kms_encrypted 1.2.2 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f8fd21d9b3a411372d965975296ad6cfe7564754e52beee03834348ad87527f
-  data.tar.gz: b002b56976dd236017c753b6af64af9d8defd5399e0e4dfdfcb8e49faefdd380
+  metadata.gz: 203e6f831854468ec07bc0aac59f0b51c68b9e767a20b5f94bb28e5437b93212
+  data.tar.gz: 226b05f2da94c4d6ddd5c67e92e7114f0f6e6b8c2cf9c0a67d9be519e3b987aa
 SHA512:
-  metadata.gz: 6bb3def681881896ee1efd604d8c13ef450c92c7ac6a894f1ad02d9c655d7b9dc4cd54e541eb2f5feec457760cefe3f39bafd4270225bfee72602aca7f299589
-  data.tar.gz: d34b859b0237a6e038dfbff7a5e12c27aabf2c2171a20b4d1273626042698e49564e8e64a1a90a7d8df8829a7a74d2af99797d740abc519ca670fd68541525b4
+  metadata.gz: ce6cd1b82a6ed5a961b88e87fec1115fccd6e569db32de9e84ec83a9f42c1eb948ac2796a99cc931be380cce25fe65868bc20caf4685a2c388017330060ee85c
+  data.tar.gz: 4c9909081f55fba296c6d183e3d871d50979b05594ae8a7519ffd8d6c9d58121a3cdf3d6f72d13623f2ce996698f91dd10acda116962d48e64e76dff90ed4d3e

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 1.4.0 (2022-01-10)
+
+- Dropped support for Ruby < 2.6 and Rails < 5.2
+
+## 1.3.0 (2021-10-10)
+
+- Added support for `google-cloud-kms` gem
+
+## 1.2.4 (2021-06-20)
+
+- Fixed another argument error with Google Cloud KMS and Ruby 3
+
+## 1.2.3 (2021-06-02)
+
+- Fixed argument error with Google Cloud KMS and Ruby 3
+
 ## 1.2.2 (2021-05-17)
 
 - Added `key_id` method

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2017-2021 Andrew Kane
+Copyright (c) 2017-2022 Andrew Kane
 
 MIT License
 

data/README.md

@@ -48,7 +48,7 @@ gem 'aws-sdk-kms'
 
 Create an [Amazon Web Services](https://aws.amazon.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on AWS.
 
-Create a [KMS master key](https://console.aws.amazon.com/iam/home#/encryptionKeys) and set it in your environment along with your AWS credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
+Create a [KMS master key](https://console.aws.amazon.com/kms/home#/kms/keys) and set it in your environment along with your AWS credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
 
 ```sh
 KMS_KEY_ID=arn:aws:kms:...
@@ -67,7 +67,7 @@ KMS_KEY_ID=alias/my-alias
 Add this line to your application’s Gemfile:
 
 ```ruby
-gem 'google-apis-cloudkms_v1'
+gem 'google-cloud-kms'
 ```
 
 Create a [Google Cloud Platform](https://cloud.google.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on GCP.
@@ -75,13 +75,7 @@ Create a [Google Cloud Platform](https://cloud.google.com/) account if you don
 Create a [KMS key ring and key](https://console.cloud.google.com/iam-admin/kms) and set it in your environment along with your GCP credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
 
 ```sh
-KMS_KEY_ID=projects/.../locations/.../keyRings/.../cryptoKeys/...
-```
-
-The Google API client logs requests by default. Be sure to turn off the logger in production or it will leak the plaintext.
-
-```ruby
-Google::Apis.logger = Logger.new(nil)
+KMS_KEY_ID=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key
 ```
 
 ### Vault
@@ -345,11 +339,9 @@ KmsEncrypted.key_id = Rails.env.test? ? "insecure-test-key" : ENV["KMS_KEY_ID"]
 
 Key management services allow you to rotate the master key without any code changes.
 
-AWS KMS supports [automatic key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
-
-For Google Cloud, use the Google Cloud Console or API.
-
-For Vault, use:
+- For AWS KMS, you can use [automatic key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)
+- For Google Cloud, use the Google Cloud Console or API
+- For Vault, use:
 
 ```sh
 vault write -f transit/keys/my-key/rotate

data/lib/kms_encrypted/clients/google.rb

@@ -11,12 +11,18 @@ module KmsEncrypted
 
         # ensure namespace gets loaded
         client = KmsEncrypted.google_client
-        request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(options)
-        response = client.encrypt_crypto_key(key_id, request)
 
-        @last_key_version = response.name
-
-        response.ciphertext
+        if defined?(::Google::Apis::CloudkmsV1::CloudKMSService) && KmsEncrypted.google_client.is_a?(::Google::Apis::CloudkmsV1::CloudKMSService)
+          request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(**options)
+          response = client.encrypt_crypto_key(key_id, request)
+          @last_key_version = response.name
+          response.ciphertext
+        else
+          options[:name] = key_id
+          response = client.encrypt(**options)
+          @last_key_version = response.name
+          response.ciphertext
+        end
       end
 
       def decrypt(ciphertext, context: nil)
@@ -27,12 +33,23 @@ module KmsEncrypted
 
         # ensure namespace gets loaded
         client = KmsEncrypted.google_client
-        request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(options)
-        begin
-          client.decrypt_crypto_key(key_id, request).plaintext
-        rescue ::Google::Apis::ClientError => e
-          decryption_failed! if e.message.include?("Decryption failed")
-          raise e
+
+        if defined?(::Google::Apis::CloudkmsV1::CloudKMSService) && KmsEncrypted.google_client.is_a?(::Google::Apis::CloudkmsV1::CloudKMSService)
+          request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(**options)
+          begin
+            client.decrypt_crypto_key(key_id, request).plaintext
+          rescue ::Google::Apis::ClientError => e
+            decryption_failed! if e.message.include?("Decryption failed")
+            raise e
+          end
+        else
+          options[:name] = key_id
+          begin
+            client.decrypt(**options).plaintext
+          rescue ::Google::Cloud::InvalidArgumentError => e
+            decryption_failed! if e.message.include?("Decryption failed")
+            raise e
+          end
         end
       end
     end

data/lib/kms_encrypted/clients/vault.rb

@@ -30,6 +30,9 @@ module KmsEncrypted
           rescue ::Vault::HTTPClientError => e
             decryption_failed! if e.message.include?("unable to decrypt")
             raise e
+          rescue ::Vault::HTTPServerError => e
+            decryption_failed! if e.message.include?("message authentication failed")
+            raise e
           rescue Encoding::UndefinedConversionError
             decryption_failed!
           end

data/lib/kms_encrypted/model.rb

@@ -123,7 +123,7 @@ module KmsEncrypted
 
           # attr_encrypted
           if self.class.respond_to?(:encrypted_attributes)
-            self.class.encrypted_attributes.each do |key, v|
+            self.class.encrypted_attributes.to_a.each do |key, v|
               if v[:key] == key_method.to_sym
                 plaintext_attributes[key] = send(key)
               elsif v[:key].respond_to?(:call)

data/lib/kms_encrypted/version.rb

@@ -1,3 +1,3 @@
 module KmsEncrypted
-  VERSION = "1.2.2"
+  VERSION = "1.4.0"
 end

data/lib/kms_encrypted.rb

@@ -39,15 +39,24 @@ module KmsEncrypted
 
     def google_client
       @google_client ||= begin
-        require "google/apis/cloudkms_v1"
-        client = ::Google::Apis::CloudkmsV1::CloudKMSService.new
-        client.authorization = ::Google::Auth.get_application_default(
-          "https://www.googleapis.com/auth/cloud-platform"
-        )
-        client.client_options.log_http_requests = false
-        client.client_options.open_timeout_sec = 2
-        client.client_options.read_timeout_sec = 2
-        client
+        begin
+          require "google/apis/cloudkms_v1"
+
+          client = ::Google::Apis::CloudkmsV1::CloudKMSService.new
+          client.authorization = ::Google::Auth.get_application_default(
+            "https://www.googleapis.com/auth/cloud-platform"
+          )
+          client.client_options.log_http_requests = false
+          client.client_options.open_timeout_sec = 2
+          client.client_options.read_timeout_sec = 2
+          client
+        rescue LoadError
+          require "google/cloud/kms"
+
+          Google::Cloud::Kms.key_management_service do |config|
+            config.timeout = 2
+          end
+        end
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kms_encrypted
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.4.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-17 00:00:00.000000000 Z
+date: 2022-01-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '5.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '5.2'
 description:
 email: andrew@ankane.org
 executables: []
@@ -57,14 +57,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: Simple, secure key management for Lockbox and attr_encrypted