kryptos 1.0.0

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in kryptos.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 William Lipa
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,74 @@
+# Kryptos
+
+Kryptos provides a way to avoid checking in unencrypted application secrets such as API keys.  The secrets will be encrypted using a key stored in the database.  The assumption is that if an attacker can get to your database, you're in big trouble anyway.  But at least we can avoid giving away our API keys to people with access to the repository.  We still have to check in database access configuration, so you should use a firewall or equivalent to protect that.
+
+Your typical workflow should be unaffected, as Kryptos handles decryption and encryption automatically.  The encrypted file will be version controlled and deployed.  There is a one time cost to set up the db secret, but after that, Kryptos should be out of your way.
+
+Kryptos depends on Rails and has one gem dependency - the 'gibberish' library, which has no other dependencies. Kryptos itself is less than 100 lines of code and does not do any weird
+monkeypatching.  So overhead should be quite light.
+
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'kryptos'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install kryptos
+
+
+Next, add config/kryptos.rb to your .gitignore.  That's the main point of all this.  The gem checks that this file is ignored, so do that step now before even creating the file itself.
+
+Add a migration for the KryptosSecrets table.  This table will contain one row with your randomly generated secret.  The migration should look like:
+
+    class AddKryptosSecrets < ActiveRecord::Migration
+      def change
+        create_table :kryptos_secrets do |t|
+          t.string :secret
+        end
+      end
+    end
+
+You can use OpenSSL or an equivalent tool to generate a random password.
+
+    $ openssl rand -base64 32
+    RANDOMSECRET
+
+Then use the console to add your secret to the database.  Do not use 'RANDOMSECRET' literally; I hope that is obvious...
+
+    $ rails console
+    > KryptosSecret.create({ :secret => 'RANDOMSECRET'}, :without_protection => true)
+
+Now create a file config/kryptos.rb that will contain the actual secrets.  This file can be any ruby code, for example:
+
+    module AppSecrets
+  
+      AWS = Struct.new(:public_key, :private_key).new.tap do |s|
+        s.public_key = "foo"
+        s.private_key = "bar"
+      end
+
+    end
+
+## Usage
+
+Fire up the console again.  You should be able to access the config data:
+
+    $ rails console
+    > AppSecrets::AWS.public_key
+    => "foo"
+
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/kryptos.gemspec

@@ -0,0 +1,21 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'kryptos/version'
+
+Gem::Specification.new do |gem|
+  gem.name          = "kryptos"
+  gem.version       = Kryptos::VERSION
+  gem.authors       = ["wlipa"]
+  gem.email         = ["dojo@masterleep.com"]
+  gem.description   = %q{Supports keeping your application configuration secrets in source control, but encrypted using a key from the database.}
+  gem.summary       = %q{Encrypt app secrets in source control using a db based key}
+  gem.homepage      = ""
+
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+  
+  gem.add_dependency 'gibberish'
+end

data/lib/kryptos/secret.rb

@@ -0,0 +1,49 @@
+class KryptosSecret < ActiveRecord::Base
+  
+  def gitignore_path
+    "#{Rails.root}/.gitignore"
+  end
+  
+  def cleartext_path
+    "#{Rails.root}/config/kryptos.rb"
+  end
+  
+  def encrypted_path
+    "#{cleartext_path}.enc"
+  end
+  
+  def clandestine_operations
+    check_gitignore
+    if File.exists? cleartext_path
+      # If the encrypted version is out of date, regenerate it
+      enc_mtime = File.exists?(encrypted_path) && File.mtime(encrypted_path)
+      encrypt_secrets if !enc_mtime || enc_mtime < File.mtime(cleartext_path)
+    else
+      decrypt_secrets
+    end
+    require cleartext_path
+  end
+  
+  def check_gitignore
+    return unless Rails.env.development?
+    to_ignore = "config/kryptos.rb"
+    ignores = IO.read(gitignore_path)
+    raise "gitignore must ignore #{to_ignore}" unless ignores =~ /^#{to_ignore}$/
+  end
+  
+  def encrypt_secrets
+    return unless Rails.env.development?
+    Rails.logger.info "kryptos encrypt_secrets"
+    cipher = Gibberish::AES.new(secret)
+    IO.write(encrypted_path, cipher.encrypt(IO.read(cleartext_path)))
+  end
+  
+  def decrypt_secrets
+    Rails.logger.info "kryptos decrypt_secrets"
+    cipher = Gibberish::AES.new(secret)
+    IO.write(cleartext_path, cipher.decrypt(IO.read(encrypted_path)))
+    prev_time = File.mtime(encrypted_path)
+    File.utime(prev_time, prev_time, cleartext_path)    # avoid round-trip
+  end
+  
+end

data/lib/kryptos/version.rb

@@ -0,0 +1,3 @@
+module Kryptos
+  VERSION = "1.0.0"
+end

data/lib/kryptos.rb

@@ -0,0 +1,19 @@
+require 'kryptos/secret'
+require 'kryptos/version'
+require 'gibberish'
+
+module Kryptos
+  
+  # Hook Rails init process
+  class Railtie < Rails::Railtie
+    initializer 'kryptos', :before => 'load_environment_config' do |app|
+      ks = KryptosSecret.last rescue nil
+      if ks
+        ks.clandestine_operations
+      else
+        Rails.logger.info "no kryptos secret defined -- skipping"
+      end
+    end
+  end
+  
+end

metadata

@@ -0,0 +1,71 @@
+--- !ruby/object:Gem::Specification
+name: kryptos
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+  prerelease: 
+platform: ruby
+authors:
+- wlipa
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-02-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: gibberish
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Supports keeping your application configuration secrets in source control,
+  but encrypted using a key from the database.
+email:
+- dojo@masterleep.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- kryptos.gemspec
+- lib/kryptos.rb
+- lib/kryptos/secret.rb
+- lib/kryptos/version.rb
+homepage: ''
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.25
+signing_key: 
+specification_version: 3
+summary: Encrypt app secrets in source control using a db based key
+test_files: []