hiera-eyaml 3.4.0 → 4.1.0

data/README.md

@@ -1,7 +1,7 @@
 # Hiera eyaml
 
 
-[![License](https://img.shields.io/github/license/voxpupuli/hiera-eyaml.svg)](https://github.com/voxpupuli/hiera-eyaml/blob/master/LICENSE)
+[![License](https://img.shields.io/github/license/voxpupuli/hiera-eyaml.svg)](https://github.com/voxpupuli/hiera-eyaml/blob/master/LICENSE.txt)
 [![Test](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/test.yml/badge.svg)](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/test.yml)
 [![codecov](https://codecov.io/gh/voxpupuli/hiera-eyaml/branch/master/graph/badge.svg)](https://codecov.io/gh/voxpupuli/hiera-eyaml)
 [![Release](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/release.yml/badge.svg)](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/release.yml)
@@ -12,7 +12,7 @@ hiera-eyaml is a backend for Hiera that provides per-value encryption of sensiti
 to be used by Puppet.
 
 -------------------------
-:new: **hiera-eyaml is now part of voxpupuli**
+:new: **hiera-eyaml is now part of Vox Pupuli**
 
 hiera-eyaml has a new home https://github.com/voxpupuli/hiera-eyaml.
 
@@ -35,7 +35,7 @@ Unlike `hiera-gpg`, `hiera-eyaml`:
    easy as using clear text files)
  - uses basic asymmetric encryption (PKCS#7) by default (doesn't require any native libraries that need to
    be compiled & allows users without the private key to encrypt values that the puppet master can decrypt)
- - has a pluggable encryption framework (e.g. GPG encryption ([hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg)) can be used
+ - has a pluggable encryption framework (e.g. GPG encryption ([hiera-eyaml-gpg](https://github.com/voxpupuli/hiera-eyaml-gpg)) can be used
    if you have the need for multiple keys and easier key rotation)
 
 The Hiera eyaml backend uses yaml formatted files with the .eyaml extension. The encrypted strings are prefixed with the encryption
@@ -70,14 +70,34 @@ Setup
 #### RubyGems
 
     $ gem install hiera-eyaml
-    
+
 #### Apt (Ubuntu 18.04+)
 
     $ sudo apt install hiera-eyaml
 
-### Installing hiera-eyaml for the new [puppet-server](https://github.com/puppetlabs/puppet-server)
+### Installing hiera-eyaml for [puppetserver](https://github.com/puppetlabs/puppetserver)
+
+All commands need to be executed as root. Puppet Enterprise vendors hiera-eyaml
+already, so you don't need to install it there.
+
+```sh
+puppetserver gem install hiera-eyaml
+```
+
+or via puppet:
 
-    $ puppetserver gem install hiera-eyaml
+```sh
+puppet resource package hiera-eyaml ensure=installed provider=puppetserver_gem
+```
+
+or via Puppet DSL:
+
+```puppet
+package { 'hiera-eyaml':
+  ensure   => 'installed',
+  provider => 'puppetserver_gem',
+}
+```
 
 ### Generate keys
 
@@ -123,9 +143,9 @@ Use the -l parameter to pass in a label for the encrypted value,
 
 ### Decryption
 
-To decrypt something, you need the public_key and the private_key.
+To decrypt something, you need the private_key.
 
-To test decryption you can also use the eyaml tool if you have both keys
+To test decryption you can use the eyaml tool
 
     $ eyaml decrypt -f filename               # Decrypt a file
     $ eyaml decrypt -s 'ENC[PKCS7,.....]'     # Decrypt a string
@@ -415,7 +435,11 @@ Configuration file for eyaml
 
 Default parameters for the eyaml command line tool can be provided by creating a configuration YAML file.
 
-Config files will be read first from `~/.eyaml/config.yaml`, then from `/etc/eyaml/config.yaml` and finally by anything referenced in the `EYAML_CONFIG` environment variable
+Config files will be read in following order:
+* first from system-wide `/etc/eyaml/config.yaml`
+* then from user home directory `~/.eyaml/config.yaml`
+* then from current working directory `.eyaml/config.yaml`
+* finally by anything referenced in the `EYAML_CONFIG` environment variable
 
 The file takes any long form argument that you can provide on the command line. For example, to override the pkcs7 keys:
 ```yaml
@@ -499,7 +523,7 @@ Issues
 
 If you have found a bug then please raise an issue here on github.
 
-Some of us hang out on #hiera-eyaml on freenode, please drop by if you want to say hi or have a question.
+Some of us hang out on #voxpupuli on [Libera.Chat](https://libera.chat/), please drop by if you want to say hi or have a question.
 
 
 Tests

data/Rakefile

@@ -21,24 +21,31 @@ else
     SimpleCov::Formatter::Codecov,
   ]
 end
-require "bundler/gem_tasks"
 
 # https://cucumber.io/docs/tools/ruby/
 # https://stackoverflow.com/questions/6473419/using-simplecov-to-display-cucumber-code-coverage
 require 'cucumber/rake/task'
 Cucumber::Rake::Task.new(:features) do |t|
-  t.cucumber_opts = "--format progress" # Any valid command line option can go here.
+  t.cucumber_opts = %w[--format progress] # Any valid command line option can go here.
 end
 
 begin
   require 'github_changelog_generator/task'
+rescue LoadError
+  # Do nothing if no required gem installed
+else
   GitHubChangelogGenerator::RakeTask.new :changelog do |config|
     version = Hiera::Backend::Eyaml::VERSION
-    config.future_release = "v#{version}" if version =~ /^\d+\.\d+.\d+$/
+    config.future_release = "v#{version}" if /^\d+\.\d+.\d+$/.match?(version)
     config.header = "# Changelog\n\nAll notable changes to this project will be documented in this file."
-    config.exclude_labels = %w{duplicate question invalid wontfix wont-fix skip-changelog}
+    config.exclude_labels = %w[duplicate question invalid wontfix wont-fix skip-changelog github_actions]
     config.user = 'voxpupuli'
     config.project = 'hiera-eyaml'
   end
+end
+
+begin
+  require 'voxpupuli/rubocop/rake'
 rescue LoadError
+  # the voxpupuli-rubocop gem is optional
 end

data/hiera-eyaml.gemspec

@@ -1,25 +1,27 @@
-# -*- encoding: utf-8 -*-
-lib = File.expand_path('../lib', __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'hiera/backend/eyaml'
 
 Gem::Specification.new do |gem|
-  gem.name          = "hiera-eyaml"
+  gem.name          = 'hiera-eyaml'
   gem.version       = Hiera::Backend::Eyaml::VERSION
-  gem.description   = "Hiera backend for decrypting encrypted yaml properties"
-  gem.summary       = "OpenSSL Encryption backend for Hiera"
-  gem.author        = "Vox Pupuli"
-  gem.email         = "voxpupuli@groups.io"
-  gem.license       = "MIT"
+  gem.description   = 'Hiera backend for decrypting encrypted yaml properties'
+  gem.summary       = 'OpenSSL Encryption backend for Hiera'
+  gem.author        = 'Vox Pupuli'
+  gem.email         = 'voxpupuli@groups.io'
+  gem.license       = 'MIT'
 
-  gem.homepage      = "https://github.com/voxpupuli/hiera-eyaml/"
+  gem.homepage      = 'https://github.com/voxpupuli/hiera-eyaml/'
   gem.files         = `git ls-files`.split($/).reject { |file| file =~ /^features.*$/ }
-  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
-  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
-  gem.require_paths = ["lib"]
+  gem.executables   = gem.files.grep(%r{^bin/}).map { |f| File.basename(f) }
+  gem.require_paths = ['lib']
 
-  gem.add_dependency('optimist')
-  gem.add_dependency('highline')
+  gem.add_runtime_dependency 'highline', '~> 2.1'
+  gem.add_runtime_dependency 'optimist', '~> 3.1'
 
-  gem.required_ruby_version = '>= 2.5.0', ' < 4'
+  gem.add_development_dependency 'rake', '~> 13.2', '>= 13.2.1'
+  gem.add_development_dependency 'rspec-expectations', '~> 3.13'
+  gem.add_development_dependency 'voxpupuli-rubocop', '2.6.0'
+
+  gem.required_ruby_version = '>= 2.7', ' < 4'
 end

data/lib/hiera/backend/eyaml/CLI.rb

@@ -10,23 +10,23 @@ class Hiera
   module Backend
     module Eyaml
       class CLI
-
         def self.parse
-
           Utils.require_dir 'hiera/backend/eyaml/subcommands'
-          Eyaml.subcommands = Utils.find_all_subclasses_of({ :parent_class => Hiera::Backend::Eyaml::Subcommands }).collect {|classname| Utils.snakecase classname}
+          Eyaml.subcommands = Utils.find_all_subclasses_of({ parent_class: Hiera::Backend::Eyaml::Subcommands }).collect do |classname|
+            Utils.snakecase classname
+          end
 
           Eyaml.subcommand = ARGV.shift
           subcommand = case Eyaml.subcommand
-          when nil
-            ARGV.delete_if {true}
-            "unknown_command"
-          when /^\-/
-            ARGV.delete_if {true}
-            "help"
-          else
-            Eyaml.subcommand
-          end
+                       when nil
+                         ARGV.delete_if { true }
+                         'unknown_command'
+                       when /^-/
+                         ARGV.delete_if { true }
+                         'help'
+                       else
+                         Eyaml.subcommand
+                       end
 
           command_class = Subcommand.find subcommand
 
@@ -36,22 +36,15 @@ class Hiera
           options = command_class.validate options
           Eyaml::Options.set options
           Eyaml::Options.trace
-
         end
 
         def self.execute
-
           executor = Eyaml::Options[:executor]
 
           result = executor.execute
           puts result unless result.nil?
-
         end
-
       end
-
     end
-
   end
-
 end

data/lib/hiera/backend/eyaml/commands.rb

@@ -4,18 +4,14 @@ class Hiera
   module Backend
     module Eyaml
       class Commands
-
         @@commands = []
 
-        def self.register
-          
-        end
+        def self.register; end
 
         def self.commands
           @@commands
         end
-
       end
     end
   end
-end
+end

data/lib/hiera/backend/eyaml/edithelper.rb

@@ -4,32 +4,38 @@ class Hiera
   module Backend
     module Eyaml
       class EditHelper
-
         def self.find_editor
-          editor = ENV['EDITOR']
-          editor ||= %w{ /usr/bin/sensible-editor /usr/bin/editor /usr/bin/vim /usr/bin/vi }.collect {|e| e if FileTest.executable? e}.compact.first
-          raise StandardError, "Editor not found. Please set your EDITOR env variable" if editor.nil?
+          editor = ENV.fetch('EDITOR', nil)
+          editor ||= %w[/usr/bin/sensible-editor /usr/bin/editor /usr/bin/vim /usr/bin/vi].collect do |e|
+            e if FileTest.executable? e
+          end.compact.first
+          raise StandardError, 'Editor not found. Please set your EDITOR env variable' if editor.nil?
+
           if editor.index(' ')
             editor = editor.dup if editor.frozen? # values from ENV are frozen
-            editor.gsub!(/([^\\]|^)~/, '\1' + ENV['HOME']) # replace ~ with home unless escaped
+            editor.gsub!(/([^\\]|^)~/, '\1' + ENV.fetch('HOME', nil)) # replace ~ with home unless escaped
             editor.gsub!(/(^|[^\\])"/, '\1') # remove unescaped quotes during processing
-            editor.gsub!(/\\ /, ' ') # unescape spaces since we quote paths
+            editor.gsub!('\\ ', ' ') # unescape spaces since we quote paths
             pieces = editor.split(' ')
-            paths = pieces.each_with_index.map {|_,x| pieces[0..x].join(' ')}.reverse # get possible paths, starting with longest
+            paths = # get possible paths, starting with longest
+              pieces.each_with_index.map do |_, x|
+                pieces[0..x].join(' ')
+              end.reverse
             extensions = (ENV['PATHEXT'] || '').split(';') # handle Windows executables
             pathdirs = ENV['PATH'].split(File::PATH_SEPARATOR)
             paths += pathdirs.collect { |dir| paths.collect { |path| File.expand_path(path, dir) } }.flatten
-            editorfile = paths.select { |path|
-              FileTest.file?(path) || ! extensions.select {|ext| FileTest.file?(path + ext) }.empty?
-            }.first
-            raise StandardError, "Editor not found. Please set your EDITOR env variable" if editorfile.nil?
+            editorfile = paths.select do |path|
+              FileTest.file?(path) || !extensions.select { |ext| FileTest.file?(path + ext) }.empty?
+            end.first
+            raise StandardError, 'Editor not found. Please set your EDITOR env variable' if editorfile.nil?
+
             raw_command = paths[(paths.index editorfile) % pieces.size]
-            editor = "\"#{editorfile}\"#{editor[raw_command.size()..-1]}"
+            editor = "\"#{editorfile}\"#{editor[raw_command.size..-1]}"
           end
           editor
         end
 
-        def self.secure_file_delete args
+        def self.secure_file_delete(args)
           file = File.open(args[:file], 'r+')
           num_bytes = args[:num_bytes]
           [0xff, 0x55, 0xaa, 0x00].each do |byte|
@@ -41,31 +47,30 @@ class Hiera
           File.delete args[:file]
         end
 
-        def self.write_tempfile data_to_write
+        def self.write_tempfile(data_to_write)
           file = Tempfile.open(['eyaml_edit', '.yaml'])
           path = file.path
           file.close!
 
-          file = File.open(path, "w")
-          file.chmod(0600)
+          file = File.open(path, 'w')
+          file.chmod(0o600)
           if ENV['OS'] == 'Windows_NT'
             # Windows doesn't support chmod
             icacls = 'C:\Windows\system32\icacls.exe'
             if File.executable? icacls
               current_user = `C:\\Windows\\system32\\whoami.exe`.chomp
               # Use ACLs to restrict access to the current user only
-              command = %Q{#{icacls} "#{file.path}" /grant:r "#{current_user}":f /inheritance:r}
+              command = %(#{icacls} "#{file.path}" /grant:r "#{current_user}":f /inheritance:r)
               system "#{command} >NUL 2>&1"
             end
           end
           file.puts data_to_write
           file.close
 
-          LoggingHelper::debug "Wrote temporary file: #{path}"
+          LoggingHelper.debug "Wrote temporary file: #{path}"
 
           path
         end
-
       end
     end
   end

data/lib/hiera/backend/eyaml/encrypthelper.rb

@@ -5,35 +5,33 @@ class Hiera
   module Backend
     module Eyaml
       class EncryptHelper
-
-        def self.write_important_file args
+        def self.write_important_file(args)
           require 'hiera/backend/eyaml/highlinehelper'
-          filename = args[ :filename ]
-          content = args[ :content ]
-          mode = args[ :mode ]
-          if File.file? "#{filename}"
-            raise StandardError, "User aborted" unless HighlineHelper::confirm? "Are you sure you want to overwrite \"#{filename}\"?"
+          filename = args[:filename]
+          content = args[:content]
+          mode = args[:mode]
+          if File.file?("#{filename}") && !(HighlineHelper.confirm? "Are you sure you want to overwrite \"#{filename}\"?")
+            raise StandardError,
+                  'User aborted'
           end
-          open( "#{filename}", "w" ) do |io|
+          open("#{filename}", 'w') do |io|
             io.write(content)
           end
-          File.chmod( mode, filename ) unless mode.nil?
+          File.chmod(mode, filename) unless mode.nil?
         end
 
-        def self.ensure_key_dir_exists key_file
+        def self.ensure_key_dir_exists(key_file)
           key_dir = File.dirname key_file
 
-          unless File.directory? key_dir
-            begin
-              FileUtils.mkdir_p key_dir
-              LoggingHelper::info "Created key directory: #{key_dir}"
-            rescue
-              raise StandardError, "Cannot create key directory: #{key_dir}"
-            end
-          end
+          return if File.directory? key_dir
 
+          begin
+            FileUtils.mkdir_p key_dir
+            LoggingHelper.info "Created key directory: #{key_dir}"
+          rescue StandardError
+            raise StandardError, "Cannot create key directory: #{key_dir}"
+          end
         end
-
       end
     end
   end

data/lib/hiera/backend/eyaml/encryptor.rb

@@ -4,79 +4,76 @@ require 'hiera/backend/eyaml/encrypthelper'
 class Hiera
   module Backend
     module Eyaml
-
       class Encryptor
-
         class << self
-          attr_accessor :options
-          attr_accessor :tag
+          attr_accessor :options, :tag
         end
 
-        def self.find encryption_scheme = nil
+        def self.find(encryption_scheme = nil)
           encryption_scheme = Eyaml.default_encryption_scheme if encryption_scheme.nil?
           require "hiera/backend/eyaml/encryptors/#{File.basename encryption_scheme.downcase}"
-          encryptor_module = Module.const_get('Hiera').const_get('Backend').const_get('Eyaml').const_get('Encryptors')
-          encryptor_class = Utils.find_closest_class :parent_class => encryptor_module, :class_name => encryption_scheme
-          raise StandardError, "Could not find hiera-eyaml encryptor: #{encryption_scheme}. Try gem install hiera-eyaml-#{encryption_scheme.downcase} ?" if encryptor_class.nil?
+          encryptor_module = Module.const_get(:Hiera).const_get(:Backend).const_get(:Eyaml).const_get(:Encryptors)
+          encryptor_class = Utils.find_closest_class parent_class: encryptor_module, class_name: encryption_scheme
+          if encryptor_class.nil?
+            raise StandardError,
+                  "Could not find hiera-eyaml encryptor: #{encryption_scheme}. Try gem install hiera-eyaml-#{encryption_scheme.downcase} ?"
+          end
+
           encryptor_class
         end
 
-        def self.encode binary_string
+        def self.encode(binary_string)
           Base64.strict_encode64(binary_string)
         end
 
-        def self.decode string
+        def self.decode(string)
           Base64.decode64(string)
         end
 
-        def self.encrypt *args
+        def self.encrypt *_args
           raise StandardError, "encrypt() not defined for encryptor plugin: #{self}"
         end
 
-        def self.decrypt *args
+        def self.decrypt *_args
           raise StandardError, "decrypt() not defined for decryptor plugin: #{self}"
         end
 
-        protected
-
-          def self.plugin_classname
-            self.to_s.split("::").last.downcase
-          end
-
-          def self.register
-            Hiera::Backend::Eyaml::Plugins.register_options :options => self.options, :plugin => plugin_classname
-          end
+        def self.plugin_classname
+          to_s.split('::').last.downcase
+        end
 
-          def self.option name
-            Eyaml::Options[ "#{plugin_classname}_#{name}" ] || self.options[ "#{plugin_classname}_#{name}" ]
-          end
+        def self.register
+          Hiera::Backend::Eyaml::Plugins.register_options options: options, plugin: plugin_classname
+        end
 
-          def self.hiera?
-            Utils::hiera?
-          end
+        def self.option(name)
+          Eyaml::Options["#{plugin_classname}_#{name}"] || options["#{plugin_classname}_#{name}"]
+        end
 
-          def self.format_message msg
-            "[eyaml_#{plugin_classname}]:  #{msg}"
-          end
+        def self.hiera?
+          Utils.hiera?
+        end
 
-          def self.trace msg
-            LoggingHelper::trace :from => plugin_classname, :msg => msg
-          end
+        def self.format_message(msg)
+          "[eyaml_#{plugin_classname}]:  #{msg}"
+        end
 
-          def self.debug msg
-            LoggingHelper::debug :from => plugin_classname, :msg => msg
-          end
+        def self.trace(msg)
+          LoggingHelper.trace from: plugin_classname, msg: msg
+        end
 
-          def self.info msg
-            LoggingHelper::info :from => plugin_classname, :msg => msg
-          end
+        def self.debug(msg)
+          LoggingHelper.debug from: plugin_classname, msg: msg
+        end
 
-          def self.warn msg
-            LoggingHelper::warn :from => plugin_classname, :msg => msg
-          end
+        def self.info(msg)
+          LoggingHelper.info from: plugin_classname, msg: msg
+        end
 
+        def self.warn(msg)
+          LoggingHelper.warn from: plugin_classname, msg: msg
+        end
       end
-
     end
   end
 end