hiera-eyaml 3.0.0 → 3.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/release.yml +24 -0
- data/.github/workflows/test.yml +31 -0
- data/.gitignore +1 -0
- data/CHANGELOG.md +83 -0
- data/Gemfile +3 -3
- data/README.md +105 -15
- data/hiera-eyaml.gemspec +2 -2
- data/lib/hiera/backend/eyaml.rb +1 -1
- data/lib/hiera/backend/eyaml/CLI.rb +3 -7
- data/lib/hiera/backend/eyaml/encryptor.rb +3 -4
- data/lib/hiera/backend/eyaml/encryptors/pkcs7.rb +36 -6
- data/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb +53 -59
- data/lib/hiera/backend/eyaml/subcommands/encrypt.rb +4 -4
- data/lib/hiera/backend/eyaml_backend.rb +13 -6
- metadata +10 -9
- data/.travis.yml +0 -43
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 5bfbd5d31fef9569be60fa1914e921a042203d41c83925cb908173d74963df05
|
|
4
|
+
data.tar.gz: f93f91ef3fa2c34cef964e7e5b5a3b64dde0e1cc2ddb4ad06a0ea94b251bbf4e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e060aeb86e2f48506413629c9664441c4d1b0fa9862be7c7136e414df7e015a477a399b0453893b2b68d92751b6a2893cf5bbb898fdd6aea0d18b91611678761
|
|
7
|
+
data.tar.gz: de656da85d672bdc7b950c21663140cba2eb5c980abdeed0e7f44961f881ac5193c5e394c5e202b5a32dc78086b0e40bda73ada9b6615add4a7640c717934ee9
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
name: Release
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
create:
|
|
5
|
+
ref_type: tag
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
release:
|
|
9
|
+
runs-on: ubuntu-latest
|
|
10
|
+
if: github.repository == 'voxpupuli/hiera-eyaml'
|
|
11
|
+
env:
|
|
12
|
+
BUNDLE_WITHOUT: release
|
|
13
|
+
steps:
|
|
14
|
+
- uses: actions/checkout@v2
|
|
15
|
+
- name: Install Ruby 2.7
|
|
16
|
+
uses: ruby/setup-ruby@v1
|
|
17
|
+
with:
|
|
18
|
+
ruby-version: '2.7'
|
|
19
|
+
- name: Build gem
|
|
20
|
+
run: gem build *.gemspec
|
|
21
|
+
- name: Publish gem
|
|
22
|
+
run: gem push *.gem
|
|
23
|
+
env:
|
|
24
|
+
GEM_HOST_API_KEY: '${{ secrets.RUBYGEMS_AUTH_TOKEN }}'
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
name: Test
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
- pull_request
|
|
5
|
+
- push
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
test:
|
|
9
|
+
runs-on: ubuntu-latest
|
|
10
|
+
strategy:
|
|
11
|
+
fail-fast: false
|
|
12
|
+
matrix:
|
|
13
|
+
ruby:
|
|
14
|
+
- "2.5"
|
|
15
|
+
- "2.6"
|
|
16
|
+
- "2.7"
|
|
17
|
+
env:
|
|
18
|
+
BUNDLE_WITHOUT: release
|
|
19
|
+
PUPPET_VERSION: "~> 6.0"
|
|
20
|
+
name: Ruby ${{ matrix.ruby }}
|
|
21
|
+
steps:
|
|
22
|
+
- uses: actions/checkout@v2
|
|
23
|
+
- name: Install expect
|
|
24
|
+
run: sudo apt-get install expect
|
|
25
|
+
- name: Install Ruby ${{ matrix.ruby }}
|
|
26
|
+
uses: ruby/setup-ruby@v1
|
|
27
|
+
with:
|
|
28
|
+
ruby-version: ${{ matrix.ruby }}
|
|
29
|
+
bundler-cache: true
|
|
30
|
+
- name: Run tests
|
|
31
|
+
run: bundle exec cucumber -f progress
|
data/.gitignore
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,86 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
|
4
4
|
|
|
5
|
+
## [v3.2.2](https://github.com/voxpupuli/hiera-eyaml/tree/v3.2.2) (2021-05-03)
|
|
6
|
+
|
|
7
|
+
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.2.1...v3.2.2)
|
|
8
|
+
|
|
9
|
+
**Fixed bugs:**
|
|
10
|
+
|
|
11
|
+
- Using `3.2.1` for editing an eyaml created with `3.2.0` will mess up formatting [\#318](https://github.com/voxpupuli/hiera-eyaml/issues/318)
|
|
12
|
+
- Fix block formatting when editing [\#319](https://github.com/voxpupuli/hiera-eyaml/pull/319) ([kenyon](https://github.com/kenyon))
|
|
13
|
+
|
|
14
|
+
**Closed issues:**
|
|
15
|
+
|
|
16
|
+
- Concerns about the encrypted? method [\#316](https://github.com/voxpupuli/hiera-eyaml/issues/316)
|
|
17
|
+
|
|
18
|
+
## [v3.2.1](https://github.com/voxpupuli/hiera-eyaml/tree/v3.2.1) (2021-02-16)
|
|
19
|
+
|
|
20
|
+
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.2.0...v3.2.1)
|
|
21
|
+
|
|
22
|
+
**Fixed bugs:**
|
|
23
|
+
|
|
24
|
+
- remove question mark from regex in encrypted? method [\#313](https://github.com/voxpupuli/hiera-eyaml/pull/313) ([mcka1n](https://github.com/mcka1n))
|
|
25
|
+
- Fix block folding [\#307](https://github.com/voxpupuli/hiera-eyaml/pull/307) ([kenyon](https://github.com/kenyon))
|
|
26
|
+
- add step-by-step how-to encrypting multiline values [\#304](https://github.com/voxpupuli/hiera-eyaml/pull/304) ([kBite](https://github.com/kBite))
|
|
27
|
+
|
|
28
|
+
**Closed issues:**
|
|
29
|
+
|
|
30
|
+
- eyaml edit should produce evenly folded blocks. [\#281](https://github.com/voxpupuli/hiera-eyaml/issues/281)
|
|
31
|
+
- Support version 4 hiera config [\#213](https://github.com/voxpupuli/hiera-eyaml/issues/213)
|
|
32
|
+
|
|
33
|
+
**Merged pull requests:**
|
|
34
|
+
|
|
35
|
+
- migrate CI to github actions [\#315](https://github.com/voxpupuli/hiera-eyaml/pull/315) ([bastelfreak](https://github.com/bastelfreak))
|
|
36
|
+
- gemspec: fix repo url / Drop Puppet 4/5 tests [\#311](https://github.com/voxpupuli/hiera-eyaml/pull/311) ([bastelfreak](https://github.com/bastelfreak))
|
|
37
|
+
- Unpin highline [\#310](https://github.com/voxpupuli/hiera-eyaml/pull/310) ([lucywyman](https://github.com/lucywyman))
|
|
38
|
+
|
|
39
|
+
## [v3.2.0](https://github.com/voxpupuli/hiera-eyaml/tree/v3.2.0) (2020-01-31)
|
|
40
|
+
|
|
41
|
+
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.1.1...v3.2.0)
|
|
42
|
+
|
|
43
|
+
**Implemented enhancements:**
|
|
44
|
+
|
|
45
|
+
- Permit reading private key from environment variable [\#294](https://github.com/voxpupuli/hiera-eyaml/pull/294) ([nferch](https://github.com/nferch))
|
|
46
|
+
|
|
47
|
+
**Fixed bugs:**
|
|
48
|
+
|
|
49
|
+
- Version 3.1.0 does not clear the private/public key when options are changed [\#289](https://github.com/voxpupuli/hiera-eyaml/issues/289)
|
|
50
|
+
|
|
51
|
+
**Merged pull requests:**
|
|
52
|
+
|
|
53
|
+
- \(doc\) Correct order for config file precedence [\#295](https://github.com/voxpupuli/hiera-eyaml/pull/295) ([crayfishx](https://github.com/crayfishx))
|
|
54
|
+
- \(maint\) Update Gemfile and README for Ruby 2.5/2.4 [\#293](https://github.com/voxpupuli/hiera-eyaml/pull/293) ([glennsarti](https://github.com/glennsarti))
|
|
55
|
+
|
|
56
|
+
## [v3.1.1](https://github.com/voxpupuli/hiera-eyaml/tree/v3.1.1) (2019-11-12)
|
|
57
|
+
|
|
58
|
+
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.1.0...v3.1.1)
|
|
59
|
+
|
|
60
|
+
**Merged pull requests:**
|
|
61
|
+
|
|
62
|
+
- Revert "Cache key strings." [\#290](https://github.com/voxpupuli/hiera-eyaml/pull/290) ([alexjfisher](https://github.com/alexjfisher))
|
|
63
|
+
|
|
64
|
+
## [v3.1.0](https://github.com/voxpupuli/hiera-eyaml/tree/v3.1.0) (2019-11-11)
|
|
65
|
+
|
|
66
|
+
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v3.0.0...v3.1.0)
|
|
67
|
+
|
|
68
|
+
**Implemented enhancements:**
|
|
69
|
+
|
|
70
|
+
- Should be able to `edit` a new file [\#84](https://github.com/voxpupuli/hiera-eyaml/issues/84)
|
|
71
|
+
- Cache key strings. [\#191](https://github.com/voxpupuli/hiera-eyaml/pull/191) ([mkulke](https://github.com/mkulke))
|
|
72
|
+
|
|
73
|
+
**Closed issues:**
|
|
74
|
+
|
|
75
|
+
- Decryption errors should return error code. [\#282](https://github.com/voxpupuli/hiera-eyaml/issues/282)
|
|
76
|
+
- Release a new version [\#271](https://github.com/voxpupuli/hiera-eyaml/issues/271)
|
|
77
|
+
|
|
78
|
+
**Merged pull requests:**
|
|
79
|
+
|
|
80
|
+
- \(docs\) Update README with reference to hiera-eyaml-vault [\#287](https://github.com/voxpupuli/hiera-eyaml/pull/287) ([crayfishx](https://github.com/crayfishx))
|
|
81
|
+
- fix: don't handle cli exceptions early [\#283](https://github.com/voxpupuli/hiera-eyaml/pull/283) ([stuart-warren](https://github.com/stuart-warren))
|
|
82
|
+
- Adding doc for Google KMS plugin [\#279](https://github.com/voxpupuli/hiera-eyaml/pull/279) ([craigwatson](https://github.com/craigwatson))
|
|
83
|
+
- catch failed decryption and print a helpful message [\#144](https://github.com/voxpupuli/hiera-eyaml/pull/144) ([GeoffWilliams](https://github.com/GeoffWilliams))
|
|
84
|
+
|
|
5
85
|
## [v3.0.0](https://github.com/voxpupuli/hiera-eyaml/tree/v3.0.0) (2019-01-17)
|
|
6
86
|
|
|
7
87
|
[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v2.1.0...v3.0.0)
|
|
@@ -76,7 +156,10 @@ This is the first release after this project was migrated to Vox Pupuli.
|
|
|
76
156
|
- \(docs\) Update README with instructions for using Hiera 5 [\#229](https://github.com/voxpupuli/hiera-eyaml/pull/229) ([nfagerlund](https://github.com/nfagerlund))
|
|
77
157
|
- Attempt to resolve Travis CI issues [\#220](https://github.com/voxpupuli/hiera-eyaml/pull/220) ([rnelson0](https://github.com/rnelson0))
|
|
78
158
|
- Make it clear that the ID and parens must be deleted, not just the ID [\#188](https://github.com/voxpupuli/hiera-eyaml/pull/188) ([sdotz](https://github.com/sdotz))
|
|
159
|
+
- Refactor highline import [\#187](https://github.com/voxpupuli/hiera-eyaml/pull/187) ([petems](https://github.com/petems))
|
|
160
|
+
- Adding hiera-eyaml-kms plugin to readme file [\#184](https://github.com/voxpupuli/hiera-eyaml/pull/184) ([adenot](https://github.com/adenot))
|
|
79
161
|
- Make output of `eyaml decrypt` valid yaml with multiline values. [\#183](https://github.com/voxpupuli/hiera-eyaml/pull/183) ([peculater](https://github.com/peculater))
|
|
162
|
+
- Add testing support for puppet 4 [\#181](https://github.com/voxpupuli/hiera-eyaml/pull/181) ([peculater](https://github.com/peculater))
|
|
80
163
|
|
|
81
164
|
## v2.1.0 (2016-03-02)
|
|
82
165
|
|
data/Gemfile
CHANGED
|
@@ -7,9 +7,9 @@ group :development do
|
|
|
7
7
|
gem "cucumber", '~> 1.1'
|
|
8
8
|
gem "rspec-expectations", '~> 3.1.0'
|
|
9
9
|
gem "hiera-eyaml-plaintext"
|
|
10
|
-
gem "puppet", ENV['PUPPET_VERSION'] || '
|
|
11
|
-
gem '
|
|
12
|
-
gem
|
|
10
|
+
gem "puppet", ENV['PUPPET_VERSION'] || '>= 7'
|
|
11
|
+
gem 'github_changelog_generator'
|
|
12
|
+
gem "activesupport"
|
|
13
13
|
end
|
|
14
14
|
|
|
15
15
|
group :test do
|
data/README.md
CHANGED
|
@@ -5,7 +5,7 @@ Hiera eyaml
|
|
|
5
5
|
[](https://rubygems.org/gems/hiera-eyaml)
|
|
6
6
|
[](https://rubygems.org/gems/hiera-eyaml)
|
|
7
7
|
|
|
8
|
-
hiera-eyaml is a backend for Hiera that provides per-value encryption of sensitive data within yaml files
|
|
8
|
+
hiera-eyaml is a backend for Hiera that provides per-value encryption of sensitive data within yaml files
|
|
9
9
|
to be used by Puppet.
|
|
10
10
|
|
|
11
11
|
-------------------------
|
|
@@ -18,8 +18,8 @@ Hopefully this will mean more frequent feature updates and bug fixes!
|
|
|
18
18
|
Advantages over hiera-gpg
|
|
19
19
|
-------------------------
|
|
20
20
|
|
|
21
|
-
A few people found that [hiera-gpg](https://github.com/crayfishx/hiera-gpg) just wasn't cutting it for all use cases,
|
|
22
|
-
one of the best expressed frustrations was
|
|
21
|
+
A few people found that [hiera-gpg](https://github.com/crayfishx/hiera-gpg) just wasn't cutting it for all use cases,
|
|
22
|
+
one of the best expressed frustrations was
|
|
23
23
|
[written back in June 2013](http://slashdevslashrandom.wordpress.com/2013/06/03/my-griefs-with-hiera-gpg/). So
|
|
24
24
|
[Tom created an initial version](http://themettlemonkey.wordpress.com/2013/07/15/hiera-eyaml-per-value-encrypted-backend-for-hiera-and-puppet/)
|
|
25
25
|
and this was refined into an elegant solution over the following months.
|
|
@@ -28,14 +28,14 @@ Unlike `hiera-gpg`, `hiera-eyaml`:
|
|
|
28
28
|
|
|
29
29
|
- only encrypts the values (which allows files to be swiftly reviewed without decryption)
|
|
30
30
|
- encrypts the value of each key individually (this means that `git diff` is meaningful)
|
|
31
|
-
- includes a command line tool for encrypting, decrypting, editing and rotating keys (makes it almost as
|
|
31
|
+
- includes a command line tool for encrypting, decrypting, editing and rotating keys (makes it almost as
|
|
32
32
|
easy as using clear text files)
|
|
33
|
-
- uses basic asymmetric encryption (PKCS#7) by default (doesn't require any native libraries that need to
|
|
33
|
+
- uses basic asymmetric encryption (PKCS#7) by default (doesn't require any native libraries that need to
|
|
34
34
|
be compiled & allows users without the private key to encrypt values that the puppet master can decrypt)
|
|
35
|
-
- has a pluggable encryption framework (e.g. GPG encryption ([hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg)) can be used
|
|
35
|
+
- has a pluggable encryption framework (e.g. GPG encryption ([hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg)) can be used
|
|
36
36
|
if you have the need for multiple keys and easier key rotation)
|
|
37
37
|
|
|
38
|
-
The Hiera eyaml backend uses yaml formatted files with the .eyaml extension. The encrypted strings are prefixed with the encryption
|
|
38
|
+
The Hiera eyaml backend uses yaml formatted files with the .eyaml extension. The encrypted strings are prefixed with the encryption
|
|
39
39
|
method, wrapped with ENC[] and placed in an eyaml file. You can mix your plain values in as well or separate them into different files.
|
|
40
40
|
Encrypted values can occur within arrays, hashes, nested arrays and nested hashes.
|
|
41
41
|
|
|
@@ -93,6 +93,8 @@ The permissions for this folder should allow the puppet user (normally 'puppet')
|
|
|
93
93
|
-r-------- 1 puppet puppet 1.7K Sep 24 16:24 private_key.pkcs7.pem
|
|
94
94
|
-r-------- 1 puppet puppet 1.1K Sep 24 16:24 public_key.pkcs7.pem
|
|
95
95
|
|
|
96
|
+
You may also load the keypair into an environment variable and use the `pkcs7_private_key_env_var` and `pkcs7_public_key_env_var` options to specify the environment variable names to avoid writing the secret key to disk.
|
|
97
|
+
|
|
96
98
|
|
|
97
99
|
Basic usage
|
|
98
100
|
-----------
|
|
@@ -129,8 +131,8 @@ and will encrypt and modified values when you exit the editor.
|
|
|
129
131
|
|
|
130
132
|
$ eyaml edit filename.eyaml # Edit an eyaml file in place
|
|
131
133
|
|
|
132
|
-
When editing eyaml files, you will see that the unencrypted plaintext is marked to allow the eyaml tool to
|
|
133
|
-
identify each encrypted block, along with the encryption method. This is used to make sure that the block
|
|
134
|
+
When editing eyaml files, you will see that the unencrypted plaintext is marked to allow the eyaml tool to
|
|
135
|
+
identify each encrypted block, along with the encryption method. This is used to make sure that the block
|
|
134
136
|
is encrypted again only if the clear text value has changed, and is encrypted using the
|
|
135
137
|
original encryption mechanism (see plugable encryption later).
|
|
136
138
|
|
|
@@ -161,7 +163,7 @@ things:
|
|
|
161
163
|
- nested thing 2.1
|
|
162
164
|
```
|
|
163
165
|
|
|
164
|
-
Whilst editing you can delete existing values and add new one using the same format (as below). Note that it is important to
|
|
166
|
+
Whilst editing you can delete existing values and add new one using the same format (as below). Note that it is important to
|
|
165
167
|
omit the number in brackets for new values. If any duplicate IDs are found then the re-encryption process will be abandoned
|
|
166
168
|
by the eyaml tool.
|
|
167
169
|
|
|
@@ -185,6 +187,89 @@ file just like any other eyaml string and your done. If the file is rather
|
|
|
185
187
|
large, you may wish to use a helper like `xclip` to copy the stdout directly to
|
|
186
188
|
your clipboard.
|
|
187
189
|
|
|
190
|
+
### Encrypting multiline values
|
|
191
|
+
|
|
192
|
+
The following step-by-step example shows you how to encrypt multiline values.
|
|
193
|
+
|
|
194
|
+
- Copy the YAML text below to a file named `multiline_example.eyaml`
|
|
195
|
+
```
|
|
196
|
+
---
|
|
197
|
+
accounts::key_sets:
|
|
198
|
+
dummy:
|
|
199
|
+
private: |
|
|
200
|
+
---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
|
|
201
|
+
Comment: "dummy-key-hiera-eyaml-issue-rsa-key-20200911"
|
|
202
|
+
P2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS
|
|
203
|
+
1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw
|
|
204
|
+
JWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj
|
|
205
|
+
2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr
|
|
206
|
+
QEPM5xLW0unCsQ==
|
|
207
|
+
---- END SSH2 ENCRYPTED PRIVATE KEY ----
|
|
208
|
+
```
|
|
209
|
+
|
|
210
|
+
- Use `edit` to ...
|
|
211
|
+
- replace '|' with '>',
|
|
212
|
+
- prepend `DEC::PKCS7[` before the first line,
|
|
213
|
+
- remove all whitespaces used for indentation,
|
|
214
|
+
- and append `]!` to the last line of the multiline value.
|
|
215
|
+
|
|
216
|
+
`eyaml edit multiline_example.eyaml`
|
|
217
|
+
```
|
|
218
|
+
---
|
|
219
|
+
accounts::key_sets:
|
|
220
|
+
dummy:
|
|
221
|
+
private: >
|
|
222
|
+
DEC::PKCS7[---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
|
|
223
|
+
Comment: "dummy-key-hiera-eyaml-issue-rsa-key-20170123"
|
|
224
|
+
P2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS
|
|
225
|
+
1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw
|
|
226
|
+
JWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj
|
|
227
|
+
2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr
|
|
228
|
+
QEPM5xLW0unCsQ==
|
|
229
|
+
---- END SSH2 ENCRYPTED PRIVATE KEY ----]!
|
|
230
|
+
```
|
|
231
|
+
```
|
|
232
|
+
# resulting encrypted file
|
|
233
|
+
---
|
|
234
|
+
accounts::key_sets:
|
|
235
|
+
dummy:
|
|
236
|
+
private: >
|
|
237
|
+
ENC[PKCS7,MIIDTQYJKoZIhvcNAQcDoIIDPjCCAzoCAQAxggEhMIIBHQIBADAFMAACAQEw
|
|
238
|
+
DQYJKoZIhvcNAQEBBQAEggEAXH7xB1xuzoMAqA/3jSXO0ZUR6+UCb3DsTTj3
|
|
239
|
+
Lsrcx5oQBnJ/ml7GfBCPxBKfArZunLcnxmSk4hECKXdfgKsVjAa++JQWvtEm
|
|
240
|
+
HUNTFqvwd76Ku+nMfI9c8g+X+l6obLjzWfJdg3t6Ja7CJKl8UNFtSmbfYKVi
|
|
241
|
+
nZ0xBubgdY4plLAFcZyD5/A/lNFqwb051TRLbZOIRRfLUlRL7RNkKRC59Aog
|
|
242
|
+
S5aJXjmqx6vRzFifNK0JFZvYHGD75TiHJ5LFjg4rjgFd43AnK8iNo773ZWP2
|
|
243
|
+
48Gly5Zx7qVQDCDDi1YBgNFb0NIBQw+kWy7HcPH2REvPnXu/HV2FWvDP3Ond
|
|
244
|
+
yr2EbTCCAg4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEH+CjZJ1gKfaQIrr
|
|
245
|
+
N5zef7OAggHgBmRVsfaoiNEOzhmHZ5SxxZztmpBNtLv7mteaSqSL5o0TtKQh
|
|
246
|
+
SDgxBhaQmlL51+JM1Jsnvqm57ikZhj7Vtek/vr5DhYhWs0AxttH5rNaw0zKU
|
|
247
|
+
4bMppVu+SNKCtT+2Qw31x/S7gF7yVl+mwmXhq3qAj9ExWRX3d/8/zTuC61Io
|
|
248
|
+
f+7O6YUOucZ/m/YPrQnC5v7bDSKlIf1aFaKqukjM3QO8FZlAOHGPvRuWV2Om
|
|
249
|
+
QIgxQE6F8r+bTkW3KiVIx5FEIthRZ90VS3tz/2wjj77svddBhlid9ov/0ard
|
|
250
|
+
GGVNGsl1BFpLqxC0mpZXz237cL/aM58naqmX52J6YmC0xQM3DNmahWlYx1HV
|
|
251
|
+
J/Ogk12pOYPLJB/09OuoHPzKC4WfpB9B7wAC6pghRkO/84cOw6rgSdbzze5W
|
|
252
|
+
WMPvo181Y74BSBKhJDdO3lWYmEcDyx4TEsMUlpxd9PBDcOHqf9qHviXrwGzO
|
|
253
|
+
oSm2bUV0Fum5ueU+D2vu3mO0yIQ6fwyvDZLBRjfJV7K/PyDz81feWT6+g38t
|
|
254
|
+
AC27c0h8wk9b7HYfqG28nZE7F13qrhwCKnOaYLglsmbszNpRrBhfo1IHF6oM
|
|
255
|
+
YZRZrnrGQg5qQcxMsLq37RAfRgkY0rRLs78EEAhkf4NDxw0A/ovt]
|
|
256
|
+
```
|
|
257
|
+
- Output of `eyaml decrypt -f multiline_example.eyaml`:
|
|
258
|
+
```
|
|
259
|
+
---
|
|
260
|
+
accounts::key_sets:
|
|
261
|
+
dummy:
|
|
262
|
+
private: |
|
|
263
|
+
---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
|
|
264
|
+
Comment: "dummy-key-hiera-eyaml-issue-rsa-key-20200911"
|
|
265
|
+
P2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS
|
|
266
|
+
1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw
|
|
267
|
+
JWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj
|
|
268
|
+
2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr
|
|
269
|
+
QEPM5xLW0unCsQ==
|
|
270
|
+
---- END SSH2 ENCRYPTED PRIVATE KEY ----
|
|
271
|
+
```
|
|
272
|
+
- The output *does NOT* have to be valid YAML for usage with Puppet.
|
|
188
273
|
|
|
189
274
|
Hiera
|
|
190
275
|
-----
|
|
@@ -203,7 +288,7 @@ Hierarchy levels that use eyaml must set the following keys:
|
|
|
203
288
|
* `lookup_key` (must be set to `eyaml_lookup_key`).
|
|
204
289
|
* `path`/`paths`/`glob`/`globs` (choose one).
|
|
205
290
|
* `datadir` (can be omitted if you've set a default).
|
|
206
|
-
* `options` — a hash of eyaml-specific settings; by default, this should include `pkcs7_private_key` and `pkcs7_public_key`, but alternate encryption plugins use alternate options. Anything from the old `:eyaml` config section (except `datadir`) goes here.
|
|
291
|
+
* `options` — a hash of eyaml-specific settings; by default, this should include `pkcs7_private_key` and `pkcs7_public_key`, or `pkcs7_public_key_env_var` and `pkcs7_private_key_env_var`, but alternate encryption plugins use alternate options. Anything from the old `:eyaml` config section (except `datadir`) goes here.
|
|
207
292
|
|
|
208
293
|
You do not need to specify key names as `:symbols`; normal strings are fine.
|
|
209
294
|
|
|
@@ -321,7 +406,7 @@ Configuration file for eyaml
|
|
|
321
406
|
|
|
322
407
|
Default parameters for the eyaml command line tool can be provided by creating a configuration YAML file.
|
|
323
408
|
|
|
324
|
-
Config files will be read first from
|
|
409
|
+
Config files will be read first from `~/.eyaml/config.yaml`, then from `/etc/eyaml/config.yaml` and finally by anything referenced in the `EYAML_CONFIG` environment variable
|
|
325
410
|
|
|
326
411
|
The file takes any long form argument that you can provide on the command line. For example, to override the pkcs7 keys:
|
|
327
412
|
```yaml
|
|
@@ -358,14 +443,17 @@ When editing eyaml files, you will see that the unencrypted plaintext is marked
|
|
|
358
443
|
This is a list of available plugins:
|
|
359
444
|
|
|
360
445
|
- [hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg) - Provide GPG encryption
|
|
361
|
-
- [hiera-eyaml-plaintext](https://github.com/gtmtechltd/hiera-eyaml-plaintext) - This is a no-op encryption plugin that
|
|
362
|
-
simply base64 encodes the values. It exists as an example plugin to create your own and to do integration tests on
|
|
446
|
+
- [hiera-eyaml-plaintext](https://github.com/gtmtechltd/hiera-eyaml-plaintext) - This is a no-op encryption plugin that
|
|
447
|
+
simply base64 encodes the values. It exists as an example plugin to create your own and to do integration tests on
|
|
363
448
|
hiera-eyaml. **THIS SHOULD NOT BE USED IN PRODUCTION**
|
|
364
449
|
- [hiera-eyaml-twofac](https://github.com/gtmtechltd/hiera-eyaml-twofac) - PKCS7 keypair + AES256 symmetric password for two-factor encryption
|
|
365
450
|
Note that this plugin mandates the user enter a password. It is useful for non-automated scenarios, and is not advised to be used
|
|
366
451
|
in conjunction with puppet, as it requires entry of a password over a terminal.
|
|
367
452
|
- [hiera-eyaml-kms](https://github.com/adenot/hiera-eyaml-kms) - Encryption using AWS Key Management Service (KMS)
|
|
368
|
-
|
|
453
|
+
- [hiera-eyaml-gkms](https://github.com/craigwatson/hiera-eyaml-gkms) - Encryption using Google Cloud KMS
|
|
454
|
+
- [hiera-eyaml-vault](https://github.com/crayfishx/hiera-eyaml-vault) - Use the transit secrets engine from Vault for providing encryption.
|
|
455
|
+
|
|
456
|
+
|
|
369
457
|
### How-To's:
|
|
370
458
|
|
|
371
459
|
- [How to use different Hiera/Eyaml keys for different environments using the AWS Parameter Store to store the encryption keys for Hiera/Eyaml](https://gist.github.com/FransUrbo/88b26033cb513a8aa569bd5392a427b1).
|
|
@@ -408,6 +496,8 @@ Some of us hang out on #hiera-eyaml on freenode, please drop by if you want to s
|
|
|
408
496
|
Tests
|
|
409
497
|
-----
|
|
410
498
|
|
|
499
|
+
**NOTE** Some testing requirements are not supported on Windows
|
|
500
|
+
|
|
411
501
|
In order to run the tests, simply run `cucumber` in the top level directory of the project.
|
|
412
502
|
|
|
413
503
|
You'll need to have a few requirements installed:
|
data/hiera-eyaml.gemspec
CHANGED
|
@@ -11,12 +11,12 @@ Gem::Specification.new do |gem|
|
|
|
11
11
|
gem.author = "Tom Poulton"
|
|
12
12
|
gem.license = "MIT"
|
|
13
13
|
|
|
14
|
-
gem.homepage = "
|
|
14
|
+
gem.homepage = "https://github.com/voxpupuli/hiera-eyaml/"
|
|
15
15
|
gem.files = `git ls-files`.split($/).reject { |file| file =~ /^features.*$/ }
|
|
16
16
|
gem.executables = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
|
|
17
17
|
gem.test_files = gem.files.grep(%r{^(test|spec|features)/})
|
|
18
18
|
gem.require_paths = ["lib"]
|
|
19
19
|
|
|
20
20
|
gem.add_dependency('optimist')
|
|
21
|
-
gem.add_dependency('highline'
|
|
21
|
+
gem.add_dependency('highline')
|
|
22
22
|
end
|
data/lib/hiera/backend/eyaml.rb
CHANGED
|
@@ -42,13 +42,9 @@ class Hiera
|
|
|
42
42
|
def self.execute
|
|
43
43
|
|
|
44
44
|
executor = Eyaml::Options[:executor]
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
rescue Exception => e
|
|
49
|
-
LoggingHelper.warn e.message
|
|
50
|
-
LoggingHelper.debug e.backtrace.join("\n")
|
|
51
|
-
end
|
|
45
|
+
|
|
46
|
+
result = executor.execute
|
|
47
|
+
puts result unless result.nil?
|
|
52
48
|
|
|
53
49
|
end
|
|
54
50
|
|
|
@@ -14,7 +14,7 @@ class Hiera
|
|
|
14
14
|
|
|
15
15
|
def self.find encryption_scheme = nil
|
|
16
16
|
encryption_scheme = Eyaml.default_encryption_scheme if encryption_scheme.nil?
|
|
17
|
-
require "hiera/backend/eyaml/encryptors/#{File.basename encryption_scheme.downcase}"
|
|
17
|
+
require "hiera/backend/eyaml/encryptors/#{File.basename encryption_scheme.downcase}"
|
|
18
18
|
encryptor_module = Module.const_get('Hiera').const_get('Backend').const_get('Eyaml').const_get('Encryptors')
|
|
19
19
|
encryptor_class = Utils.find_closest_class :parent_class => encryptor_module, :class_name => encryption_scheme
|
|
20
20
|
raise StandardError, "Could not find hiera-eyaml encryptor: #{encryption_scheme}. Try gem install hiera-eyaml-#{encryption_scheme.downcase} ?" if encryptor_class.nil?
|
|
@@ -22,14 +22,14 @@ class Hiera
|
|
|
22
22
|
end
|
|
23
23
|
|
|
24
24
|
def self.encode binary_string
|
|
25
|
-
Base64.
|
|
25
|
+
Base64.strict_encode64(binary_string)
|
|
26
26
|
end
|
|
27
27
|
|
|
28
28
|
def self.decode string
|
|
29
29
|
Base64.decode64(string)
|
|
30
30
|
end
|
|
31
31
|
|
|
32
|
-
def self.encrypt *args
|
|
32
|
+
def self.encrypt *args
|
|
33
33
|
raise StandardError, "encrypt() not defined for encryptor plugin: #{self}"
|
|
34
34
|
end
|
|
35
35
|
|
|
@@ -80,4 +80,3 @@ class Hiera
|
|
|
80
80
|
end
|
|
81
81
|
end
|
|
82
82
|
end
|
|
83
|
-
|
|
@@ -18,6 +18,10 @@ class Hiera
|
|
|
18
18
|
:public_key => { :desc => "Path to public key",
|
|
19
19
|
:type => :string,
|
|
20
20
|
:default => "./keys/public_key.pkcs7.pem" },
|
|
21
|
+
:private_key_env_var => { :desc => "Name of environment variable to read private key from",
|
|
22
|
+
:type => :string },
|
|
23
|
+
:public_key_env_var => { :desc => "Name of environment variable to read public key from",
|
|
24
|
+
:type => :string },
|
|
21
25
|
:subject => { :desc => "Subject to use for certificate when creating keys",
|
|
22
26
|
:type => :string,
|
|
23
27
|
:default => "/" },
|
|
@@ -36,9 +40,18 @@ class Hiera
|
|
|
36
40
|
LoggingHelper::trace 'PKCS7 encrypt'
|
|
37
41
|
|
|
38
42
|
public_key = self.option :public_key
|
|
39
|
-
|
|
43
|
+
public_key_env_var = self.option :public_key_env_var
|
|
44
|
+
raise StandardError, "pkcs7_public_key is not defined" unless public_key or public_key_env_var
|
|
40
45
|
|
|
41
|
-
|
|
46
|
+
if public_key and public_key_env_var
|
|
47
|
+
warn "both public_key and public_key_env_var specified, using public_key"
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
if public_key_env_var and ENV[public_key_env_var]
|
|
51
|
+
public_key_pem = ENV[public_key_env_var]
|
|
52
|
+
else
|
|
53
|
+
public_key_pem = File.read public_key
|
|
54
|
+
end
|
|
42
55
|
public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )
|
|
43
56
|
|
|
44
57
|
cipher = OpenSSL::Cipher::AES.new(256, :CBC)
|
|
@@ -51,13 +64,30 @@ class Hiera
|
|
|
51
64
|
|
|
52
65
|
public_key = self.option :public_key
|
|
53
66
|
private_key = self.option :private_key
|
|
54
|
-
|
|
55
|
-
|
|
67
|
+
public_key_env_var = self.option :public_key_env_var
|
|
68
|
+
private_key_env_var = self.option :private_key_env_var
|
|
69
|
+
raise StandardError, "pkcs7_public_key is not defined" unless public_key or public_key_env_var
|
|
70
|
+
raise StandardError, "pkcs7_private_key is not defined" unless private_key or private_key_env_var
|
|
71
|
+
|
|
72
|
+
if public_key and public_key_env_var
|
|
73
|
+
warn "both public_key and public_key_env_var specified, using public_key"
|
|
74
|
+
end
|
|
75
|
+
if private_key and private_key_env_var
|
|
76
|
+
warn "both private_key and private_key_env_var specified, using private_key"
|
|
77
|
+
end
|
|
56
78
|
|
|
57
|
-
|
|
79
|
+
if private_key_env_var and ENV[private_key_env_var]
|
|
80
|
+
private_key_pem = ENV[private_key_env_var]
|
|
81
|
+
else
|
|
82
|
+
private_key_pem = File.read private_key
|
|
83
|
+
end
|
|
58
84
|
private_key_rsa = OpenSSL::PKey::RSA.new( private_key_pem )
|
|
59
85
|
|
|
60
|
-
|
|
86
|
+
if public_key_env_var and ENV[public_key_env_var]
|
|
87
|
+
public_key_pem = ENV[public_key_env_var]
|
|
88
|
+
else
|
|
89
|
+
public_key_pem = File.read public_key
|
|
90
|
+
end
|
|
61
91
|
public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )
|
|
62
92
|
|
|
63
93
|
pkcs7 = OpenSSL::PKCS7.new( ciphertext )
|
|
@@ -4,34 +4,36 @@ require 'hiera/backend/eyaml/encryptor'
|
|
|
4
4
|
require 'hiera/backend/eyaml'
|
|
5
5
|
require 'base64'
|
|
6
6
|
|
|
7
|
-
|
|
8
7
|
class Hiera
|
|
9
8
|
module Backend
|
|
10
9
|
module Eyaml
|
|
11
10
|
module Parser
|
|
12
11
|
class EncToken < Token
|
|
13
|
-
@@tokens_map =
|
|
12
|
+
@@tokens_map = {}
|
|
14
13
|
@@encrypt_unchanged = true
|
|
15
14
|
attr_reader :format, :cipher, :encryptor, :indentation, :plain_text, :id
|
|
15
|
+
|
|
16
16
|
def self.encrypted_value(format, encryption_scheme, cipher, match, indentation = '')
|
|
17
17
|
decryptor = Encryptor.find encryption_scheme
|
|
18
|
-
plain_text = decryptor.decrypt(
|
|
18
|
+
plain_text = decryptor.decrypt(decryptor.decode(cipher))
|
|
19
19
|
EncToken.new(format, plain_text, decryptor, cipher, match, indentation)
|
|
20
20
|
end
|
|
21
|
+
|
|
21
22
|
def self.decrypted_value(format, plain_text, encryption_scheme, match, id, indentation = '')
|
|
22
23
|
encryptor = Encryptor.find encryption_scheme
|
|
23
|
-
cipher = encryptor.encode(
|
|
24
|
-
id_number = id.nil? ? nil : id.gsub(/\(|\)/,
|
|
24
|
+
cipher = encryptor.encode(encryptor.encrypt(plain_text))
|
|
25
|
+
id_number = id.nil? ? nil : id.gsub(/\(|\)/, '').to_i
|
|
25
26
|
EncToken.new(format, plain_text, encryptor, cipher, match, indentation, id_number)
|
|
26
27
|
end
|
|
28
|
+
|
|
27
29
|
def self.plain_text_value(format, plain_text, encryption_scheme, match, id, indentation = '')
|
|
28
30
|
encryptor = Encryptor.find encryption_scheme
|
|
29
|
-
id_number = id.gsub(/\(|\)/,
|
|
30
|
-
EncToken.new(format, plain_text, encryptor,
|
|
31
|
+
id_number = id.gsub(/\(|\)/, '').to_i unless id.nil?
|
|
32
|
+
EncToken.new(format, plain_text, encryptor, '', match, indentation, id_number)
|
|
31
33
|
end
|
|
32
34
|
|
|
33
35
|
def self.tokens_map
|
|
34
|
-
|
|
36
|
+
@@tokens_map
|
|
35
37
|
end
|
|
36
38
|
|
|
37
39
|
def self.set_encrypt_unchanged(encrypt_unchanged)
|
|
@@ -39,12 +41,12 @@ class Hiera
|
|
|
39
41
|
end
|
|
40
42
|
|
|
41
43
|
def self.encrypt_unchanged
|
|
42
|
-
|
|
44
|
+
@@encrypt_unchanged
|
|
43
45
|
end
|
|
44
46
|
|
|
45
47
|
def initialize(format, plain_text, encryptor, cipher, match = '', indentation = '', id = nil)
|
|
46
48
|
@format = format
|
|
47
|
-
@plain_text = Utils.convert_to_utf_8(
|
|
49
|
+
@plain_text = Utils.convert_to_utf_8(plain_text)
|
|
48
50
|
@encryptor = encryptor
|
|
49
51
|
@cipher = cipher
|
|
50
52
|
@indentation = indentation
|
|
@@ -52,69 +54,64 @@ class Hiera
|
|
|
52
54
|
super(match)
|
|
53
55
|
end
|
|
54
56
|
|
|
55
|
-
def to_encrypted(args={})
|
|
57
|
+
def to_encrypted(args = {})
|
|
56
58
|
label = args[:label]
|
|
57
59
|
label_string = label.nil? ? '' : "#{label}: "
|
|
58
60
|
format = args[:format].nil? ? @format : args[:format]
|
|
59
61
|
encryption_method = args[:change_encryption]
|
|
60
|
-
|
|
62
|
+
unless encryption_method.nil?
|
|
61
63
|
@encryptor = Encryptor.find encryption_method
|
|
62
|
-
@cipher = Base64.
|
|
64
|
+
@cipher = Base64.strict_encode64(@encryptor.encrypt(@plain_text))
|
|
63
65
|
end
|
|
64
66
|
case format
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
"#{label_string}ENC[#{@encryptor.tag},#{ciphertext}]"
|
|
75
|
-
else
|
|
76
|
-
raise "#{@format} is not a valid format"
|
|
67
|
+
when :block
|
|
68
|
+
@cipher = @cipher.gsub(/\s/, '')
|
|
69
|
+
chevron = args[:use_chevron].nil? || args[:use_chevron] ? ">\n" : ''
|
|
70
|
+
"#{label_string}#{chevron}" + @indentation + "ENC[#{@encryptor.tag},#{@cipher}]".scan(/.{1,60}/).join("\n" + @indentation)
|
|
71
|
+
when :string
|
|
72
|
+
ciphertext = @cipher.gsub(/[\n\r]/, '')
|
|
73
|
+
"#{label_string}ENC[#{@encryptor.tag},#{ciphertext}]"
|
|
74
|
+
else
|
|
75
|
+
raise "#{@format} is not a valid format"
|
|
77
76
|
end
|
|
78
77
|
end
|
|
79
78
|
|
|
80
|
-
def to_decrypted(args={})
|
|
79
|
+
def to_decrypted(args = {})
|
|
81
80
|
label = args[:label]
|
|
82
81
|
label_string = label.nil? ? '' : "#{label}: "
|
|
83
82
|
format = args[:format].nil? ? @format : args[:format]
|
|
84
83
|
index = args[:index].nil? ? '' : "(#{args[:index]})"
|
|
85
|
-
if @@encrypt_unchanged == false
|
|
86
|
-
EncToken.tokens_map[index] = @plain_text
|
|
87
|
-
end
|
|
84
|
+
EncToken.tokens_map[index] = @plain_text if @@encrypt_unchanged == false
|
|
88
85
|
|
|
89
86
|
case format
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
87
|
+
when :block
|
|
88
|
+
chevron = args[:use_chevron].nil? || args[:use_chevron] ? ">\n" : ''
|
|
89
|
+
"#{label_string}#{chevron}" + indentation + "DEC#{index}::#{@encryptor.tag}[" + @plain_text + ']!'
|
|
90
|
+
when :string
|
|
91
|
+
"#{label_string}DEC#{index}::#{@encryptor.tag}[" + @plain_text + ']!'
|
|
92
|
+
else
|
|
93
|
+
raise "#{@format} is not a valid format"
|
|
97
94
|
end
|
|
98
95
|
end
|
|
99
96
|
|
|
100
97
|
def to_plain_text
|
|
101
98
|
@plain_text
|
|
102
99
|
end
|
|
103
|
-
|
|
104
100
|
end
|
|
105
101
|
|
|
106
102
|
class EncTokenType < TokenType
|
|
107
103
|
def create_enc_token(match, type, enc_comma, cipher, indentation = '')
|
|
108
|
-
encryption_scheme = enc_comma.nil? ? Eyaml.default_encryption_scheme : enc_comma.split(
|
|
104
|
+
encryption_scheme = enc_comma.nil? ? Eyaml.default_encryption_scheme : enc_comma.split(',').first
|
|
109
105
|
EncToken.encrypted_value(type, encryption_scheme, cipher, match, indentation)
|
|
110
106
|
end
|
|
111
107
|
end
|
|
112
108
|
|
|
113
109
|
class EncHieraTokenType < EncTokenType
|
|
114
110
|
def initialize
|
|
115
|
-
@regex =
|
|
116
|
-
@string_token_type = EncStringTokenType.new
|
|
111
|
+
@regex = %r{ENC\[(\w+,)?([a-zA-Z0-9+/ =\n]+?)\]}
|
|
112
|
+
@string_token_type = EncStringTokenType.new
|
|
117
113
|
end
|
|
114
|
+
|
|
118
115
|
def create_token(string)
|
|
119
116
|
@string_token_type.create_token(string.gsub(/\s/, ''))
|
|
120
117
|
end
|
|
@@ -122,58 +119,55 @@ class Hiera
|
|
|
122
119
|
|
|
123
120
|
class EncStringTokenType < EncTokenType
|
|
124
121
|
def initialize
|
|
125
|
-
@regex =
|
|
122
|
+
@regex = %r{ENC\[(\w+,)?([a-zA-Z0-9+/=]+?)\]}
|
|
126
123
|
end
|
|
124
|
+
|
|
127
125
|
def create_token(string)
|
|
128
126
|
md = @regex.match(string)
|
|
129
|
-
|
|
127
|
+
create_enc_token(string, :string, md[1], md[2])
|
|
130
128
|
end
|
|
131
129
|
end
|
|
132
130
|
|
|
133
131
|
class EncBlockTokenType < EncTokenType
|
|
134
132
|
def initialize
|
|
135
|
-
@regex =
|
|
133
|
+
@regex = %r{>\n(\s*)ENC\[(\w+,)?([a-zA-Z0-9+/=\s]+?)\]}
|
|
136
134
|
end
|
|
135
|
+
|
|
137
136
|
def create_token(string)
|
|
138
137
|
md = @regex.match(string)
|
|
139
|
-
|
|
138
|
+
create_enc_token(string, :block, md[2], md[3], md[1])
|
|
140
139
|
end
|
|
141
140
|
end
|
|
142
141
|
|
|
143
142
|
class DecStringTokenType < TokenType
|
|
144
143
|
def initialize
|
|
145
|
-
@regex = /DEC(\(\d+\))?::(\w+)\[(.+?)\]
|
|
144
|
+
@regex = /DEC(\(\d+\))?::(\w+)\[(.+?)\]!/m
|
|
146
145
|
end
|
|
146
|
+
|
|
147
147
|
def create_token(string)
|
|
148
148
|
md = @regex.match(string)
|
|
149
|
-
if
|
|
150
|
-
|
|
151
|
-
if md[3] == EncToken.tokens_map[md[1]]
|
|
152
|
-
return EncToken.plain_text_value(:string, md[3], md[2], string, md[1])
|
|
153
|
-
end
|
|
154
|
-
end
|
|
149
|
+
if EncToken.encrypt_unchanged == false && !md[1].nil? && (md[3] == EncToken.tokens_map[md[1]])
|
|
150
|
+
return EncToken.plain_text_value(:string, md[3], md[2], string, md[1])
|
|
155
151
|
end
|
|
152
|
+
|
|
156
153
|
EncToken.decrypted_value(:string, md[3], md[2], string, md[1])
|
|
157
154
|
end
|
|
158
155
|
end
|
|
159
156
|
|
|
160
157
|
class DecBlockTokenType < TokenType
|
|
161
158
|
def initialize
|
|
162
|
-
@regex = />\n(\s*)DEC(\(\d+\))?::(\w+)\[(.+?)\]
|
|
159
|
+
@regex = />\n(\s*)DEC(\(\d+\))?::(\w+)\[(.+?)\]!/m
|
|
163
160
|
end
|
|
161
|
+
|
|
164
162
|
def create_token(string)
|
|
165
163
|
md = @regex.match(string)
|
|
166
|
-
if
|
|
167
|
-
|
|
168
|
-
if md[4] == EncToken.tokens_map[md[2]]
|
|
169
|
-
return EncToken.plain_text_value(:string, md[4], md[3], string, md[2])
|
|
170
|
-
end
|
|
171
|
-
end
|
|
164
|
+
if EncToken.encrypt_unchanged == false && !md[2].nil? && (md[4] == EncToken.tokens_map[md[2]])
|
|
165
|
+
return EncToken.plain_text_value(:string, md[4], md[3], string, md[2])
|
|
172
166
|
end
|
|
167
|
+
|
|
173
168
|
EncToken.decrypted_value(:block, md[4], md[3], string, md[2], md[1])
|
|
174
169
|
end
|
|
175
170
|
end
|
|
176
|
-
|
|
177
171
|
end
|
|
178
172
|
end
|
|
179
173
|
end
|
|
@@ -11,12 +11,12 @@ class Hiera
|
|
|
11
11
|
class Encrypt < Subcommand
|
|
12
12
|
|
|
13
13
|
def self.options
|
|
14
|
-
[{:name => :password,
|
|
15
|
-
:description => "Source input is a password entered on the terminal",
|
|
14
|
+
[{:name => :password,
|
|
15
|
+
:description => "Source input is a password entered on the terminal",
|
|
16
16
|
:short => 'p'},
|
|
17
17
|
{:name => :string,
|
|
18
18
|
:description => "Source input is a string provided as an argument",
|
|
19
|
-
:short => 's',
|
|
19
|
+
:short => 's',
|
|
20
20
|
:type => :string},
|
|
21
21
|
{:name => :file,
|
|
22
22
|
:description => "Source input is a regular file",
|
|
@@ -78,7 +78,7 @@ class Hiera
|
|
|
78
78
|
else
|
|
79
79
|
encryptor = Encryptor.find
|
|
80
80
|
ciphertext = encryptor.encode( encryptor.encrypt(Eyaml::Options[:input_data]) )
|
|
81
|
-
token = Parser::EncToken.new(:block, Eyaml::Options[:input_data], encryptor, ciphertext, nil, '
|
|
81
|
+
token = Parser::EncToken.new(:block, Eyaml::Options[:input_data], encryptor, ciphertext, nil, ' ')
|
|
82
82
|
case Eyaml::Options[:output]
|
|
83
83
|
when "block"
|
|
84
84
|
token.to_encrypted :label => Eyaml::Options[:label], :use_chevron => !Eyaml::Options[:label].nil?, :format => :block
|
|
@@ -79,12 +79,19 @@ class Hiera
|
|
|
79
79
|
def decrypt(data)
|
|
80
80
|
if encrypted?(data)
|
|
81
81
|
debug("Attempting to decrypt")
|
|
82
|
+
begin
|
|
83
|
+
parser = Eyaml::Parser::ParserFactory.hiera_backend_parser
|
|
84
|
+
tokens = parser.parse(data)
|
|
85
|
+
decrypted = tokens.map{ |token| token.to_plain_text }
|
|
86
|
+
plaintext = decrypted.join
|
|
87
|
+
rescue OpenSSL::PKCS7::PKCS7Error => e
|
|
88
|
+
debug("Caught exception: #{e.class}, #{e.message}\n"\
|
|
89
|
+
"#{e.backtrace.join("\n")}")
|
|
90
|
+
raise "Hiera-eyaml decryption failed, check the "\
|
|
91
|
+
"encrypted data matches the key you are using.\n"\
|
|
92
|
+
"Raw message from system: #{e.message}"
|
|
82
93
|
|
|
83
|
-
|
|
84
|
-
tokens = parser.parse(data)
|
|
85
|
-
decrypted = tokens.map{ |token| token.to_plain_text }
|
|
86
|
-
plaintext = decrypted.join
|
|
87
|
-
|
|
94
|
+
end
|
|
88
95
|
plaintext.chomp
|
|
89
96
|
else
|
|
90
97
|
data
|
|
@@ -92,7 +99,7 @@ class Hiera
|
|
|
92
99
|
end
|
|
93
100
|
|
|
94
101
|
def encrypted?(data)
|
|
95
|
-
/.*ENC\[
|
|
102
|
+
/.*ENC\[.*\]/ =~ data ? true : false
|
|
96
103
|
end
|
|
97
104
|
|
|
98
105
|
def parse_answer(data, scope, extra_data={})
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: hiera-eyaml
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.
|
|
4
|
+
version: 3.2.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Tom Poulton
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2021-05-03 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: optimist
|
|
@@ -28,16 +28,16 @@ dependencies:
|
|
|
28
28
|
name: highline
|
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
|
30
30
|
requirements:
|
|
31
|
-
- - "
|
|
31
|
+
- - ">="
|
|
32
32
|
- !ruby/object:Gem::Version
|
|
33
|
-
version:
|
|
33
|
+
version: '0'
|
|
34
34
|
type: :runtime
|
|
35
35
|
prerelease: false
|
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
|
37
37
|
requirements:
|
|
38
|
-
- - "
|
|
38
|
+
- - ">="
|
|
39
39
|
- !ruby/object:Gem::Version
|
|
40
|
-
version:
|
|
40
|
+
version: '0'
|
|
41
41
|
description: Hiera backend for decrypting encrypted yaml properties
|
|
42
42
|
email:
|
|
43
43
|
executables:
|
|
@@ -45,8 +45,9 @@ executables:
|
|
|
45
45
|
extensions: []
|
|
46
46
|
extra_rdoc_files: []
|
|
47
47
|
files:
|
|
48
|
+
- ".github/workflows/release.yml"
|
|
49
|
+
- ".github/workflows/test.yml"
|
|
48
50
|
- ".gitignore"
|
|
49
|
-
- ".travis.yml"
|
|
50
51
|
- CHANGELOG.md
|
|
51
52
|
- Gemfile
|
|
52
53
|
- HISTORY.md
|
|
@@ -86,7 +87,7 @@ files:
|
|
|
86
87
|
- sublime_text/eyaml.syntax_definition.json
|
|
87
88
|
- tools/git_tag_release.rb
|
|
88
89
|
- tools/regem.sh
|
|
89
|
-
homepage:
|
|
90
|
+
homepage: https://github.com/voxpupuli/hiera-eyaml/
|
|
90
91
|
licenses:
|
|
91
92
|
- MIT
|
|
92
93
|
metadata: {}
|
|
@@ -105,7 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
105
106
|
- !ruby/object:Gem::Version
|
|
106
107
|
version: '0'
|
|
107
108
|
requirements: []
|
|
108
|
-
rubygems_version: 3.
|
|
109
|
+
rubygems_version: 3.1.6
|
|
109
110
|
signing_key:
|
|
110
111
|
specification_version: 4
|
|
111
112
|
summary: OpenSSL Encryption backend for Hiera
|
data/.travis.yml
DELETED
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
dist: trusty
|
|
3
|
-
language: ruby
|
|
4
|
-
cache: bundler
|
|
5
|
-
sudo: false
|
|
6
|
-
before_install:
|
|
7
|
-
- bundle -v
|
|
8
|
-
- rm Gemfile.lock || true
|
|
9
|
-
- gem update --system $RUBYGEMS_VERSION
|
|
10
|
-
- gem update bundler
|
|
11
|
-
- gem --version
|
|
12
|
-
- bundle -v
|
|
13
|
-
addons:
|
|
14
|
-
apt:
|
|
15
|
-
packages:
|
|
16
|
-
- expect
|
|
17
|
-
script:
|
|
18
|
-
bundle exec cucumber -f progress
|
|
19
|
-
matrix:
|
|
20
|
-
include:
|
|
21
|
-
- rvm: 2.1.9
|
|
22
|
-
env: PUPPET_VERSION="~> 4.0" RUBYGEMS_VERSION=2.7.8
|
|
23
|
-
- rvm: 2.4.2
|
|
24
|
-
env: PUPPET_VERSION="~> 5.0"
|
|
25
|
-
notifications:
|
|
26
|
-
email: false
|
|
27
|
-
irc:
|
|
28
|
-
on_success: always
|
|
29
|
-
on_failure: always
|
|
30
|
-
channels:
|
|
31
|
-
- "chat.freenode.org#voxpupuli-notifications"
|
|
32
|
-
branches:
|
|
33
|
-
only:
|
|
34
|
-
- master
|
|
35
|
-
- /^v\d/
|
|
36
|
-
deploy:
|
|
37
|
-
provider: rubygems
|
|
38
|
-
api_key:
|
|
39
|
-
secure: 'W6a8A3KfxNydnbK4qhpL4S4KBUnadw8eGr1s8vqeOc8gXlc/qkj/DET9jWpgaEsdnEN/ALJL0WEksYJCHDpdeJv1qKaidFg5dC5l+qZ5gdVHRoKKVFkVlt8WDHe5UdP+bI2vUHWQ/1c04P92+jU9SJ0afTU1xUFn4d3AWCgwmdk='
|
|
40
|
-
gem: hiera-eyaml
|
|
41
|
-
on:
|
|
42
|
-
tags: true
|
|
43
|
-
repo: voxpupuli/hiera-eyaml
|