chef-vault 4.1.5 → 4.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3dbf90bc269d6b9c3f76c53410d110c12f39fb82d7639c7f330fc44fe908b010
-  data.tar.gz: 01bbe6b31cf4afd76eaaac84abe62ec19d09ce56f8f77e85085c2a8fee0a34da
+  metadata.gz: 44f75213a45df776972cad854aedf5abb94d7a54fde7a9986caed78930f8790e
+  data.tar.gz: aaa272cb7893c232b456ef5148bfc0ff91bc5b53a8ae4e9b573f68edaff78df8
 SHA512:
-  metadata.gz: b10fd270fdbc62c7389eb81bc28426490df2ba0dee4cec0e40f6ff316e4a5368949dd315ccde9ed80b325f596f8eea59d7e8d506ee56fdf3c4a84b5e31ea1961
-  data.tar.gz: '08aa808060b961b10594f92c48f3bdb7098fe3f9d2a9bc9fc1a35b1053aa4dd6b289c68d53a23eb874099203db873969497dda4c0678c42440261b6b1af57725'
+  metadata.gz: ad149c125f2aa41b9e3fd8d07281c65ecec8317bbc5a6daf2b7deb9e6def089820e57ee59ca68b53852f6fffe54cbf8d711e1c40b6ac04629597bc3ef07107c2
+  data.tar.gz: 8e0f928a9b4e8dfb6a2800d0d5c65af323cc2f4678b91b2a535b4c450cd71d96ea320b9861638329821ffe5041e025a81e1cf5dbb1cab5bc90bfcd703876afc1

data/Gemfile

@@ -4,13 +4,22 @@ gemspec
 
 group :development do
   gem "chefstyle"
-  gem "chef-zero"
   gem "rake"
-  gem "rspec", "~> 3.4"
-  gem "aruba", "~> 0.6"
-  gem "chef", "~> 14.0" # avoids test failures on license acceptance
   gem "contracts", "~> 0.16.1" # pin until we drop ruby < 2.7
-  gem "chef-utils", "= 16.6.14" # pin until we drop ruby 2.5
+  if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("3.0.0")
+    gem "chef-zero"
+    gem "rspec", "~> 3.4"
+    gem "aruba", "~> 0.6"
+    gem "chef", "~> 14.0"
+    gem "chef-utils", "17.10.0" # pin until we drop ruby 2.5
+  else
+    gem "chef-zero", ">= 15.0.4"
+    gem "chef", "~> 17.0"
+    gem "rspec", "~> 3.10.0"
+    gem "aruba", "~> 1.1"
+    gem "knife", "~> 17.0"
+    gem "chef-utils", "17.10.0" # pin until we drop ruby >=3
+  end
 end
 
 group :docs do
@@ -22,6 +31,8 @@ end
 group :debug do
   gem "pry"
   gem "pry-byebug"
-  gem "pry-stack_explorer", "~> 0.4.0" # pin until we drop ruby < 2.6
+  gem "pry-stack_explorer", "~> 0.6.1" # pin until we drop ruby < 2.6
   gem "rb-readline"
 end
+
+gem "simplecov", require: false

data/chef-vault.gemspec

@@ -31,5 +31,5 @@ Gem::Specification.new do |s|
   s.bindir           = "bin"
   s.executables      = %w{ chef-vault }
 
-  s.required_ruby_version = ">= 2.4"
+  s.required_ruby_version = ">= 2.6"
 end

data/lib/chef/knife/vault_create.rb

@@ -14,15 +14,11 @@
 # limitations under the License.
 
 require_relative "vault_base"
-require_relative "vault_admins"
-require_relative "vault_clients"
 
 class Chef
   class Knife
     class VaultCreate < Knife
       include Chef::Knife::VaultBase
-      include Chef::Knife::VaultAdmins
-      include Chef::Knife::VaultClients
 
       banner "knife vault create VAULT ITEM VALUES (options)"
 
@@ -55,6 +51,13 @@ class Chef
         long: "--file FILE",
         description: "File to be added to vault item as file-content"
 
+      deps do
+        require_relative "vault_admins"
+        require_relative "vault_clients"
+        include Chef::Knife::VaultAdmins
+        include Chef::Knife::VaultClients
+      end
+
       def run
         vault = @name_args[0]
         item = @name_args[1]

data/lib/chef/knife/vault_remove.rb

@@ -14,13 +14,11 @@
 # limitations under the License.
 
 require_relative "vault_base"
-require_relative "vault_clients"
 
 class Chef
   class Knife
     class VaultRemove < Knife
       include Chef::Knife::VaultBase
-      include Chef::Knife::VaultClients
 
       banner "knife vault remove VAULT ITEM VALUES (options)"
 
@@ -43,6 +41,11 @@ class Chef
         long: "--clean-unknown-clients",
         description: "Remove unknown clients during key rotation"
 
+      deps do
+        require_relative "vault_clients"
+        include Chef::Knife::VaultClients
+      end
+
       def run
         vault = @name_args[0]
         item = @name_args[1]

data/lib/chef/knife/vault_update.rb

@@ -14,15 +14,11 @@
 # limitations under the License.
 
 require_relative "vault_base"
-require_relative "vault_admins"
-require_relative "vault_clients"
 
 class Chef
   class Knife
     class VaultUpdate < Knife
       include Chef::Knife::VaultBase
-      include Chef::Knife::VaultAdmins
-      include Chef::Knife::VaultClients
 
       banner "knife vault update VAULT ITEM VALUES (options)"
 
@@ -59,6 +55,13 @@ class Chef
         long: "--keys-mode KEYS_MODE",
         description: "Mode in which to save vault keys"
 
+      deps do
+        require_relative "vault_admins"
+        require_relative "vault_clients"
+        include Chef::Knife::VaultAdmins
+        include Chef::Knife::VaultClients
+      end
+
       def run
         vault = @name_args[0]
         item = @name_args[1]

data/lib/chef-vault/actor.rb

@@ -39,7 +39,7 @@ class ChefVault
     def get_admin_key
       # chef vault currently only supports using the default key
       get_key("users")
-    rescue Net::HTTPServerException => http_error
+    rescue Net::HTTPClientException => http_error
       # if we failed to find an admin key, attempt to load a client key by the same name
       case http_error.response.code
       when "403"
@@ -49,7 +49,7 @@ class ChefVault
         begin
           ChefVault::Log.warn "The default key for #{name} not found in users, trying client keys."
           get_key("clients")
-        rescue Net::HTTPServerException => http_error
+        rescue Net::HTTPClientException => http_error
           case http_error.response.code
           when "404"
             raise ChefVault::Exceptions::AdminNotFound,
@@ -68,7 +68,7 @@ class ChefVault
 
     def get_client_key
       get_key("clients")
-    rescue Net::HTTPServerException => http_error
+    rescue Net::HTTPClientException => http_error
       if http_error.response.code.eql?("403")
         print_forbidden_error
         raise http_error
@@ -114,7 +114,7 @@ class ChefVault
     def get_key(request_actor_type)
       api.org_scoped_rest_v1.get("#{request_actor_type}/#{name}/keys/default").fetch("public_key")
     # If the keys endpoint doesn't exist, try getting it directly from the V0 chef object.
-    rescue Net::HTTPServerException => http_error
+    rescue Net::HTTPClientException => http_error
       raise http_error unless http_error.response.code.eql?("404")
 
       if request_actor_type.eql?("clients")

data/lib/chef-vault/item.rb

@@ -40,6 +40,11 @@ class ChefVault
     #     decrypt secrets.  Defaults to the value of Chef::Config[:client_key]
     attr_accessor :client_key_path
 
+    # @!attribute [rw] client_key_contents
+    #   @return [String] the contents of the private key that is used to
+    #     decrypt secrets.  Defaults to the value of Chef::Config[:client_key_contents]
+    attr_accessor :client_key_contents
+
     # returns the raw keys of the underlying Chef::DataBagItem.  chef-vault v2
     # defined #keys as a public accessor that returns the ChefVault::ItemKeys
     # object for the vault.  Ideally, #keys would provide Hash-like behaviour
@@ -58,6 +63,8 @@ class ChefVault
     #   as. Defaults to the :node_name value of Chef::Config
     # @option opts [String] :client_key_path the name of the node to decrypt
     #   secrets as.  Defaults to the :client_key value of Chef::Config
+    # @option opts [String] :client_key_contents the private key to decrypt
+    #   secrets as.  Defaults to the :client_key_contents value of Chef::Config
     def initialize(vault, name, opts = {})
       super() # Don't pass parameters
       @data_bag = vault
@@ -68,9 +75,11 @@ class ChefVault
       opts = {
         node_name: Chef::Config[:node_name],
         client_key_path: Chef::Config[:client_key],
+        client_key_contents: Chef::Config[:client_key_contents],
       }.merge(opts)
       @node_name = opts[:node_name]
       @client_key_path = opts[:client_key_path]
+      @client_key_contents = opts[:client_key_contents]
       @current_query = search
     end
 
@@ -163,7 +172,11 @@ class ChefVault
 
     def secret
       if @keys.include?(@node_name) && !@keys[@node_name].nil?
-        private_key = OpenSSL::PKey::RSA.new(File.open(@client_key_path).read)
+        unless @client_key_contents.nil?
+          private_key = OpenSSL::PKey::RSA.new(@client_key_contents)
+        else
+          private_key = OpenSSL::PKey::RSA.new(File.open(@client_key_path).read)
+        end
         begin
           private_key.private_decrypt(Base64.decode64(@keys[@node_name]))
         rescue OpenSSL::PKey::RSAError
@@ -231,7 +244,7 @@ class ChefVault
       else
         begin
           Chef::DataBag.load(data_bag)
-        rescue Net::HTTPServerException => http_error
+        rescue Net::HTTPClientException => http_error
           if http_error.response.code == "404"
             chef_data_bag = Chef::DataBag.new
             chef_data_bag.name data_bag
@@ -295,7 +308,7 @@ class ChefVault
       begin
         item.raw_data =
           Chef::EncryptedDataBagItem.load(vault, name, item.secret).to_hash
-      rescue Net::HTTPServerException => http_error
+      rescue Net::HTTPClientException => http_error
         if http_error.response.code == "404"
           raise ChefVault::Exceptions::ItemNotFound,
             "#{vault}/#{name} could not be found"
@@ -351,7 +364,7 @@ class ChefVault
       # and https://github.com/sensu/sensu-chef/blob/2.9.0/libraries/sensu_helpers.rb
       begin
         dbi = Chef::DataBagItem.load(vault, name)
-      rescue Net::HTTPServerException => http_error
+      rescue Net::HTTPClientException => http_error
         if http_error.response.code == "404"
           raise ChefVault::Exceptions::ItemNotFound,
             "#{vault}/#{name} not found"
@@ -454,7 +467,7 @@ class ChefVault
     def client_exists?(clientname)
       Chef::ApiClient.load(clientname)
       true
-    rescue Net::HTTPServerException => http_error
+    rescue Net::HTTPClientException => http_error
       return false if http_error.response.code == "404"
 
       raise http_error

data/lib/chef-vault/item_keys.rb

@@ -122,7 +122,7 @@ class ChefVault
       unless Chef::Config[:solo_legacy_mode]
         begin
           Chef::DataBag.load(data_bag)
-        rescue Net::HTTPServerException => http_error
+        rescue Net::HTTPClientException => http_error
           if http_error.response.code == "404"
             chef_data_bag = Chef::DataBag.new
             chef_data_bag.name data_bag
@@ -143,7 +143,7 @@ class ChefVault
               Chef::DataBagItem.from_hash("data_bag" => data_bag,
                                           "id" => sparse_id(key))
                 .destroy(data_bag, sparse_id(key))
-            rescue Net::HTTPServerException => http_error
+            rescue Net::HTTPClientException => http_error
               raise http_error unless http_error.response.code == "404"
             end
           end
@@ -234,7 +234,7 @@ class ChefVault
     def self.load(vault, name)
       begin
         data_bag_item = Chef::DataBagItem.load(vault, name)
-      rescue Net::HTTPServerException => http_error
+      rescue Net::HTTPClientException => http_error
         if http_error.response.code == "404"
           raise ChefVault::Exceptions::KeysNotFound,
             "#{vault}/#{name} could not be found"
@@ -265,7 +265,7 @@ class ChefVault
       else
         begin
           Chef::DataBagItem.load(@data_bag, sid)
-        rescue Net::HTTPServerException => http_error
+        rescue Net::HTTPClientException => http_error
           nil if http_error.response.code == "404"
         end
       end

data/lib/chef-vault/version.rb

@@ -15,6 +15,6 @@
 # limitations under the License.
 
 class ChefVault
-  VERSION = "4.1.5"
+  VERSION = "4.1.11"
   MAJOR, MINOR, TINY = VERSION.split(".")
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chef-vault
 version: !ruby/object:Gem::Version
-  version: 4.1.5
+  version: 4.1.11
 platform: ruby
 authors:
 - Thom May
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-26 00:00:00.000000000 Z
+date: 2023-02-14 00:00:00.000000000 Z
 dependencies: []
 description: Data encryption support for Chef Infra using data bags
 email:
@@ -61,7 +61,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="