kms_encrypted 1.2.4 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +4 -0
  3. data/README.md +3 -9
  4. data/lib/kms_encrypted/clients/google.rb +28 -11
  5. data/lib/kms_encrypted/version.rb +1 -1
  6. data/lib/kms_encrypted.rb +18 -9
  7. metadata +3 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: a409a4d0d4d5a3e0b6a334908ffbc80196f200b4159afced04e87c70e955c43a
4
- data.tar.gz: 8c375ef8eb0103f395aaad213ce30c9cb6ed644a1dbcb2613111b70a14ef5d21
3
+ metadata.gz: 67d1e3fb931f190e380e35875f1c6346025ebbdd101cdef33ed028d57f2e1b9d
4
+ data.tar.gz: fe2286f23847db1ee9314cd505fb00478574682a6edd9c7e754e2ce231926e4c
5
5
  SHA512:
6
- metadata.gz: ced745edbcf99f7d9938160e60b961f98b6c9ed11321605d187394d9518f53e1616e7ca50b43abe26b7861598d0ac02f0930d426e00c91f0ce6c3e53fadd5291
7
- data.tar.gz: 83bf433d376ea6380353d65f457b12ec4aca028e6f9bbfca55d2e5f05ebb2da6e4509fa718b293715c092e48c87be683ccc954490161f81a87a10098b97e1c70
6
+ metadata.gz: 9c651b9fad6d49d6ae4d2a6006ac34d65f7d0f2072446f7cb622c1f48c2c050fc7d70fc6baa0c8883fbe86e34c0ce4e0a00e1b6907d6577209b3389dd94cbced
7
+ data.tar.gz: 21eeadd0dbb9ed008ca9d2feb34bd43b5dee9c0527aa56b3a1a8a318535ef4707f3690acf504af6091837ec52a81abf1041e7166ef3a2a110cfa35824adebcde
data/CHANGELOG.md CHANGED
@@ -1,3 +1,7 @@
1
+ ## 1.3.0 (2021-10-10)
2
+
3
+ - Added support for `google-cloud-kms` gem
4
+
1
5
  ## 1.2.4 (2021-06-20)
2
6
 
3
7
  - Fixed another argument error with Google Cloud KMS and Ruby 3
data/README.md CHANGED
@@ -48,7 +48,7 @@ gem 'aws-sdk-kms'
48
48
 
49
49
  Create an [Amazon Web Services](https://aws.amazon.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on AWS.
50
50
 
51
- Create a [KMS master key](https://console.aws.amazon.com/iam/home#/encryptionKeys) and set it in your environment along with your AWS credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
51
+ Create a [KMS master key](https://console.aws.amazon.com/kms/home#/kms/keys) and set it in your environment along with your AWS credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
52
52
 
53
53
  ```sh
54
54
  KMS_KEY_ID=arn:aws:kms:...
@@ -67,7 +67,7 @@ KMS_KEY_ID=alias/my-alias
67
67
  Add this line to your application’s Gemfile:
68
68
 
69
69
  ```ruby
70
- gem 'google-apis-cloudkms_v1'
70
+ gem 'google-cloud-kms'
71
71
  ```
72
72
 
73
73
  Create a [Google Cloud Platform](https://cloud.google.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on GCP.
@@ -75,13 +75,7 @@ Create a [Google Cloud Platform](https://cloud.google.com/) account if you don
75
75
  Create a [KMS key ring and key](https://console.cloud.google.com/iam-admin/kms) and set it in your environment along with your GCP credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
76
76
 
77
77
  ```sh
78
- KMS_KEY_ID=projects/.../locations/.../keyRings/.../cryptoKeys/...
79
- ```
80
-
81
- The Google API client logs requests by default. Be sure to turn off the logger in production or it will leak the plaintext.
82
-
83
- ```ruby
84
- Google::Apis.logger = Logger.new(nil)
78
+ KMS_KEY_ID=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key
85
79
  ```
86
80
 
87
81
  ### Vault
data/lib/kms_encrypted/clients/google.rb CHANGED
@@ -11,12 +11,18 @@ module KmsEncrypted
11
11
 
12
12
  # ensure namespace gets loaded
13
13
  client = KmsEncrypted.google_client
14
- request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(**options)
15
- response = client.encrypt_crypto_key(key_id, request)
16
14
 
17
- @last_key_version = response.name
18
-
19
- response.ciphertext
15
+ if defined?(::Google::Apis::CloudkmsV1::CloudKMSService) && KmsEncrypted.google_client.is_a?(::Google::Apis::CloudkmsV1::CloudKMSService)
16
+ request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(**options)
17
+ response = client.encrypt_crypto_key(key_id, request)
18
+ @last_key_version = response.name
19
+ response.ciphertext
20
+ else
21
+ options[:name] = key_id
22
+ response = client.encrypt(**options)
23
+ @last_key_version = response.name
24
+ response.ciphertext
25
+ end
20
26
  end
21
27
 
22
28
  def decrypt(ciphertext, context: nil)
@@ -27,12 +33,23 @@ module KmsEncrypted
27
33
 
28
34
  # ensure namespace gets loaded
29
35
  client = KmsEncrypted.google_client
30
- request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(**options)
31
- begin
32
- client.decrypt_crypto_key(key_id, request).plaintext
33
- rescue ::Google::Apis::ClientError => e
34
- decryption_failed! if e.message.include?("Decryption failed")
35
- raise e
36
+
37
+ if defined?(::Google::Apis::CloudkmsV1::CloudKMSService) && KmsEncrypted.google_client.is_a?(::Google::Apis::CloudkmsV1::CloudKMSService)
38
+ request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(**options)
39
+ begin
40
+ client.decrypt_crypto_key(key_id, request).plaintext
41
+ rescue ::Google::Apis::ClientError => e
42
+ decryption_failed! if e.message.include?("Decryption failed")
43
+ raise e
44
+ end
45
+ else
46
+ options[:name] = key_id
47
+ begin
48
+ client.decrypt(**options).plaintext
49
+ rescue ::Google::Cloud::InvalidArgumentError => e
50
+ decryption_failed! if e.message.include?("Decryption failed")
51
+ raise e
52
+ end
36
53
  end
37
54
  end
38
55
  end
data/lib/kms_encrypted/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module KmsEncrypted
2
- VERSION = "1.2.4"
2
+ VERSION = "1.3.0"
3
3
  end
data/lib/kms_encrypted.rb CHANGED
@@ -39,15 +39,24 @@ module KmsEncrypted
39
39
 
40
40
  def google_client
41
41
  @google_client ||= begin
42
- require "google/apis/cloudkms_v1"
43
- client = ::Google::Apis::CloudkmsV1::CloudKMSService.new
44
- client.authorization = ::Google::Auth.get_application_default(
45
- "https://www.googleapis.com/auth/cloud-platform"
46
- )
47
- client.client_options.log_http_requests = false
48
- client.client_options.open_timeout_sec = 2
49
- client.client_options.read_timeout_sec = 2
50
- client
42
+ begin
43
+ require "google/apis/cloudkms_v1"
44
+
45
+ client = ::Google::Apis::CloudkmsV1::CloudKMSService.new
46
+ client.authorization = ::Google::Auth.get_application_default(
47
+ "https://www.googleapis.com/auth/cloud-platform"
48
+ )
49
+ client.client_options.log_http_requests = false
50
+ client.client_options.open_timeout_sec = 2
51
+ client.client_options.read_timeout_sec = 2
52
+ client
53
+ rescue LoadError
54
+ require "google/cloud/kms"
55
+
56
+ Google::Cloud::Kms.key_management_service do |config|
57
+ config.timeout = 2
58
+ end
59
+ end
51
60
  end
52
61
  end
53
62
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: kms_encrypted
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.4
4
+ version: 1.3.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Andrew Kane
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-06-20 00:00:00.000000000 Z
11
+ date: 2021-10-10 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -64,7 +64,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
64
64
  - !ruby/object:Gem::Version
65
65
  version: '0'
66
66
  requirements: []
67
- rubygems_version: 3.2.3
67
+ rubygems_version: 3.2.22
68
68
  signing_key:
69
69
  specification_version: 4
70
70
  summary: Simple, secure key management for Lockbox and attr_encrypted