dotenv-gpg 0.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ea4591c6118ce5fb0aa7ed03ae6cbb8c5797fd16
+  data.tar.gz: 1ec9487f27126c9bca7e44769f2d3e4a6f8b873f
+SHA512:
+  metadata.gz: 3e7670a20665fa97c5ae6557f2bc0706d45ad18f98e6b70db2ea9a056c87acd2ab81dfcf30d7144f2e188127db724e288d4b09ad238447e1eb1340c1c0ca6ba7
+  data.tar.gz: 18a41ddc5ca53f583d8566e1ba1666758369b81242a1fa1f74ac2d99f442858254b19bfa91906d25606d2f3345210550c91a404ccab6a13a090747c878ee5d9d

data/.gitignore

@@ -0,0 +1 @@
+*.gem

data/Gemfile

@@ -0,0 +1,2 @@
+source "https://rubygems.org/"
+gemspec

data/Gemfile.lock

@@ -0,0 +1,33 @@
+PATH
+  remote: .
+  specs:
+    dotenv-gpg (0.2)
+      gpgme
+      thor
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    coderay (1.0.9)
+    debug_inspector (0.0.2)
+    gpgme (2.0.2)
+    method_source (0.8.2)
+    pry (0.9.12.2)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pry-stack_explorer (0.4.9.1)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    slop (3.4.6)
+    thor (0.18.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  dotenv-gpg!
+  pry
+  pry-stack_explorer

data/README.md

@@ -0,0 +1,132 @@
+dotgpg is a tool for backing up and versioning your production secrets securely and easily.
+
+Production secrets are things like your cookie encryption keys, database passwords and AWS access keys. All of them have two things in common: your app needs them to runs and no-one else should be able to get to them.
+
+Most people do not look after their production secrets well. If you've got them in your source-code, or unencrypted in Dropbox or Google docs you are betraying your users trust. It's too easy for someone else to get at them.
+
+Dotgpg aims to be as easy to use as your current solution, but with added encryption. It manages a shared directory of GPG-encrypted files that you can check into git or put in Dropbox. When you deploy the secrets to your servers they are decrypted so that your app can boot without intervention.
+
+Getting started
+---------------
+
+If you're a ruby developer, you know the drill. Either `gem install dotgpg` or add `gem "dotgpg"` to your Gemfile.
+
+There are also instructions for [use without ruby](#use-without-ruby).
+
+#### Mac OS X
+
+1. `brew install gpg`
+2. `sudo gem install dotgpg`
+
+#### Ubuntu
+
+1. `sudo apt-get install ruby1.9`
+2. `sudo gem install dotgpg`
+
+## Usage
+
+#### dotgpg init
+
+To get started run `dotgpg init`. Unless you've used GPG before, it will prompt you for a new passphrase. You should make this passphrase as [secure as your SSH passphrase](#security), i.e. 12-20 characters and not just letters.
+
+```
+$ dotgpg init
+Creating a new GPG key: Conrad Irwin <conrad.irwin@gmail.com>
+Passphrase:
+Passphrase confirmation:
+```
+
+#### dotgpg edit
+
+To create or edit files, just use `dotgpg edit`. I recommend you use the `.gpg` suffix so that other tools know what these files contain.
+
+```
+$ dotgpg edit production.env.gpg
+[ opens your $EDITOR ]
+```
+
+#### dotgpg cat
+
+To read encrypted files, `dotgpg cat` them.
+
+```
+$ dotgpg cat prodution.env.gpg
+GPG passphrase for conrad.irwin@gmail.com:
+```
+
+#### dotgpg add
+
+To add other people to your team, you need to `dotgpg add` them. To run this command you need their public key (see `dotgpg key`).
+
+```
+$ dotgpg add
+Paste a public key, then hit <ctrl-d> twice.
+<paste>
+<ctrl-d><ctrl-d>
+```
+
+Once you've added them run `git commit` or let Dropbox work its syncing magic and they'll be able to access the files just like you.
+
+#### dotgpg key
+
+To be added to a dotgpg directory, you just need to send your GPG public key to someone who already has access. Getting the key is as easy as running `dotgpg key`. Then email/IM someone who already has access (you can see the list with `ls .gpg`).
+
+```
+$ dotgpg key
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.15 (Darwin)
+
+mQENBFK2JfMBCAC8wX7dsWiNX2Ov9akPlz+54Y7n8a3gtdP63CiabW9Ao4614ZDu
+vZWI8GIr1QaqMQOcUnhVe9BU3u3y4TX5ei1rHp4ykKoum606R7oFKS5Q4viob/6W
+rfVND/o/Sh8twY9ZIpOxRq1zqfGmJk/wSTMuM047hhPUDZVf1BNU+lkURTh2qqnL
+...snip...
+ZQPcmlBEEI4zq+4GzLTTHHM3/rcHHZmi5p9JAK8OxM/Xyc2otF+N/+iGtIIHjD4a
+0FJjy4jQzl7FsvLbDf0VDbcw6RZkJ5dGXIyaEcNiOkF3UGwDcfg6oLsA7d5lo+3a
+leJCaaNJQBbIOj4QOjFWiZ8ATqLH9nkgawSwOV3xp0MWayCJ3MVnibt4CaI=
+=Vzb6
+-----END PGP PUBLIC KEY BLOCK-----
+```
+
+## Use without ruby
+
+The only person who really needs to use the `dotgpg` executable is the one responsible for adding and removing users from the directory. If you want to use `dotgpg` without requiring everyone to install ruby you can give them these instructions:
+
+To export your GPG key, use: `gpg --armor --export EMAIL_ADDRESS`. (If you get an error 'nothing exported', you can generate a new key using the default settings of `gpg --gen-key`.)
+
+To read the encrypted files use `gpg --decrypt FILE`.
+
+To edit the encrypted files, you'll want to use [vim-gnupg](https://github.com/jamessan/vim-gnupgnumber) and add `autocmd User GnuPG let b:GPGOptions += ["sign"]` to your `~/.vimrc`. Every time a new user is added to the directory, you'll need to sync GPG's public key store with `gpg --import .gpg/*` or you won't be able to save changes.
+
+## Security
+
+I'm not a security professional, so please [email me](conrad.irwin@gmail.com) if you have feedback on anything in this section.
+
+The files stored in `dotgpg` are unreadable to an attacker provided:
+
+1. A file encrypted by GnuPG cannot be decrypted except by someone with access to a recipient's private key.
+2. No-one has access to your GPG private key.
+
+The former assumption is reasonably strong. I'm willing to accept the tiny risk that there's a bug in GnuPG because it'll make headline news.
+
+The latter assumption is reasonably weak. GPG private keys are stored encrypted on your laptop, and the encryption key is based on a passphrase.
+
+This means that if someone gets access to your laptop (or a backup) they can easily get your GPG key unless you've chosen a [secure passphrase](https://howsecureismypassword.net/). I consider this acceptable risk because, by default, SSH passwords are easier to crack than GPG passphrases (GPG uses 65536 rounds of SHA-1 while SSH uses a [single round of MD5](http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html)) and if they can decrypt your SSH key they can read the secrets directly off your production servers.
+
+### Change passphrase
+
+If you didn't choose a secure passphrase, you can change it with:
+
+```
+gpg --edit-keys conrad.irwin@gmail.com passwd
+```
+
+If you can't remember your passphrase then you generate a new key with `dotgpg key -n` and ask someone on your team to overwrite your existing key with `dotgpg add -f`.
+
+### Revoking access
+
+Occasionally people leave, or stop needing access to dotgpg. To remove them use `dotgpg rm`.
+
+```
+dotgpg rm conrad.irwin@gmail.com
+```
+

data/Rakefile

@@ -0,0 +1,7 @@
+task :test do
+  Dir['./spec/**/*_spec.rb'].each do |f|
+    require f
+  end
+end
+
+task :default => :test

data/bin/dotgpg

@@ -0,0 +1,5 @@
+#!/usr/bin/env bundle exec ruby
+require "dotgpg"
+
+Dotgpg.interactive = true
+Dotgpg::Cli.start(ARGV)

data/dotenv-gpg.gemspec

@@ -0,0 +1,22 @@
+Gem::Specification.new do |gem|
+  gem.name = 'dotenv-gpg'
+  gem.version = '0.3'
+
+  gem.summary = 'gpg-encrypted backup for your dotenv files'
+  gem.description = "Easy management of gpg-encrypted backup files"
+
+  gem.authors = ['Conrad Irwin']
+  gem.email = %w(conrad@bugsnag.com)
+  gem.homepage = 'http://github.com/ConradIrwin/dotenv-gpg'
+
+  gem.license = 'MIT'
+
+  gem.add_dependency 'thor'
+  gem.add_dependency 'gpgme'
+
+  gem.add_development_dependency 'pry'
+  gem.add_development_dependency 'pry-stack_explorer'
+
+  gem.executables = 'dotgpg'
+  gem.files = `git ls-files`.split("\n")
+end

data/lib/dotgpg.rb

@@ -0,0 +1,96 @@
+require 'pathname'
+require 'fileutils'
+require 'tempfile'
+require 'shellwords'
+
+require 'gpgme'
+require 'thor'
+
+require "dotgpg/key.rb"
+require "dotgpg/dir.rb"
+require "dotgpg/cli.rb"
+
+class Dotgpg
+
+  class Failure < RuntimeError; end
+  class InvalidSignature < RuntimeError; end
+
+  # This method copied directly from Pry and is
+  # Copyright (c) 2013 John Mair (banisterfiend)
+  # https://github.com/pry/pry/blob/master/LICENSE
+  def self.editor
+    configured = ENV["VISUAL"] || ENV["EDITOR"] || guess_editor
+    case configured
+    when /^mate/, /^subl/
+      configured << " -w"
+    when /^[gm]vim/
+      configured << " --nofork"
+    when /^jedit/
+      configured << " -wait"
+    end
+
+    configured
+  end
+
+  def self.guess_editor
+    %w(subl sublime-text sensible-editor editor mate nano vim vi open).detect do |editor|
+      system("which #{editor} > /dev/null 2>&1")
+    end
+  end
+
+  def self.read_input(prompt)
+    $stderr.print prompt
+    $stderr.flush
+    $stdin.readline.strip
+  end
+
+  def self.read_passphrase(prompt)
+    `stty -echo`
+    read_input prompt
+  ensure
+    $stderr.print "\n"
+    `stty echo`
+  end
+
+  def self.interactive=(bool)
+    @interactive = bool
+    if interactive?
+      # get rid of stack trace on <ctrl-c>
+      trap(:INT){ exit 2 }
+    else
+      trap(:INT, "DEFAULT")
+    end
+  end
+
+  def self.interactive?
+    !!@interactive
+  end
+
+  # TODO: it'd be nice not to store the passphrase in
+  # plaintext in RAM.
+  def self.passphrase=(passphrase)
+    @passphrase = passphrase
+  end
+
+  def self.warn(context, error)
+    if interactive?
+      $stderr.puts "#{context}: #{error.message}"
+    else
+      puts "raising warning"
+      raise error
+    end
+  end
+
+  def self.passfunc(hook, uid_hint, passphrase_info, prev_was_bad, fd)
+    if interactive? && (!@passphrase || prev_was_bad != 0)
+      uid_hint = $1 if uid_hint =~ /<(.*)>/
+      @passphrase = read_passphrase "GPG passphrase for #{uid_hint}: "
+    elsif !@passphrase
+      raise "You must set Dotgpg.password or Dotgpg.interactive"
+    end
+
+    io = IO.for_fd(fd, 'w')
+    io.puts(@passphrase)
+    io.flush
+  end
+end

data/lib/dotgpg/cli.rb

@@ -0,0 +1,194 @@
+class Dotgpg
+  class Cli < Thor
+    include Thor::Actions
+
+    class_option "help", type: :boolean, desc: "Show help", aliases: ["-h"]
+
+    desc "init [DIRECTORY]", "create a new dotgpg directory"
+    option :"new-key", type: :boolean, desc: "Force creating a new key", aliases: ["-n"]
+    option :email, type: :string, desc: "Use a specific email address", aliases: ["-e"]
+    def init(directory=".")
+      return if helped?
+
+      dir = Dotgpg::Dir.new directory
+
+      if dir.dotgpg.exist?
+        fail "#{directory}/.gpg already exists"
+      end
+
+      key = Dotgpg::Key.secret_key(options[:email], options[:"new-key"])
+
+      info "Initializing new dotgpg directory"
+      info "  #{directory}/README.md"
+      info "  #{directory}/.gpg/#{key.email}"
+
+      FileUtils.mkdir_p(dir.dotgpg)
+      FileUtils.cp Pathname.new(__FILE__).dirname.join("template/README.md"), dir.path.join("README.md")
+      dir.add_key(key)
+    end
+
+    desc "key", "export your GPG public key in a format that `dotgpg add` will understand"
+    option :"new-key", type: :boolean, desc: "Force creating a new key", aliases: ["-n"]
+    option :email, type: :string, desc: "Use a specific email address", aliases: ["-e"]
+    def key
+      return if helped?
+
+      key = Dotgpg::Key.secret_key(options[:email], options[:"new-key"])
+      $stdout.print key.export(armor: true).to_s
+    end
+
+    desc "add [PUBLIC_KEY]", "add a user's public key", aliases: ["-f"]
+    option :force, type: :boolean, desc: "Overwrite an existing key with the same email address", aliases: ["-f"]
+    def add(file=nil)
+      return if helped?
+
+      dir = Dotgpg::Dir.closest
+      fail "not in a dotgpg directory" unless dir
+
+      key = read_key_file_for_add(file)
+      fail "#{file || "<stdin>"}: not a valid GPG key" unless key
+
+      if dir.has_key?(key) && !options[:force]
+        fail "#{dir.key_path(key)}: already exists"
+      end
+
+      info "Adding #{key.name} to #{dir.path}"
+      info "  #{dir.key_path(key).relative_path_from(dir.path)}"
+
+      dir.add_key(key)
+    rescue GPGME::Error::BadPassphrase => e
+      fail e.message
+    end
+
+    desc "rm KEY", "remove a user's public key"
+    option :force, type: :boolean, desc: "Succeed silently if the key doesn't exist or is your own secret key", aliases: ["-f"]
+    def rm(file=nil)
+      return if helped?(file.nil?)
+
+      dir = Dotgpg::Dir.closest
+      fail "not in a dotgpg directory" unless dir
+
+      key = read_key_file_for_rm(file)
+      fail "#{file}: not a valid GPG key" if !key && !options[:force]
+
+      if key
+        if GPGME::Key.find(:secret).include?(key) && !options[:force]
+          fail "#{file}: refusing to remove your own secret key"
+        end
+
+        info "Removing #{key.name} from #{dir.path}"
+        info "D #{dir.key_path(key).relative_path_from(dir.path)}"
+        dir.remove_key(key)
+      end
+    rescue GPGME::Error::BadPassphrase => e
+      fail e.message
+    end
+
+    desc "cat FILES...", "decrypt and print files"
+    def cat(*files)
+      return if helped?
+
+      dir = Dotgpg::Dir.closest(*files)
+      fail "not in a dotgpg directory" unless dir
+
+      files.each do |f|
+        dir.decrypt f, $stdout
+      end
+    rescue GPGME::Error::BadPassphrase => e
+      fail e.message
+    end
+
+    desc "edit FILES...", "edit and re-encrypt files"
+    def edit(*files)
+      return if helped?
+
+      dir = Dotgpg::Dir.closest(*files)
+      fail "not in a dotgpg directory" unless dir
+
+      dir.reencrypt files do |tempfiles|
+        if tempfiles.any?
+          to_edit = tempfiles.values.map do |temp|
+            Shellwords.escape(temp.path)
+          end
+
+          system "#{Dotgpg.editor} #{to_edit.join(" ")}"
+          fail "Problem with editor. Not saving changes" unless $?.success?
+        end
+      end
+
+    rescue GPGME::Error::BadPassphrase => e
+      fail e.message
+    end
+
+    private
+
+    # If the global --help or -h flag is passed, show help.
+    #
+    # Should be invoked at the start of every command.
+    #
+    # @param [Boolean] force  force showing help
+    # @return [Boolean]  help was shown
+    def helped?(force=false)
+      if options[:help] || force
+        invoke :help, @_invocations[self.class]
+        true
+      end
+    end
+
+    # Print an informational message in interactive mode.
+    #
+    # @param [String] msg  The message to show
+    def info(msg)
+      if Dotgpg.interactive?
+        $stdout.puts msg
+      end
+    end
+
+    # Fail with a message.
+    #
+    # In interactive mode, exits the program with status 1.
+    # Otherwise raises a Dotgpg::Failure.
+    #
+    # @param [String] msg
+    def fail(msg)
+      if Dotgpg.interactive?
+        $stderr.puts msg
+        exit 1
+      else
+        raise Dotgpg::Failure, msg, caller[1]
+      end
+    end
+
+    # Read a key from a given file or stdin.
+    #
+    # @param [nil, String]  the file the user specified.
+    # @return [nil, GPGME::Key]
+    def read_key_file_for_add(file)
+      if file.nil?
+        if $stdin.tty?
+          info "Paste a public key, then hit <ctrl+d> twice."
+          key = Dotgpg::Key.read($stdin)
+        else
+          key = Dotgpg::Key.read($stdin)
+          $stdin.reopen "/dev/tty"
+        end
+      elsif File.readable?(file)
+        key = Dotgpg::Key.read(File.read(file))
+      end
+    end
+
+    # Read a key from a given file or from the .gpg directory
+    #
+    # @param [String]  the file the user specified
+    # @return [nil, GPGME::Key]
+    def read_key_file_for_rm(file)
+      if !File.exist?(file) && File.exist?(".gpg/" + file)
+        file = ".gpg/" + file
+      end
+
+      if File.readable?(file)
+        Dotgpg::Key.read(File.read(file))
+      end
+    end
+  end
+end