hiera-eyaml 3.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6fde1d8051eb21831b79c698fd423e9a4a08b824d2360e9ff6812d7992bc0388
-  data.tar.gz: 51f03df435163ec479f4e843d83c3c5d1c04c0581901bbe0f578d06314e3f625
+  metadata.gz: 5b9a21a2c014fd073b1733d4c9c8ac2422b4d011f22f9ceb700834ce13710090
+  data.tar.gz: e8672bc02e4f4e9c41c8bba28677a99c06f08b5fd870936b660bb495d6df0e26
 SHA512:
-  metadata.gz: 8363cd6de0401411ba832d79e3a7ce5df9e1b3a9a6a9d532d7b3e935e7a98a10ff29be65acd36a953494a3923e090c0cd8cfc594f63ff56d39f38e881553d874
-  data.tar.gz: 6f34d66445e374ea6c6c7c6d34c50f20a14d76eef48732b661bad86ce793a362564b93538f896d85c219ee415a33b222b0d15e4c770d0ee6013428091c0d1649
+  metadata.gz: ac59e7c61933e8db2d074bf267c2d45a8cc3aacc23a2a4b732483529506d9cb089ed144794f1b37e010407646a461ca64cd1fc4f4cb53b9b81a65318d604fbad
+  data.tar.gz: f8fe859c0a1a855b0138690362a8e3952f0fa0756540135d314e117668d8936159a3d7862d0bf3e91ce9eba2efa0d30284f301037ecac7683133a5f6dcfb43a8

data/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v3.1.0](https://github.com/voxpupuli/hiera-eyaml/tree/v3.1.0) (2019-11-11)
+
+[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.0.0...v3.1.0)
+
+**Implemented enhancements:**
+
+- Should be able to `edit` a new file [\#84](https://github.com/voxpupuli/hiera-eyaml/issues/84)
+- Cache key strings. [\#191](https://github.com/voxpupuli/hiera-eyaml/pull/191) ([mkulke](https://github.com/mkulke))
+
+**Closed issues:**
+
+- Decryption errors should return error code. [\#282](https://github.com/voxpupuli/hiera-eyaml/issues/282)
+- Release a new version [\#271](https://github.com/voxpupuli/hiera-eyaml/issues/271)
+
+**Merged pull requests:**
+
+- \(docs\) Update README with reference to hiera-eyaml-vault [\#287](https://github.com/voxpupuli/hiera-eyaml/pull/287) ([crayfishx](https://github.com/crayfishx))
+- fix: don't handle cli exceptions early [\#283](https://github.com/voxpupuli/hiera-eyaml/pull/283) ([stuart-warren](https://github.com/stuart-warren))
+- Adding doc for Google KMS plugin [\#279](https://github.com/voxpupuli/hiera-eyaml/pull/279) ([craigwatson](https://github.com/craigwatson))
+- catch failed decryption and print a helpful message [\#144](https://github.com/voxpupuli/hiera-eyaml/pull/144) ([GeoffWilliams](https://github.com/GeoffWilliams))
+
 ## [v3.0.0](https://github.com/voxpupuli/hiera-eyaml/tree/v3.0.0) (2019-01-17)
 
 [Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v2.1.0...v3.0.0)

data/README.md

@@ -365,7 +365,10 @@ This is a list of available plugins:
    Note that this plugin mandates the user enter a password. It is useful for non-automated scenarios, and is not advised to be used
    in conjunction with puppet, as it requires entry of a password over a terminal.
  - [hiera-eyaml-kms](https://github.com/adenot/hiera-eyaml-kms) - Encryption using AWS Key Management Service (KMS)
- 
+ - [hiera-eyaml-gkms](https://github.com/craigwatson/hiera-eyaml-gkms) - Encryption using Google Cloud KMS
+ - [hiera-eyaml-vault](https://github.com/crayfishx/hiera-eyaml-vault) - Use the transit secrets engine from Vault for providing encryption.
+
+
 ### How-To's:
 
  - [How to use different Hiera/Eyaml keys for different environments using the AWS Parameter Store to store the encryption keys for Hiera/Eyaml](https://gist.github.com/FransUrbo/88b26033cb513a8aa569bd5392a427b1).

data/lib/hiera/backend/eyaml.rb

@@ -2,7 +2,7 @@ class Hiera
   module Backend
     module Eyaml
 
-      VERSION = "3.0.0"
+      VERSION = "3.1.0"
       DESCRIPTION = "Hiera-eyaml is a backend for Hiera which provides OpenSSL encryption/decryption for Hiera properties"
 
       class RecoverableError < StandardError

data/lib/hiera/backend/eyaml/CLI.rb

@@ -42,13 +42,9 @@ class Hiera
         def self.execute
 
           executor = Eyaml::Options[:executor]
-          begin
-            result = executor.execute
-            puts result unless result.nil?
-          rescue Exception => e
-            LoggingHelper.warn e.message
-            LoggingHelper.debug e.backtrace.join("\n")
-          end
+
+          result = executor.execute
+          puts result unless result.nil?
 
         end
 

data/lib/hiera/backend/eyaml/encryptors/pkcs7.rb

@@ -38,8 +38,8 @@ class Hiera
             public_key = self.option :public_key
             raise StandardError, "pkcs7_public_key is not defined" unless public_key
 
-            public_key_pem = File.read public_key 
-            public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )
+            @public_key_pem ||= File.read public_key
+            public_key_x509 = OpenSSL::X509::Certificate.new( @public_key_pem )
 
             cipher = OpenSSL::Cipher::AES.new(256, :CBC)
             OpenSSL::PKCS7::encrypt([public_key_x509], plaintext, cipher, OpenSSL::PKCS7::BINARY).to_der
@@ -54,11 +54,11 @@ class Hiera
             raise StandardError, "pkcs7_public_key is not defined" unless public_key
             raise StandardError, "pkcs7_private_key is not defined" unless private_key
 
-            private_key_pem = File.read private_key
-            private_key_rsa = OpenSSL::PKey::RSA.new( private_key_pem )
+            @private_key_pem ||= File.read private_key
+            private_key_rsa = OpenSSL::PKey::RSA.new( @private_key_pem )
 
-            public_key_pem = File.read public_key
-            public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )
+            @public_key_pem ||= File.read public_key
+            public_key_x509 = OpenSSL::X509::Certificate.new( @public_key_pem )
 
             pkcs7 = OpenSSL::PKCS7.new( ciphertext )
             pkcs7.decrypt(private_key_rsa, public_key_x509)

data/lib/hiera/backend/eyaml_backend.rb

@@ -79,12 +79,19 @@ class Hiera
       def decrypt(data)
         if encrypted?(data)
           debug("Attempting to decrypt")
+          begin
+            parser = Eyaml::Parser::ParserFactory.hiera_backend_parser
+            tokens = parser.parse(data)
+            decrypted = tokens.map{ |token| token.to_plain_text }
+            plaintext = decrypted.join
+          rescue OpenSSL::PKCS7::PKCS7Error => e
+            debug("Caught exception: #{e.class}, #{e.message}\n"\
+                  "#{e.backtrace.join("\n")}")
+            raise "Hiera-eyaml decryption failed, check the "\
+              "encrypted data matches the key you are using.\n"\
+              "Raw message from system: #{e.message}"
 
-          parser = Eyaml::Parser::ParserFactory.hiera_backend_parser
-          tokens = parser.parse(data)
-          decrypted = tokens.map{ |token| token.to_plain_text }
-          plaintext = decrypted.join
-
+          end
           plaintext.chomp
         else
           data

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hiera-eyaml
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Tom Poulton
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-17 00:00:00.000000000 Z
+date: 2019-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: optimist
@@ -105,7 +105,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.2
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: OpenSSL Encryption backend for Hiera