legion-crypt 1.4.7 → 1.4.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a91784c5d25f02bae1517ea0192185a147df4739c5f40467c4a1eaac4c5d073
-  data.tar.gz: a5c94a7cbd0074c8b2494f0fcf7bf46eff9daa2c45fe04b86f4f7548e79e1c93
+  metadata.gz: f23263a49bc4e450c4c13189039e6a1324201fc31c074a59800569076c4baa40
+  data.tar.gz: 7c7fddeb4adb4a6d6721dea856af301f69a6b6a4c124c28195c87cf3e5e04f82
 SHA512:
-  metadata.gz: c5695228ec9226e79cf6b14322ce944e7eb80c24450c91ddbcf4d4a93ee33ef825b92ee8f742029155b301e18d676e597e13ea33ecfbb2397b7cb13f45f0ef4e
-  data.tar.gz: 6b37ee3075d821ec4c3bc01b44ad1450177ba6ec8aa6ea2c1ffe7fa6e44c4d40ab3e5a15c63464dd0432d15c2eaaddee13802533333e8f35011895fde47cda0a
+  metadata.gz: fe700545e2fe3ec3166cf14e760655e84572c5283895057d9c5f114849e89d5e00f59b13de05769c350eea9deabc0caa3cba926d89ca9121f40787c75707583c
+  data.tar.gz: 7b22b0a6ff01a262d44497e201c0f9fab260d5897e4be7af0a7a8c8d7a1e6c7c95ec9b422c9047ef5c6428a8ffb0ed9de066bda0d63849f45c9634eb2692ebc4

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Legion::Crypt
 
+## [1.4.8] - 2026-03-22
+
+### Changed
+- Added logging to all silent rescue blocks across attestation, cluster_secret, ed25519, erasure, jwks_client, ldap_auth, vault_jwt_auth, and vault_kerberos_auth
+
 ## [1.4.7] - 2026-03-22
 
 ### Added

data/lib/legion/crypt/attestation.rb

@@ -39,7 +39,8 @@ module Legion
         def fresh?(claim_hash, max_age_seconds: 300)
           timestamp = Time.parse(claim_hash[:timestamp])
           Time.now.utc - timestamp < max_age_seconds
-        rescue StandardError
+        rescue StandardError => e
+          Legion::Logging.warn("Legion::Crypt::Attestation#fresh? failed: #{e.message}") if defined?(Legion::Logging)
           false
         end
       end

data/lib/legion/crypt/cluster_secret.rb

@@ -32,7 +32,8 @@ module Legion
         return nil unless Legion::Crypt.exist?('crypt')
 
         get('crypt')[:cluster_secret]
-      rescue StandardError
+      rescue StandardError => e
+        Legion::Logging.warn("Legion::Crypt::ClusterSecret#from_vault failed: #{e.message}") if defined?(Legion::Logging)
         nil
       end
 
@@ -77,7 +78,8 @@ module Legion
 
       def only_member?
         Legion::Transport::Queue.new('node.crypt', passive: true).consumer_count.zero?
-      rescue StandardError
+      rescue StandardError => e
+        Legion::Logging.warn("Legion::Crypt::ClusterSecret#only_member? failed: #{e.message}") if defined?(Legion::Logging)
         nil
       end
 

data/lib/legion/crypt/ed25519.rb

@@ -28,7 +28,8 @@ module Legion
           verify_key.verify(signature, message)
           Legion::Logging.debug 'Ed25519 verify success' if defined?(Legion::Logging)
           true
-        rescue ::Ed25519::VerifyError
+        rescue ::Ed25519::VerifyError => e
+          Legion::Logging.debug("Legion::Crypt::Ed25519.verify signature mismatch: #{e.message}") if defined?(Legion::Logging)
           false
         end
 
@@ -50,7 +51,8 @@ module Legion
           Legion::Logging.debug "Ed25519 loading private key from #{vault_path}" if defined?(Legion::Logging)
           data = Legion::Crypt::Vault.read(vault_path)
           [data[:private_key]].pack('H*') if data&.dig(:private_key)
-        rescue StandardError
+        rescue StandardError => e
+          Legion::Logging.warn("Legion::Crypt::Ed25519#load_private_key failed: #{e.message}") if defined?(Legion::Logging)
           nil
         end
 
@@ -59,7 +61,8 @@ module Legion
         def key_prefix
           begin
             Legion::Settings[:crypt][:ed25519][:vault_key_prefix]
-          rescue StandardError
+          rescue StandardError => e
+            Legion::Logging.debug("Legion::Crypt::Ed25519#key_prefix settings lookup failed: #{e.message}") if defined?(Legion::Logging)
             nil
           end || 'secret/data/legion/keys'
         end

data/lib/legion/crypt/erasure.rb

@@ -13,6 +13,7 @@ module Legion
 
           { erased: true, tenant_id: tenant_id, path: key_path }
         rescue StandardError => e
+          Legion::Logging.error("Legion::Crypt::Erasure#erase_tenant failed: #{e.message}") if defined?(Legion::Logging)
           { erased: false, tenant_id: tenant_id, error: e.message }
         end
 
@@ -20,7 +21,8 @@ module Legion
           key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
           data = Legion::Crypt::Vault.read(key_path)
           { erased: data.nil?, tenant_id: tenant_id }
-        rescue StandardError
+        rescue StandardError => e
+          Legion::Logging.warn("Legion::Crypt::Erasure#verify_erasure failed: #{e.message}") if defined?(Legion::Logging)
           { erased: true, tenant_id: tenant_id }
         end
 
@@ -33,7 +35,8 @@ module Legion
         def tenant_prefix
           begin
             Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]
-          rescue StandardError
+          rescue StandardError => e
+            Legion::Logging.debug("Legion::Crypt::Erasure#tenant_prefix settings lookup failed: #{e.message}") if defined?(Legion::Logging)
             nil
           end || 'secret/data/legion/tenants'
         end

data/lib/legion/crypt/jwks_client.rb

@@ -95,8 +95,8 @@ module Legion
 
             jwk = ::JWT::JWK.new(jwk_hash)
             keys[kid] = jwk.public_key
-          rescue StandardError
-            # Skip malformed keys, continue with valid ones
+          rescue StandardError => e
+            Legion::Logging.debug("Legion::Crypt::JwksClient#parse_jwks skipping malformed key kid=#{kid}: #{e.message}") if defined?(Legion::Logging)
             next
           end
 

data/lib/legion/crypt/ldap_auth.rb

@@ -28,6 +28,7 @@ module Legion
 
           results[name] = ldap_login(cluster_name: name, username: username, password: password)
         rescue StandardError => e
+          Legion::Logging.warn("Legion::Crypt::LdapAuth#ldap_login_all cluster=#{name} failed: #{e.message}") if defined?(Legion::Logging)
           results[name] = { error: e.message }
         end
         results

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -84,7 +84,8 @@ module Legion
         defined?(::Vault) &&
           defined?(Legion::Settings) &&
           Legion::Settings[:crypt][:vault][:connected] == true
-      rescue StandardError
+      rescue StandardError => e
+        Legion::Logging.debug("Legion::Crypt::VaultJwtAuth#vault_connected? failed: #{e.message}") if defined?(Legion::Logging)
         false
       end
 

data/lib/legion/crypt/vault_kerberos_auth.rb

@@ -33,7 +33,8 @@ module Legion
       def self.vault_connected?
         defined?(::Vault) && defined?(Legion::Settings) &&
           Legion::Settings[:crypt][:vault][:connected] == true
-      rescue StandardError
+      rescue StandardError => e
+        Legion::Logging.debug("Legion::Crypt::VaultKerberosAuth#vault_connected? failed: #{e.message}") if defined?(Legion::Logging)
         false
       end
 

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.7'
+    VERSION = '1.4.8'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.7
+  version: 1.4.8
 platform: ruby
 authors:
 - Esity