conjur-cli 6.2.2 → 6.2.3

data/README.md

@@ -6,7 +6,18 @@ Command-line interface for Conjur.
 
 A complete reference guide is available at [conjur.org](https://www.conjur.org).
 
-## Quick start
+## Table of Contents
+- [Getting Started](#getting-started)
+    - [Quick Start](#quick-start)
+    - [Using This Project With Conjur OSS](#Using-conjur-cli-with-Conjur-OSS)
+- [Using Docker](#using-docker)
+- [Usage](#usage)
+- [Contributing](#contributing)
+- [License](#license)
+
+## Getting Started 
+
+### Quick start
 
 ```sh-session
 $ gem install conjur-cli
@@ -15,7 +26,19 @@ $ conjur -v
 conjur version 6.0.0
 ```
 
+### Using conjur-cli with Conjur OSS 
+
+Are you using this project with [Conjur OSS](https://github.com/cyberark/conjur)? Then we 
+**strongly** recommend choosing the version of this project to use from the latest [Conjur OSS 
+suite release](https://docs.conjur.org/Latest/en/Content/Overview/Conjur-OSS-Suite-Overview.html). 
+Conjur maintainers perform additional testing on the suite release versions to ensure 
+compatibility. When possible, upgrade your Conjur version to match the 
+[latest suite release](https://docs.conjur.org/Latest/en/Content/ReleaseNotes/ConjurOSS-suite-RN.htm); 
+when using integrations, choose the latest suite release that matches your Conjur version. For any 
+questions, please contact us on [Discourse](https://discuss.cyberarkcommons.org/c/conjur/5).
+
 ## Using Docker
+
 [![Docker Build Status](https://img.shields.io/docker/build/conjurinc/cli5.svg)](https://hub.docker.com/r/conjurinc/cli5/)
 This software is included in the standalone cyberark/conjur-cli:5 Docker image. Docker containers are designed to be ephemeral, which means they don't store state after the container exits.
 
@@ -59,6 +82,280 @@ drwxr-xr-x  2 you  staff    68 Mar 29 14:16 .cache
 ```
 *Security notice:* the file `.netrc`, created or updated by `conjur authn login`, contains a user identity credential that can be used to access the Conjur API. You should remove it after use or otherwise secure it like you would another netrc file.
 
+## Usage
+
+```
+NAME
+    conjur - Command-line toolkit for managing roles, resources and privileges
+
+SYNOPSIS
+    conjur [global options] command [command options] [arguments...]
+
+GLOBAL OPTIONS
+    --help    - Show this message
+    --version - Display the program version
+```
+
+### Commands
+
+| Command                            | Description                                       |
+| ---------------------------------- | ------------------------------------------------- |
+| [authn](#conjur-authn)             | - Login and logout                                |
+| [check](#conjur-check)             | - Check for a privilege on a resource             |
+| [env](#conjur-env)                 | - Use values of Conjur variables in local context |
+| [host](#conjur-host)               | - Manage hosts                                    |
+| [hostfactory](#conjur-hostfactory) | - Manage host factories                           |
+| [init](#conjur-init)               | - Initialize the Conjur configuration             |
+| [ldap-sync](#conjur-ldap-sync)     | - LDAP sync management commands                   |
+| [list](#conjur-list)               | - List objects                                    |
+| [plugin](#conjur-plugin)           | - Manage plugins                                  |
+| [policy](#conjur-policy)           | - Manage policies                                 |
+| [pubkeys](#conjur-pubkeys)         | - Public keys service operations                  |
+| [resource](#conjur-resource)       | - Manage resources                                |
+| [role](#conjur-role)               | - Manage roles                                    |
+| [show](#conjur-show)               | - Show an object                                  |
+| [user](#conjur-user)               | - Manage users                                    |
+| [variable](#conjur-variable)       | - Manage variables                                |
+
+#### `conjur authn`
+
+```
+NAME
+   authn       - Login and logout
+SYNOPSIS
+    conjur [global options] authn authenticate [-H|--header] [-f filename|--filename filename]
+    conjur [global options] authn login [-p password|--password password] [-u username|--username username] login-name
+    conjur [global options] authn logout
+    conjur [global options] authn whoami
+COMMANDS
+    authenticate - Obtains an authentication token using the current logged-in
+                   user
+    login        - Logs in and caches credentials to netrc.
+    logout       - Logs out
+    whoami       - Prints out the current logged in username
+```
+
+#### `conjur check`
+
+```
+NAME
+   check       - Check for a user’s privilege on a resource
+SYNOPSIS
+   conjur check [object] [privilege] [user]
+PRIVILEGES
+   read, write, execute
+```
+
+#### `conjur env`
+
+```
+NAME
+    env         - Use values of Conjur variables in local context
+SYNOPSIS
+    conjur [global options] env check [--policy arg] [--yaml arg] [-c FILE]
+    conjur [global options] env help
+    conjur [global options] env run [--policy arg] [--yaml arg] [-c FILE] -- command [arg1, arg2 ...]
+    conjur [global options] env template [--policy arg] [--yaml arg] [-c FILE] template.erb
+
+COMMANDS
+    check    - Check availability of Conjur variables
+    help     - Print description of environment configuration format
+    run      - Execute external command with environment variables populated
+               from Conjur
+    template - Render ERB template with variables obtained from Conjur
+
+root@e1bfc649b68d:/# conjur env help
+
+Environment configuration (either stored in file referred by -c option or provided inline with --yaml option) should be a YAML document describing one-level Hash.
+Keys of the hash are 'local names', used to refer to variable values in convenient manner.  (See help for env:run and env:template for more details about how they are interpreted).
+
+Values of the hash may take one of the following forms: a) string b) string preceeded with !var tag c) string preceeded with !tmp tag.
+
+a) Plain string is just associated with local name without any calls to Conjur.
+
+b) String preceeded by !var tag is interpreted as an ID of the Conjur variable, which value should be obtained and associated with appropriate local name.
+
+c) String preceeded by !tmp tag is interpreted as an ID of the Conjur variable, which value should be stored in temporary file, which location should in turn be associated with appropriate local name.
+
+Example of environment configuration: 
+
+{ local_variable_1: 'literal value', local_variable_2: !var id/of/Conjur/Variable , local_variable_3: !tmp id/of/another/Conjur/variable }
+```
+
+#### `conjur host`
+
+```
+NAME
+    host - Manage hosts
+
+SYNOPSIS
+    conjur [global options] host layers HOST
+    conjur [global options] host rotate_api_key [--host arg|-h arg]
+
+COMMANDS
+    layers         - List the layers to which the host belongs
+    rotate_api_key - Rotate a host's API key
+```
+
+#### `conjur hostfactory`
+
+```
+NAME
+    hostfactory - Manage host factories
+
+SYNOPSIS
+    conjur [global options] hostfactory hosts
+    conjur [global options] hostfactory tokens
+
+COMMANDS
+    hosts  - Operations on hosts
+    tokens - Operations on tokens
+```
+
+#### `conjur init`
+
+```
+NAME
+   init – Initialize the Conjur configuration
+SYNOPSIS
+   conjur [global options] init [-u URL of Conjur service] [-a account name]
+```
+
+#### `conjur ldap-sync`
+
+```
+NAME
+    ldap-sync - LDAP sync management commands
+
+SYNOPSIS
+    conjur [global options] ldap-sync policy
+
+COMMANDS
+    policy - Manage the policy used to sync Conjur and the LDAP server
+```
+
+#### `conjur list`
+
+```
+Lists conjur objects
+```
+
+#### `conjur plugin`
+
+```
+NAME
+    plugin - Manage plugins
+
+SYNOPSIS
+    conjur [global options] plugin install [-v version|--version version] PLUGIN
+    conjur [global options] plugin list
+    conjur [global options] plugin show PLUGIN
+    conjur [global options] plugin uninstall PLUGIN
+
+COMMANDS
+    install   - Install a plugin
+    list      - List installed plugins
+    show      - Show a plugin's details
+    uninstall - Uninstall a plugin
+```
+
+#### `conjur policy`
+
+```
+NAME
+    policy - Manage policies
+
+SYNOPSIS
+    conjur [global options] policy load [--delete] [--replace] POLICY FILENAME
+
+COMMANDS
+    load - Load a policy
+--delete – deletes a policy
+--replace – replaces a policy
+```
+
+#### `conjur pubkeys`
+
+```
+NAME
+   pubkeys - Public keys service operations
+SYNOPSIS
+   conjur [global options] pubkeys [USER]
+```
+
+#### `conjur resource`
+
+```
+NAME
+    resource - Manage resources
+
+SYNOPSIS
+    conjur [global options] resource exists RESOURCE
+    conjur [global options] resource permitted_roles RESOURCE PRIVILEGE
+
+COMMANDS
+    exists          - Determines whether a resource exists
+    permitted_roles - List roles with a specified privilege on the resource
+```
+
+#### `conjur role`
+
+```
+NAME
+    role - Manage roles
+
+SYNOPSIS
+    conjur [global options] role exists [--json] ROLE
+    conjur [global options] role members [-V|--verbose] ROLE
+    conjur [global options] role memberships [-s|--system] ROLE
+
+COMMANDS
+    exists      - Determines whether a role exists
+    members     - Lists all direct members of the role. The membership list is
+                  not recursively expanded.
+    memberships - Lists role memberships. The role membership list is
+                  recursively expanded.
+```
+
+#### `conjur show`
+
+```
+NAME
+   show        - Show an object
+SYNOPSIS
+   conjur show [object]
+```
+
+#### `conjur user`
+
+```
+NAME
+    user - Manage users
+
+SYNOPSIS
+    conjur [global options] user rotate_api_key [--user arg|-u arg]
+    conjur [global options] user update_password [-p arg|--password arg]
+
+COMMANDS
+    rotate_api_key  - Rotate a user's API key
+    update_password - Update the password of the logged-in user
+```
+
+#### `conjur variable`
+
+```
+NAME
+    variable - Manage variables
+
+SYNOPSIS
+    conjur [global options] variable value [-v arg|--version arg] VARIABLE
+    conjur [global options] variable values
+
+COMMANDS
+    value  - Get a value
+    values - Access variable values
+```
+
 ## Contributing
 
 We welcome contributions of all kinds to this repository. For instructions on how to get started and descriptions of our development workflows, please see our [contributing

data/SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policies and Procedures
+
+This document outlines security procedures and general policies for the CyberArk Conjur
+suite of tools and products.
+
+  * [Reporting a Bug](#reporting-a-bug)
+  * [Disclosure Policy](#disclosure-policy)
+  * [Comments on this Policy](#comments-on-this-policy)
+
+## Reporting a Bug
+
+The CyberArk Conjur team and community take all security bugs in the Conjur suite seriously.
+Thank you for improving the security of the Conjur suite. We appreciate your efforts and
+responsible disclosure and will make every effort to acknowledge your
+contributions.
+
+Report security bugs by emailing the lead maintainers at security@conjur.org.
+
+The maintainers will acknowledge your email within 2 business days. Subsequently, we will 
+send a more detailed response within 2 business days of our acknowledgement indicating
+the next steps in handling your report. After the initial reply to your report, the security
+team will endeavor to keep you informed of the progress towards a fix and full
+announcement, and may ask for additional information or guidance.
+
+Report security bugs in third-party modules to the person or team maintaining
+the module.
+
+## Disclosure Policy
+
+When the security team receives a security bug report, they will assign it to a
+primary handler. This person will coordinate the fix and release process,
+involving the following steps:
+
+  * Confirm the problem and determine the affected versions.
+  * Audit code to find any potential similar problems.
+  * Prepare fixes for all releases still under maintenance. These fixes will be
+    released as fast as possible.
+
+## Comments on this Policy
+
+If you have suggestions on how this process could be improved please submit a
+pull request.

data/VERSION

@@ -1 +1 @@
-6.2.2
+6.2.3

data/build-standalone

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-TAG="cyberark/conjur-cli:latest"
+IMAGE="cyberark/conjur-cli:latest"
 
 ENV_VARS=(
   "CONJUR_MAJOR_VERSION=5"
@@ -9,7 +9,7 @@ ENV_VARS=(
 )
 
 # Flatten resulting image.
-function flatten() {
+flatten() {
   local image="$1"
   echo "Flattening image '$image'..."
 
@@ -19,26 +19,27 @@ function flatten() {
   # required for running the image (ENV, EXPOSE, WORKDIR, etc) so we
   # manually rebuild them.
   # See here for more details: https://github.com/moby/moby/issues/8334
-  local container=`docker create $image`
+  local container
+  container=$(docker create "$image")
 
   env_var_params=()
-  for env_var in ${ENV_VARS[@]}; do
+  for env_var in "${ENV_VARS[@]}"; do
     env_var_params+=("--change")
     env_var_params+=("ENV $env_var")
   done
 
-  docker export $container | docker import \
+  docker export "$container" | docker import \
     "${env_var_params[@]}" \
     --change 'ENTRYPOINT ["/bin/entry"]' \
-    - $image
-  docker rm $container
+    - "$image"
+  docker rm "$container"
 }
 
 # Build the cli standalone container image
-echo "Building image $TAG"
+echo "Building image $IMAGE"
 
 docker build . \
-       -f Dockerfile.standalone \
-       -t "$TAG"
+       --file Dockerfile.standalone \
+       --tag "$IMAGE"
 
-flatten "$TAG"
+flatten "$IMAGE"

data/conjur-cli.gemspec

@@ -3,11 +3,11 @@ require File.expand_path('../lib/conjur/version', __FILE__)
 require "English"
 
 Gem::Specification.new do |gem|
-  gem.authors       = ["Rafal Rzepecki", "Kevin Gilpin"]
-  gem.email         = ["rafal@conjur.net", "kgilpin@conjur.net",]
+  gem.authors       = ["Conjur Maintainers"]
+  gem.email         = ["conj_maintainers@cyberark.com",]
   gem.summary       = %q{Conjur command line interface}
-  gem.homepage      = "https://github.com/conjurinc/cli-ruby"
-  gem.license       = 'MIT'
+  gem.homepage      = "https://github.com/cyberark/conjur-cli"
+  gem.license       = 'Apache 2.0'
 
   gem.files         = (`git ls-files`.split($OUTPUT_RECORD_SEPARATOR)
                                      .select { |x| x !~ /^Dockerfile/ }

data/lib/conjur/command/hosts.rb

@@ -36,7 +36,7 @@ class Conjur::Command::Hosts < Conjur::Command
           host_resourceid = full_resource_id("host:#{host}")
 
           unless api.resource(host_resourceid).exists?
-            exit_now! "host '#{host}' not found"
+            exit_now! "Host '#{host}' not found"
           end
 
           # Prepend 'host/' if it wasn't passed in

data/lib/conjur/command/rspec/mock_services.rb

@@ -29,7 +29,13 @@ end
 shared_context "when logged in", logged_in: true do
   include_context "with mock authn"
   before do
-    allow(api).to receive(:credentials) { {} }
+    allow(api).to receive(:credentials) do
+      {
+        :username => 'dknuth',
+        :headers => { :authorization => "fakeauth" },
+      }
+    end
+
     netrc[authn_host] = [username, api_key]
     allow(Conjur::Command).to receive_messages api: api
   end