dotenvcrypt 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 281a89c7380b61972623d6d94ab5e10911b07d49abd05653974b60c83c0a243c
-  data.tar.gz: cd25bc6834e0aa6bd8927a3ca5e20fd00712967abd446c537109de7bc6a5e9ff
+  metadata.gz: 1ead91de7add08540af64e47ff6f32f8c0a3e0f552fdd6b5a04a0485dc618909
+  data.tar.gz: fef0232606440a15f36b5f9e3ab39588df74780cd110697e53c4cfc1a5ca1f48
 SHA512:
-  metadata.gz: 3ab9cb7e645289a41a17e2f534d58ad59cd891f95d5665613d25329a11815bc154ba74e6ab8eba43f7647561f818ba177b249d42fe6078a5d7be9b8e84a2a35a
-  data.tar.gz: 6bbe096aca3355525202c64e9fdd79a6942441f7e7f7ab8457d48a81a389696e88f21c4fa9b6708ca038feca44538bce8a32209e8f3ee73fa882473a6f96591a
+  metadata.gz: 64aa077f96823950f7c354f9a08f61c671e042d2fefd17df84c5776f53cbc21c590b6716c22d3d696baa2cf67804142b6a44cef5fc7acde87c5fc182f4ffbbea
+  data.tar.gz: 2600fa1f56ae93551ad6649f7dca32cebb2dbfd3bec63c5501a5c836162110d4aa2eff7efaccde382a0044c312ac0dce44cb890dc54c9e0b1bde9eea9b02249d

data/bin/dotenvcrypt

@@ -55,11 +55,11 @@ case command
 when 'encrypt'
   input_file = ARGV[0] || UNENCRYPTED_FILE
   output_file = ARGV[1] || ENCRYPTED_FILE
-  dotenvcrypt.encrypt_env(input_file, output_file)
+  dotenvcrypt.encrypt_file(input_file, output_file)
 when 'decrypt'
-  dotenvcrypt.decrypt_env(ARGV[0] || ENCRYPTED_FILE)
+  dotenvcrypt.decrypt_file(ARGV[0] || ENCRYPTED_FILE)
 when 'edit'
-  dotenvcrypt.edit_env(ARGV[0] || ENCRYPTED_FILE)
+  dotenvcrypt.edit_file(ARGV[0] || ENCRYPTED_FILE)
 else
   puts "Unknown command: #{command}"
   puts opt_parser

data/lib/dotenvcrypt/encryptor.rb

@@ -0,0 +1,65 @@
+module Dotenvcrypt
+  class Encryptor
+    def initialize(encryption_key)
+      @encryption_key = encryption_key
+    end
+
+    # Encrypt file
+    def encrypt(data)
+      cipher = OpenSSL::Cipher::AES256.new(:GCM)
+      cipher.encrypt
+      key = OpenSSL::Digest::SHA256.digest(encryption_key)
+      cipher.key = key
+
+      # Generate a secure random IV (12 bytes is recommended for GCM)
+      iv = cipher.random_iv
+
+      encrypted = cipher.update(data) + cipher.final
+
+      # Get the authentication tag (16 bytes)
+      auth_tag = cipher.auth_tag
+
+      # Combine IV, encrypted data, and auth tag
+      combined = iv + auth_tag + encrypted
+
+      # Convert to base64 for readability
+      Base64.strict_encode64(combined)
+    end
+
+    # Decrypt file
+    def decrypt(encoded_data)
+      begin
+        data = Base64.strict_decode64(encoded_data)
+      rescue ArgumentError
+        puts "❌ Decryption failed. File is not in valid base64 format."
+        exit(1)
+      end
+
+      # For GCM mode:
+      # - IV is 12 bytes
+      # - Auth tag is 16 bytes
+      iv_size = 12
+      auth_tag_size = 16
+
+      # Extract the components
+      iv = data[0...iv_size]
+      auth_tag = data[iv_size...(iv_size + auth_tag_size)]
+      encrypted_data = data[(iv_size + auth_tag_size)..-1]
+
+      cipher = OpenSSL::Cipher::AES256.new(:GCM)
+      cipher.decrypt
+      cipher.key = OpenSSL::Digest::SHA256.digest(encryption_key)
+      cipher.iv = iv
+      cipher.auth_tag = auth_tag
+
+      cipher.update(encrypted_data) + cipher.final
+    rescue OpenSSL::Cipher::CipherError
+      puts "❌ Decryption failed. Invalid key, corrupted file, or tampering detected."
+      exit(1)
+    end
+
+    private
+
+    attr_reader :encryption_key
+  end
+end

data/lib/dotenvcrypt/manager.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require 'openssl'
 require 'base64'
+require 'openssl'
+require 'tempfile'
 require 'tty-prompt'
 require 'tty-command'
-require 'tempfile'
-require 'optparse'
+require_relative 'encryptor'
 
 module Dotenvcrypt
   class Manager
@@ -22,38 +22,49 @@ module Dotenvcrypt
 
     def initialize(encryption_key = nil)
       @encryption_key = encryption_key
+      @encryptor = Encryptor.new(fetch_key)
     end
 
     # Encrypt an existing `.env` file
-    def encrypt_env(unencrypted_file, encrypted_file)
+    def encrypt_file(unencrypted_file, encrypted_file)
       unless File.exist?(unencrypted_file)
         puts "❌ File not found: #{unencrypted_file}"
         exit(1)
       end
 
-      encrypt(unencrypted_file, encrypted_file)
+      File.open(encrypted_file, 'w') do |f|
+        f.write encryptor.encrypt(File.read(unencrypted_file))
+      end
 
       puts "🔒 Encrypted #{unencrypted_file} → #{encrypted_file}"
     end
 
     # Decrypt an encrypted `.env` file and print to stdout
-    def decrypt_env(encrypted_file)
-      puts decrypt(encrypted_file)
+    def decrypt_file(encrypted_file)
+      puts encryptor.decrypt(File.read(encrypted_file))
     end
 
     # Edit decrypted env, then re-encrypt
-    def edit_env(encrypted_file)
+    def edit_file(encrypted_file)
       temp_file = Tempfile.new('dotenvcrypt')
 
+      original_content = encryptor.decrypt(File.read(encrypted_file))
+
       File.open(temp_file.path, 'w') do |f|
-        f.write decrypt(encrypted_file)
+        f.write original_content
       end
 
       puts "Waiting for file to be saved. Abort with Ctrl-C."
 
       system("#{ENV['EDITOR'] || 'vim'} #{temp_file.path}")
 
-      encrypt(temp_file.path, encrypted_file)
+      updated_content = File.read(temp_file.path)
+
+      if updated_content != original_content
+        File.open(encrypted_file, 'w') do |f|
+          f.write encryptor.encrypt(updated_content)
+        end
+      end
 
       puts "🔒 Encrypted and saved #{encrypted_file}"
     ensure
@@ -62,68 +73,7 @@ module Dotenvcrypt
 
     private
 
-    attr_reader :encryption_key
-
-    # Encrypt file
-    def encrypt(input_file, output_file)
-      cipher = OpenSSL::Cipher::AES256.new(:GCM)
-      cipher.encrypt
-      key = OpenSSL::Digest::SHA256.digest(fetch_key)
-      cipher.key = key
-
-      # Generate a secure random IV (12 bytes is recommended for GCM)
-      iv = cipher.random_iv
-
-      data = File.read(input_file)
-      encrypted = cipher.update(data) + cipher.final
-
-      # Get the authentication tag (16 bytes)
-      auth_tag = cipher.auth_tag
-
-      # Combine IV, encrypted data, and auth tag
-      combined = iv + auth_tag + encrypted
-
-      # Convert to base64 for readability
-      base64_data = Base64.strict_encode64(combined)
-
-      File.open(output_file, 'w') do |f|
-        f.write(base64_data)
-      end
-    end
-
-    # Decrypt file
-    def decrypt(input_file)
-      # Read the encrypted file
-      begin
-        base64_data = File.read(input_file)
-        data = Base64.strict_decode64(base64_data)
-      rescue ArgumentError
-        puts "❌ Decryption failed. File is not in valid base64 format."
-        exit(1)
-      end
-
-      # For GCM mode:
-      # - IV is 12 bytes
-      # - Auth tag is 16 bytes
-      iv_size = 12
-      auth_tag_size = 16
-
-      # Extract the components
-      iv = data[0...iv_size]
-      auth_tag = data[iv_size...(iv_size + auth_tag_size)]
-      encrypted_data = data[(iv_size + auth_tag_size)..-1]
-
-      cipher = OpenSSL::Cipher::AES256.new(:GCM)
-      cipher.decrypt
-      cipher.key = OpenSSL::Digest::SHA256.digest(fetch_key)
-      cipher.iv = iv
-      cipher.auth_tag = auth_tag
-
-      cipher.update(encrypted_data) + cipher.final
-    rescue OpenSSL::Cipher::CipherError
-      puts "❌ Decryption failed. Invalid key, corrupted file, or tampering detected."
-      exit(1)
-    end
+    attr_reader :encryption_key, :encryptor
 
     # Get encryption key: From CLI arg OR encryption-key file OR securely prompt from stdin
     def fetch_key
@@ -133,11 +83,7 @@ module Dotenvcrypt
         return File.read(key_file).strip if File.exist?(key_file)
       end
 
-      prompt.ask("Enter encryption key:", echo: false)
-    end
-
-    def prompt
-      @prompt ||= TTY::Prompt.new
+      TTY::Prompt.new.ask("Enter encryption key:", echo: false)
     end
   end
 end

data/lib/dotenvcrypt/version.rb

@@ -1,3 +1,3 @@
 module Dotenvcrypt
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/dotenvcrypt.rb

@@ -1,2 +1,3 @@
+require_relative "dotenvcrypt/encryptor"
 require_relative "dotenvcrypt/manager"
 require_relative "dotenvcrypt/version"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dotenvcrypt
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Dan Loman
@@ -38,8 +38,8 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.10.1
-description: dotenvcrypt ensures any API keys in your .env files are encrypted - enabling
-  storage of these files directly within Git.
+description: dotenvcrypt ensures your .env files - and, by extension, any secrets
+  within them - are encrypted, enabling storage of these files directly within Git.
 email:
 - daniel.loman@gmail.com
 executables:
@@ -51,6 +51,7 @@ files:
 - README.md
 - bin/dotenvcrypt
 - lib/dotenvcrypt.rb
+- lib/dotenvcrypt/encryptor.rb
 - lib/dotenvcrypt/manager.rb
 - lib/dotenvcrypt/version.rb
 homepage: https://github.com/namolnad/dotenvcrypt