dry-credentials 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 24deb6ca2d926a11c530c6e81821af802fe1ac36e4fafb8c2273619afdd4ff8e
+  data.tar.gz: 5be212ecb261ab3134b80f14d93a8ca9b7492be642b7a129b16239b0b727410f
+SHA512:
+  metadata.gz: a4e0f03fa13561dbc97b110b2d3f660889f0fe76d98615b981af07bf5b44481669f9b176692f77508d71d3629a8cf05c98262601cef5db4a5ee04b0d04de158a
+  data.tar.gz: a0258c2537012e92dfa82ec88d1881a740d04eb9fae617fbafc79a3dabb9e0ff526e51856218a0316c5d99a1c357edb681d404cd2f831f7f79e183659de2dde3

data/CHANGELOG.md

@@ -0,0 +1,13 @@
+## Main
+
+Nothing so far
+
+## 0.1.0
+
+#### Initial implementation
+
+* Require Ruby 3.0 or newer
+* Class mixin featuring the `credentials` macro:
+  * Block to change (default) settings such as the cipher
+  * Bang method to edit or reload credentials
+  * Arbitrary method chain to query credentials

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 Sven Schwyn
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,167 @@
+[![Version](https://img.shields.io/gem/v/dry-credentials.svg?style=flat)](https://rubygems.org/gems/dry-credentials)
+[![Tests](https://img.shields.io/github/actions/workflow/status/svoop/dry-credentials/test.yml?style=flat&label=tests)](https://github.com/svoop/dry-credentials/actions?workflow=Test)
+[![Code Climate](https://img.shields.io/codeclimate/maintainability/svoop/dry-credentials.svg?style=flat)](https://codeclimate.com/github/svoop/dry-credentials/)
+[![Donorbox](https://img.shields.io/badge/donate-on_donorbox-yellow.svg)](https://donorbox.org/bitcetera)
+
+# Dry::Credentials
+
+Manage and deploy secrets (access keys, API tokens etc) in encrypted files which can safely be committed to the code repository. To decrypt and and use them, only one environment variable containing the corresponding key is required.
+
+While similar in purpose to ActiveSupport::EncryptedConfiguration, this lightweight implementation doesn't introduce any dependencies.
+
+* [Homepage](https://github.com/svoop/dry-credentials)
+* [API](https://www.rubydoc.info/gems/dry-credentials)
+* Author: [Sven Schwyn - Bitcetera](https://bitcetera.com)
+
+## Install
+
+### Security
+
+This gem is [cryptographically signed](https://guides.rubygems.org/security/#using-gems) in order to assure it hasn't been tampered with. Unless already done, please add the author's public key as a trusted certificate now:
+
+```
+gem cert --add <(curl -Ls https://raw.github.com/svoop/dry-credentials/main/certs/svoop.pem)
+```
+
+### Bundler
+
+Add the following to the <tt>Gemfile</tt> or <tt>gems.rb</tt> of your [Bundler](https://bundler.io) powered Ruby project:
+
+```ruby
+gem 'dry-credentials'
+```
+
+And then install the bundle:
+
+```
+bundle install --trust-policy MediumSecurity
+```
+
+## Usage
+
+Extend any class with `Dry::Credentials` to use the [default settings](#defaults):
+
+```ruby
+class App
+  extend Dry::Credentials
+end
+```
+
+The `credentials` macro allows you to tweak the settings:
+
+```ruby
+class App
+  extend Dry::Credentials
+
+  credentials do
+    env "sandbox"
+    dir "/path/to/credentials"
+  end
+end
+```
+
+⚠️ The `dir` must exist and have the proper permissions set.
+
+Now initialize the credentials for this `env`:
+
+```ruby
+App.credentials.edit!
+```
+
+It creates `/path/to/credentials/sandbox.yml.enc` (where the encrypted credentials are stored) and opens this file using your favourite editor as per the `EDITOR` environment variable.
+
+For the sake of this example, let's assume you paste the following credentials:
+
+```yml
+otp:
+  secret_key: ZcikLNiUQoqOo594oH2eqw04HPclhjkpgvpBik/40oU=
+  salt: 583506a49c71724a9f085bf2e70362df9d973f08d6575191cab6a177dfb872c6
+  meta:
+    realm: main
+```
+
+When you close the editor, the credentials are encrypted and stored. This first time only, the key to encrypt and decrypt is printed to STDOUT:
+
+```
+SANDBOX_CREDENTIALS_KEY=68656973716a4e706e336733377245732b6e77584c6c772b5432446532456f674767664271374a623876383d
+```
+
+⚠️ In case you've entered invalid YAML, a warning will be printed and the editor reopens immediately.
+
+To decrypt the credentials and use them in your app, you have to set just this one environment variable containing the key, in this case:
+
+```sh
+export SANDBOX_CREDENTIALS_KEY=68656973716a4e706e336733377245732b6e77584c6c772b5432446532456f674767664271374a623876383d
+```
+
+With this in place, you can use the decrypted credentials anywhere in your app:
+
+```ruby
+App.credentials.otp.secret_key
+# => "ZcikLNiUQoqOo594oH2eqw04HPclhjkpgvpBik/40oU="
+
+App.credentials.otp.meta.realm
+# => "main"
+```
+
+## Environments
+
+Credentials are isolated into environments which most likely will, but don't necessarily have to align with the environments of the app framework you're using.
+
+By default, the current environment is read from `RACK_ENV`.
+
+⚠️ For safety reasons, don't share the same key across multiple environments!
+
+## Reload Credentials
+
+The credentials are lazy loaded when queried for the first time. After that, changes in the encrypted credentials files are not taken into account at runtime for efficiency reasons.
+
+However, you can schedule a reload:
+
+```ruby
+App.credentials.reload!
+```
+
+The reload is not done immediately but the next time credentials are queried.
+
+## Edit Credentials
+
+This gem does not provide any CLI tools to edit the credentials. You should integrate it into your app instead e.g. with a Rake task or an extension to the CLI tool of the app framework you're using.
+
+You can explicitly pass the environment to edit:
+
+```ruby
+App.credentials.edit! "production"
+```
+
+Editing credentials implicitly schedules a `reload!`.
+
+## Settings
+
+If you have to, you can access the settings programmatically:
+
+```ruby
+App.credentials[:env]   # => "production"
+```
+
+### Defaults
+
+Setting | Default | Description
+--------|---------|------------
+`env` | `-> { ENV["RACK_ENV"] }` | environment such as `development`
+`dir` | `"config/credentials"` | directory where encrypted credentials are stored
+`cipher` | `"aes-256-gcm"` | any of `OpenSSL::Cipher.ciphers`
+`digest` | `"sha256"` | sign digest used if the cipher doesn't support AEAD
+`serializer` | `Marshal` | serializer responding to `dump` and `load`
+
+## Development
+
+To install the development dependencies and then run the test suite:
+
+```
+bundle install
+bundle exec rake    # run tests once
+bundle exec guard   # run tests whenever files are modified
+```
+
+You're welcome to [submit issues](https://github.com/svoop/dry-credentials/issues) and contribute code by [forking the project and submitting pull requests](https://docs.github.com/en/get-started/quickstart/fork-a-repo).

data/lib/dry/credentials/encryptor.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+# Inspired by +ActiveSupport::EncryptedConfiguration+, the most recent compare
+# to pinpoint newly discovered safety issues was done against version 7.0.4.2.
+
+module Dry
+  module Credentials
+    class Encryptor
+
+      DEFAULT_CIPHER = 'aes-256-gcm'
+      DEFAULT_DIGEST = 'sha256'
+      DEFAULT_SERIALIZER = Marshal
+      SEPARATOR = '--'
+
+      attr_reader :cipher
+
+      # @param cipher [String] any of +OpenSSL::Cipher.ciphers+
+      # @param digest [String] any of +openssl list+
+      # @param serializer [Class] must respond to +dump+ and +load+
+      def initialize(cipher: DEFAULT_CIPHER, digest: DEFAULT_DIGEST, serializer: DEFAULT_SERIALIZER)
+        @cipher = OpenSSL::Cipher.new(cipher)
+        @digest, @serializer = digest, serializer
+      end
+
+      # Generate a random key with the length requird by the current cipher,
+      # then Base64 encodes and unpacks all bytes to hex.
+      #
+      # @return [String] key
+      def generate_key
+        unpack(encode(SecureRandom.bytes(cipher.key_len)))
+      end
+
+      # Encrypts the object
+      #
+      # Relies on encrypted authenticated encryption mode if available for the
+      # selected cipher. Otherwise, the encrypted string is HMAC signed.
+      #
+      # @param object [Object] object to be encrypted
+      # @param key [String] key (Base64 encoded and unpacked to hex)
+      # @return [String] encrypted and authenticated/signed string
+      def encrypt(object, key:)
+        cipher.encrypt
+        cipher.key = decoded_key = decode(pack(key.strip))
+        iv = cipher.random_iv
+        cipher.auth_data = '' if aead?
+        cipher.update(@serializer.dump(object)).then do |data|
+          data << cipher.final
+          data = encode(data) + SEPARATOR + encode(iv)
+          data << SEPARATOR + if aead?
+            encode(cipher.auth_tag)
+          else
+            hmac(decoded_key, data)
+          end
+        end
+      end
+
+      # Decrypts the encrypted object
+      #
+      # @param encrypted_object [String] encrypted object to be decrypted
+      # @param key [String] key (Base64 encoded and unpacked to hex)
+      # @return [Object] verified and decrypted object
+      def decrypt(encrypted_object, key:)
+        cipher.decrypt
+        cipher.key = decoded_key = decode(pack(key.strip))
+        payload, iv, auth_tag = encrypted_object.strip.split(SEPARATOR)
+        if auth_tag.nil? ||
+          (aead? && decode(auth_tag).bytes.length != auth_tag_length) ||
+          (!aead? && hmac(decoded_key, payload + SEPARATOR + iv) != auth_tag)
+        then
+          fail Dry::Credentials::InvalidEncryptedObjectError
+        end
+        cipher.iv = decode(iv)
+        if aead?
+          cipher.auth_tag = decode(auth_tag)
+          cipher.auth_data = ''
+        end
+        cipher.update(decode(payload)).then do |data|
+          data << cipher.final
+          @serializer.load(data)
+        end
+      rescue OpenSSL::Cipher::CipherError, TypeError, ArgumentError
+        raise Dry::Credentials::InvalidEncryptedObjectError
+      end
+
+      private
+
+      # @example
+      #   encode("abc")   # => "YWJj"
+      def encode(string)
+        Base64.strict_encode64(string)
+      end
+
+      # @example
+      #   decode("YWJj")   # => "abc"
+      def decode(string)
+        Base64.strict_decode64(string)
+      end
+
+      # @example
+      #   unpack("YWJj")   # => "59574a6a"
+      def unpack(string)
+        string.unpack1('H*')
+      end
+
+      # @example
+      #   pack("59574a6a")   # => "YWJj"
+      def pack(string)
+        [string].pack('H*')
+      end
+
+      # Whether the cipher supports AEAD (Authenticated Encryption with
+      # Associated Data) or not - in which case a HMAC signature using the
+      # +digest+ is used instead
+      def aead?
+        @auth ||= cipher.authenticated?
+      end
+
+      def hmac(key, string)
+        OpenSSL::HMAC.hexdigest(@digest, key, string)
+      end
+
+      # @see https://github.com/ruby/openssl/issues/63
+      def auth_tag_length
+        16
+      end
+
+    end
+  end
+end

data/lib/dry/credentials/errors.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    class UnrecognizedSettingError < StandardError
+      def initialize(msg='setting not recognized') = super
+    end
+
+    class EnvNotSetError < StandardError
+      def initialize(msg='env must be set') = super
+    end
+
+    class KeyNotSetError < StandardError
+      def initialize(msg='key must be set') = super
+    end
+
+    class InvalidEncryptedObjectError < StandardError
+      def initialize(msg='corrupt encrypted object or wrong key') = super
+    end
+
+    class YAMLFormatError < StandardError
+      def initialize(msg='top level must be a dictionary') = super
+    end
+  end
+end

data/lib/dry/credentials/extension.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    class Extension
+
+      def initialize
+        @settings = Dry::Credentials::Settings.new
+        @injected = []
+      end
+
+      # Load the credentials once
+      #
+      # @api private
+      # @return [self]
+      def load!
+        helpers = Dry::Credentials::Helpers.new(self)
+        if  @injected.none? && !helpers.create?
+          @injected = Dry::Credentials::YAML.new(helpers.read_yaml).inject_into(self)
+        end
+        self
+      end
+
+      # Reload the credentials
+      #
+      # @return [self]
+      def reload!
+        singleton_class.undef_method(@injected.pop) until @injected.empty?
+        self
+      end
+
+      # Edit credentials file
+      #
+      # @param env [String] name of the env to edit the credentials for
+      # @return [self]
+      def edit!(env=nil)
+        helpers = Dry::Credentials::Helpers.new(self, env)
+        create = helpers.create?
+        yaml = helpers.read_yaml
+        begin
+          yaml = helpers.edit_yaml yaml
+        end until helpers.yaml_valid? yaml
+        helpers.write_yaml yaml
+        puts [helpers.key_ev, ENV[helpers.key_ev]].join('=') if create
+        reload!
+      end
+
+      # Query settings
+      #
+      # @param setting [String] name of the setting
+      # @return [String] setting value
+      def [](setting)
+        @settings.send(setting)
+      end
+
+    end
+  end
+end

data/lib/dry/credentials/helpers.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    class Helpers
+
+      # Helpers wrapped in a separate class in order not to pollute the
+      # extension with methods that could collide with credentials
+      #
+      # @param extension [Dry::Credentials::Extension] extension using the helpers
+      # @param env [String, nil] overrides env setting
+      def initialize(extension, env=nil)
+        @extension = extension
+        @env = env || extension[:env]
+      end
+
+      # Read the encrypted file and return the decrypted YAML content
+      #
+      # @return [String] YAML content
+      def read_yaml
+        return '' if create?
+        encryptor.decrypt(encrypted_file.read, key: key)
+      end
+
+      # Write the decrypted YAML content to the encrypted file
+      #
+      # @param yaml [String] YAML content
+      def write_yaml(yaml)
+        encrypted_file.write(encryptor.encrypt(yaml, key: key))
+      end
+
+      # Open the given YAML in the preferred editor
+      #
+      # @param yaml [String] YAML content to edit
+      # @return [String] edited YAML content
+      def edit_yaml(yaml)
+        Tempfile.create('dryc') do |tempfile|
+          tempfile.write yaml
+          tempfile.close
+          system %Q(#{ENV['EDITOR']} "#{tempfile.path}")
+          File.read(tempfile.path)
+        end
+      end
+
+      # Whether the YAML content can be read
+      #
+      # @param yaml [String] YAML content
+      # @return [Boolean]
+      def yaml_valid?(yaml)
+        Dry::Credentials::YAML.new(yaml)
+        true
+      rescue Dry::Credentials::YAMLFormatError, Psych::SyntaxError => error
+        warn "WARNING: #{error.message}"
+        false
+      end
+
+      # Whether a new encrypted file will be created
+      #
+      # @return [Boolean]
+      def create?
+        !encrypted_file.exist?
+      end
+
+      # Name of the environment variable holding the key
+      #
+      # @return [String]
+      def key_ev
+        fail Dry::Credentials::EnvNotSetError unless @env
+        "#{@env.upcase}_CREDENTIALS_KEY"
+      end
+
+      private
+
+      def key
+        if create?
+          ENV[key_ev] = encryptor.generate_key
+        else
+          ENV[key_ev]  or fail Dry::Credentials::KeyNotSetError
+        end
+      end
+
+      def encrypted_file
+        fail Dry::Credentials::EnvNotSetError unless @env
+        Pathname(@extension[:dir]).realpath.join("#{@env}.yml.enc")
+      end
+
+      def encryptor
+        Dry::Credentials::Encryptor.new(
+          cipher: @extension[:cipher],
+          digest: @extension[:digest],
+          serializer: @extension[:serializer]
+        )
+      end
+
+    end
+  end
+end

data/lib/dry/credentials/settings.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    class Settings
+
+      DEFAULT_SETTINGS = {
+        env: -> { ENV['RACK_ENV'] },
+        dir: 'config/credentials',
+        cipher: 'aes-256-gcm',
+        digest: 'sha256',
+        serializer: Marshal
+      }.freeze
+
+      def initialize
+        @settings = {}
+      end
+
+      def method_missing(key, value=nil)
+        fail Dry::Credentials::UnrecognizedSettingError, key unless DEFAULT_SETTINGS.has_key? key
+        if value
+          @settings[key] = value
+        else
+          resolve(@settings[key] || DEFAULT_SETTINGS[key])
+        end
+      end
+
+      private
+
+      def resolve(value)
+        if value.respond_to? :call
+          value.call
+        else
+          value
+        end
+      end
+
+    end
+  end
+end

data/lib/dry/credentials/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    VERSION = "0.1.0"
+  end
+end

data/lib/dry/credentials/yaml.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Dry
+  module Credentials
+    class YAML
+
+      # @param string [String] YAML document content
+      def initialize(yaml)
+        @yaml = yaml
+        @hash = ::YAML.safe_load yaml
+        fail Dry::Credentials::YAMLFormatError unless @hash.instance_of? Hash
+      rescue Psych::DisallowedClass
+        raise Dry::Credentials::YAMLFormatError
+      end
+
+      # Define readers for the first level of the credentials on the
+      # given +object+.
+      #
+      # @param [Object] object to inject the methods into
+      # @return [Array] injected methods
+      def inject_into(object)
+        Query.new(@hash).send(:inject_into, object)
+      end
+
+      class Query
+        # @param hash [Hash] hash of hashes containing the credentials
+        def initialize(hash)
+          @hash = hash
+          inject_into self
+        end
+
+        # Get all credentials below the current node as a hash.
+        #
+        # @return [Hash] credentials
+        def to_h
+          @hash
+        end
+
+        private
+
+        def inject_into(object)
+          @hash.each do |key, value|
+            object.define_singleton_method key do
+              if value.instance_of? Hash
+                Query.new value
+              else
+                value
+              end
+            end
+          end
+          @hash.keys
+        end
+      end
+
+    end
+  end
+end

data/lib/dry/credentials.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "tempfile"
+require "yaml"
+require "securerandom"
+require "openssl"
+require "base64"
+
+require_relative "credentials/version"
+require_relative "credentials/errors"
+require_relative "credentials/encryptor"
+require_relative "credentials/yaml"
+require_relative "credentials/settings"
+require_relative "credentials/helpers"
+require_relative "credentials/extension"
+
+module Dry
+  module Credentials
+    def credentials(&block)
+      if block
+        __credentials_extension__
+          .instance_variable_get('@settings')
+          .instance_eval(&block)
+        self
+      else
+        __credentials_extension__.load!
+      end
+    end
+
+    def __credentials_extension__
+      @__credentials_extension__ ||= Extension.new
+    end
+  end
+end

data/lib/dry-credentials.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "dry/credentials"

data.tar.gz.sig

@@ -0,0 +1,3 @@
+nޯ�U��:�\����	��$A֣/
+���ok�^�T[0m����;�����fA~܀ /�-Dt\�|&Zt���€�� QrV��ԋ�AX�P�J͈b]��h0vEg��"�v�S���e�#�Ͼ���Yr��Y�lg��՘�]�p���PD��VW�dh�Z��?���0Ӆ�+��Ȕf�>��2E���+	�=�u�h����k�
+��y

metadata

@@ -0,0 +1,210 @@
+--- !ruby/object:Gem::Specification
+name: dry-credentials
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Sven Schwyn
+autorequire:
+bindir: bin
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDODCCAiCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAjMSEwHwYDVQQDDBhydWJ5
+  L0RDPWJpdGNldGVyYS9EQz1jb20wHhcNMjIxMTA2MTIzNjUwWhcNMjMxMTA2MTIz
+  NjUwWjAjMSEwHwYDVQQDDBhydWJ5L0RDPWJpdGNldGVyYS9EQz1jb20wggEiMA0G
+  CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDcLg+IHjXYaUlTSU7R235lQKD8ZhEe
+  KMhoGlSUonZ/zo1OT3KXcqTCP1iMX743xYs6upEGALCWWwq+nxvlDdnWRjF3AAv7
+  ikC+Z2BEowjyeCCT/0gvn4ohKcR0JOzzRaIlFUVInlGSAHx2QHZ2N8ntf54lu7nd
+  L8CiDK8rClsY4JBNGOgH9UC81f+m61UUQuTLxyM2CXfAYkj/sGNTvFRJcNX+nfdC
+  hM9r2kH1+7wsa8yG7wJ2IkrzNACD8v84oE6qVusN8OLEMUI/NaEPVPbw2LUM149H
+  PVa0i729A4IhroNnFNmw4wOC93ARNbM1+LW36PLMmKjKudf5Exg8VmDVAgMBAAGj
+  dzB1MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBSfK8MtR62mQ6oN
+  yoX/VKJzFjLSVDAdBgNVHREEFjAUgRJydWJ5QGJpdGNldGVyYS5jb20wHQYDVR0S
+  BBYwFIEScnVieUBiaXRjZXRlcmEuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAYG2na
+  ye8OE2DANQIFM/xDos/E4DaPWCJjX5xvFKNKHMCeQYPeZvLICCwyw2paE7Otwk6p
+  uvbg2Ks5ykXsbk5i6vxDoeeOLvmxCqI6m+tHb8v7VZtmwRJm8so0eSX0WvTaKnIf
+  CAn1bVUggczVdNoBXw9WAILKyw9bvh3Ft740XZrR74sd+m2pGwjCaM8hzLvrVbGP
+  DyYhlBeRWyQKQ0WDIsiTSRhzK8HwSTUWjvPwx7SEdIU/HZgyrk0ETObKPakVu6bH
+  kAyiRqgxF4dJviwtqI7mZIomWL63+kXLgjOjMe1SHxfIPo/0ji6+r1p4KYa7o41v
+  fwIwU1MKlFBdsjkd
+  -----END CERTIFICATE-----
+date: 2023-02-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: debug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest-sound
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest-focus
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard-minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: |
+  Manage and deploy secrets (access keys, API tokens etc) in encrypted
+  files which can safely be committed to the code repository. To decrypt and
+  and use them, only one environment variable containing the corresponding key
+  is required.
+
+  While similar to ActiveSupport::EncryptedConfiguration, this lightweight
+  implementation introduces as few dependencies as necessary.
+email:
+- ruby@bitcetera.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- README.md
+- CHANGELOG.md
+- LICENSE.txt
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/dry-credentials.rb
+- lib/dry/credentials.rb
+- lib/dry/credentials/encryptor.rb
+- lib/dry/credentials/errors.rb
+- lib/dry/credentials/extension.rb
+- lib/dry/credentials/helpers.rb
+- lib/dry/credentials/settings.rb
+- lib/dry/credentials/version.rb
+- lib/dry/credentials/yaml.rb
+homepage: https://github.com/svoop/dry-credentials
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/svoop/dry-credentials
+  changelog_uri: https://github.com/svoop/dry-credentials/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/svoop/dry-credentials
+  documentation_uri: https://www.rubydoc.info/gems/dry-credentials
+  bug_tracker_uri: https://github.com/svoop/dry-credentials/issues
+post_install_message:
+rdoc_options:
+- "--title"
+- Dry::Credentials
+- "--main"
+- README.md
+- "--line-numbers"
+- "--inline-source"
+- "--quiet"
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.7
+signing_key:
+specification_version: 4
+summary: A mixin to use encrypted credentials in your classes
+test_files: []

metadata.gz.sig

@@ -0,0 +1,3 @@
+SC8Ɉd��']'���� lX�B�!s��
+q:���i-�1��Ѫ��E�1{θ��M]IQ�u��N*�+�|�o�P7@��E%��0�<;TU�<>���הGs����5�	Dv*�
+_�̃��Y_4	� �:z&W>o��.�&p��j,-uP���"d��Cj���O���+