rails_outofband_keys 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c028a4ebdbf7196c3cdaa3279dfda0dd8d5d75d25a9b662c847847d650087b1d
-  data.tar.gz: 6d393b4056c6e6bfd9b63f7bdbb7dbba10a29544ca833a7e09109d71498f59c1
+  metadata.gz: ba17a3f37978f5480cbfe4eaf2c9b630fb977d87d38adadc800f096c28d17463
+  data.tar.gz: 3bb26e6d5e3167a057ddfc290c5f1dc58ee32fa706ed98b47036ee6cb2076354
 SHA512:
-  metadata.gz: 8d0f2b467ced1b33e8e139843413f4e1f0c21e524a73eb41985dba3c75091a9d8818bd87976b21cab592ca4f5d325e426991720ef7d3cd62b36347ab96597202
-  data.tar.gz: 642e1b15c124d6dc4fee45991c69fee2b36ef486f6428a61b7844b371350c1b9de55b07f70d8b70e4dfd11a56ae0e5ef4ca30ebee770f65688cdaa7cab10f485
+  metadata.gz: fc1f6e8e74b6a7a4db2de13548afc0a1457ce7efd83af383dbadf94b9b82bb4d18463a4ca51299811b7e6b3730c8b4bb84d2b39b4fad07e12c56e4bee231c7a8
+  data.tar.gz: dcd71239e65d5fc21d89ffa94d409610b7ab3cb599ce1a139746cd4247ea60cb2560da0c15e0db67be6ed901e4355e779ee23a9b45c01340a6632430fa63dfc5

data/README.md

@@ -1,21 +1,36 @@
 # rails_outofband_keys
 
-`rails_outofband_keys` is a Rails plugin that changes **how Rails finds your credentials key files** (e.g., `production.key` or `master.key`). It allows you to keep these sensitive keys **outside of your project directory and git tree** (e.g., in `~/.config/`).
+`rails_outofband_keys` is a Rails plugin that changes **how Rails finds your credentials key files** (e.g., `production.key` or `master.key`). It allows you to keep these sensitive keys **outside of your project directory and git tree** (for example, under `~/.config/`).
 
-It does **not** replace Rails credentials, change where `credentials.yml.enc` lives, or alter how encryption works. It only dynamically configures `config.credentials.key_path` during the boot process.
+It does **not** replace Rails credentials, change where `credentials.yml.enc` lives, or alter how encryption works. It only configures `config.credentials.key_path` during the boot process.
+
+## Why did I make this?
+
+Encrypted credentials are a solid default. They simplify onboarding, move teams away from risky `.env` files, and give Rails a single, consistent way to manage secrets.
+
+But the system is only as strong as how the encryption keys are handled.
+
+In Rails, it’s standard practice to store credentials keys next to the encrypted files and rely on `.gitignore` to keep them out of version control. That works — until it doesn’t. It assumes perfect developer hygiene and assumes your tooling will always respect ignore rules.
+
+Modern AI assistants and agentic tools break that assumption. These tools upload project files to the cloud and often execute commands directly inside your repo. Even ignored files are now a single `grep` or accidental read away from exposure.
+
+Moving encryption keys out of the project directory is a simple, effective risk reduction. It’s one of the baseline requirements I set before allowing agentic tooling on my team, alongside credential redaction in logs and exceptions.
+
+This gem exists to make that safer pattern easy and boring.
 
 ## Resolution Order
 
 1. If `RAILS_MASTER_KEY` is set in the environment, Rails uses it (this gem does nothing).
 2. If `RAILS_CREDENTIALS_KEY_DIR` is set, it is used as the base directory for the app.
 3. If `RAILS_OUTOFBAND_BASE_DIR` is set, it is used as the global base directory.
-4. Otherwise, the gem fallbacks to OS defaults:
-  - **Linux/macOS**: XDG config directory (`~/.config` fallback)
-  - **Windows**: `%AppData%`
+4. Otherwise, the gem falls back to OS defaults:
+- **Linux/macOS**: XDG config directory (`~/.config` fallback)
+- **Windows**: `%AppData%`
 
 The final path is constructed as:
-`base_directory / root_subdir / credentials_subdir / <environment>.key`
-`base_directory / root_subdir / credentials_subdir / master.key`
+
+- `base_directory / root_subdir / credentials_subdir / <environment>.key`
+- `base_directory / root_subdir / credentials_subdir / master.key`
 
 ## Configuration
 
@@ -41,9 +56,9 @@ On Unix-like systems, key files **must** have secure permissions. They must be o
 Add the gem to your Gemfile:
 
 ```ruby
-gem "rails_outofband_keys", git: "git@github.com:lholden/rails_outofband_keys.git", tag: "v0.1.1"
+gem "rails_outofband_keys", "~> 0.1.1"
 ```
 
 ## License
 
-MIT
+MIT

data/lib/rails_outofband_keys/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsOutofbandKeys
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_outofband_keys
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Lori Holden
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2025-12-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -38,8 +39,11 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.2'
 description: |
-  Configures Rails credentials key_path to load environment/master key files
-  from an out-of-band directory (XDG on Unix/MacOS, AppData on Windows).
+  Configures Rails to load credentials master and environment key files from an out-of-band location
+  (XDG on Linux/macOS, AppData on Windows) instead of the project directory.
+
+  This reduces the risk of key exposure from tooling that reads or executes within your repo,
+  including modern AI assistants and agentic tools.
 email:
 - git@loriholden.com
 executables: []
@@ -58,6 +62,9 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
+  homepage_uri: https://github.com/lholden/rails_outofband_keys
+  source_code_uri: https://github.com/lholden/rails_outofband_keys
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -72,8 +79,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.2
+rubygems_version: 3.5.23
+signing_key:
 specification_version: 4
-summary: Resolve Rails credentials key files outside the project tree (XDG/AppData
-  + overrides).
+summary: Load Rails credentials keys from outside your repo.
 test_files: []