keypairs 0.1.0.alpha.1 → 0.1.0.alpha.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6674e2a0a6b9e2a995950c220252b13402d1410d58d2102819cf10811275a50
-  data.tar.gz: dfd6fa3397cbce88a13b405fcf5c4f6fea0dfa20fcd94daba6d7247f0c33aca9
+  metadata.gz: bf4de0021d86f8b939eb09102bf3523ff50c43b65306090823f4d7ea896f85c6
+  data.tar.gz: 69e0d3738b6e8d3c2d3d1e7b397b08361d83b98f075526ffd9174ab844201109
 SHA512:
-  metadata.gz: c92758e1f8552b5cc461790e7779a2526d21580a962c8de2126ed441f19a548273fe049924dbf1e80e92edb08becb84fdb00a7877142a9cfcd600bc474df1977
-  data.tar.gz: d689d8a570e11ff872174a5163411427f9cd189fff972976741bae5c89b01624096f3646bb6194257e8698d6c3e7fe554faf20726b6992bc011e37a6094b7353
+  metadata.gz: 0e2acb9c0ec8069c3de1885bb810d6d759fa5e6594ce309feffb3abd5e357338106740949185734731f2fd9368b06472cbc2cd2dedc2a283711c78a17587c6af
+  data.tar.gz: 359aeb886e535c34f4c8071b4043e1186c92e91947b05c6215cd45efd3a54314abb85be17d8e56b5e186581b8a166f9b8f5f2e22ab4cc1af8a9590d796c9c546

data/README.md

@@ -12,6 +12,8 @@ gem 'keypairs'
 
 The of course run `bundle install` and run the migrations `bundle exec rake db:migrate`. The migrations from the gem run automatically.
 
+The private keys are encrypted with the [lockbox](https://github.com/ankane/lockbox) gem. In order for this to work, you need to set the master key as described in [the readme](https://github.com/ankane/lockbox#key-generation), but the easiest thing is to set the environment variable `LOCKBOX_MASTER_KEY` to a sufficient long string (you can generate one with `Lockbox.generate_key`).
+
 ## Usage
 The central point of this gem is the `Keypair` model which is backed by the `keypairs` table. If you need to sign messages, you can get the current keypair with the `Keypair.current` method. This method performs the rotation of the keypairs if required.
 

data/app/models/keypair.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'attr_encrypted'
+require 'lockbox'
 require 'jwt'
 
 # This class contains functionality needed for signing messages
@@ -23,8 +23,9 @@ require 'jwt'
 # @attr [String] jwk_kid The public external id of the key used to find the associated key on decoding.
 class Keypair < ActiveRecord::Base
   ALGORITHM = 'RS256'
+  ROTATION_INTERVAL = 1.month
 
-  attr_encrypted :_keypair, key: Rails.application.secrets.secret_key_base[0, 32]
+  encrypts :_keypair
 
   validates :_keypair, presence: true
   validates :jwk_kid, presence: true

data/db/migrate/20201024100500_create_keypairs.rb

@@ -4,8 +4,7 @@ class CreateKeypairs < ActiveRecord::Migration[6.0]
   def change
     create_table :keypairs do |t|
       t.string :jwk_kid, null: false
-      t.string :encrypted__keypair, null: false
-      t.string :encrypted__keypair_iv, null: false
+      t.text :_keypair_ciphertext, null: false
       t.timestamps precision: 6
       # Since we are ordering on created_at, let's create an index
       t.index :created_at

data/lib/keypairs.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
 
+require 'lockbox'
 require 'keypairs/engine'

data/lib/keypairs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Keypairs
-  VERSION = '0.1.0.alpha.1'
+  VERSION = '0.1.0.alpha.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: keypairs
 version: !ruby/object:Gem::Version
-  version: 0.1.0.alpha.1
+  version: 0.1.0.alpha.2
 platform: ruby
 authors:
 - Stef Schenkelaars
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-24 00:00:00.000000000 Z
+date: 2020-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -39,33 +39,33 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6.0'
 - !ruby/object:Gem::Dependency
-  name: attr_encrypted
+  name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '2.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
-  name: jwt
+  name: lockbox
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '0.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '0.4'
 - !ruby/object:Gem::Dependency
   name: brakeman
   requirement: !ruby/object:Gem::Requirement