hiera-eyaml 4.3.0 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2577211244aa5ae7a4702accf5c85ccaf652631cc8e83fb1cecd11aa0a6e4de
-  data.tar.gz: c399d35a8687cea60ec1a969776163b1b3fe4cd0a53614243154979c4306b104
+  metadata.gz: 932c6b900a2840edbf57d44a00b39e31c337f6c76fd0161c47ed4d49b18463a8
+  data.tar.gz: 51ee6c0a95ebfc4bb9af94572451554d6a2390ade43c1b0c4a2f0f18f8df8d99
 SHA512:
-  metadata.gz: 5a2efe12d2603a60cd2d0c3a2931ed1c4b3b9150e65604c20765ba12d34fcf66f87f0f2f48738cc3f07604b0ee65a618eb9797e93b6a46d5df5e248c893ed84e
-  data.tar.gz: 69eaedaf4cd15cd26233177a508bfc0e780557639374618c78d3b1c2ff6b081000a5c9bcca0072c020da9eaefcd309ef45c67d094769e47901cb938d63772d16
+  metadata.gz: 92a37b8e83aa2fcf0e483df040eafba7885d29f5b8179646ca1012f930776c336e4b1327704ff2ae6cf2b3cc0a67d5f432de81539b5698fd92986b05e934a516
+  data.tar.gz: 9d44c0788b1cc0eb6c838eefb8d2dd4f4d5a113207d96bdb4e2aef8f20b2a187842f3f5774c298f53e4db4e18dce8117dfe5db70ed2e0d5b7a0dd582470d479f

data/.github/release.yml

@@ -0,0 +1,41 @@
+---
+# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
+
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - modulesync
+      - question
+      - skip-changelog
+      - wont-fix
+      - wontfix
+      - github_actions
+
+  categories:
+    - title: Breaking Changes 🛠
+      labels:
+        - backwards-incompatible
+
+    - title: New Features 🎉
+      labels:
+        - enhancement
+
+    - title: Bug Fixes 🐛
+      labels:
+        - bug
+        - bugfix
+
+    - title: Documentation Updates 📚
+      labels:
+        - documentation
+        - docs
+
+    - title: Dependency Updates ⬆️
+      labels:
+        - dependencies
+
+    - title: Other Changes
+      labels:
+        - "*"

data/.github/workflows/release.yml

@@ -1,30 +1,106 @@
-name: Release
+---
+name: Gem Release
 
 on:
   push:
     tags:
       - '*'
 
+permissions: {}
+
 jobs:
-  release:
-    runs-on: ubuntu-latest
+  build-release:
+    # Prevent releases from forked repositories
     if: github.repository_owner == 'voxpupuli'
+    name: Build the gem
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Ruby 3.3
+      - uses: actions/checkout@v6
+      - name: Install Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.3'
+          ruby-version: 'ruby'
       - name: Build gem
-        run: gem build --strict --verbose *.gemspec
+        shell: bash
+        run: gem build --verbose *.gemspec
+      - name: Upload gem to GitHub cache
+        uses: actions/upload-artifact@v6
+        with:
+          name: gem-artifact
+          path: '*.gem'
+          retention-days: 1
+          compression-level: 0
+
+  create-github-release:
+    needs: build-release
+    name: Create GitHub release
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write # clone repo and create release
+    steps:
+      - name: Download gem from GitHub cache
+        uses: actions/download-artifact@v7
+        with:
+          name: gem-artifact
+      - name: Create Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create --repo ${{ github.repository }} ${{ github.ref_name }} --generate-notes *.gem
+
+  release-to-github:
+    needs: build-release
+    name: Release to GitHub
+    runs-on: ubuntu-24.04
+    permissions:
+      packages: write # publish to rubygems.pkg.github.com
+    steps:
+      - name: Download gem from GitHub cache
+        uses: actions/download-artifact@v7
+        with:
+          name: gem-artifact
+      - name: Publish gem to GitHub packages
+        run: gem push --host https://rubygems.pkg.github.com/${{ github.repository_owner }} *.gem
+        env:
+          GEM_HOST_API_KEY: ${{ secrets.GITHUB_TOKEN }}
+
+  release-to-rubygems:
+    needs: build-release
+    name: Release gem to rubygems.org
+    runs-on: ubuntu-24.04
+    environment: release # recommended by rubygems.org
+    permissions:
+      id-token: write # rubygems.org authentication
+    steps:
+      - name: Download gem from GitHub cache
+        uses: actions/download-artifact@v7
+        with:
+          name: gem-artifact
+      - uses: rubygems/configure-rubygems-credentials@v1.0.0
       - name: Publish gem to rubygems.org
+        shell: bash
         run: gem push *.gem
-        env:
-          GEM_HOST_API_KEY: '${{ secrets.RUBYGEMS_AUTH_TOKEN }}'
-      - name: Setup GitHub packages access
+
+  release-verification:
+    name: Check that all releases are done
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read # minimal permissions that we have to grant
+    needs:
+      - create-github-release
+      - release-to-github
+      - release-to-rubygems
+    steps:
+      - name: Download gem from GitHub cache
+        uses: actions/download-artifact@v7
+        with:
+          name: gem-artifact
+      - name: Install Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 'ruby'
+      - name: Wait for release to propagate
+        shell: bash
         run: |
-          mkdir -p ~/.gem
-          echo ":github: Bearer ${{ secrets.GITHUB_TOKEN }}" >> ~/.gem/credentials
-          chmod 0600 ~/.gem/credentials
-      - name: Publish gem to GitHub packages
-        run: gem push --key github --host https://rubygems.pkg.github.com/voxpupuli *.gem
+          gem install rubygems-await
+          gem await *.gem

data/.github/workflows/test.yml

@@ -7,8 +7,8 @@ on:
     branches:
       - master
 
-env:
-  BUNDLE_WITHOUT: release
+permissions:
+  contents: read
 
 jobs:
   rubocop:
@@ -16,7 +16,7 @@ jobs:
       BUNDLE_WITHOUT: release
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:
@@ -35,22 +35,28 @@ jobs:
           - "3.1"
           - "3.2"
           - "3.3"
+          - "3.4"
+          - "4.0"
           - jruby-9.4
+          - jruby-10
         openvox:
           - "~> 8"
           - "~> 7"
           - "https://github.com/OpenVoxProject/puppet.git#main"
         exclude:
+          - ruby: jruby-10
+            openvox: "~> 7"
+          - ruby: "4.0"
+            openvox: "~> 7"
+
+          - ruby: "3.4"
+            openvox: "~> 7"
+
           - ruby: "3.0"
             openvox: "~> 8"
           - ruby: "2.7"
             openvox: "~> 8"
 
-          - ruby: "3.0"
-            openvox: "https://github.com/openvoxlabs/puppet.git#main"
-          - ruby: "2.7"
-            openvox: "https://github.com/openvoxlabs/puppet.git#main"
-
           - ruby: "3.0"
             openvox: "https://github.com/openvoxproject/puppet.git#main"
           - ruby: "2.7"
@@ -62,11 +68,9 @@ jobs:
     name: "Ruby ${{ matrix.ruby }} - OpenVox ${{ matrix.openvox }}"
     steps:
       - name: Enable coverage reporting on Ruby 3.1
-        if: matrix.openvox == '~> 7.24' && matrix.ruby == '3.1'
+        if: matrix.openvox == '~> 7' && matrix.ruby == '3.1'
         run: echo 'COVERAGE=yes' >> $GITHUB_ENV
-      - uses: actions/checkout@v4
-      - name: Install expect
-        run: sudo apt-get install expect
+      - uses: actions/checkout@v6
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:
@@ -80,10 +84,14 @@ jobs:
         run: gem build --strict --verbose *.gemspec
 
   tests:
+    if: always()
     needs:
       - rubocop
       - test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Test suite
     steps:
-      - run: echo Test suite completed
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}

data/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v5.0.0](https://github.com/voxpupuli/hiera-eyaml/tree/v5.0.0) (2026-02-21)
+
+[Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v4.3.0...v5.0.0)
+
+**Breaking changes:**
+
+- adjust CLI newline printing to fix output not matching input [\#389](https://github.com/voxpupuli/hiera-eyaml/pull/389) ([bugfood](https://github.com/bugfood))
+
+**Implemented enhancements:**
+
+- syslog: Allow 0.4 [\#411](https://github.com/voxpupuli/hiera-eyaml/pull/411) ([bastelfreak](https://github.com/bastelfreak))
+- Add Jruby-10 support [\#410](https://github.com/voxpupuli/hiera-eyaml/pull/410) ([bastelfreak](https://github.com/bastelfreak))
+- Add Ruby 4.0 support [\#409](https://github.com/voxpupuli/hiera-eyaml/pull/409) ([bastelfreak](https://github.com/bastelfreak))
+- feat\(\#404\): Accept base64 encoded environment variables as pkcs7 keys [\#405](https://github.com/voxpupuli/hiera-eyaml/pull/405) ([JGodin-C2C](https://github.com/JGodin-C2C))
+- CI: Add Ruby 3.4 support [\#397](https://github.com/voxpupuli/hiera-eyaml/pull/397) ([bastelfreak](https://github.com/bastelfreak))
+
+**Fixed bugs:**
+
+- Trailing newline is added during encryption/decryption [\#272](https://github.com/voxpupuli/hiera-eyaml/issues/272)
+
+**Merged pull requests:**
+
+- README: mention that puppet-hiera can manage hiera-eyaml [\#399](https://github.com/voxpupuli/hiera-eyaml/pull/399) ([kenyon](https://github.com/kenyon))
+
 ## [v4.3.0](https://github.com/voxpupuli/hiera-eyaml/tree/v4.3.0) (2025-06-05)
 
 [Full Changelog](https://github.com/voxpupuli/hiera-eyaml/compare/v4.2.0...v4.3.0)

data/Gemfile

@@ -24,12 +24,19 @@ group :development do
   gem 'openvox', *location_for(ENV['OPENVOX_VERSION']) if ENV['OPENVOX_VERSION']
 end
 
-group :release do
-  gem 'faraday-retry', require: false
-  gem 'github_changelog_generator', require: false
+group :release, optional: true do
+  gem 'faraday-retry', '~> 2.1', require: false
+  gem 'github_changelog_generator', '~> 1.16.4', require: false
 end
 
 group :coverage, optional: ENV['COVERAGE'] != 'yes' do
   gem 'codecov', require: false
   gem 'simplecov-console', require: false
 end
+
+# openvox gem depends on syslog, but doesn't list it as explicit dependency
+# until Ruby 3.4, syslog was part of MRI ruby core
+# https://github.com/OpenVoxProject/puppet/issues/90
+platforms :mri do
+  gem 'syslog', '>= 0.3.0', '< 0.5'
+end

data/README.md

@@ -65,6 +65,10 @@ files as simple as clear text files.
 Setup
 -----
 
+### Puppet module
+
+The Vox Pupuli [hiera module](https://github.com/voxpupuli/puppet-hiera) can manage the installation and configuration of hiera-eyaml.
+
 ### Installing hiera-eyaml
 
 #### RubyGems
@@ -535,7 +539,6 @@ In order to run the tests, simply run `cucumber` in the top level directory of t
 
 You'll need to have a few requirements installed:
 
-  * `expect` (via yum/apt-get or system package)
   * `aruba` (gem)
   * `cucumber` (gem)
   * `puppet` (gem)

data/hiera-eyaml.gemspec

@@ -16,6 +16,7 @@ Gem::Specification.new do |gem|
   gem.executables   = gem.files.grep(%r{^bin/}).map { |f| File.basename(f) }
   gem.require_paths = ['lib']
 
+  gem.add_dependency 'base64', '~> 0.3.0'
   gem.add_dependency 'highline', '>= 2.1', '< 4'
   gem.add_dependency 'optimist', '~> 3.1'
 
@@ -23,5 +24,5 @@ Gem::Specification.new do |gem|
   gem.add_development_dependency 'rspec-expectations', '~> 3.13'
   gem.add_development_dependency 'voxpupuli-rubocop', '~> 3.1.0'
 
-  gem.required_ruby_version = '>= 2.7', ' < 4'
+  gem.required_ruby_version = '>= 2.7', ' < 5'
 end

data/lib/hiera/backend/eyaml/CLI.rb

@@ -42,7 +42,7 @@ class Hiera
           executor = Eyaml::Options[:executor]
 
           result = executor.execute
-          puts result unless result.nil?
+          executor.print_out(result) unless result.nil?
         end
       end
     end

data/lib/hiera/backend/eyaml/encryptors/pkcs7.rb

@@ -1,4 +1,5 @@
 require 'openssl'
+require 'base64'
 require 'hiera/backend/eyaml/encryptor'
 require 'hiera/backend/eyaml/encrypthelper'
 require 'hiera/backend/eyaml/logginghelper'
@@ -20,6 +21,10 @@ class Hiera
                                    type: :string, },
             public_key_env_var: { desc: 'Name of environment variable to read public key from',
                                   type: :string, },
+            b64_private_key_env_var: { desc: 'Name of environment variable to read private key from, encoded in base64',
+                                       type: :string, },
+            b64_public_key_env_var: { desc: 'Name of environment variable to read public key from, encoded in base64',
+                                      type: :string, },
             keysize: { desc: 'Key size used for encryption',
                        type: :integer,
                        default: 2048, },
@@ -91,9 +96,10 @@ class Hiera
             LoggingHelper.info 'Keys created OK'
           end
 
-          def self.load_ANY_key_pem(optname_key, optname_env_var)
+          def self.load_ANY_key_pem(optname_key, optname_env_var, b64_optname_env_var)
             opt_key = option(optname_key.to_sym)
             opt_key_env_var = option(optname_env_var.to_sym)
+            b64_opt_key_env_var = option(b64_optname_env_var.to_sym)
 
             if opt_key and opt_key_env_var
               warn "both #{optname_key} and #{optname_env_var} specified, using #{optname_env_var}"
@@ -103,6 +109,10 @@ class Hiera
               raise StandardError, "env #{opt_key_env_var} is not set" unless ENV[opt_key_env_var]
 
               opt_key_pem = ENV.fetch(opt_key_env_var, nil)
+            elsif b64_opt_key_env_var
+              raise StandardError, "env #{b64_opt_key_env_var} is not set" unless ENV[b64_opt_key_env_var]
+
+              opt_key_pem = Base64.decode64(ENV.fetch(b64_opt_key_env_var, nil))
             elsif opt_key
               raise StandardError, "file #{opt_key} does not exist" unless File.exist? opt_key
 
@@ -115,11 +125,11 @@ class Hiera
           end
 
           def self.load_public_key_pem
-            load_ANY_key_pem('public_key', 'public_key_env_var')
+            load_ANY_key_pem('public_key', 'public_key_env_var', 'b64_public_key_env_var')
           end
 
           def self.load_private_key_pem
-            load_ANY_key_pem('private_key', 'private_key_env_var')
+            load_ANY_key_pem('private_key', 'private_key_env_var', 'b64_private_key_env_var')
           end
         end
       end

data/lib/hiera/backend/eyaml/highlinehelper.rb

@@ -1,15 +1,19 @@
-require 'highline/import'
+require 'highline'
 
 class Hiera
   module Backend
     module Eyaml
       class HighlineHelper
+        def self.cli
+          HighLine.new($stdin, $stderr)
+        end
+
         def self.read_password
-          ask('Enter password: ') { |q| q.echo = '*' }
+          cli.ask('Enter password: ') { |q| q.echo = '*' }
         end
 
         def self.confirm?(message)
-          result = ask("#{message} (y/N): ")
+          result = cli.ask("#{message} (y/N): ")
           %w[y yes].include?(result.downcase) || false
         end
       end

data/lib/hiera/backend/eyaml/subcommand.rb

@@ -135,6 +135,10 @@ class Hiera
           options
         end
 
+        def self.print_out(string)
+          print string
+        end
+
         def self.validate(args)
           args
         end

data/lib/hiera/backend/eyaml/subcommands/decrypt.rb

@@ -81,6 +81,17 @@ class Hiera
               decrypted.join
             end
           end
+
+          def self.print_out(string)
+            case Eyaml::Options[:source]
+            when :eyaml
+              # Be sure the output ends with a newline, since YAML is a text format.
+              puts string
+            else
+              # Print the exact result.
+              print string
+            end
+          end
         end
       end
     end

data/lib/hiera/backend/eyaml/subcommands/encrypt.rb

@@ -90,6 +90,18 @@ class Hiera
               end
             end
           end
+
+          def self.print_out(string)
+            case Eyaml::Options[:output]
+            when 'string'
+              # Do not include a newline, so that 'eyaml decrypt' of the
+              # output returns the original input.
+              print string
+            else
+              # The output is a text file, so ensure there is a final newline.
+              puts string
+            end
+          end
         end
       end
     end

data/lib/hiera/backend/eyaml.rb

@@ -1,7 +1,7 @@
 class Hiera
   module Backend
     module Eyaml
-      VERSION = '4.3.0'
+      VERSION = '5.0.0'
       DESCRIPTION = 'Hiera-eyaml is a backend for Hiera which provides OpenSSL encryption/decryption for Hiera properties'
 
       class RecoverableError < StandardError

metadata

@@ -1,15 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: hiera-eyaml
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 5.0.0
 platform: ruby
 authors:
 - Vox Pupuli
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-06-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: highline
   requirement: !ruby/object:Gem::Requirement
@@ -100,6 +113,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/dependabot.yml"
+- ".github/release.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/test.yml"
 - ".gitignore"
@@ -146,7 +160,6 @@ homepage: https://github.com/voxpupuli/hiera-eyaml/
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -157,15 +170,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '2.7'
   - - "<"
     - !ruby/object:Gem::Version
-      version: '4'
+      version: '5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: OpenSSL Encryption backend for Hiera
 test_files: []