rake_git_crypt 0.3.0.pre.2 → 0.3.0.pre.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: acea5ccef8eb241156531ab11f601a30df636a4930470e1879d746692870e67b
-  data.tar.gz: b74d89cba4744dd3c7dd3e2ad8ffdf31f1d1c15f4eaaddf59a5f8473d70e2094
+  metadata.gz: b944dc5a6b13423f03b1e36fbbfd013e4e1dd007f6b27f2abaa05fb8abf41782
+  data.tar.gz: 7a69c01c2fcd3a41ff3a4036dba1611c6a1773e4a511c05c2734fcaf4004137c
 SHA512:
-  metadata.gz: b630643b6c327cff65471b3eea288fbff2bdd4c8abd0f4a2cf0713513bd81f6d9e75822dd3c3a7b354ad099d0bc1392e2f426a39f11fedfdc3c0080da3a1ad01
-  data.tar.gz: 1c136a336644dfdd8373c66751b8e70d60920ab0ef9bd981b2651e933f05f313062effda2ca112f03dd6f7e500832f9375c9b59339fd3ea81226de342e45cf08
+  metadata.gz: 864b5a7cf30588d848b56587e22e950ffd6e38a6dd67de4692012ca7fcddbb0b73732f9dbb9488bdafb27f92a1d66ffaf7db5dc2a2b2ea18d0c512d4228a7768
+  data.tar.gz: 42e0b804fe2d7e979f74ecd4965deaa6ad7c8fd38a5f584e5a3b420241c9c95cd7183d439142e5243c431848671f81ec6dde5890104ba446f6662b8c5e5426d0

data/Gemfile.lock

@@ -1,8 +1,9 @@
 PATH
   remote: .
   specs:
-    rake_git_crypt (0.3.0.pre.2)
+    rake_git_crypt (0.3.0.pre.3)
       colored2 (~> 3.1)
+      lino (~> 4.1)
       rake_factory (~> 0.33)
       ruby_git_crypt (~> 0.1)
       ruby_gpg2 (~> 0.12)
@@ -10,53 +11,56 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.1.3.4)
+    activesupport (7.2.2.1)
       base64
+      benchmark (>= 0.3)
       bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+      concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
-      mutex_m
-      tzinfo (~> 2.0)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
-    ast (2.4.2)
+    ast (2.4.3)
     base64 (0.2.0)
+    benchmark (0.4.0)
     bigdecimal (3.1.8)
     childprocess (5.0.0)
     colored2 (3.1.2)
-    concurrent-ruby (1.3.3)
+    concurrent-ruby (1.3.4)
     connection_pool (2.4.1)
-    diff-lcs (1.5.1)
+    diff-lcs (1.6.2)
     docile (1.4.0)
     drb (2.2.1)
     excon (0.111.0)
     faraday (2.10.0)
       faraday-net_http (>= 2.0, < 3.2)
       logger
-    faraday-net_http (3.1.0)
+    faraday-net_http (3.1.1)
       net-http
-    gem-release (2.2.2)
+    gem-release (2.2.4)
     git (1.19.1)
       addressable (~> 2.8)
       rchardet (~> 1.8)
     hamster (3.0.0)
       concurrent-ruby (~> 1.0)
-    i18n (1.14.5)
+    i18n (1.14.6)
       concurrent-ruby (~> 1.0)
     immutable-struct (2.4.1)
-    json (2.7.2)
-    language_server-protocol (3.17.0.3)
+    json (2.12.2)
+    language_server-protocol (3.17.0.5)
     lino (4.1.0)
       childprocess (~> 5.0.0)
       hamster (~> 3.0)
       open4 (~> 1.3)
-    logger (1.6.0)
+    lint_roller (1.1.0)
+    logger (1.6.2)
     memfs (1.0.0)
-    minitest (5.24.1)
-    mutex_m (0.2.0)
+    minitest (5.25.4)
     net-http (0.4.1)
       uri
     octokit (8.1.0)
@@ -64,72 +68,74 @@ GEM
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     open4 (1.3.4)
-    parallel (1.25.1)
-    parser (3.3.4.0)
+    parallel (1.27.0)
+    parser (3.3.8.0)
       ast (~> 2.4.1)
       racc
+    prism (1.4.0)
     public_suffix (6.0.1)
-    racc (1.8.0)
+    racc (1.8.1)
     rainbow (3.1.1)
-    rake (13.2.1)
-    rake_circle_ci (0.11.0)
+    rake (13.3.0)
+    rake_circle_ci (0.13.0)
       colored2 (~> 3.1)
       excon (~> 0.72)
-      rake_factory (~> 0.23)
+      rake_factory (~> 0.33)
       sshkey (~> 2.0)
     rake_factory (0.33.0)
       activesupport (>= 4)
       rake (~> 13.0)
-    rake_git (0.1.0.pre.11)
+    rake_git (0.3.0.pre.2)
       colored2 (~> 3.1)
       git (~> 1.13, >= 1.13.2)
-      rake_factory (>= 0.32.0.pre.2)
-    rake_github (0.13.0)
+      rake_factory (~> 0.33)
+    rake_github (0.15.0)
       colored2 (~> 3.1)
       octokit (>= 4.16, < 9.0)
-      rake_factory (~> 0.23)
+      rake_factory (~> 0.33)
       sshkey (~> 2.0)
-    rake_gpg (0.18.0)
-      rake_factory (~> 0.23)
-      ruby_gpg2 (~> 0.6)
-    rake_ssh (0.10.0)
+    rake_gpg (0.20.0)
+      rake_factory (~> 0.33)
+      ruby_gpg2 (~> 0.12)
+    rake_ssh (0.12.0)
       colored2 (~> 3.1)
-      rake_factory (~> 0.23)
+      rake_factory (~> 0.33)
       sshkey (~> 2.0)
     rchardet (1.8.0)
-    regexp_parser (2.9.2)
-    rexml (3.3.2)
-      strscan
-    rspec (3.13.0)
+    regexp_parser (2.10.0)
+    rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.0)
+    rspec-core (3.13.4)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.1)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.1)
+    rspec-mocks (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.1)
-    rubocop (1.65.0)
+    rspec-support (3.13.4)
+    rubocop (1.76.0)
       json (~> 2.3)
-      language_server-protocol (>= 3.17.0)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.4, < 3.0)
-      rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.31.1, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.45.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.31.3)
-      parser (>= 3.3.1.0)
-    rubocop-rake (0.6.0)
-      rubocop (~> 1.0)
-    rubocop-rspec (3.0.3)
-      rubocop (~> 1.61)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.45.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
+    rubocop-rake (0.7.1)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.72.1)
+    rubocop-rspec (3.6.0)
+      lint_roller (~> 1.1)
+      rubocop (~> 1.72, >= 1.72.1)
     ruby-progressbar (1.13.0)
     ruby_git_crypt (0.1.0)
       immutable-struct (~> 2.4)
@@ -139,6 +145,7 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.4.0)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
@@ -146,11 +153,12 @@ GEM
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
     sshkey (2.0.0)
-    strscan (3.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (2.5.0)
-    uri (0.13.0)
+    unicode-display_width (3.1.4)
+      unicode-emoji (~> 4.0, >= 4.0.4)
+    unicode-emoji (4.0.4)
+    uri (0.13.2)
 
 PLATFORMS
   arm64-darwin-21

data/README.md

@@ -22,6 +22,44 @@ Or install it yourself as:
 
 TODO: Write docs.
 
+### Unlocking git-crypt with an encrypted GPG key
+
+The `unlock_with_encrypted_gpg_key` task unlocks git-crypt using a
+passphrase-encrypted GPG key, useful in CI environments. It decrypts an
+OpenSSL-encrypted GPG private key, imports it into GPG and runs
+`git-crypt unlock`. The passphrase is read from an environment variable so
+that it never appears on the process command line.
+
+By default the key is imported into a temporary GPG home directory (created
+under the GPG work directory) which is used for both the import and the
+`git-crypt unlock`, so the private key never lands in the default keyring
+and does not persist after the task completes. A specific home directory can
+be provided via `gpg_home_directory`, in which case it is used as-is.
+
+```ruby
+require 'rake_git_crypt'
+
+RakeGitCrypt::Tasks::UnlockWithEncryptedGPGKey.define(
+  encrypted_key_path: '.github/gpg.private.enc',
+  passphrase_env_var_name: 'ENCRYPTION_PASSPHRASE'
+)
+```
+
+Both parameters are optional and default to the values shown above. The task
+is also included in the standard task set, where the same settings can be
+provided via `unlock_with_encrypted_gpg_key_encrypted_key_path` and
+`unlock_with_encrypted_gpg_key_passphrase_env_var_name`, with the GPG home
+and work directories controlled by the shared `gpg_home_directory` and
+`gpg_work_directory` settings.
+
+The passphrase is expected to be provided as a secret (for example the
+`ENCRYPTION_PASSPHRASE` GitHub Actions or Dependabot secret) and exposed to
+the step that runs the task:
+
+```bash
+ENCRYPTION_PASSPHRASE="..." bundle exec rake unlock_with_encrypted_gpg_key
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run

data/lib/rake_git_crypt/task_sets/standard.rb

@@ -24,6 +24,11 @@ module RakeGitCrypt
 
       parameter :unlock_key_paths
 
+      parameter :unlock_with_encrypted_gpg_key_encrypted_key_path,
+                default: '.github/gpg.private.enc'
+      parameter :unlock_with_encrypted_gpg_key_passphrase_env_var_name,
+                default: 'ENCRYPTION_PASSPHRASE'
+
       parameter :install_commit_message_template,
                 default: 'Installing git-crypt.'
       parameter :install_commit_task_name
@@ -52,6 +57,8 @@ module RakeGitCrypt
       parameter :init_task_name, default: :init
       parameter :lock_task_name, default: :lock
       parameter :unlock_task_name, default: :unlock
+      parameter :unlock_with_encrypted_gpg_key_task_name,
+                default: :unlock_with_encrypted_gpg_key
       parameter :install_task_name, default: :install
       parameter :uninstall_task_name, default: :uninstall
       parameter :reinstall_task_name, default: :reinstall
@@ -88,6 +95,24 @@ module RakeGitCrypt
                ts.unlock_key_paths
              end
            })
+      task(Tasks::UnlockWithEncryptedGPGKey,
+           {
+             name: RakeFactory::DynamicValue.new do |ts|
+               ts.unlock_with_encrypted_gpg_key_task_name
+             end,
+             encrypted_key_path: RakeFactory::DynamicValue.new do |ts|
+               ts.unlock_with_encrypted_gpg_key_encrypted_key_path
+             end,
+             passphrase_env_var_name: RakeFactory::DynamicValue.new do |ts|
+               ts.unlock_with_encrypted_gpg_key_passphrase_env_var_name
+             end,
+             gpg_home_directory: RakeFactory::DynamicValue.new do |ts|
+               ts.gpg_home_directory
+             end,
+             gpg_work_directory: RakeFactory::DynamicValue.new do |ts|
+               ts.gpg_work_directory
+             end
+           })
       task(Tasks::Install,
            {
              name: RakeFactory::DynamicValue.new do |ts|

data/lib/rake_git_crypt/tasks/unlock_with_encrypted_gpg_key.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'lino'
+require 'rake_factory'
+require 'ruby_git_crypt'
+require 'ruby_gpg2'
+require 'tmpdir'
+
+require_relative '../home'
+
+module RakeGitCrypt
+  module Tasks
+    class UnlockWithEncryptedGPGKey < RakeFactory::Task
+      default_name :unlock_with_encrypted_gpg_key
+      default_description 'Unlock git-crypt using a passphrase-encrypted ' \
+                          'GPG key.'
+
+      parameter :encrypted_key_path, default: '.github/gpg.private.enc'
+      parameter :passphrase_env_var_name, default: 'ENCRYPTION_PASSPHRASE'
+      parameter :gpg_home_directory
+      parameter :gpg_work_directory, default: '/tmp'
+
+      action do
+        ensure_passphrase_present
+        ensure_encrypted_key_present
+
+        puts('Unlocking git-crypt using passphrase-encrypted GPG key...')
+        with_gpg_home_directory do |home_directory|
+          with_decrypted_key do |decrypted_key_path|
+            import_key(decrypted_key_path, home_directory)
+          end
+          unlock(home_directory)
+        end
+        puts('Done.')
+      end
+
+      private
+
+      def with_gpg_home_directory(&block)
+        Home.new(gpg_work_directory, gpg_home_directory || :temporary)
+            .with_resolved_directory do |home_directory|
+          block.call(home_directory)
+        end
+      end
+
+      def ensure_passphrase_present
+        passphrase = ENV.fetch(passphrase_env_var_name, nil)
+        return unless passphrase.nil? || passphrase.empty?
+
+        raise(RakeFactory::RequiredParameterUnset, passphrase_missing_message)
+      end
+
+      def ensure_encrypted_key_present
+        return if File.file?(encrypted_key_path)
+
+        raise(encrypted_key_missing_message)
+      end
+
+      def with_decrypted_key
+        Dir.mktmpdir('git-crypt-unlock', gpg_work_directory) do |directory|
+          decrypted_key_path = File.join(directory, 'gpg.private')
+          decrypt_key(decrypted_key_path)
+          yield decrypted_key_path
+        end
+      end
+
+      def decrypt_key(decrypted_key_path)
+        openssl_command(decrypted_key_path).build.execute
+      end
+
+      def openssl_command(decrypted_key_path)
+        Lino
+          .builder_for_command('openssl')
+          .with_options_after_subcommands
+          .with_subcommand('aes-256-cbc')
+          .with_flag('-d')
+          .with_option('-md', 'sha1')
+          .with_option('-in', encrypted_key_path)
+          .with_option('-out', decrypted_key_path)
+          .with_option('-pass', "env:#{passphrase_env_var_name}")
+      end
+
+      def import_key(decrypted_key_path, home_directory)
+        RubyGPG2.import(
+          key_file_paths: [decrypted_key_path],
+          work_directory: gpg_work_directory,
+          home_directory:
+        )
+      end
+
+      def unlock(home_directory)
+        RubyGitCrypt.unlock(
+          {},
+          { environment: { GNUPGHOME: home_directory } }
+        )
+      end
+
+      def passphrase_missing_message
+        'No passphrase found in environment variable ' \
+          "'#{passphrase_env_var_name}'. This passphrase decrypts the CI " \
+          'GPG private key and is stored as the ' \
+          "'#{passphrase_env_var_name}' secret in the repository's GitHub " \
+          'Actions and Dependabot secrets stores (Settings > Secrets and ' \
+          'variables). Expose it to this step, for example with:' \
+          "\n  env:\n    #{passphrase_env_var_name}: " \
+          "${{ secrets.#{passphrase_env_var_name} }}\n" \
+          'For Dependabot-triggered runs the secret must also be mirrored ' \
+          'into the Dependabot secrets store.'
+      end
+
+      def encrypted_key_missing_message
+        'Encrypted GPG private key not found at ' \
+          "'#{encrypted_key_path}'. Set the encrypted_key_path parameter " \
+          'to the location of the OpenSSL-encrypted GPG private key ' \
+          '(repositories part-way through migration may still hold it at ' \
+          "'.circleci/gpg.private.enc')."
+      end
+    end
+  end
+end

data/lib/rake_git_crypt/tasks.rb

@@ -8,6 +8,7 @@ require_relative 'tasks/lock'
 require_relative 'tasks/reinstall'
 require_relative 'tasks/uninstall'
 require_relative 'tasks/unlock'
+require_relative 'tasks/unlock_with_encrypted_gpg_key'
 
 module RakeGitCrypt
   module Tasks

data/lib/rake_git_crypt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeGitCrypt
-  VERSION = '0.3.0.pre.2'
+  VERSION = '0.3.0.pre.3'
 end

data/rake_git_crypt.gemspec

@@ -37,6 +37,7 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 3.1'
 
   spec.add_dependency 'colored2', '~> 3.1'
+  spec.add_dependency 'lino', '~> 4.1'
   spec.add_dependency 'rake_factory', '~> 0.33'
   spec.add_dependency 'ruby_git_crypt', '~> 0.1'
   spec.add_dependency 'ruby_gpg2', '~> 0.12'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rake_git_crypt
 version: !ruby/object:Gem::Version
-  version: 0.3.0.pre.2
+  version: 0.3.0.pre.3
 platform: ruby
 authors:
 - InfraBlocks Maintainers
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-07-26 00:00:00.000000000 Z
+date: 2026-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colored2
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.1'
+- !ruby/object:Gem::Dependency
+  name: lino
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.1'
 - !ruby/object:Gem::Dependency
   name: rake_factory
   requirement: !ruby/object:Gem::Requirement
@@ -95,6 +109,7 @@ files:
 - lib/rake_git_crypt/tasks/reinstall.rb
 - lib/rake_git_crypt/tasks/uninstall.rb
 - lib/rake_git_crypt/tasks/unlock.rb
+- lib/rake_git_crypt/tasks/unlock_with_encrypted_gpg_key.rb
 - lib/rake_git_crypt/template.rb
 - lib/rake_git_crypt/version.rb
 - rake_git_crypt.gemspec
@@ -103,7 +118,7 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'false'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -119,7 +134,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.1
 requirements: []
 rubygems_version: 3.3.7
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Rake tasks for interacting with git-crypt.
 test_files: []