heirloom 0.9.0 → 0.10.0

data/.rvmrc

@@ -1 +1 @@
-rvm use ruby-1.9.3-p194@heirloom --create
+rvm use ruby-1.9.3-p327@heirloom --create

data/CHANGELOG

@@ -1,3 +1,10 @@
+## 0.10.0:
+
+* Confirm tar and gpg executables are present when necessary
+* Switch to gpg for encryption
+* S3 key names will have gpg appended when encrypted
+* Switch rvm to 1.9.3-p327
+
 ## 0.9.0:
 
 * Updated tempfile logic to fix GC issues.

data/README.md

@@ -22,7 +22,7 @@ Install the gem
 gem install heirloom --no-ri --no-rdoc
 ```
 
-To get started copy the sample below into ~/.heirloom.yml and update the specified fields.
+To get started, copy the sample below to ~/.heirloom.yml and update the specified fields.
 
 ```
 aws:
@@ -31,16 +31,6 @@ aws:
   metadata_region: us-west-1
 ```
 
-Proxy Support
--------------
-
-Heirloom supports accessing AWS API endpoint throught a proxy.  This can be set via the http_proxy and https_proxy variables.
-
-```
-export http_proxy=http://1.2.3.4:80
-export http_proxys=http://1.2.3.4:80
-```
-
 Documentation
 -------------
 

data/lib/heirloom.rb

@@ -1,3 +1,5 @@
+require "heirloom/utils"
+
 require "heirloom/acl"
 require "heirloom/archive"
 require "heirloom/aws"

data/lib/heirloom/acl/s3.rb

@@ -11,20 +11,19 @@ module Heirloom
       end
 
       def allow_read_access_from_accounts(args)
-        bucket = args[:bucket]
-        key_name = args[:key_name]
+        bucket     = args[:bucket]
+        key_name   = args[:key_name]
         key_folder = args[:key_folder]
-        accounts = args[:accounts]
+        accounts   = args[:accounts]
 
-        key = "#{key_folder}/#{key_name}.tar.gz"
+        key          = "#{key_folder}/#{key_name}"
 
         current_acls = s3.get_bucket_acl bucket
+        name         = current_acls['Owner']['Name']
+        id           = current_acls['Owner']['ID']
 
-        name = current_acls['Owner']['Name']
-        id = current_acls['Owner']['ID']
-
-        grants = build_bucket_grants :id => id,
-                                     :name => name,
+        grants = build_bucket_grants :id       => id,
+                                     :name     => name,
                                      :accounts => accounts
 
         accounts.each do |a|

data/lib/heirloom/archive/authorizer.rb

@@ -17,13 +17,15 @@ module Heirloom
 
       @logger.info "Authorizing #{@accounts.join(', ')}."
 
+      key_name = reader.key_name
+
       regions.each do |region|
         bucket = reader.get_bucket :region => region
 
         s3_acl = ACL::S3.new :config => @config,
                              :region => region
 
-        s3_acl.allow_read_access_from_accounts :key_name   => @id,
+        s3_acl.allow_read_access_from_accounts :key_name   => key_name,
                                                :key_folder => @name,
                                                :accounts   => @accounts,
                                                :bucket     => bucket

data/lib/heirloom/archive/destroyer.rb

@@ -18,15 +18,15 @@ module Heirloom
       regions.each do |region|
         bucket = reader.get_bucket :region => region
 
-        key = "#{@id}.tar.gz"
+        key_name = reader.key_name
 
         if bucket
-          @logger.debug "Destroying 's3://#{bucket}/#{@name}/#{key}'."
+          @logger.debug "Destroying 's3://#{bucket}/#{@name}/#{key_name}'."
 
           s3_destroyer = Destroyer::S3.new :config => @config,
                                            :region => region
 
-          s3_destroyer.destroy_file :key_name   => key,
+          s3_destroyer.destroy_file :key_name   => key_name,
                                     :bucket     => bucket,
                                     :key_folder => @name
         end

data/lib/heirloom/archive/downloader.rb

@@ -12,8 +12,8 @@ module Heirloom
     def download(args)
       @region        = args[:region]
       @bucket_prefix = args[:bucket_prefix]
+      @secret        = args[:secret]
       extract        = args[:extract]
-      secret         = args[:secret]
       output         = args[:output] ||= './'
 
       @logger.info "Downloading s3://#{bucket}/#{key} from #{@region}."
@@ -28,7 +28,7 @@ module Heirloom
       return false unless raw_archive
 
       archive = cipher_data.decrypt_data :data   => raw_archive,
-                                         :secret => secret
+                                         :secret => @secret
 
       return false unless archive
 
@@ -44,12 +44,12 @@ module Heirloom
 
     private
 
-    def file 
+    def file
       "#{@id}.tar.gz"
     end
 
     def key
-      "#{@name}/#{file}"
+      @secret ? "#{@name}/#{@id}.tar.gz.gpg" : "#{@name}/#{@id}.tar.gz"
     end
 
     def bucket

data/lib/heirloom/archive/reader.rb

@@ -4,9 +4,9 @@ module Heirloom
 
     def initialize(args)
       @config = args[:config]
-      @name = args[:name]
+      @name   = args[:name]
+      @id     = args[:id]
       @domain = "heirloom_#{@name}"
-      @id = args[:id]
       @logger = @config.logger
     end
 
@@ -66,21 +66,31 @@ module Heirloom
       end
     end
 
+    def key_name
+      encrypted? ? "#{@id}.tar.gz.gpg" : "#{@id}.tar.gz"
+    end
+
     private
 
+    def encrypted?
+      show['encrypted'] == 'true'
+    end
+
     def domain_exists?
       sdb.domain_exists? @domain
     end
 
     def get_url(args)
+      region = args[:region]
+
       return nil unless exists?
-      @logger.debug "Looking for #{args[:region]} endpoint for #{@id}"
-      url = "#{args[:region]}-s3-url"
+      @logger.debug "Looking for #{region} endpoint for #{@id}"
+      url = "#{region}-s3-url"
       if show[url]
         @logger.debug "Found #{url} for #{@id}."
         show[url]
       else
-        @logger.debug "#{args[:region]} endpoint for #{@id} not found."
+        @logger.debug "#{region} endpoint for #{@id} not found."
         nil
       end
     end

data/lib/heirloom/archive/uploader.rb

@@ -4,16 +4,19 @@ module Heirloom
 
     def initialize(args)
       @config = args[:config]
-      @name = args[:name]
-      @id = args[:id]
+      @name   = args[:name]
+      @id     = args[:id]
       @logger = @config.logger
     end
 
     def upload(args)
-      heirloom_file = args[:file]
-      bucket_prefix = args[:bucket_prefix]
-      regions = args[:regions]
+      heirloom_file   = args[:file]
+      bucket_prefix   = args[:bucket_prefix]
+      regions         = args[:regions]
       public_readable = args[:public_readable]
+      secret          = args[:secret]
+
+      key_name = secret ? "#{@id}.tar.gz.gpg" : "#{@id}.tar.gz"
 
       regions.each do |region|
         bucket = "#{bucket_prefix}-#{region}"
@@ -26,13 +29,14 @@ module Heirloom
                                 :file            => heirloom_file,
                                 :id              => @id,
                                 :key_folder      => @name,
-                                :key_name        => "#{@id}.tar.gz",
+                                :key_name        => key_name,
                                 :name            => @name,
                                 :public_readable => public_readable
 
-        s3_uploader.add_endpoint_attributes :bucket     => bucket,
-                                            :id         => @id,
-                                            :name       => @name
+        s3_uploader.add_endpoint_attributes :bucket   => bucket,
+                                            :id       => @id,
+                                            :name     => @name,
+                                            :key_name => key_name
       end
       @logger.info "Upload complete."
     end

data/lib/heirloom/archive/writer.rb

@@ -1,3 +1,5 @@
+require 'tempfile'
+
 module Heirloom
   class Writer
 

data/lib/heirloom/cipher.rb

@@ -1,2 +1,4 @@
+require 'heirloom/cipher/shared'
+
 require 'heirloom/cipher/data'
 require 'heirloom/cipher/file'

data/lib/heirloom/cipher/data.rb

@@ -1,36 +1,54 @@
-require 'openssl'
+require 'tempfile'
 
 module Heirloom
   module Cipher
     class Data
 
+      include Heirloom::Cipher::Shared
+
       def initialize(args)
         @config = args[:config]
         @logger = @config.logger
       end
 
       def decrypt_data(args)
-        data   = args[:data]
-        secret = args[:secret]
-
-        return data unless args[:secret]
-
-        @logger.info "Secret provided. Decrypting Heirloom."
-
-        @aes = OpenSSL::Cipher::AES256.new(:CBC)
-        @aes.decrypt
-        @aes.key = Digest::SHA256.hexdigest secret
-        @aes.iv = data.slice!(0,16)
-        begin
-          @aes.update(data) + @aes.final
-        rescue OpenSSL::Cipher::CipherError => e
-          if e.message == 'wrong final block length'
-            @logger.error 'This Heirloom does not appear to be encrypted.'
-          end
-          @logger.error "Unable to decrypt Heirloom: '#{e.message}'"
+        @data   = args[:data]
+        @secret = args[:secret]
+
+        return @data unless args[:secret]
+        return false unless gpg_in_path?
+
+        @encrypted_file = Tempfile.new('archive.tar.gz.gpg')
+        @decrypted_file = Tempfile.new('archive.tar.gz')
+
+        ::File.open(@encrypted_file, 'w') { |f| f.write @data }
+
+        decrypt
+      end
+
+      private
+
+      def decrypt
+        @logger.info "Secret provided. Decrypting with: '#{command}'"
+        output = `#{command(@secret)}`
+        @logger.debug "Decryption output: '#{output}'"
+
+        if $?.success?
+          @decrypted_file.read 
+        else
+          @logger.error "Decryption failed with output: '#{output}'"
           false
         end
       end
+
+      def command(secret='XXXXXXXX')
+        "gpg --batch --yes --cipher-algo AES256 --passphrase #{secret} --output #{@decrypted_file.path} #{@encrypted_file.path} 2>&1"
+      end
+
+      def logger
+        @logger
+      end
+
     end
   end
 end

data/lib/heirloom/cipher/file.rb

@@ -1,4 +1,3 @@
-require 'openssl'
 require 'tempfile'
 require 'fileutils'
 
@@ -6,45 +5,47 @@ module Heirloom
   module Cipher
     class File
 
+      include Heirloom::Cipher::Shared
+
       def initialize(args)
         @config = args[:config]
-        @aes = OpenSSL::Cipher::AES256.new(:CBC)
+        @logger = @config.logger
       end
 
       def encrypt_file(args)
         @file           = args[:file]
+        @secret         = args[:secret]
         @encrypted_file = Tempfile.new('archive.tar.gz.enc')
-        secret          = args[:secret]
-        iv              = @aes.random_iv
-
-        @aes.encrypt
-        @aes.iv = iv
-        @aes.key = Digest::SHA256.hexdigest secret
-
-        # Need to refactor to be less complex
-        # Additionally tests to do fully cover logic
-        ::File.open(@encrypted_file,'w') do |enc|
-          enc << iv
-          ::File.open(@file) do |f|
-            loop do
-              r = f.read(4096)
-              break unless r
-              enc << @aes.update(r)
-            end
-          end
-          enc << @aes.final
-        end
+
+        return false unless gpg_in_path?
+        return false unless encrypt
 
         replace_file
       end
 
       private
 
+      def encrypt
+        @logger.info "Encrypting with: '#{command}'"
+        output = `#{command(@secret)}`
+        @logger.debug "Encryption output: '#{output}'"
+        @logger.error "Encryption failed with output: '#{output}'" unless $?.success?
+        $?.success?
+      end
+
+      def command(secret="XXXXXXXX")
+        "gpg --batch --yes -c --cipher-algo AES256 --passphrase #{secret} --output #{@encrypted_file.path} #{@file} 2>&1"
+      end
+
       def replace_file
         FileUtils.mv @encrypted_file.path, @file
         @encrypted_file.close!
       end
 
+      def logger
+        @logger
+      end
+
     end
   end
 end

data/lib/heirloom/cipher/shared.rb

@@ -0,0 +1,19 @@
+require 'tempfile'
+
+module Heirloom
+  module Cipher
+    module Shared
+
+      include Heirloom::Utils::File
+
+      def gpg_in_path?
+        unless which('gpg')
+          @logger.error "gpg not found in path."
+          return false
+        end
+        true
+      end
+
+    end
+  end
+end

data/lib/heirloom/cli/upload.rb

@@ -62,7 +62,8 @@ module Heirloom
         @archive.upload :bucket_prefix   => @bucket_prefix,
                         :regions         => @regions,
                         :public_readable => @opts[:public],
-                        :file            => @file.path
+                        :file            => @file.path,
+                        :secret          => secret
 
         @file.close!
       end

data/lib/heirloom/directory/directory.rb

@@ -2,6 +2,8 @@ module Heirloom
 
   class Directory
 
+    include Heirloom::Utils::File
+
     def initialize(args)
       @config  = args[:config]
       @exclude = args[:exclude]
@@ -25,6 +27,7 @@ module Heirloom
     private
 
     def build_archive
+      return false unless tar_in_path?
       command = "cd #{@path} && tar czf #{@file} #{files_to_pack}"
       @logger.info "Archiving with: `#{command}`"
       output = `#{command}`
@@ -39,8 +42,16 @@ module Heirloom
                                :secret => @secret
     end
 
+    def tar_in_path?
+      unless which('tar')
+        @logger.error "tar not found in path."
+        return false
+      end
+      true
+    end
+
     def files_to_pack
-      (Dir.entries(@path) - ['.', '..'] - @exclude).map do |file|
+      @files_to_pack ||= (Dir.entries(@path) - ['.', '..'] - @exclude).map do |file|
         "'#{file}'"
       end.join(' ')
     end