVzdDAeFw0x
92
+ NjA1MDYxNTUyNDNaFw0yNjA1MDQxNTUyNDNaMDoxCzAJBgNVBAYTAkJFMQ0wCwYD
93
+ VQQKDARUZXN0MQ0wCwYDVQQLDARUZXN0MQ0wCwYDVQQDDARUZXN0MIIBIjANBgkq
94
+ hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA05YhPcD7+FWysWeKFXSHnqmWnL+hKUbh
95
+ kWFoIm6xpfFb1AvZ/rNGcVKhsKZqabHCEuMoK75WFGQ/qf5cTYTD6Sw2UT88tfh6
96
+ L6ArS+N5EGo6olZcyx0rO4Lx6doEGWo69dZCrCNl320zEi0wtztMtrhAy/2PftZS
97
+ lmGmIB2I9KXGsvH/wDtOD4PtvpS9l+Tncb+taRCsfaKLqKafN0FFP/SSJb1Gz5D6
98
+ pqNuofHfYgv6sgXc1wgt0xHAPdicSq6MRft23HDK7cIbs7H/s01q/eIDadM0emS6
99
+ kw8k/3VqoXJlphrpwSjS/J95G+DiBcTbIvqSE5HQQ0jToa6Dz0h8vwIDAQABo4GX
100
+ MIGUMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNo5o+5ea0sNMlW/75VgGJCv
101
+ 2AcJMGIGA1UdIwRbMFmAFNo5o+5ea0sNMlW/75VgGJCv2AcJoT6kPDA6MQswCQYD
102
+ VQQGEwJCRTENMAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwE
103
+ VGVzdIIBADANBgkqhkiG9w0BAQUFAAOCAQEAWrxwj2tA4veMfY23h81KmCHNMiWX
104
+ KLVd+UHGmGx7Io1VHdtB94wc7veakLisHT9GRa+UydCO9z7FzpAhb9N32jg7gZJI
105
+ ZRSrJkAUiEqo9G83V9e1Gld8bSGUxoAq3QENmYhw+ZRY8Fx0OLwEDFSTCe4u1D63
106
+ RZQq8n8lbPfchPoK0NXiJPt4JXsqjj1C4wYMQ0CODhkIdAUULHy4k+Xk+/pLP6gP
107
+ 17zRouSlfXDPW8KbvsLWZJ26tGfv95mXC4HhHd2lVfudP+S2ExdU/el/raz5YnNY
108
+ Fj67XJdeSH805xQYv2fLwiXJPfO6aat+3AcKy6QnQYo1Sl+6LbcwRFsPHw==
109
+ -----END CERTIFICATE-----
data/bosh_manifest_without_secrets.yml ADDED
@@ -0,0 +1,52 @@
1
+ ---
2
+ name: learn-bosh
3
+ director_uuid: 510ac165-ee99-4c45-8274-1b989e5d5697
4
+
5
+ releases:
6
+ - name: learn-bosh
7
+ version: latest
8
+
9
+ networks:
10
+ - name: default
11
+ subnets:
12
+ - range: 10.244.0.0/28
13
+ reserved: [10.244.0.1]
14
+ static: [10.244.0.2,10.244.0.6,10.244.0.10]
15
+ cloud_properties:
16
+ name: random
17
+
18
+ resource_pools:
19
+ - name: default
20
+ stemcell:
21
+ name: bosh-warden-boshlite-ubuntu-trusty-go_agent
22
+ version: latest
23
+ network: default
24
+ cloud_properties: {}
25
+
26
+ compilation:
27
+ workers: 2
28
+ network: default
29
+ cloud_properties: {}
30
+
31
+ update:
32
+ canaries: 1
33
+ canary_watch_time: 60000
34
+ update_watch_time: 60000
35
+ max_in_flight: 2
36
+
37
+ jobs:
38
+ - name: app
39
+ templates:
40
+ - name: app
41
+ instances: 1
42
+ resource_pool: default
43
+ networks:
44
+ - name: default
45
+ static_ips:
46
+ - 10.244.0.2
47
+ properties:
48
+ admin_password: <%= get_password 'my_admin_password' %>
49
+ private_key: <%= get_private_key 'my_key' %>
50
+ public_key: <%= get_public_key 'my_key' %>
51
+ cert: <%= get_certificate 'my_cert', 'my_key', '*.example.com' %>
52
+ cert_for_haproxy: <%= get_certificate_and_key 'my_cert', 'my_key', '*.example.com' %>
data/lib/bosh/cli/commands/certificate.rb ADDED
@@ -0,0 +1,22 @@
1
+ require "bosh/openssl"
2
+
3
+ module Bosh::Cli::Command
4
+ class Certificate < Base
5
+ include Bosh::Openssl::Helpers
6
+
7
+ usage "certificate"
8
+ desc "Returns a named self-signed certificate. Generates and signes a new cert if it doesn't already exist."
9
+ option "--include-key", "include private key in output"
10
+ option "--no-escape", "don't escape newlines in output"
11
+ option "--cn <common-name>", String, "common name for certificate"
12
+
13
+ def perform(cert_name, key_name)
14
+ out = certificate(cert_name, key_name, options[:common_name]).to_s
15
+ out += private_key(key_name).to_s if options[:include_key]
16
+ out = out.dump unless options[:no_escape] == false
17
+ puts out
18
+ end
19
+ end
20
+ end
21
+
22
+
data/lib/bosh/cli/commands/password.rb ADDED
@@ -0,0 +1,15 @@
1
+ require "bosh/openssl"
2
+
3
+ module Bosh::Cli::Command
4
+ class Password < Base
5
+ include Bosh::Openssl::Helpers
6
+
7
+ usage "password <name>"
8
+ desc "Generates random password."
9
+
10
+ def perform(name)
11
+ puts password name
12
+ end
13
+ end
14
+ end
15
+
data/lib/bosh/cli/commands/private_key.rb ADDED
@@ -0,0 +1,17 @@
1
+ require "bosh/openssl"
2
+
3
+ module Bosh::Cli::Command
4
+ class PrivateKey < Base
5
+ include Bosh::Openssl::Helpers
6
+
7
+ usage "private key"
8
+ desc "Returns named private key. Generates new key if it doesn't already exist."
9
+ option "--no-escape", "don't escape newlines in output"
10
+
11
+ def perform(name)
12
+ out = private_key(name).to_s
13
+ out = out.dump unless options[:no_escape] == false
14
+ puts out
15
+ end
16
+ end
17
+ end
data/lib/bosh/cli/commands/public_key.rb ADDED
@@ -0,0 +1,17 @@
1
+ require "bosh/openssl"
2
+
3
+ module Bosh::Cli::Command
4
+ class PublicKey < Base
5
+ include Bosh::Openssl::Helpers
6
+
7
+ usage "public key"
8
+ desc "Returns named public key. Generates new key if it doesn't already exist."
9
+ option "--no-escape", "don't escape newlines in output"
10
+
11
+ def perform(name)
12
+ out = public_key(name).to_s
13
+ out = out.dump unless options[:no_escape] == false
14
+ puts out
15
+ end
16
+ end
17
+ end
data/lib/bosh/cli/commands/yaml_extensions.rb ADDED
@@ -0,0 +1,39 @@
1
+ require "bosh/openssl"
2
+
3
+ module Bosh::Cli::Command
4
+ class YamlExtensions < Base
5
+
6
+ ::BoshExtensions.module_eval do
7
+
8
+ def get_password name
9
+ include ::Bosh::Openssl::Helpers
10
+ password name
11
+ end
12
+
13
+ def get_certificate cert_name, key_name, common_name
14
+ include ::Bosh::Openssl::Helpers
15
+ out = certificate(cert_name, key_name, common_name).to_s
16
+ out.dump
17
+ end
18
+
19
+ def get_certificate_and_key cert_name, key_name, common_name
20
+ include ::Bosh::Openssl::Helpers
21
+ out = certificate(cert_name, key_name, common_name).to_s
22
+ out += private_key(key_name).to_s
23
+ out.dump
24
+ end
25
+
26
+ def get_public_key name
27
+ include ::Bosh::Openssl::Helpers
28
+ out = public_key(name).to_s
29
+ out.dump
30
+ end
31
+
32
+ def get_private_key name
33
+ include ::Bosh::Openssl::Helpers
34
+ out = private_key(name).to_s
35
+ out.dump.to_s
36
+ end
37
+ end
38
+ end
39
+ end
data/lib/bosh/openssl.rb ADDED
@@ -0,0 +1,15 @@
1
+ require "cli/core_ext"
2
+ require "cli/validation"
3
+
4
+ module Bosh
5
+ module Openssl
6
+ include BoshExtensions
7
+ end
8
+ end
9
+
10
+ require "bosh/openssl/helpers"
11
+ require "bosh/openssl/version"
12
+ require "bosh/cli/commands/private_key"
13
+ require "bosh/cli/commands/public_key"
14
+ require "bosh/cli/commands/password"
15
+ require "bosh/cli/commands/certificate"
data/lib/bosh/openssl/helpers.rb ADDED
@@ -0,0 +1,127 @@
1
+ require 'openssl'
2
+ require 'vault'
3
+
4
+ module Bosh
5
+ module Openssl
6
+ module Helpers
7
+
8
+ def public_key(name)
9
+ private_key(name).public_key
10
+ end
11
+
12
+ def private_key(name)
13
+ name += ".key"
14
+ return read_key(name) if exists?(name)
15
+
16
+ key = OpenSSL::PKey::RSA.new(2048)
17
+ write(name, key)
18
+ key
19
+ end
20
+
21
+ def password(name)
22
+ name += ".passwd"
23
+ return read(name) if exists?(name)
24
+
25
+ password = Base64.encode64(OpenSSL::Random.random_bytes(16))
26
+ write(name, password)
27
+ password
28
+ end
29
+
30
+ def certificate(cert_name, key_name, common_name)
31
+ cert_name += ".crt"
32
+ return read_cert(cert_name) if exists?(cert_name)
33
+
34
+ cert = sign_certificate(generate_certificate(common_name), key_name).to_pem
35
+ write(cert_name, cert)
36
+ cert
37
+ end
38
+
39
+ private
40
+
41
+ SSL_DIR=File.join(File.expand_path('~'), '.bosh', 'openssl')
42
+
43
+ def generate_certificate(common_name)
44
+ subject = '/C=AU/O=Test/OU=Test'
45
+ subject += "/CN=#{common_name}" if common_name
46
+
47
+ cert = OpenSSL::X509::Certificate.new
48
+ cert.subject = cert.issuer = OpenSSL::X509::Name.parse(subject)
49
+ cert.not_before = Time.now
50
+ cert.not_after = Time.now + 10 * 365 * 24 * 60 * 60
51
+ cert.serial = 0x0
52
+ cert.version = 2
53
+
54
+ ef = OpenSSL::X509::ExtensionFactory.new
55
+ ef.subject_certificate = cert
56
+ ef.issuer_certificate = cert
57
+ cert.extensions = [
58
+ ef.create_extension("basicConstraints","CA:TRUE", true),
59
+ ef.create_extension("subjectKeyIdentifier", "hash"),
60
+ ]
61
+ cert.add_extension ef.create_extension("authorityKeyIdentifier",
62
+ "keyid:always,issuer:always")
63
+
64
+ cert
65
+ end
66
+
67
+ def sign_certificate(cert, key_name)
68
+ cert.public_key = public_key(key_name)
69
+ cert.sign private_key(key_name), OpenSSL::Digest::SHA1.new
70
+ cert
71
+ end
72
+
73
+ def read_key(name)
74
+ OpenSSL::PKey::RSA.new read(name)
75
+ end
76
+
77
+ def read_cert(name)
78
+ OpenSSL::X509::Certificate.new read(name)
79
+ end
80
+
81
+ def read(name)
82
+ return read_from_vault(name) if vault_backend_available?
83
+ read_file(name)
84
+ end
85
+
86
+ def write(name, payload)
87
+ return write_to_vault(name, payload) if vault_backend_available?
88
+ write_file(name, payload)
89
+ end
90
+
91
+ def exists?(name)
92
+ return read_from_vault(name)!='' if vault_backend_available?
93
+ File.exists?(path(name))
94
+ end
95
+
96
+ def vault_backend_available?
97
+ ENV['VAULT_ADDR'] || false
98
+ end
99
+
100
+ def read_from_vault(name)
101
+ secrets = Vault.logical.read("secret/#{name}")
102
+ return '' if secrets.nil?
103
+ secrets.data[:value]
104
+ end
105
+
106
+ def write_to_vault(name, payload)
107
+ data = {}
108
+ data[:value] = payload
109
+ Vault.logical.write("secret/#{name}", data)
110
+ end
111
+
112
+ def read_file(name)
113
+ File.read(path(name))
114
+ end
115
+
116
+ def write_file(name, payload)
117
+ FileUtils::mkdir_p SSL_DIR
118
+ File.open(path(name), 'w') { |file| file.write(payload) }
119
+ end
120
+
121
+ def path(name)
122
+ File.join(SSL_DIR, name)
123
+ end
124
+
125
+ end
126
+ end
127
+ end
data/lib/bosh/openssl/version.rb ADDED
@@ -0,0 +1,5 @@
1
+ module Bosh
2
+ module Openssl
3
+ VERSION = "0.0.1"
4
+ end
5
+ end
metadata ADDED
@@ -0,0 +1,214 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: bosh-openssl
3
+ version: !ruby/object:Gem::Version
4
+ version: 0.0.1
5
+ platform: ruby
6
+ authors:
7
+ - Stev Witzel
8
+ autorequire:
9
+ bindir: bin
10
+ cert_chain: []
11
+ date: 2016-05-06 00:00:00.000000000 Z
12
+ dependencies:
13
+ - !ruby/object:Gem::Dependency
14
+ name: bosh_cli
15
+ requirement: !ruby/object:Gem::Requirement
16
+ requirements:
17
+ - - ">="
18
+ - !ruby/object:Gem::Version
19
+ version: 1.2682.0
20
+ type: :runtime
21
+ prerelease: false
22
+ version_requirements: !ruby/object:Gem::Requirement
23
+ requirements:
24
+ - - ">="
25
+ - !ruby/object:Gem::Version
26
+ version: 1.2682.0
27
+ - !ruby/object:Gem::Dependency
28
+ name: bosh_common
29
+ requirement: !ruby/object:Gem::Requirement
30
+ requirements:
31
+ - - ">="
32
+ - !ruby/object:Gem::Version
33
+ version: 1.2682.0
34
+ type: :runtime
35
+ prerelease: false
36
+ version_requirements: !ruby/object:Gem::Requirement
37
+ requirements:
38
+ - - ">="
39
+ - !ruby/object:Gem::Version
40
+ version: 1.2682.0
41
+ - !ruby/object:Gem::Dependency
42
+ name: semi_semantic
43
+ requirement: !ruby/object:Gem::Requirement
44
+ requirements:
45
+ - - "~>"
46
+ - !ruby/object:Gem::Version
47
+ version: 1.1.0
48
+ type: :runtime
49
+ prerelease: false
50
+ version_requirements: !ruby/object:Gem::Requirement
51
+ requirements:
52
+ - - "~>"
53
+ - !ruby/object:Gem::Version
54
+ version: 1.1.0
55
+ - !ruby/object:Gem::Dependency
56
+ name: membrane
57
+ requirement: !ruby/object:Gem::Requirement
58
+ requirements:
59
+ - - "~>"
60
+ - !ruby/object:Gem::Version
61
+ version: 1.1.0
62
+ type: :runtime
63
+ prerelease: false
64
+ version_requirements: !ruby/object:Gem::Requirement
65
+ requirements:
66
+ - - "~>"
67
+ - !ruby/object:Gem::Version
68
+ version: 1.1.0
69
+ - !ruby/object:Gem::Dependency
70
+ name: git
71
+ requirement: !ruby/object:Gem::Requirement
72
+ requirements:
73
+ - - "~>"
74
+ - !ruby/object:Gem::Version
75
+ version: 1.2.6
76
+ type: :runtime
77
+ prerelease: false
78
+ version_requirements: !ruby/object:Gem::Requirement
79
+ requirements:
80
+ - - "~>"
81
+ - !ruby/object:Gem::Version
82
+ version: 1.2.6
83
+ - !ruby/object:Gem::Dependency
84
+ name: vault
85
+ requirement: !ruby/object:Gem::Requirement
86
+ requirements:
87
+ - - "~>"
88
+ - !ruby/object:Gem::Version
89
+ version: '0.1'
90
+ type: :runtime
91
+ prerelease: false
92
+ version_requirements: !ruby/object:Gem::Requirement
93
+ requirements:
94
+ - - "~>"
95
+ - !ruby/object:Gem::Version
96
+ version: '0.1'
97
+ - !ruby/object:Gem::Dependency
98
+ name: bundler
99
+ requirement: !ruby/object:Gem::Requirement
100
+ requirements:
101
+ - - "~>"
102
+ - !ruby/object:Gem::Version
103
+ version: '1.6'
104
+ type: :development
105
+ prerelease: false
106
+ version_requirements: !ruby/object:Gem::Requirement
107
+ requirements:
108
+ - - "~>"
109
+ - !ruby/object:Gem::Version
110
+ version: '1.6'
111
+ - !ruby/object:Gem::Dependency
112
+ name: rspec
113
+ requirement: !ruby/object:Gem::Requirement
114
+ requirements:
115
+ - - "~>"
116
+ - !ruby/object:Gem::Version
117
+ version: 3.1.0
118
+ type: :development
119
+ prerelease: false
120
+ version_requirements: !ruby/object:Gem::Requirement
121
+ requirements:
122
+ - - "~>"
123
+ - !ruby/object:Gem::Version
124
+ version: 3.1.0
125
+ - !ruby/object:Gem::Dependency
126
+ name: rspec-its
127
+ requirement: !ruby/object:Gem::Requirement
128
+ requirements:
129
+ - - "~>"
130
+ - !ruby/object:Gem::Version
131
+ version: 1.1.0
132
+ type: :development
133
+ prerelease: false
134
+ version_requirements: !ruby/object:Gem::Requirement
135
+ requirements:
136
+ - - "~>"
137
+ - !ruby/object:Gem::Version
138
+ version: 1.1.0
139
+ - !ruby/object:Gem::Dependency
140
+ name: rake
141
+ requirement: !ruby/object:Gem::Requirement
142
+ requirements:
143
+ - - ">="
144
+ - !ruby/object:Gem::Version
145
+ version: '0'
146
+ type: :development
147
+ prerelease: false
148
+ version_requirements: !ruby/object:Gem::Requirement
149
+ requirements:
150
+ - - ">="
151
+ - !ruby/object:Gem::Version
152
+ version: '0'
153
+ - !ruby/object:Gem::Dependency
154
+ name: rubocop
155
+ requirement: !ruby/object:Gem::Requirement
156
+ requirements:
157
+ - - ">="
158
+ - !ruby/object:Gem::Version
159
+ version: '0'
160
+ type: :development
161
+ prerelease: false
162
+ version_requirements: !ruby/object:Gem::Requirement
163
+ requirements:
164
+ - - ">="
165
+ - !ruby/object:Gem::Version
166
+ version: '0'
167
+ description: Short description.
168
+ email:
169
+ - switzel@pivotal.io
170
+ executables: []
171
+ extensions: []
172
+ extra_rdoc_files: []
173
+ files:
174
+ - ".gitignore"
175
+ - ".rspec"
176
+ - Gemfile
177
+ - Gemfile.lock
178
+ - README.md
179
+ - Rakefile
180
+ - bosh-openssl.gemspec
181
+ - bosh_manifest.yml
182
+ - bosh_manifest_without_secrets.yml
183
+ - lib/bosh/cli/commands/certificate.rb
184
+ - lib/bosh/cli/commands/password.rb
185
+ - lib/bosh/cli/commands/private_key.rb
186
+ - lib/bosh/cli/commands/public_key.rb
187
+ - lib/bosh/cli/commands/yaml_extensions.rb
188
+ - lib/bosh/openssl.rb
189
+ - lib/bosh/openssl/helpers.rb
190
+ - lib/bosh/openssl/version.rb
191
+ homepage: https://github.com/cloudfoundry/bosh
192
+ licenses: []
193
+ metadata: {}
194
+ post_install_message:
195
+ rdoc_options: []
196
+ require_paths:
197
+ - lib
198
+ required_ruby_version: !ruby/object:Gem::Requirement
199
+ requirements:
200
+ - - ">="
201
+ - !ruby/object:Gem::Version
202
+ version: 2.0.0
203
+ required_rubygems_version: !ruby/object:Gem::Requirement
204
+ requirements:
205
+ - - ">="
206
+ - !ruby/object:Gem::Version
207
+ version: '0'
208
+ requirements: []
209
+ rubyforge_project:
210
+ rubygems_version: 2.4.5
211
+ signing_key:
212
+ specification_version: 4
213
+ summary: Short description.
214
+ test_files: []