secret_keys 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 637787c84aaeb9fc38f77ac00f67f38ee4094b0a42ac5fe714a9c10285c65ed7
-  data.tar.gz: c57ed55617d13bee4d988d9c0283fff89534ccddd7980f8fa1afe81b5b7b61a4
+  metadata.gz: fd54d07d04fbd4695a6896fec897ee82171f27e10778aa59247dc2c216511149
+  data.tar.gz: 6faeb6462cce486f5f4e27619fe3e88e7f1587a1a51949821166ee3359419a0f
 SHA512:
-  metadata.gz: bfb75203d78bfe74c6c394175cd08a775f3f9415d206f60df941c77ab38c74413cf4e2854a2af3c0208e1e580d0dc3e35f70fd2b59c1d7cd4a7d215a53441efd
-  data.tar.gz: b9b1e6ee2be772b78fe9da0ed4768455ce6249e12ff37b6328b9bc197c4ded8638764810a1a23ffcc1820bcfb696f0ed3723b61cdb6af116723e0030068f988a
+  metadata.gz: e509e3f5b8fb49e5c7859f18cd73a620ca89d95c0e82631cdb40bf77366d5dba131107d09d2057236d8e44982a6a232497c799e5723727968b37f6c88f253d13
+  data.tar.gz: 772f82950d3efe42d597bc6918f10f8ed2664d6b5738a9af0bb8767fb59b8212a0420a88a5169ad35972600936aace607323921b9bdf80dedf0b66669a7c6e22

data/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 1.0.3
+
+### Fixed
+
+- Files are now written atomically (write to a temporary file and rename) so a crash or concurrent reader can never see a partially written secrets file. The mode of an existing file is preserved.
+- New secrets files are now created readable and writable only by the owner (mode 0600) instead of relying on the process umask. The mode of an existing file is still preserved.
+- `secret_keys init` now uses an exclusive file create so it can no longer overwrite a file created between the existence check and the write.
+- `SecretKeys#save` no longer raises `ArgumentError` when passed a `Pathname`.
+- An unsupported `.version` value that is a string now raises `SecretKeys::VersionError` instead of a comparison `ArgumentError`; numeric strings like `"1"` are accepted.
+- Input that does not parse to a Hash now raises a clear `ArgumentError` instead of failing with confusing errors; input that parses to nothing (e.g. only comments) loads as an empty document.
+- A non-Hash value in the `.encrypted` key now raises a clear `ArgumentError`.
+- `SecretKeys#encryption_key=` now raises `SecretKeys::EncryptionKeyError` when given a nil or empty key instead of silently keeping the old key.
+- The `--secret-key-file` CLI option now reports a missing file as a clean error instead of an unhandled `Errno::ENOENT`.
+
+## 1.0.2
+
+### Changed
+
+- Follow [RFC 4648](https://www.ietf.org/rfc/rfc4648.txt) base 64 encoding, removing line-feeds from the encoded data.
+
+## 1.0.1 (June 01, 2020)
+
+### Fixed
+
+- Fix missing documentation links
+
+## v1.0.0 (May 31, 2020)
+
+### Added
+
+- Initial release

data/README.md

@@ -1,8 +1,10 @@
-# SecretKeys
+# Secret Keys
 
-[![specs](https://github.com/bdurand/secret_keys/workflows/Run%20tests/badge.svg)](https://github.com/bdurand/secret_keys/actions?query=branch%3Amaster)
-[![code style](https://img.shields.io/badge/code_style-standard-brightgreen.svg)](https://github.com/testdouble/standard)
+[![Continuous Integration](https://github.com/bdurand/secret_keys/actions/workflows/continuous_integration.yml/badge.svg)](https://github.com/bdurand/secret_keys/actions/workflows/continuous_integration.yml)
+[![Regression Test](https://github.com/bdurand/secret_keys/actions/workflows/regression_test.yml/badge.svg)](https://github.com/bdurand/secret_keys/actions/workflows/regression_test.yml)
+[![Ruby Style Guide](https://img.shields.io/badge/code_style-standard-brightgreen.svg)](https://github.com/testdouble/standard)
 [![gem version](https://badge.fury.io/rb/secret_keys.svg)](https://badge.fury.io/rb/secret_keys)
+[![Gem Version](https://badge.fury.io/rb/secret_keys.svg)](https://badge.fury.io/rb/secret_keys)
 
 This ruby gem handles encrypting values in a JSON or YAML file. It is yet another solution for storing secrets in a ruby project.
 

data/VERSION

@@ -1 +1 @@
-1.0.2
+1.0.3

data/lib/secret_keys/cli.rb

@@ -78,6 +78,7 @@ module SecretKeys::CLI
         HELP
         opts.on("--secret-key-file=PATH", String, *secret_file_docs) do |value|
           raise ArgumentError, "You have already passed in the secret key" unless @secret_key.nil?
+          raise ArgumentError, "Secret key file '#{value}' does not exist" unless File.exist?(value)
           @secret_key = File.read(value).chomp
         end
 
@@ -165,13 +166,19 @@ module SecretKeys::CLI
     def run!
       @secrets = SecretKeys.new({}, secret_key)
       if input.is_a?(String)
-        if File.exist?(input)
+        contents = encrypted_file_contents
+        begin
+          # Open with exclusive create so a file created by another process
+          # between now and the write can never be clobbered. The file is
+          # created readable and writable only by the owner.
+          File.open(input, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |file|
+            file.write(contents)
+          end
+        rescue Errno::EEXIST
           warn "Error: Cannot init preexisting file '#{input}'"
           warn "You may want to try calling `secret_keys encrypt/edit` instead"
           exit 1
         end
-
-        File.write(input, encrypted_file_contents)
       else
         $stdout.write(encrypted_file_contents)
       end
@@ -220,7 +227,7 @@ module SecretKeys::CLI
         raise ArgumentError, "Cannot perform in place editing on streams" unless @input.is_a?(String)
         # make sure we read the file **before** writing to it.
         contents = encrypted_file_contents
-        File.write(@input, contents)
+        SecretKeys.atomic_write(@input, contents)
       else
         $stdout.write(encrypted_file_contents)
         $stdout.flush

data/lib/secret_keys/encryptor.rb

@@ -21,8 +21,8 @@ class SecretKeys::Encryptor
   class << self
     # Create an Encryptor from a password and salt. This is a shortcut for generating an Encryptor
     # with a 32 byte encryption key. The key will be derived from the password and salt.
-    # @param [String] password secret used to encrypt the data
-    # @param [String] salt random hex-encoded byte array for key derivation
+    # @param password [String] secret used to encrypt the data
+    # @param salt [String] random hex-encoded byte array for key derivation
     # @return [SecretKeys::Encryptor] a new encryptor with key derived from password and salt
     def from_password(password, salt)
       raise ArgumentError, "Password must be present" if password.nil? || password.empty?
@@ -55,7 +55,7 @@ class SecretKeys::Encryptor
     end
   end
 
-  # @param [String] raw_key the key directly passed into the encrypt/decrypt functions. This must be exactly {KEY_LENGTH} bytes long.
+  # @param raw_key [String] the key directly passed into the encrypt/decrypt functions. This must be exactly {KEY_LENGTH} bytes long.
   def initialize(raw_key)
     raise ArgumentError, "key must be #{KEY_LENGTH} bytes long" unless raw_key.bytesize == KEY_LENGTH
     @derived_key = raw_key
@@ -65,7 +65,7 @@ class SecretKeys::Encryptor
   # calling this function multiple times will result in different values. Only strings
   # can be encrypted. Any other object type will be return the value passed in.
   #
-  # @param [String] str string to encrypt (assumes UTF-8)
+  # @param str [String] string to encrypt (assumes UTF-8)
   # @return [String] Base64 encoded encrypted string with all aes parameters
   def encrypt(str)
     return str unless str.is_a?(String)
@@ -96,13 +96,13 @@ class SecretKeys::Encryptor
   # Decrypt a string with the encryption key. If the value is not a string or it was
   # not encrypted with the encryption key, the value itself will be returned.
   #
-  # @param [String] encrypted_str Base64 encoded encrypted string with aes params (from {#encrypt})
+  # @param encrypted_str [String] Base64 encoded encrypted string with aes params (from {#encrypt})
   # @return [String] decrypted string value
   # @raise [OpenSSL::Cipher::CipherError] there is something wrong with the encoded data (usually incorrect key)
   def decrypt(encrypted_str)
     return encrypted_str unless self.class.encrypted?(encrypted_str)
 
-    decrypt_str = encrypted_str[ENCRYPTED_PREFIX.length..-1]
+    decrypt_str = encrypted_str[ENCRYPTED_PREFIX.length..]
     params = decode_aes(decrypt_str)
 
     cipher = OpenSSL::Cipher.new(CIPHER).decrypt

data/lib/secret_keys.rb

@@ -15,13 +15,42 @@ class SecretKeys < DelegateClass(Hash)
   # Error if the crypto version specified in the file is unsupported
   class VersionError < StandardError; end
 
+  # Write a file atomically by writing to a temporary file in the same directory and
+  # renaming it over the target path so that readers never see a partially written file.
+  # The mode of an existing file at the path will be preserved. New files are created
+  # readable and writable only by the owner.
+  #
+  # @api private
+  # @param path [String, Pathname] path of the file to write
+  # @param content [String] contents of the file
+  # @return [void]
+  def self.atomic_write(path, content)
+    path = File.expand_path(path.to_s)
+    mode = begin
+      File.stat(path).mode & 0o7777
+    rescue Errno::ENOENT
+      0o600
+    end
+    tmp_path = File.join(File.dirname(path), ".#{File.basename(path)}.tmp.#{Process.pid}.#{rand(1_000_000)}")
+    begin
+      File.open(tmp_path, "w") do |file| # rubocop:disable Style/FileWrite
+        file.write(content)
+      end
+      File.chmod(mode, tmp_path)
+      File.rename(tmp_path, path)
+    ensure
+      File.unlink(tmp_path) if File.exist?(tmp_path)
+    end
+    nil
+  end
+
   # Parse a JSON or YAML stream or file with encrypted values. Any values in the ".encrypted" key
   # in the document will be decrypted with the provided encryption key. If values
   # were put into the ".encrypted" key manually and are not yet encrypted, they will be used
   # as is without any decryption.
   #
-  # @param [String, #read, Hash] path_or_stream path to a JSON/YAML file to load, an IO object, or a Hash (mostly for testing purposes)
-  # @param [String] encryption_key secret to use for encryption/decryption
+  # @param path_or_stream [String, #read, Hash] path to a JSON/YAML file to load, an IO object, or a Hash (mostly for testing purposes)
+  # @param encryption_key [String] secret to use for encryption/decryption
   #
   # @note If no encryption key is passed, this will defautl to env var SECRET_KEYS_ENCRYPTION_KEY
   # or (if that is empty) the value read from the file path in SECRET_KEYS_ENCRYPTION_KEY_FILE.
@@ -48,7 +77,7 @@ class SecretKeys < DelegateClass(Hash)
 
   # Mark the key as being encrypted when the JSON is saved.
   #
-  # @param [String] key key to mark as needing encryption
+  # @param key [String] key to mark as needing encryption
   # @return [void]
   def encrypt!(key)
     @secret_keys << key
@@ -57,7 +86,7 @@ class SecretKeys < DelegateClass(Hash)
 
   # Mark the key as no longer being decrypted when the JSON is saved.
   #
-  # @param [String] key key to mark as not needing encryption
+  # @param key [String] key to mark as not needing encryption
   # @return [void]
   def decrypt!(key)
     @secret_keys.delete(key)
@@ -66,7 +95,7 @@ class SecretKeys < DelegateClass(Hash)
 
   # Return true if the key is encrypted.
   #
-  # @param [String] key key to check
+  # @param key [String] key to check
   # @return [Boolean]
   def encrypted?(key)
     @secret_keys.include?(key)
@@ -77,8 +106,8 @@ class SecretKeys < DelegateClass(Hash)
   # different initialization vector). This can be helpful if you have your secrets in source
   # control so that only changed keys will actually be changed in the file when it is updated.
   #
-  # @param [String, Pathname] path path of the file to save. If the file exists, only changed values will be updated.
-  # @param [String, Symbol] format: output format (YAML or JSON) to use. This will default based on the extension on the file path or the format originally used
+  # @param path [String, Pathname] path of the file to save. If the file exists, only changed values will be updated.
+  # @param format [String, Symbol] output format (YAML or JSON) to use. This will default based on the extension on the file path or the format originally used
   # @return [void]
   def save(path, format: nil)
     # create a copy of the encrypted hash for working on
@@ -96,7 +125,7 @@ class SecretKeys < DelegateClass(Hash)
 
     output = ((format == "yaml") ? YAML.dump(encrypted) : JSON.pretty_generate(encrypted))
     output << $/ unless output.end_with?($/) # ensure file ends with system dependent new line
-    File.write(path, output)
+    self.class.atomic_write(path, output)
     nil
   end
 
@@ -131,9 +160,10 @@ class SecretKeys < DelegateClass(Hash)
 
   # Change the encryption key in the document. When saving later, this key will be used.
   #
-  # @param [String] new_encryption_key encryption key to use for future {#save} calls
+  # @param new_encryption_key [String] encryption key to use for future {#save} calls
   # @return [void]
   def encryption_key=(new_encryption_key)
+    raise EncryptionKeyError.new("Encryption key not specified") if new_encryption_key.nil? || new_encryption_key.empty?
     @original_encrypted = {}
     update_secret(key: new_encryption_key)
   end
@@ -166,10 +196,10 @@ class SecretKeys < DelegateClass(Hash)
 
     hash = {}
     if path_or_stream.is_a?(Hash)
-      # HACK: Perform a marshal dump/load operation to get a deep copy of the hash.
-      #       Otherwise, we can end up using destructive `#delete` operations and mess
-      #       up deeply nested values for external code (esp. when loading key: .encrypted)
-      hash = Marshal.load(Marshal.dump(path_or_stream))
+      # Deep copy the hash. Otherwise, we can end up using destructive `#delete`
+      # operations and mess up deeply nested values for external code
+      # (esp. when loading key: .encrypted)
+      hash = deep_dup(path_or_stream)
     elsif path_or_stream
       data = path_or_stream.read
       hash = parse_data(data)
@@ -177,20 +207,31 @@ class SecretKeys < DelegateClass(Hash)
 
     encrypted_values = hash.delete(ENCRYPTED)
     if encrypted_values
-      @original_encrypted = Marshal.load(Marshal.dump(encrypted_values))
+      raise ArgumentError, "The #{ENCRYPTED} key must contain a Hash of encrypted values" unless encrypted_values.is_a?(Hash)
+
+      @original_encrypted = deep_dup(encrypted_values)
 
       version = encrypted_values.delete(VERSION_KEY) || CRYPTO_VERSION
-      raise VersionError, "Unsupported file version #{version}. Max supported is #{CRYPTO_VERSION}." if version > CRYPTO_VERSION
+      if version.is_a?(String)
+        version = begin
+          Integer(version, 10)
+        rescue ArgumentError
+          version
+        end
+      end
+      unless version.is_a?(Numeric) && version <= CRYPTO_VERSION
+        raise VersionError, "Unsupported file version #{version}. Max supported is #{CRYPTO_VERSION}."
+      end
 
       file_key = encrypted_values.delete(ENCRYPTION_KEY)
-      salt = (encrypted_values.delete(SALT) || Encryptor.random_salt)
+      salt = encrypted_values.delete(SALT) || Encryptor.random_salt
       update_secret(salt: salt)
 
       # Check that we are using the right key
       if file_key && !encryption_key_matches?(file_key)
         raise EncryptionKeyError.new("Incorrect encryption key")
       end
-      @secret_keys = encrypted_values.keys
+      @secret_keys = Set.new(encrypted_values.keys)
       hash.merge!(decrypt_values(encrypted_values))
     elsif @salt.nil?
       # if no salt exists, create one.
@@ -201,15 +242,38 @@ class SecretKeys < DelegateClass(Hash)
   end
 
   # Attempt to parse the file first using JSON and fallback to YAML
-  # @param [String] data file data to parse
+  # @param data [String] file data to parse
   # @return [Hash] data parsed to a hash
   def parse_data(data)
     @format = :json
     return {} if data.nil? || data.empty?
-    JSON.parse(data)
-  rescue JSON::JSONError
-    @format = :yaml
-    YAML.safe_load(data)
+    hash = begin
+      JSON.parse(data)
+    rescue JSON::JSONError
+      @format = :yaml
+      YAML.safe_load(data)
+    end
+    # YAML.safe_load returns false instead of nil for empty documents on Ruby < 3.4.
+    return {} if hash.nil? || hash == false
+    raise ArgumentError, "Data must parse to a Hash of key value pairs" unless hash.is_a?(Hash)
+    hash
+  end
+
+  # Deep copy a parsed data structure of hashes, arrays, and scalar values.
+  def deep_dup(value)
+    if value.is_a?(Hash)
+      copy = {}
+      value.each do |key, val|
+        copy[deep_dup(key)] = deep_dup(val)
+      end
+      copy
+    elsif value.is_a?(Array)
+      value.collect { |val| deep_dup(val) }
+    elsif value.is_a?(String)
+      value.dup
+    else
+      value
+    end
   end
 
   # Recursively encrypt all values.
@@ -263,23 +327,6 @@ class SecretKeys < DelegateClass(Hash)
     @encryptor.decrypt(encrypted_value)
   end
 
-  # Helper method to test if two values are both encrypted, but result in the same decrypted value.
-  def equal_encrypted_values?(value_1, value_2)
-    return true if value_1 == value_2
-
-    decrypt_val_1 = decrypt_value(value_1)
-    decrypt_val_2 = decrypt_value(value_2)
-    if decrypt_val_1 == decrypt_val_2
-      if value_1 == decrypt_val_1 || value_2 == decrypt_val_2
-        false
-      else
-        true
-      end
-    else
-      false
-    end
-  end
-
   # This is an encrypted known value that can be used determine if the secret has changed.
   def encrypted_known_value
     encrypt_value(KNOWN_VALUE)
@@ -294,13 +341,12 @@ class SecretKeys < DelegateClass(Hash)
   end
 
   def yaml_file?(path)
-    ext = path.split(".").last.to_s.downcase
-    ext == "yaml" || ext == "yml"
+    ext = File.extname(path.to_s).downcase
+    ext == ".yaml" || ext == ".yml"
   end
 
   def json_file?(path)
-    ext = path.split(".").last.to_s.downcase
-    ext == "json"
+    File.extname(path.to_s).downcase == ".json"
   end
 
   # Update the secret key by updating the salt

data/secret_keys.gemspec

@@ -7,9 +7,12 @@ Gem::Specification.new do |spec|
   spec.summary = "Simple mechanism for loading JSON file with encrypted values."
   spec.homepage = "https://github.com/bdurand/secret_keys"
   spec.license = "MIT"
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = "https://github.com/bdurand/secret_keys/tree/v#{spec.version}"
-  spec.metadata["documentation_uri"] = "https://www.rubydoc.info/gems/secret_keys"
+
+  spec.metadata = {
+    "homepage_uri" => spec.homepage,
+    "source_code_uri" => spec.homepage,
+    "changelog_uri" => "#{spec.homepage}/blob/main/CHANGELOG.md"
+  }
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
@@ -17,6 +20,7 @@ Gem::Specification.new do |spec|
     .
     Appraisals
     Gemfile
+    Gemfile.lock
     Rakefile
     gemfiles/
     spec/
@@ -29,7 +33,7 @@ Gem::Specification.new do |spec|
   spec.bindir = "bin"
   spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
 
-  spec.required_ruby_version = ">= 2.4"
+  spec.required_ruby_version = ">= 2.6"
 
-  spec.add_development_dependency "bundler", "~>2.0"
+  spec.add_development_dependency "bundler"
 end

metadata

@@ -1,31 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: secret_keys
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Brian Durand
 - Winston Durand
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-04 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
-description:
+        version: '0'
 email:
 - bbdurand@gmail.com
 - me@winstondurand.com
@@ -34,7 +32,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- CHANGE_LOG.md
+- CHANGELOG.md
 - MIT_LICENSE.txt
 - README.md
 - VERSION
@@ -49,9 +47,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/bdurand/secret_keys
-  source_code_uri: https://github.com/bdurand/secret_keys/tree/v1.0.2
-  documentation_uri: https://www.rubydoc.info/gems/secret_keys
-post_install_message:
+  source_code_uri: https://github.com/bdurand/secret_keys
+  changelog_uri: https://github.com/bdurand/secret_keys/blob/main/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -59,15 +56,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.22
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Simple mechanism for loading JSON file with encrypted values.
 test_files: []

data/CHANGE_LOG.md

@@ -1,22 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [1.0.2] - 2023-04-04
-
-- Follow [RFC 4648](https://www.ietf.org/rfc/rfc4648.txt) base 64 encoding, removing line-feeds from the encoded data.
-
-## [1.0.1] - 2020-06-01
-
-### Fixed
-
-- Fix missing documentation links
-
-## [1.0.0] 2020-05-31
-
-### Added
-
-- Initial release