ecfg 0.2.0 → 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/build/darwin-amd64/ecfg +0 -0
- data/build/linux-amd64/ecfg +0 -0
- data/lib/ecfg/version.rb +1 -1
- data/man/man1/ecfg-decrypt.1 +1 -1
- data/man/man1/ecfg-encrypt.1 +1 -1
- data/man/man1/ecfg-keygen.1 +2 -2
- data/man/man1/ecfg.1 +130 -3
- data/man/man5/ecfg.5 +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 0549b12acc4a5455eab8b0ea68f6842f60db304d
|
|
4
|
+
data.tar.gz: e801695b9fd88dd4c2067ccac42b13da7aa15b33
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 43c148d8d42d3e540de16f4cc50d860e90c692cad41b7e10dd1a73873a005315ffdc11f0cbe4c5e659c467d835bf41bdab10e0714875465afc995d32242dd00a
|
|
7
|
+
data.tar.gz: 6b94f754af12c0457ef1fc690c8c4b97b639a0b17fa774575844f078343c378f536b153ee7c5e5d089b1a55dcb52bde0d6e2c641dff0e6aa35d34c66831d9311
|
data/build/darwin-amd64/ecfg
CHANGED
|
Binary file
|
data/build/linux-amd64/ecfg
CHANGED
|
Binary file
|
data/lib/ecfg/version.rb
CHANGED
data/man/man1/ecfg-decrypt.1
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
.\" generated with Ronn/v0.7.3
|
|
2
2
|
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
|
3
3
|
.
|
|
4
|
-
.TH "ECFG\-DECRYPT" "1" "July 2016" "Shopify" "Version 0.
|
|
4
|
+
.TH "ECFG\-DECRYPT" "1" "July 2016" "Shopify" "Version 0.3.0"
|
|
5
5
|
.
|
|
6
6
|
.SH "NAME"
|
|
7
7
|
\fBecfg\-decrypt\fR \- decrypt an ecfg file
|
data/man/man1/ecfg-encrypt.1
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
.\" generated with Ronn/v0.7.3
|
|
2
2
|
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
|
3
3
|
.
|
|
4
|
-
.TH "ECFG\-ENCRYPT" "1" "July 2016" "Shopify" "Version 0.
|
|
4
|
+
.TH "ECFG\-ENCRYPT" "1" "July 2016" "Shopify" "Version 0.3.0"
|
|
5
5
|
.
|
|
6
6
|
.SH "NAME"
|
|
7
7
|
\fBecfg\-encrypt\fR \- encrypt an ecfg file
|
data/man/man1/ecfg-keygen.1
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
.\" generated with Ronn/v0.7.3
|
|
2
2
|
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
|
3
3
|
.
|
|
4
|
-
.TH "ECFG\-KEYGEN" "1" "July 2016" "Shopify" "Version 0.
|
|
4
|
+
.TH "ECFG\-KEYGEN" "1" "July 2016" "Shopify" "Version 0.3.0"
|
|
5
5
|
.
|
|
6
6
|
.SH "NAME"
|
|
7
7
|
\fBecfg\-keygen\fR \- generate a new keypair for use with ecfg
|
|
@@ -16,7 +16,7 @@ Generates a new keypair suitable for use with ecfg(1) and prints the resulting p
|
|
|
16
16
|
.
|
|
17
17
|
.TP
|
|
18
18
|
\fB\-w\fR, \fB\-\-write\fR
|
|
19
|
-
Rather than printing the keypair to the screen, write it directly to the keydir\. The public key will still be printed, but the private key will be inserted into the
|
|
19
|
+
Rather than printing the keypair to the screen, write it directly to the keydir\. The public key will still be printed, but the private key will be inserted into the first writable path listed in the key paths, decribed in more detail in ecfg(1)\.
|
|
20
20
|
.
|
|
21
21
|
.SH "SEE ALSO"
|
|
22
22
|
ecfg(1), ecfg\-encrypt(1), ecfg\-decrypt(1), ecfg(5)
|
data/man/man1/ecfg.1
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
.\" generated with Ronn/v0.7.3
|
|
2
2
|
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
|
3
3
|
.
|
|
4
|
-
.TH "ECFG" "1" "July 2016" "Shopify" "Version 0.
|
|
4
|
+
.TH "ECFG" "1" "July 2016" "Shopify" "Version 0.3.0"
|
|
5
5
|
.
|
|
6
6
|
.SH "NAME"
|
|
7
7
|
\fBecfg\fR \- manage application secrets via encrypted config
|
|
8
8
|
.
|
|
9
9
|
.SH "SYNOPSIS"
|
|
10
|
-
\fBecfg\fR \fBcommand\fR [\fBargs\fR]
|
|
10
|
+
\fBecfg\fR [\fB\-k\fR|\fB\-\-keydir\fR \fIdir\fR] \fBcommand\fR [\fBargs\fR]
|
|
11
11
|
.
|
|
12
12
|
.SH "DESCRIPTION"
|
|
13
13
|
\fBecfg\fR is a utility for managing a collection of secrets, typically to be committed to source control\. The secrets are encrypted using public key, elliptic curve cryptography\. Secrets are collected in a JSON, YAML, or TOML file, in which all the string values are encrypted\. Public keys are embedded in the file, and the decrypter looks up the corresponding private key from its local filesystem or process environment\.
|
|
@@ -33,17 +33,144 @@ Decrypt an \fBecfg\fR file (alias: \fBecfg d\fR)
|
|
|
33
33
|
\fBecfg keygen\fR : ecfg\-keygen(1)
|
|
34
34
|
Generate an \fBecfg\fR keypair (alias: \fBecfg g\fR)
|
|
35
35
|
.
|
|
36
|
+
.SH "GLOBAL OPTIONS"
|
|
37
|
+
.
|
|
38
|
+
.TP
|
|
39
|
+
\fB\-k\fR, \fB\-\-keydir\fR=\fI\fR
|
|
40
|
+
Use the provided directory instead of the default key paths (decribed in the KEY MANAGEMENT section)
|
|
41
|
+
.
|
|
36
42
|
.SH "ENVIRONMENT"
|
|
37
43
|
.
|
|
38
44
|
.TP
|
|
39
45
|
\fBECFG_KEYDIR\fR
|
|
40
|
-
|
|
46
|
+
Use a custom directory instead of the default key lookup path decribed in the KEY MANAGEMENT section\.
|
|
41
47
|
.
|
|
42
48
|
.TP
|
|
43
49
|
\fBECFG_PRIVATE_KEY\fR
|
|
44
50
|
When decrypting, instead of looking up the matching private key for the public key given in the input file, assume the file was encrypted to the provided private key\. This option is useful when running in environments such as heroku where obtaining keys from disk is impractical\.
|
|
45
51
|
.
|
|
52
|
+
.SH "KEY MANAGEMENT"
|
|
53
|
+
\fBecfg\fR keypairs are stored as individual files in a key directory\. The file name is the public key and the file content is the private key\. \fBecfg\fR has a default lookup path for key directories:
|
|
54
|
+
.
|
|
55
|
+
.IP "\(bu" 4
|
|
56
|
+
\fB$XDG_CONFIG_HOME/ecfg/keys\fR (if \fB$XDG_CONFIG_HOME\fR is set and running as non\-root user)
|
|
57
|
+
.
|
|
58
|
+
.IP "\(bu" 4
|
|
59
|
+
\fB$HOME/\.ecfg/keys\fR (if running as non\-root user)
|
|
60
|
+
.
|
|
61
|
+
.IP "\(bu" 4
|
|
62
|
+
\fB/etc/ecfg/keys\fR
|
|
63
|
+
.
|
|
64
|
+
.IP "\(bu" 4
|
|
65
|
+
\fB/opt/ejson/keys\fR (for backwards\-compatibility with \fBejson\fR)
|
|
66
|
+
.
|
|
67
|
+
.IP "" 0
|
|
68
|
+
.
|
|
69
|
+
.P
|
|
70
|
+
When passing \fB\-k\fR or \fB\-\-keydir\fR to \fBecfg\fR, or when invoked with \fBECFG_KEYDIR\fR in the environment, this lookup path is completely ignored and the key is instead retrieved from or stored to the provided path\.
|
|
71
|
+
.
|
|
72
|
+
.P
|
|
73
|
+
If \fBECFG_PRIVATE_KEY\fR is set for decryption, the key directories aren\'t even touched; instead, we just assume the provided private key is the correct one, failing if it\'s not\.
|
|
74
|
+
.
|
|
46
75
|
.SH "WORKFLOW"
|
|
76
|
+
.
|
|
77
|
+
.SS "1: Create the Keydir"
|
|
78
|
+
By default, \fBecfg\fR looks for keys in \fB/opt/ecfg/keys\fR\. You can change this by setting \fBECFG_KEYDIR\fR or passing the \fB\-keydir\fR option\.
|
|
79
|
+
.
|
|
80
|
+
.IP "" 4
|
|
81
|
+
.
|
|
82
|
+
.nf
|
|
83
|
+
|
|
84
|
+
$ mkdir \-p /opt/ecfg/keys
|
|
85
|
+
.
|
|
86
|
+
.fi
|
|
87
|
+
.
|
|
88
|
+
.IP "" 0
|
|
89
|
+
.
|
|
90
|
+
.SS "2: Generate a keypair"
|
|
91
|
+
When called with \fB\-w\fR, \fBecfg keygen\fR will write the keypair into the \fBkeydir\fR and print the public key\. Without \fB\-w\fR, it will print both keys to stdout\. This is useful if you have to distribute the key to multiple servers via configuration management, etc\.
|
|
92
|
+
.
|
|
93
|
+
.IP "" 4
|
|
94
|
+
.
|
|
95
|
+
.nf
|
|
96
|
+
|
|
97
|
+
$ ecfg keygen
|
|
98
|
+
Public Key:
|
|
99
|
+
63ccf05a9492e68e12eeb1c705888aebdcc0080af7e594fc402beb24cce9d14f
|
|
100
|
+
Private Key:
|
|
101
|
+
75b80b4a693156eb435f4ed2fe397e583f461f09fd99ec2bd1bdef0a56cf6e64
|
|
102
|
+
|
|
103
|
+
$ \./ecfg keygen \-w
|
|
104
|
+
53393332c6c7c474af603c078f5696c8fe16677a09a711bba299a6c1c1676a59
|
|
105
|
+
$ cat /opt/ecfg/keys/5339*
|
|
106
|
+
888a4291bef9135729357b8c70e5a62b0bbe104a679d829cdbe56d46a4481aaf
|
|
107
|
+
.
|
|
108
|
+
.fi
|
|
109
|
+
.
|
|
110
|
+
.IP "" 0
|
|
111
|
+
.
|
|
112
|
+
.SS "3: Create an ecfg file"
|
|
113
|
+
The format is described in more detail in ecfg(5)\. For now, create a file that looks something like this\. Fill in the \fB<key>\fR with whatever you got back in step 2\.
|
|
114
|
+
.
|
|
115
|
+
.P
|
|
116
|
+
Create this file as \fBtest\.ecfg\.json\fR:
|
|
117
|
+
.
|
|
118
|
+
.IP "" 4
|
|
119
|
+
.
|
|
120
|
+
.nf
|
|
121
|
+
|
|
122
|
+
{
|
|
123
|
+
"_public_key": "<key>",
|
|
124
|
+
"database_password": "1234password"
|
|
125
|
+
}
|
|
126
|
+
.
|
|
127
|
+
.fi
|
|
128
|
+
.
|
|
129
|
+
.IP "" 0
|
|
130
|
+
.
|
|
131
|
+
.P
|
|
132
|
+
You can also use YAML or TOML if you\'d prefer, as long as there\'s a \fB_public_key\fR element at the top\-level\.
|
|
133
|
+
.
|
|
134
|
+
.SS "4: Encrypt the file"
|
|
135
|
+
Running \fBecfg encrypt test\.ecfg\.json\fR will encrypt any new plaintext keys in the file, and leave any existing encrypted keys untouched:
|
|
136
|
+
.
|
|
137
|
+
.IP "" 4
|
|
138
|
+
.
|
|
139
|
+
.nf
|
|
140
|
+
|
|
141
|
+
{
|
|
142
|
+
"_public_key": "63ccf05a9492e68e12eeb1c705888aebdcc0080af7e594fc402beb24cce9d14f",
|
|
143
|
+
"database_password": "EJ[1:WGj2t4znULHT1IRveMEdvvNXqZzNBNMsJ5iZVy6Dvxs=:kA6ekF8ViYR5ZLeSmMXWsdLfWr7wn9qS:fcHQtdt6nqcNOXa97/M278RX6w==]"
|
|
144
|
+
}
|
|
145
|
+
.
|
|
146
|
+
.fi
|
|
147
|
+
.
|
|
148
|
+
.IP "" 0
|
|
149
|
+
.
|
|
150
|
+
.P
|
|
151
|
+
Try adding another plaintext secret to the file and run \fBecfg encrypt test\.ecfg\.json\fR again\. The \fBdatabase_password\fR field will not be changed, but the new secret will be encrypted\.
|
|
152
|
+
.
|
|
153
|
+
.SS "5: Decrypt the file"
|
|
154
|
+
To decrypt the file, you must have a file present in the \fBkeydir\fR whose name is the 64\-byte hex\-encoded public key exactly as embedded in the ecfg(5) document\. The contents of that file must be the similarly\-encoded private key\. If you used \fBecfg keygen \-w\fR, you\'ve already got this covered\.
|
|
155
|
+
.
|
|
156
|
+
.P
|
|
157
|
+
Unlike ecfg\-encrypt(1), which overwrites the specified files, ecfg\-decrypt(1) only takes one file parameter, and prints the output to \fBstdout\fR:
|
|
158
|
+
.
|
|
159
|
+
.IP "" 4
|
|
160
|
+
.
|
|
161
|
+
.nf
|
|
162
|
+
|
|
163
|
+
$ ecfg decrypt foo\.ecfg\.json
|
|
164
|
+
{
|
|
165
|
+
"_public_key": "63ccf05a9492e68e12eeb1c705888aebdcc0080af7e594fc402beb24cce9d14f",
|
|
166
|
+
"database_password": "1234password"
|
|
167
|
+
}
|
|
168
|
+
.
|
|
169
|
+
.fi
|
|
170
|
+
.
|
|
171
|
+
.IP "" 0
|
|
172
|
+
.
|
|
173
|
+
.P
|
|
47
174
|
TODO
|
|
48
175
|
.
|
|
49
176
|
.SH "BUGS"
|
data/man/man5/ecfg.5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
.\" generated with Ronn/v0.7.3
|
|
2
2
|
.\" http://github.com/rtomayko/ronn/tree/0.7.3
|
|
3
3
|
.
|
|
4
|
-
.TH "ECFG" "5" "July 2016" "Shopify" "Version 0.
|
|
4
|
+
.TH "ECFG" "5" "July 2016" "Shopify" "Version 0.3.0"
|
|
5
5
|
.
|
|
6
6
|
.SH "NAME"
|
|
7
7
|
\fBecfg\fR \- JSON, YAML, or TOML file with asymmetric\-key\-encrypted values
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: ecfg
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.3.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Burke Libbey
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-07-
|
|
11
|
+
date: 2016-07-19 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: Secret management by encrypting values in a JSON or YAML file with a
|
|
14
14
|
public/private keypair
|