secret-keeper 0.2.2 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 125a92be1b1a91a487b487a7ad5896a6944fa565
-  data.tar.gz: d2c860df86d3711ca1c1f475be655eb9c30c1306
+SHA256:
+  metadata.gz: a4af085b4a020f82a80ec5e4f2995fc676c6d24497b424ccfe5788d8fa83085b
+  data.tar.gz: 4f3c88876416d7dadf20f903338827b52c03ecb1799b5b31b823d5cd484e5513
 SHA512:
-  metadata.gz: 28eccb33926ba31c2e192faea7bc09ac460d2fbe5822c785f39ea63bd50f4653e29d6e2764a4a982668512834207a16f016570bea282d9dd8c993492e33ce9c4
-  data.tar.gz: d1639ce6af25d95ffcd11f76bd06d2daee2351f441ccb6690f173bbd1e49d9de5cf4110b5c450dbe32b82f3a72c61399969cc31a8351273b20db7ed502eb509e
+  metadata.gz: 40512c3536a8f2b8824f3d6fbf97df57e8381fb7d5f135ef3ac05771a6ca9b472e52aa1818e35d7699400b688f918b6f534895eef04ff359d4706f99bd24da37
+  data.tar.gz: 5aecafc7b60fb43bc34b46744b63761db551b44d428e7fcfdb8afd8ee74e157a51f43903f45e3f8bf925150975d5c80e999344cef824e81e01c3603591f2190e

data/README.md

@@ -13,7 +13,7 @@ with bundler, write follwing line in your Gemfile
     gem 'secret-keeper', require: false
 
 ## Usage
-1. setup files need to be encrypted in config/secret-keeper.yml
+setup files need to be encrypted in config/secret-keeper.yml
 
     # config/secret-keeper.yml example
     development:
@@ -31,29 +31,38 @@ with bundler, write follwing line in your Gemfile
           # decrypt_from: example/secrets.yml.enc
           decrypt_to: example/secrets.yml
 
-2. using environment variable SECRET_KEEPER to be your key of cipher
+using environment variable SECRET_KEEPER to be your key of cipher
 
     $> SECRET_KEEPER=[YOUR-CIPHER-KEY-HERE] irb
 
-3. require on demand
+require on demand
 
     irb> require 'secret-keeper'
 
-4. encrypt files based on your tasks defined in config/secret-keeper.yml
+encrypt files based on your tasks defined in config/secret-keeper.yml
 
     irb> SecretKeeper.encrypt_files
     # Encrypting...
     #   * example/database.yml --> example/database.yml.enc, ok
     #   * example/secrets.yml --> example/secrets.yml.enc, ok
-    # Over!
+    # Done!
 
-5. decrypt files based on your tasks defined in config/secret-keeper.yml
+decrypt files based on your tasks defined in config/secret-keeper.yml
 
     irb> SecretKeeper.decrypt_files
     # Decrypting...
     #   * example/database.yml.enc --> example/database.yml, ok
     #   * example/secrets.yml.enc --> example/secrets.yml, ok
-    # Over!
+    # Done!
+
+decrypt files and remove production configs
+
+    irb> production? = true
+    irb> SecretKeeper.decrypt_files(production?)
+    # Decrypting... (production config removed)
+    #   * example/database.yml.enc --> example/database.yml, ok
+    #   * example/secrets.yml.enc --> example/secrets.yml, ok
+    # Done!
 
 ## Available Ciphers
 

data/lib/secret-keeper.rb

@@ -4,7 +4,7 @@ require 'yaml'
 class SecretKeeper
   def self.encrypt_files
     sk = SecretKeeper.new
-    puts 'Encrypting...'
+    puts 'Encrypting...' unless sk.slience
     ok_queue = []
     sk.tasks.each do |task|
       from = task['encrypt_from']
@@ -12,27 +12,34 @@ class SecretKeeper
 
       result = sk.encrypt_file(from, to)
       ok_queue << result if result == :ok
-      puts "  * #{from} --> #{to}, #{result}"
+      puts "  * #{from} --> #{to}, #{result}" unless sk.slience
     end
     success = ok_queue.count == sk.tasks.count
-    puts success ? 'Done!' : 'Failed!'
+    puts success ? 'Done!' : 'Failed!' unless sk.slience
     success
   end
 
-  def self.decrypt_files
+  def self.decrypt_files(remove_production=false)
     sk = SecretKeeper.new
-    puts 'Decrypting...'
+    print 'Decrypting...' unless sk.slience
+    puts remove_production ? '(production config removed)' : nil unless sk.slience
+
     ok_queue = []
     sk.tasks.each do |task|
       from = task['decrypt_from'] || task['encrypt_to']
       to = task['decrypt_to'] || task['encrypt_from']
 
       result = sk.decrypt_file(from, to)
+
+      if result == :ok && remove_production
+        result = sk.remove_production_config(to)
+      end
+
       ok_queue << result if result == :ok
-      puts "  * #{from} --> #{to}, #{result}"
+      puts "  * #{from} --> #{to}, #{result}" unless sk.slience
     end
     success = ok_queue.count == sk.tasks.count
-    puts success ? 'Done!' : 'Failed!'
+    puts success ? 'Done!' : 'Failed!' unless sk.slience
     success
   end
 
@@ -42,17 +49,24 @@ class SecretKeeper
     fail 'config/secret-keeper.yml not existed nor not readable' if string.nil?
     config = YAML.load(string)[env]
     fail 'config/secret-keeper.yml incorrect or environment not exist' if config.nil?
-    @ev_name = config['ev_name'] || 'SECRET_KEEPER'
-    fail "environment variable #{@ev_name} not exist" if ENV[@ev_name].nil?
+    ev_name = config['ev_name'] || 'SECRET_KEEPER'
+    fail "environment variable #{ev_name} not exist" if ENV[ev_name].nil?
 
     @tasks = config['tasks']
-    @using_cipher = OpenSSL::Cipher.new(config['cipher'])
+    @using_cipher = OpenSSL::Cipher.new(config['cipher'] || 'AES-256-CBC')
+    @cipher_key = Digest::SHA2.hexdigest(ENV[ev_name])[0...@using_cipher.key_len]
+
+    @slience = config['slience'] || false
   end
 
   def tasks
     @tasks
   end
 
+  def slience
+    @slience
+  end
+
   def encrypt_file(from_file, to_file)
     encrypted = File.open(from_file, 'rb') { |f| encrypt(f.read) }
     File.open(to_file, 'w:ASCII-8BIT') { |f| f.write(encrypted) }
@@ -63,7 +77,17 @@ class SecretKeeper
 
   def decrypt_file(from_file, to_file)
     decrypted = File.open(from_file, 'rb') { |f| decrypt(f.read) }
-    File.open(to_file, 'w') { |f| f.write(decrypted) }
+    File.open(to_file, 'w') { |f| f.write(decrypted.force_encoding('UTF-8')) }
+    :ok
+  rescue => e
+    e
+  end
+
+  def remove_production_config(file_path)
+    return :ok unless file_path =~ /\.yml/
+    hash = YAML.load_file(file_path)
+    hash.delete('production')
+    File.write(file_path, YAML.dump(hash))
     :ok
   rescue => e
     e
@@ -73,13 +97,13 @@ class SecretKeeper
 
   def encrypt(data)
     cipher = @using_cipher.encrypt
-    cipher.key = Digest::SHA2.hexdigest(ENV[@ev_name])[0..(cipher.key_len-1)]
+    cipher.key = @cipher_key
     cipher.update(data) + cipher.final
   end
 
   def decrypt(data)
     cipher = @using_cipher.decrypt
-    cipher.key = Digest::SHA2.hexdigest(ENV[@ev_name])[0..(cipher.key_len-1)]
+    cipher.key = @cipher_key
     cipher.update(data) + cipher.final
   end
 end

data/spec/secret-keeper_spec.rb

@@ -14,6 +14,17 @@ describe SecretKeeper do
     it 'should return true' do
       result = SecretKeeper.decrypt_files
       expect(result).to eq(true)
+      hash = YAML.load_file('example/secrets.yml')
+      expect(hash['development']['secret_key_base']).to eq('e8310af93d52f174f475940c41fbfb90417b300ebc19e1b24bd5639f4fe35c5ffaa5775a347ace9732958f656a47f6bb8e1fd0760b12e51b0b4fe1f65ef0a1d6')
+      expect(hash['production']['secret_key_base']).to eq('339f639f4fe35c5ffaa47ace973260b12e51b0b4fe1f65effd283a5f054f47594b24bd565779e351a20dfd4ada4f777958f0417b305c06cdedbde392b8e1fd07')
+    end
+
+    it 'should return true on remove_production true' do
+      result = SecretKeeper.decrypt_files(ENV['RAILS_ENV'] != 'production')
+      expect(result).to eq(true)
+      hash = YAML.load_file('example/secrets.yml')
+      expect(hash['development']['secret_key_base']).to eq('e8310af93d52f174f475940c41fbfb90417b300ebc19e1b24bd5639f4fe35c5ffaa5775a347ace9732958f656a47f6bb8e1fd0760b12e51b0b4fe1f65ef0a1d6')
+      expect(hash['production']).to be_nil
     end
 
     it 'should be false, if SECRET_KEEPER incorrect' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secret-keeper
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 1.0.0
 platform: ruby
 authors:
 - Ray Lee
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-13 00:00:00.000000000 Z
+date: 2021-02-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -34,7 +34,7 @@ files:
 - README.md
 - lib/secret-keeper.rb
 - spec/secret-keeper_spec.rb
-homepage: https://gitlab.com/ray-lee/secret-keeper
+homepage: https://github.com/kdan-mobile-software-ltd/secret-keeper
 licenses:
 - MIT
 metadata: {}
@@ -54,8 +54,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Keep all your secret files within openssl