localvault 1.9.1 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20aa094af163dfa0173fae2eabfc274da78badf84ebc37366bf85163f7b7f77d
-  data.tar.gz: f113382f8edb4a630732b56de9abe163470c0c377bbcbf64951fde108f6d5e0b
+  metadata.gz: f52091ddaad3306c188919a18acc4cae01aff5d0582e3ca07426b6ab3dede07e
+  data.tar.gz: 4db7f05666bbb3644b436561e82bcbd51b2b8402618885469ec0534abed60302
 SHA512:
-  metadata.gz: e65ac37ab002da71e42ed5d1e31369dd492982683e2817165060962777e197b8873b6c73c11761d2f7aa829c1c6729f7334691d83d16f0de858c59de2a8abbec
-  data.tar.gz: 2efaf71acba0f24beaa48313a88d0a9f58058d42f7c80a5ef439af76f29deac6df30435dd74868d04d1bbedf224e1d87499a647e32509cecf0895d696f453934
+  metadata.gz: 76a6c6007b74d7287673345f0e11b08cc4dca663381b04e6e23e1917d84c92a45f0f9f809be73d028492617b905a66968b0c98791ab0a2772980b94f0e9bcf58
+  data.tar.gz: 10751a27f1d8bdce859045e678af61a968a18fe65679dc015a60056502ede9fb4de414439f234ca550da3721f0bd63aaa3e3b93895676b653036befd29d0a348

data/README.md

@@ -88,11 +88,11 @@ localvault exec -- rails server
 | `init [NAME]` | Create a vault (Argon2id key derivation) |
 | `set KEY --stdin` | Store a secret from stdin without argv/history exposure |
 | `set KEY [VALUE]` | Store a secret (positional value kept for compatibility) |
-| `set --group GROUP KEY --stdin` | Store a secret in a named group from stdin |
+| `set --group GROUP KEY --stdin` | Store a secret in a named group from stdin (`-g`) |
 | `get KEY` | Retrieve a secret (raw, pipeable) |
 | `show` | Display all secrets in a table (masked by default) |
-| `show --reveal` | Display with values visible |
-| `show --group` | Group by dot-notation prefix (one table per project) |
+| `show --reveal` | Display with values visible (`-r`) |
+| `show --group` | Group by dot-notation prefix, one table per project (`-g`) |
 | `show --group QUERY` | Show one exact or uniquely matching group |
 | `groups [QUERY]` | List/search group names and key counts without values |
 | `list` | List key names only |

data/lib/localvault/cli.rb

@@ -243,7 +243,7 @@ module LocalVault
       Use `localvault show -p platepose -v vault` to view a single project.
       Use `localvault import` to bulk-load from a .env, .json, or .yml file.
     DESC
-    method_option :group, type: :string, desc: "Store KEY and VALUE inside this named group"
+    method_option :group, aliases: "-g", type: :string, desc: "Store KEY and VALUE inside this named group"
     method_option :stdin, type: :boolean, default: false, desc: "Read VALUE from stdin instead of argv"
     def set(key, value = nil)
       validate_secret_value_source!(value)
@@ -526,8 +526,8 @@ module LocalVault
 \x05    localvault show -p platepose -v intellectaco  # one project only
 \x05    localvault show -p platepose -v intellectaco --reveal
     DESC
-    method_option :group, type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
-    method_option :reveal,  type: :boolean, default: false, desc: "Show full values instead of masking"
+    method_option :group, aliases: "-g", type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
+    method_option :reveal, aliases: "-r", type: :boolean, default: false, desc: "Show full values instead of masking"
     method_option :project, aliases: "-p", type: :string,   desc: "Show only this project group"
     def show
       vault = open_vault!

data/lib/localvault/guard.rb

@@ -1,4 +1,5 @@
 require "json"
+require "yaml"
 require "digest"
 require_relative "store"
 require_relative "session_cache"
@@ -15,6 +16,44 @@ module LocalVault
   # check gets uninstalled.
   module Guard
     MIN_VALUE_LENGTH = 8
+
+    # Keys the operator has explicitly declared non-secret, from
+    # ~/.localvault/config.yml:
+    #
+    #   guard_ignore:
+    #     - CLOUDFLARE_ASSETS.r2_bucket
+    #
+    # WHY EXPLICIT, AND NOT INFERRED FROM THE KEY NAME.
+    # The first attempt exempted keys whose name *looked* public — anything
+    # ending in bucket / region / _id — with a veto list of credential-ish
+    # words. An audit killed it in one line: a value stored under `AWS.bucket`
+    # would be exempt regardless of what it actually contained, so the fix
+    # traded a false positive for a false NEGATIVE in a security tool. The veto
+    # list was also unbounded (pem, jwk, seed, mnemonic, salt, otp, bearer,
+    # sas, …) and every omission is a silent bypass.
+    #
+    # A key's name cannot describe its value. Only the operator can say "this
+    # one is public", so only the operator may — by naming the exact full key,
+    # in a file they control, which is greppable and auditable.
+    #
+    # The problem being solved is still real: a public identifier stored beside
+    # real secrets (a bucket name that happens to be a substring of a project
+    # path) denies every command mentioning that path, and a guard that cries
+    # wolf gets uninstalled, which protects nothing. The answer is an explicit
+    # allowlist, not a clever one.
+    def self.ignored_keys(config_path = default_config_path)
+      return [] unless File.exist?(config_path)
+
+      raw = YAML.safe_load(File.read(config_path)) || {}
+      Array(raw["guard_ignore"]).map(&:to_s)
+    rescue StandardError
+      [] # an unreadable config must never widen the exemption
+    end
+
+    def self.default_config_path
+      File.join(Dir.home, ".localvault", "config.yml")
+    end
+
     HOOK_ENTRYPOINT = "localvault guard hook".freeze
     # The installed command must fail open on machines where the binary is
     # old, missing, or broken — otherwise every Bash call errors for users
@@ -55,12 +94,17 @@ module LocalVault
     end
 
     # @return [Array<Match>] stored secret values appearing in +text+
-    def self.scan(text, secrets = unlocked_secrets)
+    def self.scan(text, secrets = unlocked_secrets, ignore: ignored_keys)
       return [] if text.nil? || text.empty?
 
+      ignored = Array(ignore).map(&:to_s)
+
       secrets.filter_map do |entry|
         value = entry[:value]
         next if value.nil? || value.length < MIN_VALUE_LENGTH
+        # Exact full-key match only. No prefixes, no suffix inference — an
+        # operator opting one key out must never silently opt out its siblings.
+        next if ignored.include?(entry[:key].to_s)
         next unless text.include?(value)
 
         Match.new(vault: entry[:vault], key: entry[:key], fingerprint: fingerprint(value))

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.9.1"
+  VERSION = "1.9.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.9.2
 platform: ruby
 authors:
 - Nauman Tariq