secure_db_fields 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31ac55f3c53d7f1c6755f96f294cceacbc6f972891b46e809c1e4cc8222f5615
-  data.tar.gz: 2e918c0bbdffc6d95a60c6eb39e7c8f2a3345939e71c2d6d85c9745139cccb92
+  metadata.gz: '069dd6143d3148a6257bae40ed42db39bfd44658e8bb416f2aa02ee3b4d72017'
+  data.tar.gz: 000657ed15f6e5f7ba0f6da4d1bd2a9a026981236f0a4f42a52a735d7b2318c5
 SHA512:
-  metadata.gz: a872b172252d8df672af874f3dbacad680951fe6a178f428e4e7cad399a2d8b31d8bb62c9d5138ea354b26841b2e98b8c2e6a2c43fd37685d2bb4ee24b808727
-  data.tar.gz: efcdc09a8877b2a790b991a6f55bd399df7c29babc811ff1d10da8b5f0e2eaa584cd85dc3056798e68c69cd84852253f0c8dbff53647ba7e32a79f3e4b6191cf
+  metadata.gz: 40f26a4ba2d838e85f5076f7a61326b182b3f35b73b8c354304449f47a8c7b87a2ee2869d08503d2f5f8a595dcf838e78f27ba66d3b0d58b8432c12c834451eb
+  data.tar.gz: 0db619099f71e3795886b7e6d694690079ef7deac98c6b1b5f7d6a8e5b321b559302564169d61377c1c891c5634659a447f924c7d75874198d103cad504822be

data/README.md

@@ -82,7 +82,7 @@ make enable
 make status
 ```
 
-Keys are intentionally not included in the archive. Provision `/etc/secure_db_fields/keys.env` on the DB host before using decrypt/search UDFs.
+The command creates or reuses `config/secure_db_fields/keys.env` and includes that same key contract in the DBA archive. `make install` installs it on the DB host as `/etc/secure_db_fields/keys.env`, so the application and MySQL use the same keys without manual HEX copying.
 
 Readable view SQL can be generated from the application side as well:
 

data/db_deployment/mysql/README.md

@@ -6,18 +6,17 @@ This archive is produced on an application host with:
 secure_db_fields db package mysql --output secure_db_fields-mysql.tar.gz --force
 ```
 
-Copy the archive to the MySQL 5.7 host, extract it, then run:
+The archive contains the MySQL UDF source and the same `keys.env` contract used by the application. Copy the archive to the MySQL 5.7 host, extract it, then run:
 
 ```bash
 make verify
-make doctor
-sudo make install
-make enable
-make status
+make doctor MYSQL_DEFAULTS_FILE=/root/secure-db-fields-mysql.cnf MYSQL_SOCKET=/run/mysqld/mysqld.sock
+make install MYSQL_DEFAULTS_FILE=/root/secure-db-fields-mysql.cnf MYSQL_SOCKET=/run/mysqld/mysqld.sock
+make enable MYSQL_DEFAULTS_FILE=/root/secure-db-fields-mysql.cnf MYSQL_SOCKET=/run/mysqld/mysqld.sock
+make status MYSQL_DEFAULTS_FILE=/root/secure-db-fields-mysql.cnf MYSQL_SOCKET=/run/mysqld/mysqld.sock
 ```
 
-Keys are not included in this archive. The DBA must provision `/etc/secure_db_fields/keys.env`
-(or set `SECURE_DB_FIELDS_KEY_FILE` for mysqld) before using decrypt/search UDFs.
+`make install` installs `etc/secure_db_fields/keys.env` from this bundle to `/etc/secure_db_fields/keys.env` with `0640 root:mysql` permissions.
 
 Installed SQL functions:
 

data/db_deployment/mysql/bin/common

@@ -12,6 +12,7 @@ SDF_UDF_NAMES=(
   secure_phone_prefix_bidx
 )
 SDF_KEY_FILE="${SECURE_DB_FIELDS_KEY_FILE:-/etc/secure_db_fields/keys.env}"
+SDF_BUNDLED_KEY_FILE="$ROOT/etc/secure_db_fields/keys.env"
 
 sdf_die() {
   echo "secure_db_fields mysql: $*" >&2
@@ -156,6 +157,14 @@ sdf_smoke_check() {
   esac
 }
 
+sdf_key_smoke_check() {
+  local digest
+  digest="$(sdf_query "SELECT HEX(secure_phone_bidx('+77771234567'));" | tr -d '\r\n')"
+  if ! printf '%s' "$digest" | grep -Eq '^[0-9A-F]{64}$'; then
+    sdf_die "key smoke check failed; secure_phone_bidx returned ${digest:-empty}"
+  fi
+}
+
 sdf_library_checksum() {
   local library="$1"
   if [ ! -f "$library" ]; then
@@ -180,16 +189,30 @@ sdf_check_key_file_permissions() {
   fi
 }
 
+sdf_validate_key_file_values() {
+  local file="${1:-$SDF_KEY_FILE}"
+  grep -Eq '^SDF_ACTIVE_KEY_ID=[1-9][0-9]*$' "$file" || sdf_die "key file missing SDF_ACTIVE_KEY_ID: $file"
+  if ! grep -Eq '^SDF_ENC_KEY_1_HEX=[0-9a-fA-F]{64}$|^SDF_ENC_KEY_HEX=[0-9a-fA-F]{64}$' "$file"; then
+    sdf_die "key file missing SDF_ENC_KEY_1_HEX or SDF_ENC_KEY_HEX: $file"
+  fi
+  grep -Eq '^SDF_BIDX_KEY_HEX=[0-9a-fA-F]{64}$' "$file" || sdf_die "key file missing SDF_BIDX_KEY_HEX: $file"
+  grep -Eq '^SDF_BIDX_PHONE_KEY_HEX=[0-9a-fA-F]{64}$' "$file" || sdf_die "key file missing SDF_BIDX_PHONE_KEY_HEX: $file"
+  grep -Eq '^SDF_BIDX_PHONE_P7_KEY_HEX=[0-9a-fA-F]{64}$' "$file" || sdf_die "key file missing SDF_BIDX_PHONE_P7_KEY_HEX: $file"
+}
+
 sdf_prepare_key_file() {
   local dir
   dir="$(dirname "$SDF_KEY_FILE")"
   install -d -m 0750 -o root -g mysql "$dir"
-  if [ ! -e "$SDF_KEY_FILE" ]; then
-    install -m 0640 -o root -g mysql /dev/null "$SDF_KEY_FILE"
+  if [ -f "$SDF_BUNDLED_KEY_FILE" ]; then
+    install -m 0640 -o root -g mysql "$SDF_BUNDLED_KEY_FILE" "$SDF_KEY_FILE"
+  elif [ ! -e "$SDF_KEY_FILE" ]; then
+    sdf_die "key file is missing and bundle does not contain $SDF_BUNDLED_KEY_FILE"
   fi
   chown root:mysql "$SDF_KEY_FILE"
   chmod 0640 "$SDF_KEY_FILE"
   sdf_check_key_file_permissions "$SDF_KEY_FILE"
+  sdf_validate_key_file_values "$SDF_KEY_FILE"
 }
 
 sdf_build_udf() {

data/db_deployment/mysql/bin/enable

@@ -42,12 +42,14 @@ if sdf_state_is_clean_absent; then
   sdf_read_udf_state
   sdf_state_is_clean_enabled || sdf_die 'registration did not create the expected UDF state'
   sdf_smoke_check
+  sdf_key_smoke_check
   echo 'SecureDBFields MySQL UDFs are enabled. Apply generated admin-view SQL separately.'
   exit 0
 fi
 
 if sdf_state_is_clean_enabled; then
   sdf_smoke_check
+  sdf_key_smoke_check
   echo 'SecureDBFields MySQL UDFs are already enabled; no changes made.'
   exit 0
 fi

data/db_deployment/mysql/bin/status

@@ -1,11 +1,55 @@
 #!/usr/bin/env bash
 set -euo pipefail
-source "$(dirname "$0")/common"
 
-printf 'plugin_dir=%s\n' "$(plugin_dir)"
-printf 'registered_functions=%s\n' "$(function_count)"
-if mysql_cmd -e 'SELECT secure_db_fields_version() AS version;' >/dev/null 2>&1; then
-  mysql_cmd -e 'SELECT secure_db_fields_version() AS version;'
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MYSQL="${MYSQL:-mysql}"
+DEFAULTS_FILE=""
+MYSQL_SOCKET="${MYSQL_SOCKET:-}"
+
+usage() {
+  cat <<'TEXT'
+Usage: MYSQL_SOCKET=/run/mysqld/mysqld.sock ./bin/status [--mysql PATH] [--defaults-extra-file PATH]
+TEXT
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --mysql)
+      [ "$#" -ge 2 ] || { echo '--mysql requires a path' >&2; exit 2; }
+      MYSQL="$2"; shift 2 ;;
+    --defaults-extra-file)
+      [ "$#" -ge 2 ] || { echo '--defaults-extra-file requires a path' >&2; exit 2; }
+      DEFAULTS_FILE="$2"; shift 2 ;;
+    --help|-h)
+      usage; exit 0 ;;
+    *)
+      echo "secure_db_fields mysql status: unknown option: $1" >&2; exit 2 ;;
+  esac
+done
+
+source "$ROOT/bin/common"
+sdf_resolve_mysql
+sdf_mysql_args
+sdf_require_mysql57
+sdf_read_udf_state
+
+plugin_dir="$(sdf_plugin_dir)"
+printf 'plugin_dir=%s\n' "$plugin_dir"
+printf 'registered_functions=%s\n' "$SDF_EXPECTED_OWNED"
+
+if sdf_state_is_clean_enabled; then
+  echo 'state=enabled'
+  sdf_smoke_check
+  if sdf_key_smoke_check >/dev/null 2>&1; then
+    echo 'key_smoke=ok'
+  else
+    echo 'key_smoke=failed'
+  fi
+  sdf_query 'SELECT secure_db_fields_version();'
+elif sdf_state_is_clean_absent; then
+  echo 'state=disabled'
 else
-  echo 'secure_db_fields_version() is not enabled'
+  echo 'state=partial_or_conflicting'
+  printf '%s\n' "${SDF_REGISTERED_ROWS[@]}"
+  exit 2
 fi

data/docs/implementation_notes.md

@@ -60,4 +60,4 @@ The Ruby extension has separate scalar and batch paths:
 - Ruby encrypt/decrypt paths allocate the destination Ruby String first and call
   `sdf_*_aes_256_gcm_into`, avoiding native `malloc -> rb_str_new copy -> free`.
 
-The version remains `0.1.1`; these are implementation-level hot-path optimizations.
+The hot-path notes below describe the 0.1.1 implementation-level optimizations. Version 0.1.2 adds the DBA bundle key-contract flow without changing the envelope format.

data/exe/secure_db_fields

@@ -35,12 +35,13 @@ module SecureDBFields
       <<~TEXT
         Usage:
           secure_db_fields --version
-          secure_db_fields db package mysql [--output PATH] [--force]
+          secure_db_fields db package mysql [--output PATH] [--keys PATH] [--force]
           secure_db_fields db view mysql --table DB.TABLE --field NAME:ENC_COLUMN \\
             --uid-column secure_row_uid --view DB.VIEW --columns ID,CREATED_AT [--output PATH]
 
-        `db package mysql` creates a DBA handoff archive. Extract it on the MySQL 5.7
-        host and run `make doctor`, `sudo make install`, `make enable`, `make status`.
+        `db package mysql` creates a DBA handoff archive containing the shared
+        key contract used by the application. Extract it on the MySQL 5.7 host
+        and run `make doctor`, `make install`, `make enable`, `make status`.
       TEXT
     end
   end

data/ext/secure_db_fields/secure_db_fields_core.h

@@ -9,7 +9,7 @@
 #endif
 #include <openssl/sha.h>
 
-#define SDF_VERSION "0.1.1"
+#define SDF_VERSION "0.1.2"
 
 #define SDF_MAGIC            "MCEN"
 #define SDF_MAGIC_LEN        4

data/lib/secure_db_fields/db_deployment.rb

@@ -13,7 +13,7 @@ require_relative "version"
 module SecureDBFields
   module DBDeployment
     ROOT = File.expand_path("../..", __dir__)
-    BUNDLE_FORMAT_VERSION = 1
+    BUNDLE_FORMAT_VERSION = 2
     MYSQL_TARGET = "mysql"
 
     class Error < StandardError; end
@@ -49,15 +49,15 @@ module SecureDBFields
       def help
         <<~TEXT
           Usage:
-            secure_db_fields db package mysql [--output PATH] [--force]
+            secure_db_fields db package mysql [--output PATH] [--keys PATH] [--force]
 
             secure_db_fields db view mysql --table DB.TABLE --field NAME:ENC_COLUMN \\
               --uid-column secure_row_uid --view DB.VIEW --columns ID,CREATED_AT \\
               [--as NAME] [--output PATH]
 
-          `package` creates a self-contained source bundle for the DBA. The DBA
-          extracts it on the database host and runs `make doctor`, `sudo make
-          install`, `make enable`, then `make status`.
+          `package` creates a self-contained DBA bundle with the same key contract
+          used by the application. The DBA extracts it on the database host and
+          runs `make doctor`, `sudo make install`, then `make enable`.
 
           `view` emits an admin readable view. It is for projection/display only;
           indexed search must use physical bidx columns and helper procedures or
@@ -72,10 +72,11 @@ module SecureDBFields
         raise OptionParser::MissingArgument, "TARGET must be mysql" if target.nil?
         raise OptionParser::InvalidArgument, "TARGET must be mysql" unless target == MYSQL_TARGET
 
-        options = { output: nil, force: false }
+        options = { output: nil, force: false, keys: nil }
         parser = OptionParser.new do |opts|
           opts.banner = "Usage: secure_db_fields db package mysql [OPTIONS]"
           opts.on("-o", "--output PATH", "write the deployment archive to PATH") { |value| options[:output] = value }
+          opts.on("--keys PATH", "use or create the shared key contract at PATH") { |value| options[:keys] = value }
           opts.on("-f", "--force", "overwrite an existing archive") { options[:force] = true }
           opts.on("-h", "--help", "show this help") { puts opts; return 0 }
         end
@@ -83,12 +84,96 @@ module SecureDBFields
         raise OptionParser::InvalidOption, argv.join(" ") unless argv.empty?
 
         output = options[:output] || "secure_db_fields-mysql-#{SecureDBFields::VERSION}.tar.gz"
-        DeploymentBundle.new(output, force: options[:force]).write!
+        contract = KeyContract.ensure!(options[:keys] || KeyContract.default_path)
+        DeploymentBundle.new(output, force: options[:force], key_file: contract.path).write!
         puts File.expand_path(output)
         0
       end
     end
 
+    class KeyContract
+      DEFAULT_PATH = "config/secure_db_fields/keys.env"
+      HEX = /\A[0-9a-fA-F]{64}\z/.freeze
+      REQUIRED_HEX_KEYS = %w[SDF_BIDX_KEY_HEX SDF_BIDX_PHONE_KEY_HEX SDF_BIDX_PHONE_P7_KEY_HEX].freeze
+
+      attr_reader :path
+
+      def self.default_path
+        File.expand_path(DEFAULT_PATH, Dir.pwd)
+      end
+
+      def self.ensure!(path)
+        full = File.expand_path(path)
+        if File.exist?(full)
+          validate!(full)
+        else
+          write_new!(full)
+        end
+        new(full)
+      end
+
+      def self.write_new!(path)
+        FileUtils.mkdir_p(File.dirname(path))
+        enc = SecureRandom.hex(32)
+        bidx = SecureRandom.hex(32)
+        phone = bidx
+        phone_p7 = bidx
+        body = <<~ENV
+          SDF_ACTIVE_KEY_ID=1
+          SDF_ENC_KEY_1_HEX=#{enc}
+          SDF_ENC_KEY_HEX=#{enc}
+          SDF_BIDX_KEY_HEX=#{bidx}
+          SDF_BIDX_PHONE_KEY_HEX=#{phone}
+          SDF_BIDX_PHONE_P7_KEY_HEX=#{phone_p7}
+        ENV
+        temporary = File.join(File.dirname(path), "secure-db-fields-keys-#{Process.pid}-#{SecureRandom.hex(8)}.tmp")
+        File.open(temporary, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(body) }
+        File.chmod(0o600, temporary)
+        File.rename(temporary, path)
+      ensure
+        File.delete(temporary) if defined?(temporary) && File.exist?(temporary)
+      end
+
+      def self.validate!(path)
+        stat = File.stat(path)
+        raise Error, "key contract must be a regular file: #{path}" unless stat.file?
+        raise Error, "key contract permissions are too open: #{path}" unless (stat.mode & 0o077).zero?
+        values = parse(path)
+        active = values["SDF_ACTIVE_KEY_ID"]
+        raise Error, "key contract missing SDF_ACTIVE_KEY_ID: #{path}" unless active && active.match?(/\A[1-9][0-9]*\z/)
+        unless hex?(values["SDF_ENC_KEY_#{active}_HEX"]) || hex?(values["SDF_ENC_KEY_HEX"])
+          raise Error, "key contract missing SDF_ENC_KEY_#{active}_HEX or SDF_ENC_KEY_HEX: #{path}"
+        end
+        REQUIRED_HEX_KEYS.each do |name|
+          raise Error, "key contract missing #{name}: #{path}" unless hex?(values[name])
+        end
+      end
+
+      def self.parse(path)
+        values = {}
+        File.readlines(path, chomp: true).each do |line|
+          text = line.strip
+          next if text.empty? || text.start_with?("#")
+          key, value = text.split("=", 2)
+          next unless key && value
+          values[key.strip] = value.strip
+        end
+        values
+      end
+
+      def self.hex?(value)
+        value && HEX.match?(value)
+      end
+
+      def initialize(path)
+        @path = path
+      end
+
+      def data
+        File.binread(path)
+      end
+    end
+
     class ViewCommand
       IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*\z/.freeze
       QUALIFIED_IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?\z/.freeze
@@ -221,9 +306,10 @@ module SecureDBFields
 
       attr_reader :output
 
-      def initialize(output, force: false)
+      def initialize(output, force: false, key_file:)
         @output = output
         @force = force
+        @key_file = key_file
       end
 
       def write!
@@ -239,6 +325,7 @@ module SecureDBFields
             end
             add_text(tar, "VERSION", SecureDBFields::VERSION + "\n")
             add_text(tar, "BUNDLE_FORMAT", BUNDLE_FORMAT_VERSION.to_s + "\n")
+            add_bytes(tar, File.join(bundle_name, "etc/secure_db_fields/keys.env"), File.binread(@key_file), 0o600)
             add_text(tar, "SHA256SUMS", checksums)
           end
         end
@@ -275,6 +362,7 @@ module SecureDBFields
         end
         entries << ["VERSION", SecureDBFields::VERSION + "\n"]
         entries << ["BUNDLE_FORMAT", BUNDLE_FORMAT_VERSION.to_s + "\n"]
+        entries << ["etc/secure_db_fields/keys.env", File.binread(@key_file)]
 
         entries.sort_by(&:first).map do |dst, data|
           "#{Digest::SHA256.hexdigest(data)}  #{dst}"

data/lib/secure_db_fields/keys.rb

@@ -3,10 +3,26 @@
 module SecureDBFields
   class Keyring
     DEFAULT_PATH = "/etc/secure_db_fields/keys.env"
+    APP_RELATIVE_PATH = "config/secure_db_fields/keys.env"
 
     attr_reader :path
 
-    def initialize(path = ENV.fetch("SECURE_DB_FIELDS_KEY_FILE", DEFAULT_PATH))
+    def self.default_path
+      env = ENV["SECURE_DB_FIELDS_KEY_FILE"]
+      return env if env && !env.empty?
+
+      if defined?(Rails) && Rails.respond_to?(:root) && Rails.root
+        rails_path = Rails.root.join(APP_RELATIVE_PATH).to_s
+        return rails_path if File.exist?(rails_path)
+      end
+
+      app_path = File.expand_path(APP_RELATIVE_PATH, Dir.pwd)
+      return app_path if File.exist?(app_path)
+
+      DEFAULT_PATH
+    end
+
+    def initialize(path = self.class.default_path)
       @path = path
       @values = parse_file(path)
     end

data/lib/secure_db_fields/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureDBFields
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

data/mysql_udf/test/run_e2e.sh

@@ -7,8 +7,12 @@ PLATFORM="${SDF_MYSQL_PLATFORM:-linux/amd64}"
 WAIT_SECONDS="${SDF_MYSQL_WAIT_SECONDS:-120}"
 CONTAINER="sdf-mysql57-e2e-${RANDOM}-${RANDOM}"
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+GEM_VERSION="$(ruby -I "$ROOT/lib" -rsecure_db_fields/version -e 'print SecureDBFields::VERSION')"
+PACKAGE_ROOT="secure_db_fields-${GEM_VERSION}"
+BUNDLE_ROOT_NAME="secure_db_fields-mysql-${GEM_VERSION}"
 TMPDIR="$(mktemp -d)"
 ARCHIVE="$TMPDIR/secure_db_fields-mysql.tar.gz"
+CONTRACT="$TMPDIR/keys.env"
 PACKED="$TMPDIR/packed"
 BUNDLE_PARENT="/opt"
 KEY_HEX_A="6161616161616161616161616161616161616161616161616161616161616161"
@@ -29,18 +33,32 @@ prepare_packaged_gem() {
   rm -rf "$PACKED"
   mkdir -p "$PACKED"
   (cd "$ROOT" && gem build secure_db_fields.gemspec >/dev/null)
-  gem unpack "$ROOT/secure_db_fields-0.1.1.gem" --target "$PACKED" >/dev/null
+  gem unpack "$ROOT/secure_db_fields-${GEM_VERSION}.gem" --target "$PACKED" >/dev/null
 }
 
 ruby_from_packaged() {
-  ruby -I "$PACKED/secure_db_fields-0.1.1/lib" "$PACKED/secure_db_fields-0.1.1/exe/secure_db_fields" "$@"
+  ruby -I "$PACKED/$PACKAGE_ROOT/lib" "$PACKED/$PACKAGE_ROOT/exe/secure_db_fields" "$@"
+}
+
+write_contract() {
+  cat > "$CONTRACT" <<EOF_CONTRACT
+SDF_ACTIVE_KEY_ID=1
+SDF_ENC_KEY_1_HEX=$KEY_HEX_A
+SDF_ENC_KEY_HEX=$KEY_HEX_A
+SDF_BIDX_KEY_HEX=$KEY_HEX_B
+SDF_BIDX_PHONE_KEY_HEX=$KEY_HEX_B
+SDF_BIDX_PHONE_P7_KEY_HEX=$KEY_HEX_C
+EOF_CONTRACT
+  chmod 0600 "$CONTRACT"
 }
 
 build_deployment_bundle() {
-  ruby_from_packaged db package mysql --output "$ARCHIVE" --force
+  write_contract
+  ruby_from_packaged db package mysql --output "$ARCHIVE" --keys "$CONTRACT" --force
   test -s "$ARCHIVE"
-  tar -tzf "$ARCHIVE" | grep -Fx 'secure_db_fields-mysql-0.1.1/Makefile' >/dev/null
-  tar -tzf "$ARCHIVE" | grep -Fx 'secure_db_fields-mysql-0.1.1/bin/install' >/dev/null
+  tar -tzf "$ARCHIVE" | grep -Fx "$BUNDLE_ROOT_NAME/Makefile" >/dev/null
+  tar -tzf "$ARCHIVE" | grep -Fx "$BUNDLE_ROOT_NAME/bin/install" >/dev/null
+  tar -tzf "$ARCHIVE" | grep -Fx "$BUNDLE_ROOT_NAME/etc/secure_db_fields/keys.env" >/dev/null
   if tar -tzf "$ARCHIVE" | grep -E '/\.DS_Store$' >/dev/null; then
     echo 'deployment bundle must not contain .DS_Store' >&2
     exit 2
@@ -67,32 +85,16 @@ install_mysql_build_tools() {
 }
 
 install_bundle_on_db_host() {
-  local bundle_root="$BUNDLE_PARENT/secure_db_fields-mysql-0.1.1"
   docker cp "$ARCHIVE" "$CONTAINER:/tmp/secure_db_fields-mysql.tar.gz"
-  docker exec -u 0 "$CONTAINER" sh -ceu '
-    rm -rf /opt/secure_db_fields-mysql-0.1.1
-    tar -xzf /tmp/secure_db_fields-mysql.tar.gz -C /opt
-    cd /opt/secure_db_fields-mysql-0.1.1
+  docker exec -u 0 "$CONTAINER" sh -ceu "
+    rm -rf '$BUNDLE_PARENT/$BUNDLE_ROOT_NAME'
+    tar -xzf /tmp/secure_db_fields-mysql.tar.gz -C '$BUNDLE_PARENT'
+    cd '$BUNDLE_PARENT/$BUNDLE_ROOT_NAME'
     make verify
     make doctor
     make install
     make enable
     make status
-  '
-}
-
-write_key_file() {
-  docker exec -u 0 "$CONTAINER" sh -ceu "
-    install -d -m 0750 -o root -g mysql /etc/secure_db_fields
-    cat > /etc/secure_db_fields/keys.env <<'EOF'
-SDF_ACTIVE_KEY_ID=1
-SDF_ENC_KEY_1_HEX=$KEY_HEX_A
-SDF_BIDX_KEY_HEX=$KEY_HEX_B
-SDF_BIDX_PHONE_KEY_HEX=$KEY_HEX_B
-SDF_BIDX_PHONE_P7_KEY_HEX=$KEY_HEX_C
-EOF
-    chown root:mysql /etc/secure_db_fields/keys.env
-    chmod 0640 /etc/secure_db_fields/keys.env
   "
 }
 
@@ -187,7 +189,6 @@ until docker exec "$CONTAINER" mysqladmin ping --silent 2>/dev/null; do
 done
 
 install_mysql_build_tools
-write_key_file
 install_bundle_on_db_host
 make_fixture_sql
 
@@ -195,7 +196,7 @@ docker exec -i "$CONTAINER" mysql --default-character-set=utf8mb4 < "$TMPDIR/app
 docker exec -i "$CONTAINER" mysql --default-character-set=utf8mb4 < "$TMPDIR/view.sql"
 
 version="$(q 'SELECT secure_db_fields_version();')"
-assert_contains 'version' "$version" 'secure_db_fields 0.1.1'
+assert_contains 'version' "$version" "secure_db_fields $GEM_VERSION"
 assert_eq 'valid envelope' '1' "$(q 'SELECT secure_db_fields_is_valid_envelope(phone_enc) FROM app.clients WHERE id=1;')"
 assert_eq 'envelope key id' '1' "$(q 'SELECT secure_db_fields_envelope_key_id(phone_enc) FROM app.clients WHERE id=1;')"
 assert_eq 'decrypt field' '+77771234567' "$(q "SELECT secure_db_fields_decrypt_field(phone_enc, 'clients', 'phone', secure_row_uid) FROM app.clients WHERE id=1;")"
@@ -210,7 +211,7 @@ assert_contains 'EXPLAIN uses exact bidx index' "$explain_exact" 'idx_clients_ph
 explain_prefix="$(q "EXPLAIN SELECT id FROM app.clients WHERE phone_bidx_p7 = secure_phone_prefix_bidx('+77771234567', 7);")"
 assert_contains 'EXPLAIN uses prefix bidx index' "$explain_prefix" 'idx_clients_phone_bidx_p7'
 
-docker exec -u 0 "$CONTAINER" sh -ceu 'cd /opt/secure_db_fields-mysql-0.1.1 && CONFIRM=REMOVE_SECURE_DB_FIELDS make uninstall'
+docker exec -u 0 "$CONTAINER" sh -ceu "cd '$BUNDLE_PARENT/$BUNDLE_ROOT_NAME' && CONFIRM=REMOVE_SECURE_DB_FIELDS make uninstall"
 assert_eq 'functions removed' '0' "$(q "SELECT COUNT(*) FROM mysql.func WHERE dl = 'secure_db_fields_mysql.so';")"
 
 echo 'secure_db_fields MySQL 5.7 UDF e2e: ok'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_db_fields
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Roman Khaidarov
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-08 00:00:00.000000000 Z
+date: 2026-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest