hiera-eyaml 1.3.4 → 1.3.5

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 6991fc6c0e02d5a2fe5d177c48f37c41c8e665b9
+  data.tar.gz: aea670bff868758d3e43529b4df32ad50a7c6d0d
+SHA512:
+  metadata.gz: 87057907d1ffc81c21fb4fafb040f08f3d1a69cf0af00332dcc6ed642144a0e33be9eb5087b2d5ca5fc90f637c2ef3035447d64dde2c3a7062e288e7fcfe0078
+  data.tar.gz: c67e419ec77d72dde2ad5ee6f0aeb51d20696db797db5512b3aec212befe92884d1e61868da5f423ac35c9ac66822d816110b77def803cdc8d718e9b78fdfaa4

data/Gemfile.lock

@@ -8,25 +8,34 @@ GEM
     builder (3.2.2)
     childprocess (0.3.9)
       ffi (~> 1.0, >= 1.0.11)
-    cucumber (1.3.5)
+    cucumber (1.3.9)
       builder (>= 2.1.2)
       diff-lcs (>= 1.1.3)
-      gherkin (~> 2.12.0)
-      multi_json (~> 1.7.5)
+      gherkin (~> 2.12)
+      multi_json (>= 1.7.5, < 2.0)
       multi_test (>= 0.0.2)
-    diff-lcs (1.2.4)
-    ffi (1.9.0)
-    gherkin (2.12.0)
+    diff-lcs (1.2.5)
+    facter (1.7.3)
+    ffi (1.9.3)
+    gherkin (2.12.2)
       multi_json (~> 1.3)
-    hiera-eyaml (1.2.0)
+    hiera (1.2.1)
+      json_pure
+    hiera-eyaml (1.3.4)
       highline (>= 1.6.19)
       trollop (>= 2.0)
-    hiera-eyaml-plaintext (0.1)
-      hiera-eyaml (>= 1.2.0)
-    highline (1.6.19)
-    multi_json (1.7.8)
+    hiera-eyaml-plaintext (0.4)
+      hiera-eyaml (>= 1.3.1)
+    highline (1.6.20)
+    json_pure (1.8.1)
+    multi_json (1.8.2)
     multi_test (0.0.2)
-    rspec-expectations (2.14.0)
+    puppet (3.3.1)
+      facter (~> 1.6)
+      hiera (~> 1.0)
+      rgen (~> 0.6.5)
+    rgen (0.6.6)
+    rspec-expectations (2.14.4)
       diff-lcs (>= 1.1.3, < 2.0)
     trollop (2.0)
 
@@ -37,4 +46,5 @@ DEPENDENCIES
   aruba
   hiera-eyaml-plaintext
   highline
+  puppet
   trollop

data/README.md

@@ -32,6 +32,14 @@ Setup
 ### Installing hiera-eyaml
 
     $ gem install hiera-eyaml
+    
+#### Installing from behind a corporate/application proxy
+    $ export HTTP_PROXY=http://yourcorporateproxy:3128/
+    $ export HTTPS_PROXY=http://yourcorporateproxy:3128/
+    
+then run your install
+ 
+    $ gem install hiera-eyaml
 
 ### Generate keys
 
@@ -41,6 +49,26 @@ The first step is to create a pair of keys:
 
 This creates a public and private key with default names in the default location. (./keys)
 
+#### Storing the keys securely when using Puppet
+
+Since the point of using this module is to securely store sensitive information, it's important to store these keys securely.
+If using Hiera with Puppet, Your puppetmaster will need to access these keys to perform decryption when the puppet agent runs on a remote node.
+So for this reason, a suggested location might be to store them in:
+    
+    /etc/puppet/secure/keys
+    
+(Using a secure/keys/ subfolder is so that you can still store other secure puppet files in the secure/ folder that might not be related to this module.)
+ 
+The permissions for this folder should allow the puppet user (normally 'puppet') execute access to the keys directory, read only access to the keys themselves and restrict everyone else:
+
+    $ chown -R puppet:puppet /etc/puppet/secure/keys
+    $ chmod -R 0500 /etc/puppet/secure/keys
+    $ chmod 0400 /etc/puppet/secure/keys/*.pem
+    $ ls -lha /etc/puppet/secure/keys
+    -r-------- 1 puppet puppet 1.7K Sep 24 16:24 private_key.pkcs7.pem
+    -r-------- 1 puppet puppet 1.1K Sep 24 16:24 public_key.pkcs7.pem
+
+
 ### Encryption
 
 To encrypt something, you only need the public_key, so distribute that to people creating hiera properties
@@ -49,9 +77,10 @@ To encrypt something, you only need the public_key, so distribute that to people
     $ eyaml -e -s 'hello there'       # Encrypt a string
     $ eyaml -e -p                     # Encrypt a password (prompt for it)
 
-Use the -l parameter to pass in a label for the encrypted value
+Use the -l parameter to pass in a label for the encrypted value,
+
+    $ eyaml -e -l 'some_easy_to_use_label' -s 'yourSecretString' --pkcs7-private-key /etc/puppet/secure/keys/private_key.pkcs7.pem --pkcs7-public-key /etc/puppet/secure/keys/public_key.pkcs7.pem
 
-    $ eyaml -e -l 'my-secret-key' -s 'very secret stuffs'
 
 ### Decryption
 
@@ -108,13 +137,18 @@ To use eyaml with hiera and puppet, first configure hiera.yaml to use the eyaml
     :datadir: '/etc/puppet/hieradata'
 
     # If using the pkcs7 encryptor (default)
-    :pkcs7_private_key: /path/to/private_key_file.pem
-    :pkcs7_public_key:  /path/to/public_key_file.pem
+    :pkcs7_private_key: /path/to/private_key.pkcs7.pem
+    :pkcs7_public_key:  /path/to/public_key.pkcs7.pem
 
 </pre>
 
 Then, edit your hiera yaml files (renaming them with the .eyaml extension), and insert your encrypted values:
 
+
+*Important Note:* 
+The eYaml backend will not parse internally json formatted yaml files, whereas the regular yaml backend will. 
+You'll need to ensure any existing yaml files using json format are converted to syntactically correct yaml format.
+
 <pre>
 ---
 plain-property: You can see me
@@ -172,6 +206,14 @@ Notes
 
 If you do not specify an encryption method within ENC[] tags, it will be assumed to be PKCS7
 
+Also remember that after encrypting your sensitive properties, if anyone has access to your git source,
+they will see what the property was in previous commits before you encrypted. It's recommended that you
+roll any passwords when switching from unencrypted to encrypted properties. eg, Developers having write
+access to a DEV branch will be able to read/view the contents of the PRD branch, as per the design of GIT.
+
+Github has a great guide on removing sensitive data from repos here:
+https://help.github.com/articles/remove-sensitive-data
+
 Authors
 =======
 

data/lib/hiera/backend/eyaml.rb

@@ -2,7 +2,7 @@ class Hiera
   module Backend
     module Eyaml
 
-      VERSION = "1.3.4"
+      VERSION = "1.3.5"
 
       def self.default_encryption_scheme= new_encryption
         @@default_encryption_scheme = new_encryption

data/lib/hiera/backend/eyaml/CLI.rb

@@ -33,17 +33,19 @@ Options:
   EOS
           
             opt :createkeys, "Create public and private keys for use encrypting properties", :short => 'c'
-            opt :decrypt, "Decrypt something"
-            opt :encrypt, "Encrypt something"
-            opt :edit, "Decrypt, Edit, and Reencrypt", :type => :string
-            opt :eyaml, "Source input is an eyaml file", :type => :string
+            opt :decrypt, "Decrypt something", :short => 'd'
+            opt :encrypt, "Encrypt something", :short => 'e'
+            opt :edit, "Decrypt, Edit, and Reencrypt", :short => 'i', :type => :string
+            opt :eyaml, "Source input is an eyaml file", :short => 'y', :type => :string
             opt :password, "Source input is a password entered on the terminal", :short => 'p'
             opt :string, "Source input is a string provided as an argument", :short => 's', :type => :string
             opt :file, "Source input is a file", :short => 'f', :type => :string
-            opt :stdin, "Source input it taken from stdin", :short => 'z'
+            opt :stdin, "Source input is taken from stdin", :short => :none
             opt :encrypt_method, "Override default encryption and decryption method (default is PKCS7)", :short => 'n', :default => "pkcs7"
-            opt :output, "Output format of final result (examples, block, string)", :type => :string, :default => "examples"
+            opt :output, "Output format of final result (examples, block, string)", :type => :string, :short => 'o', :default => "examples"
             opt :label, "Apply a label to the encrypted result", :short => 'l', :type => :string
+            opt :debug, "Be more verbose", :short => :none
+            opt :quiet, "Be less verbose", :short => :none
 
             Hiera::Backend::Eyaml::Plugins.options.each do |name, option|
               opt name, option[:desc], :type => option[:type], :short => option[:short], :default => option[:default]
@@ -90,6 +92,7 @@ Options:
 
           Eyaml.default_encryption_scheme = options[:encrypt_method].upcase if options[:encrypt_method]
           Eyaml::Options.set options
+          Eyaml::Options.debug
 
         end
 
@@ -98,7 +101,8 @@ Options:
           action = Eyaml::Options[:action]
           action_class = Module.const_get('Hiera').const_get('Backend').const_get('Eyaml').const_get('Actions').const_get("#{Utils.camelcase action.to_s}Action")
 
-          puts action_class.execute
+          return_value = action_class.execute
+          puts return_value unless return_value.nil?
 
         end          
 

data/lib/hiera/backend/eyaml/actions/decrypt_action.rb

@@ -1,5 +1,6 @@
 require 'hiera/backend/eyaml/utils'
 require 'hiera/backend/eyaml/options'
+require 'hiera/backend/eyaml/parser/parser'
 
 class Hiera
   module Backend
@@ -8,57 +9,27 @@ class Hiera
 
         class DecryptAction
 
-          REGEX_ENCRYPTED_BLOCK = />\n(\s*)ENC\[(\w+,)?([a-zA-Z0-9\+\/ =\n]+)\]/
-          REGEX_ENCRYPTED_STRING = /ENC\[(\w+,)?([a-zA-Z0-9\+\/=]+)\]/
-
-          def self.execute 
-
-            output_data = case Eyaml::Options[:source]
-            when :eyaml
-              encryptions = []
-
-              # blocks
-              output = Eyaml::Options[:input_data].gsub( REGEX_ENCRYPTED_BLOCK ) { |match|
-                indentation = $1
-                encryption_scheme = parse_encryption_scheme( $2 )
-                decryptor = Encryptor.find encryption_scheme
-                ciphertext = $3.gsub(/[ \n]/, '')
-                plaintext = decryptor.decrypt( decryptor.decode ciphertext )
-                ">\n" + indentation + "DEC::#{decryptor.tag}[" + plaintext + "]!"
-              }
-
-              # strings
-              output.gsub!( REGEX_ENCRYPTED_STRING ) { |match|
-                encryption_scheme = parse_encryption_scheme( $1 )
-                decryptor = Encryptor.find encryption_scheme
-
-                plaintext = decryptor.decrypt( decryptor.decode $2 )
-                "DEC::#{decryptor.tag}[" + plaintext + "]!"
-              }
-
-              output
-            else
-
-              output = Eyaml::Options[:input_data].gsub( REGEX_ENCRYPTED_STRING ) { |match|
-                encryption_scheme = parse_encryption_scheme( $1 )
-                decryptor = Encryptor.find encryption_scheme
-                decryptor.decrypt( decryptor.decode $2 )
-              } 
-
-              output
+          def self.execute
+            parser = Parser::ParserFactory.encrypted_parser
+            tokens = parser.parse(Eyaml::Options[:input_data])
+            case Eyaml::Options[:source]
+              when :eyaml
+                decrypted = tokens.map{ |token| token.to_decrypted }
+                decrypted.join
+              else
+                decrypted = tokens.map{ |token|
+                  case token.class.name
+                    when /::EncToken$/
+                      token.plain_text
+                    else
+                      token.match
+                  end
+                }
+                decrypted.join
             end
 
-            output_data
-
           end
 
-          protected
-
-            def self.parse_encryption_scheme regex_result
-              regex_result = Eyaml.default_encryption_scheme + "," if regex_result.nil?
-              regex_result.split(",").first
-            end
-
         end
 
       end

data/lib/hiera/backend/eyaml/actions/edit_action.rb

@@ -2,6 +2,7 @@ require 'hiera/backend/eyaml/utils'
 require 'hiera/backend/eyaml/actions/decrypt_action'
 require 'hiera/backend/eyaml/actions/encrypt_action'
 require 'hiera/backend/eyaml/options'
+require 'hiera/backend/eyaml/parser/parser'
 
 class Hiera
   module Backend
@@ -11,32 +12,60 @@ class Hiera
         class EditAction
 
           def self.execute 
-  
-            decrypted_input = DecryptAction.execute 
+
+            encrypted_parser = Parser::ParserFactory.encrypted_parser
+            tokens = encrypted_parser.parse Eyaml::Options[:input_data]
+            decrypted_input = tokens.each_with_index.to_a.map{|(t,index)| t.to_decrypted :index => index}.join
             decrypted_file = Utils.write_tempfile decrypted_input
+
             editor = Utils.find_editor
             system editor, decrypted_file
             status = $?
-            raise StandardError, "Editor #{editor} has not exited?" unless status.exited?
-            raise StandardError, "Editor did not exit successfully (exit code #{status.exitstatus}), aborting" unless status.exitstatus  #TODO: The file is left on the disk
-            raise StandardError, "File was moved by editor" unless File.file? decrypted_file
 
+            raise StandardError, "File was moved by editor" unless File.file? decrypted_file
             edited_file = File.read decrypted_file
             Utils.secure_file_delete :file => decrypted_file, :num_bytes => [edited_file.length, decrypted_input.length].max
+
+            raise StandardError, "Editor #{editor} has not exited?" unless status.exited?
+            raise StandardError, "Editor did not exit successfully (exit code #{status.exitstatus}), aborting" unless status.exitstatus
+
             raise StandardError, "Edited file is blank" if edited_file.empty?
-            raise StandardError, "No changes" if edited_file == decrypted_input
 
-            Eyaml::Options[:input_data] = edited_file
-            Eyaml::Options[:output] = "raw"
+            if edited_file == decrypted_input
+              Utils.info "No changes detected, exiting"
+            else
+              decrypted_parser = Parser::ParserFactory.decrypted_parser
+              edited_tokens = decrypted_parser.parse(edited_file)
+
+              # check that the tokens haven't been copy / pasted
+              used_ids = edited_tokens.find_all{ |t| t.class.name =~ /::EncToken$/ }.map{ |t| t.id }
+              if used_ids.length != used_ids.uniq.length
+                  raise StandardError, "A duplicate DEC(ID) was found so I don't know how to proceed. This is probably because you copy and pasted a value - if you do this please delete the ID in parentheses"
+              end
+
+              # replace untouched values with the source values
+              edited_denoised_tokens = edited_tokens.map{ |token|
+                if token.class.name =~ /::EncToken$/ && !token.id.nil?
+                  old_token = tokens[token.id]
+                  if old_token.plain_text.eql? token.plain_text
+                    old_token
+                  else
+                    token
+                  end
+                else
+                  token
+                end
+              }
 
-            encrypted_output = EncryptAction.execute
+              encrypted_output = edited_denoised_tokens.map{ |t| t.to_encrypted }.join
 
-            filename = Eyaml::Options[:eyaml]
-            File.open("#{filename}", 'w') { |file| 
-              file.write encrypted_output
-            }
+              filename = Eyaml::Options[:eyaml]
+              File.open("#{filename}", 'w') { |file|
+                file.write encrypted_output
+              }
+            end
 
-            true
+            nil
           end
 
         end

data/lib/hiera/backend/eyaml/actions/encrypt_action.rb

@@ -1,87 +1,40 @@
 require 'hiera/backend/eyaml/options'
+require 'hiera/backend/eyaml/parser/parser'
+require 'hiera/backend/eyaml/parser/encrypted_tokens'
 
 class Hiera
   module Backend
     module Eyaml
       module Actions
-
         class EncryptAction
 
-          REGEX_DECRYPTED_BLOCK = />\n(\s*)DEC(::\w+)?\[(.+)\]\!/
-          REGEX_DECRYPTED_STRING = /DEC(::\w+)?\[(.+)\]\!/
-
           def self.execute 
-
             case Eyaml::Options[:source]
-            when :eyaml
-              encryptions = []
-
-              # blocks
-              output = Eyaml::Options[:input_data].gsub( REGEX_DECRYPTED_BLOCK ) { |match|
-                indentation = $1
-                encryption_scheme = parse_encryption_scheme( $2 )
-                encryptor = Encryptor.find encryption_scheme
-                ciphertext = encryptor.encode( encryptor.encrypt($3) ).gsub(/\n/, "\n" + indentation)
-                ">\n" + indentation + "ENC[#{encryptor.tag},#{ciphertext}]"
-              }
-
-              # strings
-              output.gsub( REGEX_DECRYPTED_STRING ) { |match|
-                encryption_scheme = parse_encryption_scheme( $1 )
-                encryptor = Encryptor.find encryption_scheme
-                ciphertext = encryptor.encode( encryptor.encrypt($2) ).gsub(/\n/, "")
-                "ENC[#{encryptor.tag},#{ciphertext}]"
-              }
-
-            else
-              encryptor = Encryptor.find
-              ciphertext = encryptor.encode( encryptor.encrypt(Eyaml::Options[:input_data]) )
-              self.format :data => "ENC[#{encryptor.tag},#{ciphertext}]", :structure => Eyaml::Options[:output], :label => Eyaml::Options[:label]
-            end
-
-          end
-
-          protected
-
-            def self.parse_encryption_scheme regex_result
-              regex_result = "::" + Eyaml.default_encryption_scheme if regex_result.nil?
-              regex_result.split("::").last
-            end
-
-            def self.format_string data, label
-              data_as_string = data.split("\n").join("")
-              prefix = label ? "#{label}: " : ''
-              prefix + data_as_string
-            end
-
-            def self.format_block data, label
-              data_as_block = data.split("\n").join("\n    ")
-              prefix = label ? "#{label}: >\n" : ''
-              prefix + "    #{data_as_block}"
-            end
-
-            def self.format args
-              data = args[:data]
-              structure = args[:structure]
-              label = args[:label]
-
-              case structure
-              when "examples"
-                self.format_string(data, label || 'string') + "\n\n" +
-                "OR\n\n" +
-                self.format_block(data, label || 'block')
-              when "block"
-                self.format_block data, label
-              when "string"
-                self.format_string data, label
+              when :eyaml
+                parser = Parser::ParserFactory.decrypted_parser
+                tokens = parser.parse(Eyaml::Options[:input_data])
+                encrypted = tokens.map{ |token| token.to_encrypted }
+                encrypted.join
               else
-                data.to_s
-              end
-
+                encryptor = Encryptor.find
+                ciphertext = encryptor.encode( encryptor.encrypt(Eyaml::Options[:input_data]) )
+                token = Parser::EncToken.new(:block, Eyaml::Options[:input_data], encryptor, ciphertext, nil, '    ')
+                case Eyaml::Options[:output]
+                  when "block"
+                    token.to_encrypted :label => Eyaml::Options[:label], :use_chevron => !Eyaml::Options[:label].nil?, :format => :block
+                  when "string"
+                    token.to_encrypted :label => Eyaml::Options[:label], :format => :string
+                  when "examples"
+                    string = token.to_encrypted :label => Eyaml::Options[:label] || 'string', :format => :string
+                    block = token.to_encrypted :label => Eyaml::Options[:label] || 'block', :format => :block
+                    "#{string}\n\nOR\n\n#{block}"
+                  else
+                    token.to_encrypted :format => :string
+                end
             end
+          end
 
         end
-
       end
     end
   end

data/lib/hiera/backend/eyaml/encryptor.rb

@@ -77,7 +77,7 @@ class Hiera
             if self.hiera?
               Hiera.debug format_message msg
             else
-              STDERR.puts format_message msg
+              Utils::debug format_message msg
             end
           end
 
@@ -85,7 +85,7 @@ class Hiera
             if self.hiera?
               Hiera.warn format_message msg
             else
-              STDERR.puts format_message msg
+              Utils::info format_message msg
             end
           end
 

data/lib/hiera/backend/eyaml/options.rb

@@ -21,9 +21,12 @@ class Hiera
         end
 
         def self.debug
+          Utils::debug "Dump of eyaml tool options dict:"
+          Utils::debug "--------------------------------"
           @@options.each do |k, v|
-            puts "#{k.class.name}:#{k} = #{v.class.name}:#{v}"
+            Utils::debug "#{k.class.name}:#{k} = #{v.class.name}:#{v}"
           end
+          Utils::debug ""
         end
 
       end

data/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb

@@ -0,0 +1,135 @@
+require 'hiera/backend/eyaml/parser/token'
+require 'hiera/backend/eyaml/utils'
+require 'hiera/backend/eyaml/encryptor'
+require 'hiera/backend/eyaml'
+
+
+class Hiera
+  module Backend
+    module Eyaml
+      module Parser
+        class EncToken < Token
+          attr_reader :format, :cipher, :encryptor, :indentation, :plain_text, :id
+          def self.encrypted_value(format, encryption_scheme, cipher, match, indentation = '')
+            decryptor = Encryptor.find encryption_scheme
+            plain_text = decryptor.decrypt( decryptor.decode cipher )
+            EncToken.new(format, plain_text, decryptor, cipher, match, indentation)
+          end
+          def self.decrypted_value(format, plain_text, encryption_scheme, match, id, indentation = '')
+            encryptor = Encryptor.find encryption_scheme
+            cipher = encryptor.encode( encryptor.encrypt plain_text )
+            id_number = id.nil? ? nil : id.gsub(/\(|\)/, "").to_i
+            EncToken.new(format, plain_text, encryptor, cipher, match, indentation, id_number)
+          end
+
+          def initialize(format, plain_text, encryptor, cipher, match = '', indentation = '', id = nil)
+            @format = format
+            @plain_text = plain_text
+            @encryptor = encryptor
+            @cipher = cipher
+            @indentation = indentation
+            @id = id
+            super(match)
+          end
+
+          def to_encrypted(args={})
+            label = args[:label]
+            label_string = label.nil? ? '' : "#{label}: "
+            format = args[:format].nil? ? @format : args[:format]
+            case format
+              when :block
+                ciphertext = @cipher.gsub(/\n/, "\n" + @indentation)
+                chevron = (args[:use_chevron].nil? || args[:use_chevron]) ? ">\n" : ''
+                "#{label_string}#{chevron}" + @indentation + "ENC[#{@encryptor.tag},#{ciphertext}]"
+              when :string
+                ciphertext = @cipher.gsub(/\n/, "")
+                "#{label_string}ENC[#{@encryptor.tag},#{ciphertext}]"
+              else
+                raise "#{@format} is not a valid format"
+            end
+          end
+
+          def to_decrypted(args={})
+            label = args[:label]
+            label_string = label.nil? ? '' : "#{label}: "
+            format = args[:format].nil? ? @format : args[:format]
+            index = args[:index].nil? ? '' : "(#{args[:index]})"
+            case format
+              when :block
+                chevron = (args[:use_chevron].nil? || args[:use_chevron]) ? ">\n" : ''
+                "#{label_string}#{chevron}" + indentation + "DEC#{index}::#{@encryptor.tag}[" + @plain_text + "]!"
+              when :string
+                "#{label_string}DEC#{index}::#{@encryptor.tag}[" + @plain_text + "]!"
+              else
+                raise "#{@format} is not a valid format"
+            end
+          end
+
+          def to_plain_text
+            @plain_text
+          end
+
+        end
+
+        class EncTokenType < TokenType
+          def create_enc_token(match, type, enc_comma, cipher, indentation = '')
+            encryption_scheme = enc_comma.nil? ? Eyaml.default_encryption_scheme : enc_comma.split(",").first
+            EncToken.encrypted_value(type, encryption_scheme, cipher, match, indentation)
+          end
+        end
+
+        class EncHieraTokenType < EncTokenType
+          def initialize
+            @regex = /ENC\[(\w+,)?([a-zA-Z0-9\+\/ =\n]+?)\]/
+            @string_token_type = EncStringTokenType.new()
+          end
+          def create_token(string)
+            @string_token_type.create_token(string.gsub(/[ \n]/, ''))
+          end
+        end
+
+        class EncStringTokenType < EncTokenType
+          def initialize
+            @regex = /ENC\[(\w+,)?([a-zA-Z0-9\+\/=]+?)\]/
+          end
+          def create_token(string)
+            md = @regex.match(string)
+            self.create_enc_token(string, :string, md[1], md[2])
+          end
+        end
+
+        class EncBlockTokenType < EncTokenType
+          def initialize
+            @regex = />\n(\s*)ENC\[(\w+,)?([a-zA-Z0-9\+\/ =\n]+?)\]/
+          end
+          def create_token(string)
+            md = @regex.match(string)
+            self.create_enc_token(string, :block, md[2], md[3], md[1])
+          end
+        end
+
+        class DecStringTokenType < TokenType
+          def initialize
+            @regex = /DEC(\(\d+\))?::(\w+)\[(.+?)\]\!/
+          end
+          def create_token(string)
+            md = @regex.match(string)
+            EncToken.decrypted_value(:string, md[3], md[2], string, md[1])
+          end
+        end
+
+        class DecBlockTokenType < TokenType
+          def initialize
+            @regex = />\n(\s*)DEC(\(\d+\))?::(\w+)\[(.+?)\]\!/
+          end
+          def create_token(string)
+            md = @regex.match(string)
+            EncToken.decrypted_value(:block, md[4], md[3], string, md[2], md[1])
+            EncToken.decrypted_value(:block, md[4], md[3], string, md[2], md[1])
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/hiera/backend/eyaml/parser/parser.rb

@@ -0,0 +1,82 @@
+require 'strscan'
+require 'hiera/backend/eyaml/parser/token'
+require 'hiera/backend/eyaml/parser/encrypted_tokens'
+
+class Hiera
+  module Backend
+    module Eyaml
+      module Parser
+        class ParserFactory
+          def self.encrypted_parser
+            enc_string = EncStringTokenType.new()
+            enc_block = EncBlockTokenType.new()
+            Parser.new([enc_string, enc_block])
+          end
+
+          def self.decrypted_parser
+            dec_string = DecStringTokenType.new()
+            dec_block = DecBlockTokenType.new()
+            Parser.new([dec_string, dec_block])
+          end
+
+          def self.hiera_backend_parser
+            enc_hiera = EncHieraTokenType.new()
+            Parser.new([enc_hiera])
+          end
+        end
+
+        class Parser
+          attr_reader :token_types
+
+          def initialize(token_types)
+            @token_types = token_types
+          end
+
+          def parse text
+            parse_scanner(StringScanner.new(text)).reverse
+          end
+
+          def parse_scanner s
+            if s.eos?
+              []
+            else
+              # Check if the scanner currently matches a regex
+              current_match = @token_types.find { |token_type|
+                s.match?(token_type.regex)
+              }
+
+              token =
+                  if current_match.nil?
+                    # No regex matches here. Find the earliest match.
+                    next_match_indexes = @token_types.map { |token_type|
+                      next_match = s.check_until(token_type.regex)
+                      if next_match.nil?
+                        nil
+                      else
+                        next_match.length - s.matched.length
+                      end
+                    }.reject { |i| i.nil? }
+                    non_match_size =
+                        if next_match_indexes.length == 0
+                          s.rest_size
+                        else
+                          next_match_indexes.min
+                        end
+                    non_match = s.peek(non_match_size)
+                    # advance scanner
+                    s.pos = s.pos + non_match_size
+                    NonMatchToken.new(non_match)
+                  else
+                    # A regex matches so create a token and do a recursive call with the advanced scanner
+                    current_match.create_token s.scan(current_match.regex)
+                  end
+
+              self.parse_scanner(s) << token
+            end
+          end
+
+        end
+      end
+    end
+  end
+end

data/lib/hiera/backend/eyaml/parser/token.rb

@@ -0,0 +1,49 @@
+class Hiera
+  module Backend
+    module Eyaml
+      module Parser
+        class TokenType
+          attr_reader :regex
+          @regex
+          def create_token string
+            raise 'Abstract method called'
+          end
+        end
+
+        class Token
+          attr_reader :match
+          def initialize(match)
+            @match = match
+          end
+          def to_encrypted(args={})
+            raise 'Abstract method called'
+          end
+          def to_decrypted(args={})
+            raise 'Abstract method called'
+          end
+          def to_plain_text
+            raise 'Abstract method called'
+          end
+          def to_s
+            "#{self.class.name}:#{@match}"
+          end
+        end
+
+        class NonMatchToken < Token
+          def initialize(non_match)
+            super(non_match)
+          end
+          def to_encrypted(args={})
+            @match
+          end
+          def to_decrypted(args={})
+            @match
+          end
+          def to_plain_text
+            @match
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hiera/backend/eyaml/plugins.rb

@@ -40,7 +40,7 @@ class Hiera
               if Gem::VERSION >= "1.8.0"
                 file = spec.matches_for_glob("**/eyaml_init.rb").first
               else
-                file = Gem.searcher.matching_files(spec, "eyaml_init.rb").first
+                file = Gem.searcher.matching_files(spec, "**/eyaml_init.rb").first
               end
 
               next unless file

data/lib/hiera/backend/eyaml/utils.rb

@@ -72,7 +72,7 @@ class Hiera
           unless File.directory? key_dir
             begin
               FileUtils.mkdir_p key_dir
-              puts "Created key directory: #{key_dir}"
+              Utils::info "Created key directory: #{key_dir}"
             rescue
               raise StandardError, "Cannot create key directory: #{key_dir}"
             end
@@ -80,6 +80,14 @@ class Hiera
 
         end
 
+        def self.info message
+          STDERR.puts message unless Eyaml::Options[:quiet]
+        end
+
+        def self.debug message
+          STDERR.puts message if Eyaml::Options[:debug]
+        end
+
       end
     end
   end

data/lib/hiera/backend/eyaml_backend.rb

@@ -1,6 +1,7 @@
 require 'hiera/backend/eyaml/encryptor'
 require 'hiera/backend/eyaml/actions/decrypt_action'
 require 'hiera/backend/eyaml/utils'
+require 'hiera/backend/eyaml/parser/parser'
 require 'yaml'
 
 class Hiera
@@ -95,11 +96,10 @@ class Hiera
 
           Eyaml::Options[:source] = "hiera"
 
-          plaintext = value.gsub( /ENC\[([^\]]*)\]/ ) { |match|
-            Eyaml::Options[:input_data] = deblock match.to_s
-            Eyaml::Options[:output] = "raw"
-            Eyaml::Actions::DecryptAction.execute
-          }
+          parser = Eyaml::Parser::ParserFactory.hiera_backend_parser
+          tokens = parser.parse(value)
+          decrypted = tokens.map{ |token| token.to_plain_text }
+          plaintext = decrypted.join
 
           plaintext.chomp
 

metadata

@@ -1,46 +1,41 @@
 --- !ruby/object:Gem::Specification
 name: hiera-eyaml
 version: !ruby/object:Gem::Version
-  version: 1.3.4
-  prerelease: 
+  version: 1.3.5
 platform: ruby
 authors:
 - Tom Poulton
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-10 00:00:00.000000000 Z
+date: 2013-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: trollop
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
   name: highline
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 1.6.19
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 1.6.19
 description: Hiera backend for decrypting encrypted yaml properties
@@ -68,6 +63,9 @@ files:
 - lib/hiera/backend/eyaml/encryptor.rb
 - lib/hiera/backend/eyaml/encryptors/pkcs7.rb
 - lib/hiera/backend/eyaml/options.rb
+- lib/hiera/backend/eyaml/parser/encrypted_tokens.rb
+- lib/hiera/backend/eyaml/parser/parser.rb
+- lib/hiera/backend/eyaml/parser/token.rb
 - lib/hiera/backend/eyaml/plugins.rb
 - lib/hiera/backend/eyaml/utils.rb
 - lib/hiera/backend/eyaml_backend.rb
@@ -78,26 +76,25 @@ files:
 homepage: http://github.com/TomPoulton/hiera-eyaml
 licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 2.0.11
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: OpenSSL Encryption backend for Hiera
 test_files: []