muchsecrets 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 639350be4d0bce627d623560089b2cc2997657be
+  data.tar.gz: 523849a5697680c7edf53de4978e52d6bde445de
+SHA512:
+  metadata.gz: f3a45736a0d5a015e5abc406dae0808f1e0805777509e3c4ec26cbb3ce78778a3626487711c5050c9a11f85dc11eb0661acc0f980bd5dc11881ac922c822d950
+  data.tar.gz: 55e41eab84259fa263f20a22fc1b8010b8c7a7f78ac5eff811869b39ef0159f20f5aa4e051339c91dfb600e2e23928d7858bf70dc3aefa7248c2f4afb8b2fcf8

data/LICENSE

@@ -0,0 +1,19 @@
+The MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,66 @@
+[![license](http://img.shields.io/badge/license-MIT-red.svg?style=flat)](https://raw.githubusercontent.com/poblahblahblah/muchsecrets/master/LICENSE)
+
+**MuchSecrets** is a poorly named gem that handles encrypting and decrypting secrets to/from consul.
+
+What's this useful for? Pulling encrypted secrets from [Consul](https://consul.io/), for one. Do you have multiple applications that need to fetch and decrypt secrets? Use a separate key pair for each application. Or not.
+
+## Setting up your keypairs ##
+
+1. create a passwordless keypair
+```bash
+:$ openssl req -new -newkey rsa:4096 -nodes -x509 -keyout application.pem -out application.pem
+````
+
+2. store your private key some place safe
+
+## Usage ##
+
+To encrypt a string:
+```ruby
+require 'muchsecrets'
+wow = MuchSecrets::Secret.new(:public_key => 'application.pem')
+wow.encrypt_string("such_privacy")
+# => "-----BEGIN PKCS7-----
+MIIDIgYJKoZIhvcNAQcDoIIDEzCCAw8CAQAxggLNMIICyQIBADCBsDCBojELMAkG
+A1UEBhMCVVMxDzANBgNVBAgTBk9yZWdvbjERMA8GA1UEBxMIUG9ydGxhbmQxHjAc
+BgNVBAoTFUdvbGRzdGFyIEV2ZW50cywgSW5jLjETMBEGA1UECxMKT3BlcmF0aW9u
+czEZMBcGA1UEAxMQd3d3LmdvbGRzdGFyLmNvbTEfMB0GCSqGSIb3DQEJARYQb3Bz
+QGdvbGRzdGFyLmNvbQIJANt3J781eLGXMA0GCSqGSIb3DQEBAQUABIICACCoyYVm
+3moYb3hZCl9fjgLRAzr1aW6mVGCbmRcHuJf/sFD91tBFG7i0/pHctvDtRKBMugER
+Te0GMKghfPkQwbg6f2ksmsmJe0np4rx9RT28ZMl3ME6ywucxI3/2Qv8DfBW1QM+I
+Erwrzw678PKDZygwriDJ+mCDbDB4i/J7jFHG6mjIeV9KilFnCW1M3h54N76+zjds
+1wu4vQlG5x1F3zaJ/uDOTw4NbUBA3TGvTsWsPBQA86dbVjeONA7EEeIG4/pFINhe
+qnMiii5zUpXymuM10vkjRWf081PH/V4Xc0LK93Ic5p5otO2kZTZfMFLMKxNTHlmP
+/Bu+8kC2af6qXfGQZOYSZdU7/WDeo55xzC89lkN9q5Um1SrdUPIwUu7633/Mn9DJ
+WHNad6ZIZdVHzA04u9OE0peR8aPb157PsU8OOWvtH22jAg9f60+qiCMaT+JSK4c2
+VN81q1PL9jRfed48sz0fox/abCF14+oLEnWkU1yvToYFUD1kzmFgr4BApxIctM6B
+COFy9Fxhwkznn5Xd7nH9ZAPB/t+pntgeLH65rqqAxgYovsw2hpXQKtiGdZlcpjH5
+vobT/ULI+8xdBfzwR4sOZ1LCwwwMZuSqtaRRsJGkwCk1qmcfpt52VyWerCLYO/Z/
+UYSWV18rcuBtpg0vnD8KbfUNI8K6Qggt2a+dMDkGCSqGSIb3DQEHATAdBglghkgB
+ZQMEASwEEMVOg3shVq9U1O7CzSDJfSyADex+cL6h7RnV1tRwDqI=
+-----END PKCS7-----"
+```
+
+Push the encrypted string to consul.
+
+To decrypt a raw key value from consul:
+```ruby
+require 'muchsecrets'
+wow = MuchSecrets::Secret.new(:public_key => 'application.pem', :private_key => 'application.pem')
+super_secret = wow.get_http_secret('notprod/github_api_key/encrypted?raw')
+# => "such_privacy"
+```
+
+## To Do ##
+
+* come up with less awful method names
+* write tests
+* be able to encrypt and POST to consul
+* more security
+
+## Please Note ##
+
+I am not a security expert. If something I am doing is terribly wrong please let me know!
+
+## Contributors ##
+

data/lib/muchsecrets.rb

@@ -0,0 +1,3 @@
+#require "goldstar/notifications/version"
+require "muchsecrets/secret"
+

data/lib/muchsecrets/secret.rb

@@ -0,0 +1,38 @@
+module MuchSecrets
+  class Secret
+    require 'openssl'
+    require 'net/http'
+
+    def initialize(options = {})
+      @private_key = options[:private_key]
+      @public_key  = options[:public_key]
+      @base_url    = options[:base_url] || "http://consul:8500/v1/kv" 
+      @cipher      = OpenSSL::Cipher.new(options[:cipher] || "AES-256-CFB")
+    end
+
+    def get_http_secret(uri)
+      encrypted_secret = fetch_encrypted_http_secret(uri)
+      return decrypt_string(encrypted_secret)
+    end
+
+    def encrypt_string(val)
+      cert = OpenSSL::X509::Certificate.new(File.read(@public_key))
+      return OpenSSL::PKCS7::encrypt([cert], val, @cipher, OpenSSL::PKCS7::BINARY)
+    end
+
+    private
+
+    def fetch_encrypted_http_secret(uri)
+      # get the secret from the http endpoint
+      uri = File.join(@base_url, uri)
+      return Net::HTTP.get(URI(uri)).chomp
+    end
+
+    def decrypt_string(val)
+      cert = OpenSSL::X509::Certificate.new(File.read(@public_key))
+      key  = OpenSSL::PKey::RSA.new(File.read(@private_key))
+      return OpenSSL::PKCS7.new(val).decrypt(key, cert)
+    end
+  end
+end
+

metadata

@@ -0,0 +1,48 @@
+--- !ruby/object:Gem::Specification
+name: muchsecrets
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- Pat O'Brien
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-03-13 00:00:00.000000000 Z
+dependencies: []
+description: handles encrypting and decrypting secrets to/from consul.
+email:
+- muchsecrets@tetrisbocks.net
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/muchsecrets/secret.rb
+- lib/muchsecrets.rb
+- LICENSE
+- README.md
+homepage: http://github.com/poblahblahblah/muchsecrets
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.0.14
+signing_key: 
+specification_version: 4
+summary: much secrets, such security
+test_files: []