dotenv-vault 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28ae7886dc467b2b1b79693a72a4d9d5cbbee538ef1ba59e3519647590d0612c
-  data.tar.gz: 91363e287dec8d84e15a3e8cc4f64e25c5b71c5fc99f28f9adb03afb00b87473
+  metadata.gz: d50c70b0cdf146642c45402aced8a3a917835a08d705d12285365a52b9e42c28
+  data.tar.gz: 0cad8a7095928704247fd5c0cde071be993612805c67163bde7e0c79d57c450c
 SHA512:
-  metadata.gz: 07a3671502b3e5e55450958b287b791d4859932ec51c564abaafcdf72259cf141944c4ca3b45ea093628bf062cf2b32b5cbe30643979c9d1d99d7947d3b40a5c
-  data.tar.gz: e44a690fbf4f660049ac24ebe2e1e42ca2f907fa2b0696ee3fc652e6e6bfda04cc7130278b06083d37d3650e602ff154a51cd2cd98a5fe03da51e758a77eb1f7
+  metadata.gz: 71b28ee0642d01ccfcb065c32265d9352a4696e8dc16822917066039efad4e42b3155d365dcfa3780d26cc295804f72c5419d6e47360d25d45ad190c7e08c9e2
+  data.tar.gz: ae75c04dbad3f6a66d6b2f77eadd10a31d54de2c6e4f75a4f8a5c779fa6b70644d5bccfeb9b104e065de5abff1eade9321acce525f485bb8d75a6dcf44f55d42

data/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file. See [standa
 
 ## [Unreleased](https://github.com/dotenv-org/dotenv-vault-ruby/compare/v0.9.0...master)
 
+## 0.10.0
+
+### Added
+
+- Support key rotation. Added comma separated capability to `DOTENV_KEY`. Add multiple keys to your DOTENV_KEY for use with decryption. Separate with a comma. [#2](https://github.com/dotenv-org/dotenv-vault-ruby/pull/2)
+
 ## 0.9.0
 
 ### Changed

data/Gemfile.lock

@@ -1,12 +1,12 @@
 PATH
   remote: .
   specs:
-    dotenv-vault (0.9.0)
+    dotenv-vault (0.10.0)
       dotenv
       lockbox
-    dotenv-vault-rails (0.9.0)
+    dotenv-vault-rails (0.10.0)
       dotenv-rails
-      dotenv-vault (= 0.9.0)
+      dotenv-vault (= 0.10.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -2,14 +2,10 @@
 
 <img src="https://raw.githubusercontent.com/motdotla/dotenv/master/dotenv.svg" alt="dotenv-vault" align="right" width="200" />
 
-Dotenv Vault extends the proven & trusted foundation of [dotenv](https://github.com/bkeepers/dotenv), with a `.env.vault` file.
+Extends the proven & trusted foundation of [dotenv](https://github.com/bkeepers/dotenv), with a `.env.vault` file.
 
 The extended standard lets you sync your `.env` files – quickly & securely. Stop sharing them over insecure channels like Slack and email, and never lose an important `.env` file again.
 
-You need a [Dotenv Account](https://dotenv.org) to use Dotenv Vault. It is free to use with premium features.
-
-**[Create your account](https://dotenv.org/signup)**
-
 ## Installation
 
 ### Rails
@@ -65,12 +61,12 @@ config.fog_directory  = ENV['S3_BUCKET']
 
 ### `.env.vault`
 
-Extended usage uses a `.env.vault` file that allows you to sync your secrets across machines, team members, and environments.
+The `.env.vault` extends `.env`. It facilitates syncing your `.env` file across machines, team members, and environments.
 
 Usage is similar to git. In the same directory as your `.env` file, run the command:
 
 ```shell
-npx dotenv-vault new
+$ npx dotenv-vault new
 ```
 
 Follow those instructions and then run:
@@ -90,6 +86,8 @@ That's it!
 
 You just synced your `.env` file. Commit your `.env.vault` file to code, and tell your teammates to run `npx dotenv-vault pull`.
 
+[Learn more](https://www.dotenv.org/docs/tutorials/sync)
+
 ## Multiple Environments
 
 Run the command:
@@ -100,7 +98,9 @@ $ npx dotenv-vault open production
 
 It will open up an interface to manage your production environment variables.
 
-## Build & Deploy Anywhere
+[Learn more](https://www.dotenv.org/docs/tutorials/environments)
+
+## Integrate Anywhere™
 
 Build your encrypted `.env.vault`:
 
@@ -131,9 +131,9 @@ All set! When your app boots, it will recognize a `DOTENV_KEY` is set, decrypt t
 
 Made a change to your production envs? Run `npx dotenv-vault build`, commit that safely to code, and deploy. It's simple and safe like that.
 
-## Dotenv.org
+[Learn more](https://www.dotenv.org/docs/tutorials/integrations)
 
-**[Create your account](https://dotenv.org/signup)**
+## Dotenv.org
 
 You need a [Dotenv Account](https://dotenv.org) to use Dotenv Vault. It is free to use with premium features.
 

data/dotenv-vault-rails.gemspec

@@ -6,8 +6,8 @@ Gem::Specification.new "dotenv-vault-rails" do |spec|
   spec.authors       = ["motdotla"]
   spec.email         = ["mot@mot.la"]
 
-  spec.summary       = %q{dotenv-vault-rails}
-  spec.description   = %q{dotenv-vault-rails}
+  spec.summary       = %q{Decrypt .env.vault file.}
+  spec.description   = %q{Decrypt .env.vault file.}
   spec.homepage      = "https://github.com/dotenv-org/dotenv-vault-ruby"
   spec.license       = "MIT"
   spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")

data/dotenv-vault.gemspec

@@ -6,8 +6,8 @@ Gem::Specification.new "dotenv-vault" do |spec|
   spec.authors       = ["motdotla"]
   spec.email         = ["mot@mot.la"]
 
-  spec.summary       = %q{dotenv-vault}
-  spec.description   = %q{dotenv-vault}
+  spec.summary       = %q{Decrypt .env.vault file.}
+  spec.description   = %q{Decrypt .env.vault file.}
   spec.homepage      = "https://github.com/dotenv-org/dotenv-vault-ruby"
   spec.license       = "MIT"
   spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")

data/lib/dotenv-vault/version.rb

@@ -1,3 +1,3 @@
 module DotenvVault
-  VERSION = "0.9.0"
+  VERSION = "0.10.0"
 end

data/lib/dotenv-vault.rb

@@ -117,31 +117,35 @@ module DotenvVault
   def parse_vault(*filenames)
     # DOTENV_KEY=development/key_1234
     #
-    # Warn the developer unless formatted correctly
-    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(ENV["DOTENV_KEY"])
+    # Warn the developer unless present
+    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(dotenv_key)
 
-    # Parse DOTENV_KEY. Format is a URI
-    uri = URI.parse(ENV["DOTENV_KEY"]) # dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=production
+    # Parse .env.vault
+    parsed = Dotenv.parse(vault_path)
 
-    # Get decrypt key
-    key = uri.password
-    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Missing key part" unless present?(key)
+    # handle scenario for comma separated keys - for use with key rotation
+    # example: DOTENV_KEY="dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenv.org/vault/.env.vault?environment=prod"
+    keys = dotenv_key.split(',')
 
-    # Get environment
-    params = Hash[URI::decode_www_form(uri.query.to_s)]
-    environment = params["environment"]
-    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Missing environment part" unless present?(environment)
+    decrypted = nil
+    keys.each_with_index do |split_dotenv_key, index|
+      begin
+        # Get full key
+        key = split_dotenv_key.strip
 
-    # Parse .env.vault
-    parsed = Dotenv.parse(vault_path)
+        # Get instructions for decrypt
+        attrs = instructions(parsed, key)
 
-    # Get ciphertext
-    environment_key = "DOTENV_VAULT_#{environment.upcase}"
-    ciphertext = parsed[environment_key] # DOTENV_VAULT_PRODUCTION
-    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate #{environment_key} in .env.vault" unless ciphertext
+        # Decrypt
+        decrypted = decrypt(attrs[:ciphertext], attrs[:key])
 
-    # Decrypt ciphertext
-    decrypted = decrypt(ciphertext, key)
+        break
+      rescue => error
+        # last key
+        raise error if index >= keys.length - 1
+        # try next key
+      end
+    end
 
     # Parse decrypted .env string
     Dotenv::Parser.call(decrypted, true)
@@ -152,7 +156,13 @@ module DotenvVault
   end
 
   def dotenv_key_present?
-    present?(ENV["DOTENV_KEY"]) && dotenv_vault_present?
+    present?(dotenv_key) && dotenv_vault_present?
+  end
+
+  def dotenv_key
+    return ENV["DOTENV_KEY"] if present?(ENV["DOTENV_KEY"])
+
+    ""
   end
 
   def dotenv_vault_present?
@@ -170,7 +180,7 @@ module DotenvVault
   def decrypt(ciphertext, key)
     key = key[-64..-1] # last 64 characters. allows for passing keys with preface like key_*****
 
-    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Key part must be 64 characters long (or more)" unless key.bytesize == 64
+    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Key part must be 64 characters long (or more)" unless key && key.bytesize == 64
 
     lockbox = Lockbox.new(key: key, encode: true)
     begin
@@ -179,4 +189,28 @@ module DotenvVault
       raise DecryptionFailed, "DECRYPTION_FAILED: Please check your DOTENV_KEY"
     end
   end
+
+  def instructions(parsed, split_dotenv_key)
+    # Parse DOTENV_KEY. Format is a URI
+    uri = URI.parse(split_dotenv_key) # dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=production
+
+    # Get decrypt key
+    key = uri.password
+    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Missing key part" unless present?(key)
+
+    # Get environment
+    params = Hash[URI::decode_www_form(uri.query.to_s)]
+    environment = params["environment"]
+    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: Missing environment part" unless present?(environment)
+
+    # Get ciphertext payload
+    environment_key = "DOTENV_VAULT_#{environment.upcase}"
+    ciphertext = parsed[environment_key] # DOTENV_VAULT_PRODUCTION
+    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate #{environment_key} in .env.vault" unless ciphertext
+
+    {
+      ciphertext: ciphertext,
+      key: key
+    }
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dotenv-vault
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: ruby
 authors:
 - motdotla
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-10-23 00:00:00.000000000 Z
+date: 2022-11-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv
@@ -80,7 +80,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: dotenv-vault
+description: Decrypt .env.vault file.
 email:
 - mot@mot.la
 executables: []
@@ -131,5 +131,5 @@ requirements: []
 rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
-summary: dotenv-vault
+summary: Decrypt .env.vault file.
 test_files: []