hiera-eyaml-age 0.1.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b410dda98aafc5197a88ce2da1c5b9e946b5262edeed99dc556431d69d8e4801
-  data.tar.gz: e84d835a8e3f8ab55b2209d51ffc24972b969fed00333797f12dee85c83c7479
+  metadata.gz: ac5587ac5f3381c45ce33c739810dde864afc461f0432345c623bc288d76341f
+  data.tar.gz: b7303a828c2ab455323f7727c1cbd21baee76be804ab3afaecc4cd3464623cc6
 SHA512:
-  metadata.gz: e4de4e92ce526c1bd1385b9bfc0facc9ff94b45f5c672e72959ee623be5e37f09ff469d22eb51b4c044398f236a24b1d3347dcecd57e77394ee73a036fbb8200
-  data.tar.gz: 450e0669ae45fd070500042c171c89dc042364847890ea28f9ff8541a2cfbb0cb961e5052a77c6d57e56390386cc03d34a65fa30755e806b1a501f0bcb9236d4
+  metadata.gz: e5c7b091d59aaa2bb591cdf0f628684b98cab0867fc168a6fe8933003bdab43f0728400879d8bfaf508f9791a22812e3dc47930a73c5822728c3ff799b5569b8
+  data.tar.gz: a402ebfbe69fb8e199bc91054ab9a619bd592b05cde1901d496a1201c20361d41c1c2b14789eaa4ebcc76e639c3bb223e15fa2498337bc5c82032513247d0c85

data/.gitignore

@@ -1,4 +1,11 @@
 *.gem
 *.swp
 .bundle/
+gem2deb*
+gem2deb*/
+hiera-eyaml-age-*
+hiera-eyaml-age-*/
+hiera-eyaml-age_*
+hiera-eyaml-age_*/
+ruby
 vendor/

data/CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.2] - 2026-05-27
+
+### Fixed
+
+- Fix option lookup: rename some option keys that still had `age_` prepended, to avoid double-prefixing by eyaml
+- Override `option()` to correctly apply defined defaults when running on a Puppet server
+
+## [0.2.1] - 2026-05-27
+
+### Fixed
+
+- Widen hiera-eyaml dependency range to `>= 4.2.0, < 6.0` to work with both Debian packaging and current gem releases
+
+## [0.2.0] - 2026-05-26
+
+### Added
+
+- Manage packaging (gem, deb)
+- Add options to take identity and/or recipients from environment variables instead of files
+
+### Fixed
+
+- Handle errors without dumping age's stderr unless asked for
+
+## [0.1.0]
+
+### Added
+
+- init

data/Makefile

@@ -0,0 +1,26 @@
+VERSION := $(shell ruby -r ./lib/hiera/backend/eyaml/encryptors/age/version \
+  -e 'puts Hiera::Backend::Eyaml::Encryptors::AgeVersion::VERSION')
+export DEBEMAIL:=network@ias.edu
+
+
+.PHONY: gem
+gem: hiera-eyaml-age-$(VERSION).gem
+
+.PHONY: deb
+deb: hiera-eyaml-age-$(VERSION).gem
+	gem2deb --package hiera-eyaml-age hiera-eyaml-age-$(VERSION).gem
+
+.PHONY: packages
+packages: deb gem
+
+hiera-eyaml-age-$(VERSION).gem:
+	gem build hiera-eyaml-age.gemspec
+
+.PHONY: clean
+clean:
+	rm -rf \
+		gem2deb* \
+		hiera-eyaml-age-* \
+		ruby* \
+		hiera-eyaml-age-* \
+		hiera-eyaml-age_*

data/README.md

@@ -61,6 +61,10 @@ age recipients can be native age public keys (`age1...`) or SSH public keys (`ss
 
 Use `eyaml --help` for more, or see the [hiera-eyaml] docs.
 
+## Hardware keys and PKCS#11 tokens
+
+If your age identity is protected by another factor (e.g. encrypted with a password, or an identity stored with touch required on a hardware security key) be aware that `hiera-eyaml` calls the encryptor once per encrypted value per file. Each call spawns a separate `age` process, which could mean one authorization interaction per encrypted value., depending on your setup. This is a limitation of `hiera-eyaml`'s design, not of `age`.
+
 ### Configuring hiera
 
 ```yaml
@@ -71,11 +75,13 @@ hierarchy:
   - name: "Per-node data"
     lookup_key: eyaml_lookup_key
     options:
+      age_binary_path: /path/to/age
       age_identity_file: /opt/puppetlabs/server/data/puppetserver/.age/identity.txt
     path: "nodes/%{::trusted.certname}.yaml"
   - name: "Common data"
     lookup_key: eyaml_lookup_key
     options:
+      age_binary_path: /path/to/age
       age_identity_file: /opt/puppetlabs/server/data/puppetserver/.age/identity.txt
     path: "common.yaml"
 ```

data/hiera-eyaml-age.gemspec

@@ -20,5 +20,5 @@ Gem::Specification.new do |gem|
   gem.require_paths = ['lib']
 
   gem.required_ruby_version = '>= 3.0'
-  gem.add_dependency('hiera-eyaml', '~> 5.0')
+  gem.add_dependency('hiera-eyaml', '>= 4.2.0', '< 6.0')
 end

data/lib/hiera/backend/eyaml/encryptors/age/version.rb

@@ -3,7 +3,7 @@ class Hiera
     module Eyaml
       module Encryptors
         module AgeVersion
-          VERSION = "0.1.0".freeze
+          VERSION = "0.2.2".freeze
         end
       end
     end

data/lib/hiera/backend/eyaml/encryptors/age.rb

@@ -13,8 +13,8 @@ class Hiera
           self.tag = "AGE"
 
           self.options = {
-            age_binary_path: {
-              desc: "Full path to the age executable",
+            binary_path: {
+              desc: "Full path to the age executable (use an absolute path in production to avoid PATH-based substitution)",
               type: :string,
               default: "age"
             },
@@ -22,6 +22,10 @@ class Hiera
               desc: "Path to age identity file for decryption",
               type: :string
             },
+            identity_env_var: {
+              desc: "Name of environment variable containing age identity for decryption",
+              type: :string
+            },
             recipients: {
               desc: "List of recipients (comma separated)",
               type: :string
@@ -29,9 +33,17 @@ class Hiera
             recipients_file: {
               desc: "File containing a list of recipients (one on each line)",
               type: :string
+            },
+            recipients_env_var: {
+              desc: "Name of environment variable containing age recipients (comma separated)",
+              type: :string
             }
           }
 
+          def self.option(name)
+            super || (self.options[name] || {})[:default]
+          end
+
           def self.encrypt(plaintext)
             recipients = determine_recipients
             debug("Recipients are #{recipients}")
@@ -46,46 +58,66 @@ class Hiera
 
             stdout, stderr, status =
               Open3.capture3(
-                option(:age_binary_path),
+                option(:binary_path),
                 "--encrypt",
                 *recipient_args,
                 stdin_data: plaintext,
                 binmode: true
               )
             unless status.success?
-              raise RecoverableError, "age encrypt failed: #{stderr.strip}"
+              warn("age encrypt failed (run with --trace for details, including errors from age which may be sensitive)")
+              debug("age encrypt stderr: #{stderr.strip}")
+              raise RecoverableError, "age encrypt failed"
             end
 
             stdout
           end
 
           def self.decrypt(ciphertext)
-            identity_file = option(:identity_file)
-            debug("age identity file is #{identity_file}")
-
-            if identity_file.nil? || identity_file.empty?
-              raise ArgumentError,
-                    "No age identity file configured, check age_identity_file configuration value is correct"
-            elsif !File.exist?(identity_file)
-              raise ArgumentError,
-                    "Configured age identity file #{identity_file} doesn't exist, check age_identity_file configuration value is correct"
+            env_var = option(:identity_env_var)
+
+            if env_var
+              raise ArgumentError, "env #{env_var} is not set" unless ENV[env_var]
+
+              # Pass the identity via a pipe rather than a temp file so the key
+              # material never touches disk. age's --identity accepts /dev/fd/N.
+              # Ruby 2.0+ opens FDs with O_CLOEXEC by default, so we must
+              # explicitly preserve the read end across the exec boundary.
+              r_fd, w_fd = IO.pipe
+              w_fd.write(ENV[env_var])
+              w_fd.close
+              identity_arg = "/dev/fd/#{r_fd.fileno}"
+              extra_opts = { r_fd.fileno => r_fd }
+            else
+              identity_file = option(:identity_file)
+              debug("age identity file is #{identity_file}")
+
+              if identity_file.nil? || identity_file.empty?
+                raise ArgumentError,
+                      "No age identity file configured, check age_identity_file configuration value is correct"
+              end
+
+              identity_arg = identity_file
+              extra_opts = {}
             end
 
             stdout, stderr, status =
               Open3.capture3(
-                option(:age_binary_path),
+                option(:binary_path),
                 "--decrypt",
                 "--identity",
-                identity_file,
+                identity_arg,
                 stdin_data: ciphertext,
-                binmode: true
+                binmode: true,
+                **extra_opts
               )
 
+            r_fd&.close
+
             unless status.success?
-              warn(
-                "Fatal: Failed to decrypt ciphertext (check settings and that you are a recipient)"
-              )
-              raise StandardError, "age decrypt failed: #{stderr.strip}"
+              warn("age decrypt failed (run with --trace for details, including errors from age which may be sensitive)")
+              debug("age decrypt stderr: #{stderr.strip}")
+              raise StandardError, "age decrypt failed"
             end
 
             stdout
@@ -99,6 +131,14 @@ class Hiera
             private
 
             def determine_recipients
+              env_var = option(:recipients_env_var)
+              if env_var
+                raise ArgumentError, "env #{env_var} is not set" unless ENV[env_var]
+
+                debug("Using --recipients-env-var option")
+                return ENV[env_var].split(",").map(&:strip)
+              end
+
               recipient_option = option :recipients
 
               unless recipient_option.nil?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hiera-eyaml-age
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.2
 platform: ruby
 authors:
 - IAS Network
@@ -13,16 +13,22 @@ dependencies:
   name: hiera-eyaml
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 4.2.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 description: age encryptor for use with hiera-eyaml
 executables: []
 extensions: []
@@ -30,8 +36,10 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - ".rubocop.yml"
+- CHANGELOG.md
 - Gemfile
 - Gemfile.lock
+- Makefile
 - README.md
 - Rakefile
 - hiera-eyaml-age.gemspec