opensecret 0.0.5 → 0.0.6
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +115 -19
- data/lib/{config.openkey.ini → config.opensecret.ini} +1 -1
- data/lib/opensecret.rb +7 -41
- data/lib/opensecret/plugins.io/cipher/crypto.rb +3 -3
- data/lib/opensecret/version.rb +1 -1
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 85c085e0242cdb55bbb6f3df229c28d8a96bd61e
|
|
4
|
+
data.tar.gz: 3a23ec34294b85318d0d6f8f7e05a33b6f83a5f0
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6ca6e6aa4e286458305475e52bf00f92fea820677b297e28337874899f7b6e527841ff4a7577fd7fbb4f97b418bf724502e687e4a2b9b78582768b9ab08e6158
|
|
7
|
+
data.tar.gz: 81f5a6d343efb2637b795481ccf3bf8311840b5ef62794d232893a2d6785d532d1f8c049900575f80c45a9e0aa83947582ea8421eac2ddb5b428f4b3a25040fe
|
data/README.md
CHANGED
|
@@ -1,43 +1,139 @@
|
|
|
1
|
-
|
|
1
|
+
opensecret [](http://travis-ci.org/TwP/inifile)
|
|
2
|
+
==========
|
|
2
3
|
|
|
3
|
-
|
|
4
|
+
Description
|
|
5
|
+
-----------
|
|
4
6
|
|
|
5
|
-
|
|
7
|
+
opensecret stashes uncrackable secrets into your Git, S3, DropBox, Google Drive and filesystems backends. You interface with its intuitive Linux, Windows, iOS front ends and it offers SDKs and plugins for Ruby, Python, Java, Jenkins, CodeShip, Ansible, Terraform, Puppet and Chef.
|
|
6
8
|
|
|
7
|
-
|
|
9
|
+
### opensecret | Install It
|
|
8
10
|
|
|
9
|
-
|
|
11
|
+
$ gem install opensecret
|
|
10
12
|
|
|
11
|
-
|
|
12
|
-
gem 'opensecret'
|
|
13
|
-
```
|
|
13
|
+
### opensecret | Create a Domain
|
|
14
14
|
|
|
15
|
-
|
|
15
|
+
You can use opensecret alone or you can use it to share secrets with colleagues, friends and family, even machines. Sometimes it is more secure for a machine to create credentials and then share them, when asked, with a select group.
|
|
16
16
|
|
|
17
|
-
$
|
|
17
|
+
$ opensecret init <<domain>> <<store-url>>
|
|
18
|
+
$ opensecret init lecturers@harvard https://www.eco-platform.co.uk/crypt/lecturers.git
|
|
18
19
|
|
|
19
|
-
|
|
20
|
+
Every domain is tied to backend storage which is accessible by you and others in your domain. You can use Git, S3, a networked filesystem or shared drive, a SSH accessible filesystem and soon, free storage from opensecret.io
|
|
20
21
|
|
|
21
|
-
$ gem install opensecret
|
|
22
22
|
|
|
23
|
-
|
|
23
|
+
### opensecret | Create Yourself
|
|
24
|
+
|
|
25
|
+
Now you have a domain, you create yourself with an id and an email address.
|
|
26
|
+
|
|
27
|
+
$ opensecret create user --id=joe --email=joebloggs@example.com
|
|
28
|
+
|
|
29
|
+
As there is only one domain, opensecret automatically adds you to it.
|
|
30
|
+
|
|
31
|
+
### opensecret | Create Your Keys
|
|
32
|
+
|
|
33
|
+
With suitcases, the key that locks the suitcase also opens it.
|
|
34
|
+
|
|
35
|
+
In cryptography - you have two keys. You give out your public key and anyone can lock any suitcase (of goodies) with your public key. Once done, that suitcase can only be opened with the other key, your private key. opensecret creates an 8192 bit private key which is simply uncrackable.
|
|
36
|
+
|
|
37
|
+
The safest place to put your private key is on a USB key drive which you carry around with your real keys. And to top it all - a password that only you know is used to lock your private key.
|
|
38
|
+
|
|
39
|
+
$ opensecret create keys <<directory-path>>
|
|
40
|
+
$ opensecret create keys /media/joe/usb_drive
|
|
41
|
+
|
|
42
|
+
The create keys command will ask you for a secure password - enter that and you are ready to start locking, unlocking, asking for - and best of all - telling - lots of juicy secrets. Some secrets are so juicy, they just have to burst.
|
|
43
|
+
|
|
44
|
+
opensecret configuration
|
|
45
|
+
------------------------
|
|
46
|
+
|
|
47
|
+
Aside from your private keys, opensecret keeps a small amount of configuration within the .opensecret folder off your home directory. A typically opensecret.ini file within that folder looks like
|
|
48
|
+
|
|
49
|
+
[joebloggs@example.com]
|
|
50
|
+
type = user
|
|
51
|
+
id = joe
|
|
52
|
+
keydir = /media/joe/usb_drive
|
|
53
|
+
domains = [ lecturers@harvard ]
|
|
54
|
+
default = true
|
|
55
|
+
printx = asdfasdfas65as87d76fa97ds6f57as6d5f87a
|
|
56
|
+
printy = asdfasdfas65as87d76fbbbasdfas0asd09080
|
|
57
|
+
printz = adsfasdflkajhsdfasdf87987987asd9f87987
|
|
58
|
+
|
|
59
|
+
[lecturers@harvard]
|
|
60
|
+
type = domain
|
|
61
|
+
store = git
|
|
62
|
+
url = https://www.eco-platform.co.uk/crypt/lecturers.git
|
|
63
|
+
|
|
24
64
|
|
|
25
|
-
TODO: Write usage instructions here
|
|
26
65
|
|
|
27
|
-
|
|
66
|
+
Backend Storage Options
|
|
67
|
+
-----------------------
|
|
68
|
+
|
|
69
|
+
The planned list of backend storage systems (each onlined with a plugin), is
|
|
70
|
+
|
|
71
|
+
- Git (including GitHub, GitLab, BitBucket, OpenGit and private Git installations).
|
|
72
|
+
- S3 Buckets from the Amazon Web Services (AWS) cloud.
|
|
73
|
+
- SSH, SCP, SFTP connected file-systems
|
|
74
|
+
- network storage including Samba, NFS, VMWare vSAN and
|
|
75
|
+
- GoogleDrive (only Windows has suitable synchronized support).
|
|
76
|
+
|
|
77
|
+
Access management is configured EXTERNAL to opensecret. Opensecret simply piggybacks the network transport if authorization is granted.
|
|
78
|
+
|
|
79
|
+
How to Join a Domain
|
|
80
|
+
--------------------
|
|
81
|
+
|
|
82
|
+
- opensecret will loop encrypting your public key's fingerprint with the public keys of present members
|
|
83
|
+
- when they interact opensecret will ask if they trust the new id/email and key
|
|
84
|
+
- if they say yes the fingerprint is imported and held with id/name
|
|
85
|
+
- ongoing domainwide checks flag up public key / fingerprint mismatches
|
|
86
|
+
- if keys are removed or updated similar questions are asked.
|
|
87
|
+
|
|
88
|
+
Why Beg for Secrets?
|
|
89
|
+
--------------------
|
|
90
|
+
|
|
91
|
+
Why beg for a secret - why not just tell someone it?
|
|
92
|
+
|
|
93
|
+
It is much more secure to beg for a secret than just have someone reveal it. When you beg for a secret - you are sending an encryption key to a single person who must possess the private key and they send back the secret encrypted with both your specific public key and the encryption key that originated from you.
|
|
94
|
+
|
|
95
|
+
Any hijacker will need access to a great many things and be very precise with their timing in order to serrupticiously subvert the system.
|
|
96
|
+
|
|
97
|
+
### Usage
|
|
98
|
+
|
|
99
|
+
Detailed usage instructions will be added right here.
|
|
100
|
+
|
|
101
|
+
### Development
|
|
28
102
|
|
|
29
103
|
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
|
30
104
|
|
|
31
105
|
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
|
32
106
|
|
|
33
|
-
|
|
107
|
+
### Contributing
|
|
34
108
|
|
|
35
109
|
Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/opensecret. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
|
|
36
110
|
|
|
37
|
-
|
|
111
|
+
License
|
|
112
|
+
-------
|
|
38
113
|
|
|
39
|
-
|
|
114
|
+
MIT License
|
|
115
|
+
Copyright (c) 2006 - 2014
|
|
40
116
|
|
|
41
|
-
|
|
117
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
|
118
|
+
a copy of this software and associated documentation files (the
|
|
119
|
+
'Software'), to deal in the Software without restriction, including
|
|
120
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
|
121
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
|
122
|
+
permit persons to whom the Software is furnished to do so, subject to
|
|
123
|
+
the following conditions:
|
|
124
|
+
|
|
125
|
+
The above copyright notice and this permission notice shall be
|
|
126
|
+
included in all copies or substantial portions of the Software.
|
|
127
|
+
|
|
128
|
+
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
|
129
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
130
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
131
|
+
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
|
132
|
+
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
|
133
|
+
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
|
134
|
+
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
135
|
+
|
|
136
|
+
### Code of Conduct
|
|
42
137
|
|
|
43
138
|
Everyone interacting in the OpenSecret project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/opensecret/blob/master/CODE_OF_CONDUCT.md).
|
|
139
|
+
|
data/lib/opensecret.rb
CHANGED
|
@@ -1,41 +1,6 @@
|
|
|
1
1
|
require "opensecret/version"
|
|
2
2
|
require "thor"
|
|
3
3
|
|
|
4
|
-
# # How domains are joined?
|
|
5
|
-
#
|
|
6
|
-
# First the user **wishing to join* must be able to access the domain shared
|
|
7
|
-
# **backend storage** system. The planned list of supported storage systems (each of
|
|
8
|
-
# which is on-lined with a plugin (in plugins.io) is
|
|
9
|
-
#
|
|
10
|
-
# - Git (including GitHub, GitLab, BitBucket, OpenGit and private Git installations).
|
|
11
|
-
# - S3 Buckets from the Amazon Web Services (AWS) cloud.
|
|
12
|
-
# - SSH, SCP, SFTP connected file-systems
|
|
13
|
-
# - network storage including Samba, NFS, VMWare vSAN
|
|
14
|
-
# - GoogleDrive (only Windows has suitable synchronized support).
|
|
15
|
-
# - DropBox
|
|
16
|
-
#
|
|
17
|
-
# Access management is configured EXTERNAL to openkey. OpenKey simply piggybacks
|
|
18
|
-
# the network transport if authorization is granted.
|
|
19
|
-
#
|
|
20
|
-
# ## Use Case - Joining a Domain
|
|
21
|
-
#
|
|
22
|
-
# - ok will loop encrypting your public key's fingerprint with the public keys of present members
|
|
23
|
-
# - when they interact ok will ask if they trust the new id/email and key
|
|
24
|
-
# - if they say yes the fingerprint is imported and held with id/name
|
|
25
|
-
# - ongoing domainwide checks flag up public key / fingerprint mismatches
|
|
26
|
-
# - if keys are removed or updated similar questions are asked.
|
|
27
|
-
#
|
|
28
|
-
# # Begging for and Revealing Secrets
|
|
29
|
-
#
|
|
30
|
-
# - Why beg for a secret - why not just tell someone it?
|
|
31
|
-
# - It is much more secure to beg for a secret than just have someone reveal it.
|
|
32
|
-
# - When you beg for a secret - you are sending an encryption key to a single person
|
|
33
|
-
# - who must possess the private key and they send back the secret encrypted with both
|
|
34
|
-
# - your specific public key and the encryption key that originated from you.
|
|
35
|
-
# -
|
|
36
|
-
# - Any hijacker will need access to a great many things and be very precise with their
|
|
37
|
-
# - timing in order to serrupticiously subvert the system.
|
|
38
|
-
#
|
|
39
4
|
# ### This command line processor will
|
|
40
5
|
#
|
|
41
6
|
# - read the posted commands, options and switches
|
|
@@ -47,9 +12,9 @@ require "thor"
|
|
|
47
12
|
#
|
|
48
13
|
# @note the Thor ruby gem is used for the heavy lifting
|
|
49
14
|
#
|
|
50
|
-
# @example
|
|
51
|
-
# @example
|
|
52
|
-
# @example
|
|
15
|
+
# @example opensecret initdomain create friends.joebloggs --secure
|
|
16
|
+
# @example opensecret user create id=joe email=joebloggs@opensecret.io
|
|
17
|
+
# @example opensecret user create id=joe email=joebloggs@opensecret.io
|
|
53
18
|
#
|
|
54
19
|
#
|
|
55
20
|
class CommandProcessor < Thor
|
|
@@ -57,16 +22,17 @@ class CommandProcessor < Thor
|
|
|
57
22
|
desc "init DOMAIN", "DOMAIN eg lecturers@harvard names your friends, family or work group."
|
|
58
23
|
desc "init STORE_URL", "STORE_URL is backend Git/S3/SSH crypt store. Use https://www.eco-platform.co.uk/crypt.store.git"
|
|
59
24
|
|
|
25
|
+
#
|
|
60
26
|
# Initialize (configure) two fundamental crypt pointers
|
|
61
27
|
#
|
|
62
|
-
# - an
|
|
28
|
+
# - an opensecret domain like » **lecturers@harvard**
|
|
63
29
|
# - the url to a backend store like Git, S3 or an SSH accessible drive.
|
|
64
30
|
#
|
|
65
31
|
# The domain will be extended to cover verified internet domains.
|
|
66
32
|
# They will also latch onto LDAP domains so when admins add, revoke
|
|
67
|
-
# or remove users, their
|
|
33
|
+
# or remove users, their opensecret access is adjusted accordingly.
|
|
68
34
|
#
|
|
69
|
-
# @example
|
|
35
|
+
# @example opensecret user create id=joe email=joebloggs@opensecret.io
|
|
70
36
|
#
|
|
71
37
|
# @param domain [String] the DOMAIN eg lecturers@harvard for your family or work group.
|
|
72
38
|
# @param store_url [String] the STORE_URL for connecting to the backend storage service
|
|
@@ -12,14 +12,14 @@ module OpenSecret
|
|
|
12
12
|
class Crypto
|
|
13
13
|
|
|
14
14
|
|
|
15
|
-
# Register two fundamental
|
|
15
|
+
# Register two fundamental opensecret crypt pointers
|
|
16
16
|
#
|
|
17
|
-
# - an
|
|
17
|
+
# - an opensecret domain like » **lecturers@harvard**
|
|
18
18
|
# - the url to a backend store like Git, S3 or an SSH accessible drive.
|
|
19
19
|
#
|
|
20
20
|
# The domain will be extended to cover verified internet domains.
|
|
21
21
|
# They will also latch onto LDAP domains so when admins add, revoke
|
|
22
|
-
# or remove users, their
|
|
22
|
+
# or remove users, their opensecret access is adjusted accordingly.
|
|
23
23
|
#
|
|
24
24
|
# @param domain [String] the DOMAIN eg lecturers@harvard for your family or work group.
|
|
25
25
|
# @param store_url [String] the STORE_URL for connecting to the backend storage service
|
data/lib/opensecret/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: opensecret
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.6
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Apollo Akora
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2018-02-
|
|
11
|
+
date: 2018-02-08 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: inifile
|
|
@@ -99,7 +99,7 @@ files:
|
|
|
99
99
|
- README.md
|
|
100
100
|
- Rakefile
|
|
101
101
|
- bin/opensecret
|
|
102
|
-
- lib/config.
|
|
102
|
+
- lib/config.opensecret.ini
|
|
103
103
|
- lib/opensecret.rb
|
|
104
104
|
- lib/opensecret/additions/array.rb
|
|
105
105
|
- lib/opensecret/additions/dir.rb
|