heirloom 0.11.0.beta.1 → 0.11.0.beta.2

data/CHANGELOG.md

@@ -8,6 +8,7 @@
 * Updated catalog output to include s3 urls
 * Catalog output renamed Bucket Prefix to bucket_prefix
 * Catalog output renamed Region to region
+* Add `rotate` command to allow for encryption key rotation
 
 ## 0.10.1 (02/28/2013):
 

data/README.md

@@ -26,7 +26,7 @@ To get started, copy the sample below to ~/.heirloom.yml and update the specifie
 
 ```
 # default environment
-aws:
+default:
   access_key: UPDATE_ME
   secret_key: UPDATE_ME
   metadata_region: us-west-1

data/lib/heirloom.rb

@@ -9,6 +9,7 @@ require "heirloom/config"
 require "heirloom/destroyer"
 require "heirloom/directory"
 require "heirloom/downloader"
+require "heirloom/exceptions"
 require "heirloom/logger"
 require "heirloom/uploader"
 require "heirloom/version"

data/lib/heirloom/archive.rb

@@ -1,16 +1,16 @@
-require 'heirloom/archive/lister.rb'
-require 'heirloom/archive/reader.rb'
+require 'heirloom/archive/authorizer.rb'
 require 'heirloom/archive/builder.rb'
-require 'heirloom/archive/updater.rb'
-require 'heirloom/archive/uploader.rb'
+require 'heirloom/archive/checker.rb'
+require 'heirloom/archive/destroyer.rb'
 require 'heirloom/archive/downloader.rb'
+require 'heirloom/archive/lister.rb'
+require 'heirloom/archive/reader.rb'
 require 'heirloom/archive/setuper.rb'
 require 'heirloom/archive/teardowner.rb'
-require 'heirloom/archive/writer.rb'
-require 'heirloom/archive/authorizer.rb'
-require 'heirloom/archive/destroyer.rb'
+require 'heirloom/archive/updater.rb'
+require 'heirloom/archive/uploader.rb'
 require 'heirloom/archive/verifier.rb'
-require 'heirloom/archive/checker.rb'
+require 'heirloom/archive/writer.rb'
 
 module Heirloom
 
@@ -79,6 +79,23 @@ module Heirloom
       reader.show.merge reader.object_acls
     end
 
+    def rotate(args)
+      temp_dir = Dir.mktmpdir
+      temp_file = Tempfile.new('archive.tar.gz')
+
+      unless download({ :output => temp_dir, :secret => args[:old_secret], :extract => true }.merge(args))
+        raise Heirloom::Exceptions::RotateFailed.new "Download failed - aborting rotation"
+      end
+      unless build({ :directory => temp_dir, :secret => args[:new_secret], :file => temp_file.path }.merge(args))
+        raise Heirloom::Exceptions::RotateFailed.new "Build failed - aborting rotation"
+      end
+      destroy
+      upload({ :file => temp_file.path, :secret => args[:new_secret] }.merge(args))
+    ensure
+      temp_file.close!
+      FileUtils.remove_entry temp_dir
+    end
+
     def list(limit=10)
       lister.list(limit)
     end

data/lib/heirloom/cli.rb

@@ -1,18 +1,20 @@
 require 'json'
 require 'trollop'
 
+require 'heirloom/cli/formatter'
 require 'heirloom/cli/shared'
+
 require 'heirloom/cli/authorize'
 require 'heirloom/cli/catalog'
-require 'heirloom/cli/upload'
-require 'heirloom/cli/setup'
+require 'heirloom/cli/destroy'
+require 'heirloom/cli/download'
 require 'heirloom/cli/list'
+require 'heirloom/cli/rotate'
+require 'heirloom/cli/setup'
 require 'heirloom/cli/show'
 require 'heirloom/cli/tag'
-require 'heirloom/cli/download'
-require 'heirloom/cli/destroy'
 require 'heirloom/cli/teardown'
-require 'heirloom/cli/formatter'
+require 'heirloom/cli/upload'
 
 module Heirloom
   module CLI
@@ -30,15 +32,17 @@ module Heirloom
         CLI::Download.new.download
       when 'list'
         CLI::List.new.list
+      when 'rotate'
+        CLI::Rotate.new.rotate
       when 'setup'
         CLI::Setup.new.setup
       when 'show'
         CLI::Show.new.show
+      when 'tag', 'update'
+        CLI::Tag.new.tag
       when 'teardown'
         CLI::Teardown.new.teardown
-      when 'update', 'tag'
-        CLI::Tag.new.tag
-      when 'build', 'upload'
+      when 'upload', 'build'
         CLI::Upload.new.upload
       when '-v'
         puts Heirloom::VERSION

data/lib/heirloom/cli/rotate.rb

@@ -0,0 +1,82 @@
+module Heirloom
+  module CLI
+    class Rotate
+
+      include Heirloom::CLI::Shared
+
+      def initialize
+        @opts = read_options
+        @logger = HeirloomLogger.new :log_level => @opts[:level]
+        @config = load_config :logger => @logger,
+                              :opts   => @opts
+
+        ensure_valid_options :provided => @opts,
+                             :required => [:name, :id, :old_secret, :new_secret],
+                             :config   => @config
+
+        @catalog = Heirloom::Catalog.new :name   => @opts[:name],
+                                         :config => @config
+
+        @archive = Archive.new :name   => @opts[:name],
+                               :config => @config,
+                               :id     => @opts[:id]
+
+        unless @opts[:bucket_prefix]
+          ensure_archive_exists :archive => @archive,
+                                :config  => @config
+        end
+
+        # Lookup upload regions, metadata region, and bucket_prefix from simpledb unless specified
+        @opts[:regions]       ||= @catalog.regions
+        @opts[:region]        ||= @catalog.regions.first
+        @opts[:bucket_prefix] ||= @catalog.bucket_prefix
+      end
+      
+      def rotate
+        @archive.rotate @opts
+      rescue Heirloom::Exceptions::RotateFailed => e
+        @config.logger.error e.message
+        exit 1
+      end
+
+      private
+
+      def read_options
+        Trollop::options do
+          version Heirloom::VERSION
+          banner <<-EOS
+
+Rotate keys for an Heirloom.  
+
+Will download the heirloom to temp directory, decrypt, encrypt, and upload, replacing original.
+
+Usage:
+
+heirloom rotate -n NAME -i ID --new-secret MY_NEW_SECRET --old-secret MY_OLD_SECRET
+
+To rotate Heirloom without looking up details in SimpleDB, specify region (-r) and bucket_prefix (-b) options.
+
+EOS
+          opt :bucket_prefix, "Bucket prefix of the Heirloom to download.", :type => :string
+          opt :help, "Display Help"
+          opt :id, "ID of the Heirloom to rotate.", :type => :string
+          opt :level, "Log level [debug|info|warn|error].", :type    => :string,
+                                                            :default => 'info'
+          opt :metadata_region, "AWS region to store Heirloom metadata.", :type    => :string,
+                                                                          :default => 'us-west-1'
+          opt :name, "Name of Heirloom.", :type => :string
+          opt :region, "Region to download Heirloom.", :type    => :string,
+                                                       :default => 'us-west-1'
+          opt :new_secret, "New Secret for encrypted Heirloom.", :type => :string,
+                                                                 :short => :none
+          opt :old_secret, "Old secret for encrypted Heirloom.", :type => :string,
+                                                                 :short => :none
+          opt :aws_access_key, "AWS Access Key ID", :type => :string, 
+                                                    :short => :none
+          opt :aws_secret_key, "AWS Secret Access Key", :type => :string, 
+                                                        :short => :none
+        end
+      end
+    end
+  end
+end

data/lib/heirloom/directory/directory.rb

@@ -6,7 +6,7 @@ module Heirloom
 
     def initialize(args)
       @config  = args[:config]
-      @exclude = args[:exclude]
+      @exclude = args[:exclude] ||= []
       @path    = args[:path]
       @file    = args[:file]
       @logger  = @config.logger

data/lib/heirloom/exceptions.rb

@@ -1,5 +1,6 @@
-module Stackster
+module Heirloom
   module Exceptions
+
     class Base < RuntimeError
       attr_accessor :message
 
@@ -7,5 +8,9 @@ module Stackster
         @message = message
       end
     end
+
+    class RotateFailed < Base
+    end
+      
   end
 end

data/lib/heirloom/version.rb

@@ -1,3 +1,3 @@
 module Heirloom
-  VERSION = "0.11.0.beta.1"
+  VERSION = "0.11.0.beta.2"
 end

data/spec/archive_spec.rb

@@ -3,7 +3,8 @@ require 'spec_helper'
 describe Heirloom do
 
   before do
-    @config_mock = mock 'config'
+    @logger_mock = mock 'logger', :info => true, :debug => true, :error => true
+    @config_mock = mock 'config', :logger => @logger_mock
     @archive = Heirloom::Archive.new :config => @config_mock,
                                      :name   => 'chef',
                                      :id     => '123'
@@ -223,4 +224,83 @@ describe Heirloom do
     end
 
   end
+
+  context "rotate" do
+    before do
+
+      @tmp_dir = '/path/to/temp/dir'
+      Dir.stub(:mktmpdir).and_return @tmp_dir
+
+      @tmp_file = mock 'file'
+      @tmp_file.stub :path => '/path/to/tmp/file', :close! => true
+      Tempfile.stub :new => @tmp_file
+      FileUtils.stub :remove_entry => true
+
+    end
+
+    it "should rotate an archive by downloading and re-uploading" do
+
+      @archive.should_receive(:download).
+               with(hash_including(:output => @tmp_dir, 
+                                   :secret => "oldpassword",
+                                   :extract => true)).
+               and_return true
+      @archive.should_receive(:build).
+               with(hash_including(:directory => @tmp_dir,
+                                   :secret => "newpassword",
+                                   :file => @tmp_file.path)).
+               and_return true
+      @archive.should_receive(:destroy).with(no_args)
+      @archive.should_receive(:upload).
+               with(hash_including(:secret => "newpassword",
+                                   :file => @tmp_file.path))
+
+      @archive.rotate({ :new_secret => "newpassword", :old_secret => "oldpassword" })
+    end
+
+    context "failing download" do
+
+      before do
+        @archive.stub :download => false, :build => true, :destroy => nil, :upload => true
+      end
+      
+      it "should raise an exception when download fails" do
+        expect {
+          @archive.rotate({ :new_secret => "new", :old_secret => "old" }) 
+        }.to raise_error Heirloom::Exceptions::RotateFailed
+      end
+
+      it "should not destroy the file when download fails" do
+        @archive.should_not_receive(:destroy)
+        begin
+          @archive.rotate({ :new_secret => "new", :old_secret => "old" })
+        rescue Heirloom::Exceptions::RotateFailed
+        end
+      end
+
+    end
+
+    context "failing build" do
+
+      before do
+        @archive.stub :download => true, :build => false, :destroy => nil, :upload => true
+      end
+      
+      it "should raise an exception when build fails" do
+        expect {
+          @archive.rotate({ :new_secret => "new", :old_secret => "old" })
+        }.to raise_error Heirloom::Exceptions::RotateFailed
+      end
+
+      it "should not destroy the file when build fails" do
+        @archive.should_not_receive(:destroy)
+        begin
+          @archive.rotate({ :new_secret => "new", :old_secret => "old" }) 
+        rescue Heirloom::Exceptions::RotateFailed
+        end
+      end
+
+    end
+
+  end
 end

data/spec/cli/rotate_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+require 'heirloom/cli'
+
+describe Heirloom do
+
+  before do
+
+    options = { :name           => 'archive_name',
+                :id             => '1.0.0',
+                :bucket_prefix  => 'bp',
+                :old_secret     => 'oldpassword',
+                :new_secret     => 'newpassword',
+                :aws_access_key => 'key',
+                :aws_secret_key => 'secret' }
+    Trollop.stub(:options).and_return options
+
+    catalog_stub = stub :regions => ['us-east-1', 'us-west-1']
+    Heirloom::Catalog.stub(:new).and_return catalog_stub
+
+    @archive_mock = mock 'archive'
+    Heirloom::Archive.stub(:new).and_return @archive_mock
+
+  end
+
+  it "should delegate to archive object" do
+
+    @archive_mock.should_receive :rotate
+
+    Heirloom::CLI::Rotate.new.rotate
+
+  end
+
+  it "should log and do a SystemExit when a rotate fails" do
+    
+    @archive_mock.stub(:rotate).and_raise Heirloom::Exceptions::RotateFailed.new("failed")
+
+    @logger_mock = mock 'logger'
+    Heirloom::HeirloomLogger.stub :new => @logger_mock
+    
+    @logger_mock.should_receive(:error).with "failed"
+    expect {
+      Heirloom::CLI::Rotate.new.rotate
+    }.to raise_error SystemExit
+    
+  end
+  
+end

data/spec/directory/directory_spec.rb

@@ -91,6 +91,23 @@ describe Heirloom::Directory do
       end
     end
 
+    context "parameter validation" do
+      before do
+        Dir.stub(:entries).and_return ['pack_me', 'dont_pack_me']
+      end
+
+      it "should not fail if exclude is nil" do
+        @directory = Heirloom::Directory.new :config  => @config_mock,
+                                             :exclude => nil,
+                                             :path    => '/dir',
+                                             :file    => '/tmp/file.tar.gz'
+        @directory.stub(:`).and_return 'cmd output'
+        lambda {
+          @directory.build_artifact_from_directory(:exclude => nil)
+        }.should_not raise_error
+      end
+    end
+
   end
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: heirloom
 version: !ruby/object:Gem::Version
-  version: 0.11.0.beta.1
+  version: 0.11.0.beta.2
   prerelease: 7
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-04-10 00:00:00.000000000 Z
+date: 2013-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -150,6 +150,7 @@ files:
 - lib/heirloom/cli/formatter/catalog.rb
 - lib/heirloom/cli/formatter/show.rb
 - lib/heirloom/cli/list.rb
+- lib/heirloom/cli/rotate.rb
 - lib/heirloom/cli/setup.rb
 - lib/heirloom/cli/shared.rb
 - lib/heirloom/cli/show.rb
@@ -204,6 +205,7 @@ files:
 - spec/cli/formatter/catalog_spec.rb
 - spec/cli/formatter/show_spec.rb
 - spec/cli/list_spec.rb
+- spec/cli/rotate_spec.rb
 - spec/cli/setup_spec.rb
 - spec/cli/shared_spec.rb
 - spec/cli/show_spec.rb
@@ -233,7 +235,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -822415306799597358
+      hash: -211146683438990673
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -280,6 +282,7 @@ test_files:
 - spec/cli/formatter/catalog_spec.rb
 - spec/cli/formatter/show_spec.rb
 - spec/cli/list_spec.rb
+- spec/cli/rotate_spec.rb
 - spec/cli/setup_spec.rb
 - spec/cli/shared_spec.rb
 - spec/cli/show_spec.rb