ruborg 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bb6c1c5f47b1fbb4538310a929914b0e744bcdb30d5e5635c4246df778e2113
-  data.tar.gz: bda5cf063fe587a047dd36fa9c5e948d8130e47501a53eabef9c34a3af7ae361
+  metadata.gz: 1233e04a2f95e8e8aadb9ad97d043b2d9b52c446821ff89495073a6a8762b6cc
+  data.tar.gz: ee3fd1ae2256299120d7f78aac3243c2de44f8f3c072c4c29dd44cb761caf769
 SHA512:
-  metadata.gz: 8828dacb76519557d51876327133491318bd199e589fb695d08a94af1a73a3c34772f022b6630e199a2c1ab9ab7d78dcce043a402bfa0f418ae51262aad80e8f
-  data.tar.gz: 99b7e79eb2e50240862f7ade79291d9a76469385f2b7e8949df8e6ac3251f9adcbe2f605e42c09364616c028f10575593c3e0a1df1d020bcf8fc7291a9cdb558
+  metadata.gz: 59d6ad7e5797cbbd964390d0425bf1392695c24f938a40978ddea371552da84604bf0a8eb189b207318ed68dba966311d45659f2b6abd3a59711f766465a5b36
+  data.tar.gz: 6c77a312c9b820dd22d7f0396dbb24fac70da4654023c89eebc94c962d367b963a448a923ce23574862276452c441e3ebd723601fd58a2634e3337d402a9c066

data/.rubocop.yml

@@ -0,0 +1,175 @@
+# RuboCop configuration for Ruborg
+
+plugins:
+  - rubocop-rspec
+
+AllCops:
+  TargetRubyVersion: 3.2
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - 'vendor/**/*'
+    - 'tmp/**/*'
+    - 'bin/*'
+
+# Disable documentation requirement
+Style/Documentation:
+  Enabled: false
+
+# Allow development dependencies in gemspec
+Gemspec/DevelopmentDependencies:
+  Enabled: false
+
+# Allow longer lines in some cases
+Layout/LineLength:
+  Max: 120
+  AllowedPatterns:
+    - '\s+# '
+    - '^\s*#'
+  Exclude:
+    - 'spec/**/*'
+
+# Allow longer methods in specs
+Metrics/MethodLength:
+  Max: 25
+  Exclude:
+    - 'spec/**/*'
+    - 'lib/ruborg/cli.rb'  # CLI commands can be longer
+
+# Allow longer blocks in specs
+Metrics/BlockLength:
+  Exclude:
+    - 'spec/**/*'
+    - '*.gemspec'
+
+# Allow more complex methods
+Metrics/AbcSize:
+  Max: 30
+  Exclude:
+    - 'spec/**/*'
+    - 'lib/ruborg/cli.rb'  # CLI commands can be more complex
+
+# Allow reasonable cyclomatic complexity
+Metrics/CyclomaticComplexity:
+  Max: 15
+  Exclude:
+    - 'lib/ruborg/cli.rb'  # CLI commands can have more branches
+
+# Allow reasonable perceived complexity
+Metrics/PerceivedComplexity:
+  Max: 15
+  Exclude:
+    - 'lib/ruborg/cli.rb'  # CLI commands can be more complex
+
+# Allow larger classes for CLI and main library classes
+Metrics/ClassLength:
+  Max: 350
+  Exclude:
+    - 'spec/**/*'
+
+# Prefer modern hash syntax
+Style/HashSyntax:
+  EnforcedStyle: ruby19
+
+# Prefer double quotes for consistency
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+# Allow both single and double quotes in specs
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+# Prefer symbols as hash keys
+Style/SymbolArray:
+  EnforcedStyle: brackets
+
+# Allow compact module/class definition
+Style/ClassAndModuleChildren:
+  Enabled: false
+
+# Allow both proc and lambda
+Style/Lambda:
+  Enabled: false
+
+# Allow if/unless modifiers
+Style/IfUnlessModifier:
+  Enabled: true
+
+# Prefer raise over fail
+Style/SignalException:
+  EnforcedStyle: only_raise
+
+# Allow compact empty methods
+Style/EmptyMethod:
+  EnforcedStyle: compact
+
+# Prefer explicit returns in some cases
+Style/RedundantReturn:
+  Enabled: false
+
+# Don't enforce attr_reader for method definitions in blocks
+Style/TrivialAccessors:
+  Enabled: false
+
+# RSpec specific cops
+RSpec/ExampleLength:
+  Max: 25
+
+RSpec/MultipleExpectations:
+  Max: 5
+
+RSpec/NestedGroups:
+  Max: 5
+
+RSpec/DescribeClass:
+  Exclude:
+    - 'spec/integration/**/*'
+    - 'spec/ruborg/auto_init_spec.rb'
+    - 'spec/ruborg/backup_integration_spec.rb'
+    - 'spec/ruborg/log_config_spec.rb'
+    - 'spec/ruborg/per_file_backup_spec.rb'
+    - 'spec/ruborg/security_spec.rb'
+
+# Allow any_instance_of for testing
+RSpec/AnyInstance:
+  Enabled: false
+
+# Allow both expect and allow for message expectations
+RSpec/MessageSpies:
+  Enabled: false
+
+# Allow both expect and allow
+RSpec/StubbedMock:
+  Enabled: false
+
+# Allow normal doubles in specs
+RSpec/VerifiedDoubles:
+  Enabled: false
+
+# Allow multiple memoized helpers
+RSpec/MultipleMemoizedHelpers:
+  Enabled: false
+
+# Allow backticks for command execution
+Style/CommandLiteral:
+  Enabled: false
+
+# Allow safe navigation chains
+Style/SafeNavigationChainLength:
+  Enabled: false
+
+# Allow useless constant scoping for clarity
+Lint/UselessConstantScoping:
+  Enabled: false
+
+# Allow get_ prefix in method names for clarity
+Naming/AccessorMethodName:
+  Enabled: false
+
+# Allow predicate methods without ? suffix
+Naming/PredicateMethod:
+  Enabled: false
+
+# Allow any spec file path format
+RSpec/SpecFilePathFormat:
+  Enabled: false

data/CHANGELOG.md

@@ -7,6 +7,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2025-10-08
+
+### Added
+- **Hostname Validation**: Optional `hostname` configuration key to restrict backup operations to specific hosts
+  - Can be configured globally or per-repository
+  - Repository-specific hostname overrides global setting
+  - Validates system hostname before backup, list, restore, check operations
+  - Prevents accidental execution of backups on wrong machines
+  - Displayed in `info` command output
+- Comprehensive test coverage for hostname validation (6 new test cases)
+- Documentation for hostname feature in example config and README
+
+### Changed
+- `info` command now displays hostname when configured (global or per-repository)
+
+## [0.4.0] - 2025-10-06
+
+### Added
+- Borg executable validation: verifies `borg_path` points to actual Borg binary
+- bundler-audit integration for dependency vulnerability scanning
+- RuboCop with rubocop-rspec for code quality enforcement
+- Enhanced pruning logs showing retention mode (standard vs per-file)
+- Comprehensive development workflow documentation in CLAUDE.md
+- Example configuration file: `ruborg.yml.example`
+
+### Security
+- **CRITICAL**: Fixed remaining command injection vulnerabilities in repository.rb
+  - Replaced backtick execution with Open3.capture3 in `list_archives_with_metadata`
+  - Replaced backtick execution with Open3.capture3 in `get_file_mtime_from_archive`
+  - Replaced backtick execution with Open3.capture2e in `execute_version_command`
+- Added borg_path validation to prevent execution of arbitrary binaries
+- Removed unused `env_to_cmd_prefix` helper method (no longer needed with Open3)
+- Updated SECURITY.md with new security features and best practices
+- Added config file permission requirements (chmod 600) to documentation
+- Zero known vulnerabilities in dependencies (verified with bundler-audit)
+
+### Changed
+- All command execution now uses Open3 methods (no backticks anywhere)
+- Pruning logs now include retention mode details
+- Enhanced security documentation with detailed config file protection guidelines
+
 ## [0.3.1] - 2025-10-05
 
 ### Added

data/CLAUDE.md

@@ -1 +1,67 @@
-- ruborg is a ruby gem to perform backups using borg. it reads a configuration file in yaml and instructs borg about what to do. it is a friendly fornt end of borg in ruby. it can create and access backup repositories. it can take and recall backup files or directories. it can interract with passbolt through cli to access encryption passwords.
+# Ruborg Project
+
+## Overview
+Ruborg is a Ruby gem to perform backups using Borg. It reads a configuration file in YAML and instructs Borg about what to do. It is a friendly frontend of Borg in Ruby. It can create and access backup repositories. It can take and recall backup files or directories. It can interact with Passbolt through CLI to access encryption passwords.
+
+## Development Practices
+
+### Code Quality
+- **RuboCop**: Static code analyzer and formatter configured in `.rubocop.yml`
+  - Run: `bundle exec rubocop`
+  - Auto-fix: `bundle exec rubocop -a`
+  - Target: 0 offenses (currently achieved)
+
+- **RuboCop RSpec**: RSpec-specific linting rules
+  - Integrated with main RuboCop configuration
+  - Enforces consistent test patterns
+
+### Security
+- **bundler-audit**: Checks for known vulnerabilities in dependencies
+  - Update database: `bundle exec bundle-audit update`
+  - Check vulnerabilities: `bundle exec bundle-audit check`
+  - Run regularly as part of CI/CD and before releases
+
+- **Security Best Practices**:
+  - Use `YAML.safe_load_file` for configuration parsing
+  - Use `Open3.capture*` methods instead of backticks for command execution
+  - Validate and sanitize all user inputs (archive names, paths)
+  - Prevent path traversal with system directory blacklists
+  - Use array syntax for system calls to prevent shell injection
+
+### Testing
+- **RSpec**: Test framework for unit and integration tests
+  - Run all tests: `bundle exec rspec`
+  - Run with documentation: `bundle exec rspec --format documentation`
+  - Target: All tests passing (currently 124 examples, 0 failures)
+
+- **Test Coverage**:
+  - Unit tests for core classes (Repository, Backup, Config)
+  - Integration tests for end-to-end workflows
+  - Security tests for input validation and path handling
+
+### Development Workflow
+1. Make code changes
+2. Run tests: `bundle exec rspec`
+3. Run linter: `bundle exec rubocop`
+4. Check security: `bundle exec bundle-audit check`
+5. Commit changes with descriptive messages
+6. Open pull request for review
+
+### Project Structure
+- `lib/ruborg/` - Main source code
+  - `cli.rb` - Command-line interface (Thor)
+  - `repository.rb` - Borg repository management
+  - `backup.rb` - Backup operations
+  - `config.rb` - YAML configuration handling
+  - `passbolt.rb` - Passbolt integration
+  - `logger.rb` - Logging functionality
+- `spec/` - RSpec tests
+- `exe/` - Executable scripts
+
+### Key Features
+- **Multi-repository support**: Manage multiple backup repositories from a single config
+- **Per-file backup mode**: Back up each file as a separate archive with metadata-based retention
+- **Passbolt integration**: Retrieve encryption passphrases from Passbolt
+- **Auto-initialization**: Automatically create repositories if they don't exist
+- **Auto-pruning**: Automatically prune old backups based on retention policies
+- **Logging**: Comprehensive logging to file or stdout