hiera-osxkeychain 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 5a378388b0c2992570f7666015200c782e1cc5e4
+  data.tar.gz: ab9c272d3155ebb4292f32044b774ff3457647fd
+SHA512:
+  metadata.gz: 8969e121b047c715db1389ae1ed9912db64bc6bef52066cde62f50d1b5e51d9518f50a2a12aed2088c42a2dd435c9fe186d215d9c5004e9d2439f4240bec0e30
+  data.tar.gz: c23ae3ab142962def384b6c847f42574221d72f97b9ced2cc38e67d1173971ba445ea293c086f5e7dfa638cf55ac526a0cecd629cef6774622fb1c9503fe34a2

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2016 Yoshimasa Niwa
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,47 @@
+Hiera OS X Keychain Backend
+===========================
+
+A simple [Hiera](https://docs.puppet.com/hiera/latest/) backend for looking up OS X keychain.
+
+Requirements
+------------
+
+This Hiera backend requires OS X, obviously.
+
+Usage
+-----
+
+Install `hiera-osxkeychain` gem to the Hiera environment.
+
+    gem intall hiera-osxkeychain
+
+In `hiera.yaml` config file, add `osxkeychain` backend and specify service name used in keychain. By default, service name is `hiera`.
+
+    :backends:
+      - osxkeychain
+      ...
+    :yaml":
+      ...
+    :osxkeychain:
+      :service: "hiera"
+    :hierarchy:
+      ...
+
+Create generic password items in OS X keychain with specified service name.
+Use account name for each Hiera lookup key.
+
+For example, launch _Keychain Access.app_, then use _New Password Item..._ under _File_ menu.
+Give `hiera` (or service name you specified in `hiera.yaml`) to _Keychain Item Name:_,
+Hiera lookup key name to _Account Name:_, then set _Password:_.
+
+Try looking up the key from command line.
+
+    hiera -c /path/to/hiera.yaml key
+
+You may see a prompt to approve keychain access from `security` command.
+
+Limitation
+----------
+
+Since keychain is a simple flat secure key-value storage, currently it doesn't support hierarchy.
+Also doesn't support interporations on the value, which I believe shouldn't be used in the situation of keychain usage.

data/lib/hiera/backend/osxkeychain_backend.rb

@@ -0,0 +1,127 @@
+class Hiera
+  module Backend
+    class Osxkeychain_backend
+      class Keychain
+        SECURITY_PATH="/usr/bin/security"
+
+        attr_reader :service
+
+        def initialize(service = nil)
+          @service = service
+        end
+
+        def lookup(options = {})
+          # See security(1) for these arguments.
+          args = ["-w"]
+
+          if service
+            args += ["-s", service]
+          end
+
+          account = options[:account]
+          if account
+            args += ["-a", account]
+          end
+
+          label = options[:label]
+          if label
+            args += ["-l", label]
+          end
+
+          command = [SECURITY_PATH, "find-generic-password"] + args
+          status, out, error = run(*command)
+          if status.success?
+            out.chomp
+          else
+            Hiera.warn("Fail to lookup #{options}: #{error.chomp}")
+            nil
+          end
+        end
+
+        private
+
+        # Fork and exec command, then return stdout, stderr and exit status.
+        # There are no such methods working on all ruby versions.
+        def run(*cmd)
+          Hiera.debug("exec #{cmd.join(" ")}")
+
+          pipes = [IO.pipe, IO.pipe]
+
+          stdout_read, stdout_write = pipes[0]
+          stderr_read, stderr_write = pipes[1]
+
+          pid = fork do
+            stdout_read.close
+            stderr_read.close
+            STDOUT.reopen(stdout_write)
+            STDERR.reopen(stderr_write)
+
+            # Close file descriptors on exec(3).
+            # This is for ruby prior to 1.9.1.
+            set_close_on_exec
+
+            # Give `:close_others` option for ruby 1.9.x.
+            # This is by default on ruby 2.0.x and later.
+            exec(*(cmd + [{:close_others => true}]))
+          end
+          stdout_write.close
+          stderr_write.close
+          _, status = Process.waitpid2(pid)
+
+          return [status, stdout_read.read, stderr_read.read]
+        ensure
+          pipes.flatten.each do |io|
+            io.close unless io.closed?
+          end
+        end
+
+        def set_close_on_exec
+          ObjectSpace.each_object(IO) do |io|
+            if ![STDIN, STDOUT, STDERR].include?(io) && !io.closed?
+              io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC) rescue SystemCallError
+            end
+          end
+        end
+      end
+
+      def initialize
+        @config = Config[:osxkeychain]
+        Hiera.debug("osxkeychain_backend initialized config: #{@config}")
+      end
+
+      def lookup(key, scope, order_override, resolution_type, *args)
+        # Ignore order_override since it doesn't not have hierarchy.
+        # Ignore scope since no need to interpolate values in anyways.
+
+        # Use key for account to lookup generic password.
+        result = keychain.lookup(:account => key)
+
+        # Hiera 2 and later, which has 5th argument, require to throw `:no_such_key`
+        # when no key found, but Hiera 1 requires to return `nil`.
+        if !result && !args.empty?
+          throw(:no_such_key)
+        end
+
+        case resolution_type
+        when :array
+          if result
+            [result]
+          else
+            []
+          end
+        when :hash
+          Hiera.warn("Unexpected resolution type.")
+          result
+        else
+          result
+        end
+      end
+
+      private
+
+      def keychain
+        @keychain ||= Keychain.new(@config[:service] || "hiera")
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,104 @@
+--- !ruby/object:Gem::Specification
+name: hiera-osxkeychain
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yoshimasa Niwa
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-04-17 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mocha
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Hiera backend for looking up OS X keychain
+email:
+- niw@niw.at
+executables: []
+extensions: []
+extra_rdoc_files:
+- LICENSE
+- README.md
+files:
+- LICENSE
+- README.md
+- lib/hiera/backend/osxkeychain_backend.rb
+homepage: https://github.com/niw/hiera-osxkeychain
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: Hiera backend for looking up OS X keychain
+test_files: []