portunus 0.3.2 → 0.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a24444a091b722e99c9eb8cbf1a976a20c5a86fb0de655f1ce486c36b919f57
-  data.tar.gz: '076438e1178c0b252e96793f9c7841c6032e26c9628692cbce0c4d8b7e2c1235'
+  metadata.gz: 55b4d7fa50d9b1784676c0cafbf30617b9eefa4fc441c2a6eb6db96b64b5a953
+  data.tar.gz: 647f2b1b543b9bd490d39e39d39d8178ab44a45f90a0b44aee1ffa7eacfa09ec
 SHA512:
-  metadata.gz: 964a8e2dd39b2507b62ce43fc43f4c4ebce5c2517c92ac7983c34c6df987ba1425d8a4647dfdfb82b71966a54d5fad972c9cc0a91e8931048a82cdc97659d643
-  data.tar.gz: 269818e9decedbd56fe98dc5d612f5c5123aa3c159eb349060ac4e256d64fda3821cfd11b1fd13d252adf38978aa646bc55f801dd3273e1d5b43a9a71a5c2584
+  metadata.gz: b2bcd7c135f15758e05ebe0c94a3cd8b88b944db67440c0d2f535cb76af0aa8829ed89048e0b28fc9f354209b3235ffeb6679cf3ec4ede699a60861dd441934b
+  data.tar.gz: 1b16cfedbe5fa06809416e4f439612216ec9e08c221f44ca9c8b4af80d0a3b5729536d77e54486c8e53afd8fe7861d09381ccec361949c7a65fa46e39922cc5d

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    portunus (0.3.1)
+    portunus (0.3.5)
       openssl (>= 2.1.0)
       rails (>= 5.0.0)
 
@@ -79,7 +79,6 @@ GEM
       activesupport (>= 4.2.0)
     i18n (1.8.2)
       concurrent-ruby (~> 1.0)
-    ipaddr (1.2.2)
     json (2.3.0)
     loofah (2.4.0)
       crass (~> 1.0.2)
@@ -97,7 +96,6 @@ GEM
     nokogiri (1.10.9)
       mini_portile2 (~> 2.4.0)
     openssl (2.1.2)
-      ipaddr
     pry (0.12.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -185,3 +183,6 @@ DEPENDENCIES
   rspec
   simplecov (~> 0.17.1)
   sqlite3
+
+BUNDLED WITH
+   2.1.4

data/README.md

@@ -54,13 +54,31 @@ include Portunus::Encryptable
 ```
 
 ### Set up your master keys
+
 Portunus comes with two adaptors for your master keys, "credentials" and 
 "environment". This should cover the most common deploy scenarios. Before
 Portunus can function, enabled master keys need to be added. There is a 
 generator to create the keys for you to then install in the proper 
-location.
+location. 
 
     $ bundle exec rake portunus:generate_master_keys
+    
+If you are using the credentials adaptor (default), add the keys here. 
+Make sure to generate keys for each environment.      
+    
+    $ bundle exec rails credentials:edit --environment=development
+
+#### Spring / Postgres / OSX
+
+When using this combination a bug may arise that prompts a weird error message:
+
+    $ objc[4182]: +[__NSPlaceholderDictionary initialize] may have been in progress in another thread when fork() was called.
+
+You can circumvent it by using the below command in High Sierra / Catalina. It 
+might not work in Mojave but I believe this issue unrelated to Portunus.
+Alternatively just don't use spring. 
+
+    $ export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
 
 ### Additional devise notes
 

data/lib/portunus/field_configurer.rb

@@ -5,7 +5,6 @@ module Portunus
     end
 
     def initialize(object:, field:)
-      require "pry"
       @object = object
 
       if field.is_a?(Hash)

data/lib/portunus/rotators/dek.rb

@@ -12,20 +12,24 @@ module Portunus
       def rotate
         encryptable = data_encryption_key.encryptable
 
-        encryptable.class.encrypted_fields_list.map do |field_name|
-          field_value_map[field_name.to_sym] = encryptable.send(field_name.to_sym)
-        end
+        Rails.logger.debug(
+          "Rotating Encryptable: #{encryptable.class}, id: #{encryptable.id}"
+        )
+
+        ActiveRecord::Base.transaction do
+          encryptable.class.encrypted_fields_list.map do |field_name|
+            field_value_map[field_name.to_sym] = encryptable.send(field_name.to_sym)
+          end
 
-        data_encryption_key.encrypted_key = new_encrypted_key
+          data_encryption_key.update(encrypted_key: new_encrypted_key)
+          encryptable.data_encryption_key.reload
 
-        field_value_map.map do |field_name, value|
-          encryptable.send("#{field_name}=".to_sym, value)
-        end
+          field_value_map.map do |field_name, value|
+            encryptable.send("#{field_name}=".to_sym, value)
+          end
 
-        ActiveRecord::Base.transaction do
           encryptable.save
-          data_encryption_key.last_dek_rotation = DateTime.now
-          data_encryption_key.save
+          data_encryption_key.update(last_dek_rotation: DateTime.now)
         end
 
         true

data/lib/portunus/tasks/rotate_keys.rake

@@ -1,12 +1,16 @@
 namespace :portunus do
   desc "Rotate KEK keys, reencrypt the deks"
   task rotate_keks: :environment do
-    scope = ::Portunus::DataEncryptionKey.
-      where(
-        "last_kek_rotation < ? or (created_at < ? and last_kek_rotation is null", 
-        ::Portunus.configuration.max_key_duration,
-        ::Portunus.configuration.max_key_duration
-      )
+    if ENV["FORCE"] == "true"
+      scope = ::Portunus::DataEncryptionKey.all
+    else
+      scope = ::Portunus::DataEncryptionKey.
+        where(
+          "last_kek_rotation < ? or (created_at < ? and last_kek_rotation is null)", 
+          DateTime.now - ::Portunus.configuration.max_key_duration,
+          DateTime.now - ::Portunus.configuration.max_key_duration
+        )
+    end
 
     scope.in_batches do |relation|
       relation.map do |encryption_key|
@@ -22,9 +26,9 @@ namespace :portunus do
     else
       scope = ::Portunus::DataEncryptionKey.
         where(
-          "last_dek_rotation < ? or (created_at < ? and last_dek_rotation is null", 
-          ::Portunus.configuration.max_key_duration,
-          ::Portunus.configuration.max_key_duration
+          "last_dek_rotation < ? or (created_at < ? and last_dek_rotation is null)", 
+          DateTime.now - ::Portunus.configuration.max_key_duration,
+          DateTime.now - ::Portunus.configuration.max_key_duration
         )
     end
     scope.in_batches do |relation|

data/lib/portunus/version.rb

@@ -1,3 +1,3 @@
 module Portunus
-  VERSION = "0.3.2"
+  VERSION = "0.3.7"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: portunus
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.7
 platform: ruby
 authors:
 - Colin Petruno
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-24 00:00:00.000000000 Z
+date: 2020-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -234,8 +234,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6.2
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: DEK and KEK Encryption for Rails