seekrit-sdk 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +9 -0
- data/lib/seekrit/client.rb +1 -0
- data/lib/seekrit/crypto.rb +9 -2
- data/lib/seekrit/version.rb +1 -1
- data/testdata/vectors.json +2 -1
- metadata +4 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 32c907a8f2923c14214ae739aaf8f183b7db26f001f3d3026a8d1ef0764c8fe1
|
|
4
|
+
data.tar.gz: 55c2748d6c1719bcfd0f98df7580664d4bbb1293582df109a446373e10151ae3
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: b7be6491946e39019f3fe2d4212df1aa9736e0145729396e24719b40420b126151cf4d97531b51962b51a8c1f73d70d0ad7c3b63d5ff8644be957949ecf98382
|
|
7
|
+
data.tar.gz: 9a281b0d885e7e887456f04474feafbf8c41e70d57a60cff07e920add154ac3fbcbe1f90f5ae8b56f1664e98adb9660fbfdfb9f647528d65140531589f05b893
|
data/README.md
CHANGED
|
@@ -107,3 +107,12 @@ CLI, `seekrit run`, and every other seekrit client. See
|
|
|
107
107
|
## License
|
|
108
108
|
|
|
109
109
|
MIT
|
|
110
|
+
|
|
111
|
+
## Service token v2
|
|
112
|
+
|
|
113
|
+
Keep one `SEEKRIT_TOKEN`: `skt_<id>_v2.<auth-secret>.<private-key>`.
|
|
114
|
+
The client sends only `skt_<id>_v2.<auth-secret>` to the API and uses the private
|
|
115
|
+
key locally to decrypt. Legacy tokens are rejected before any API request;
|
|
116
|
+
upgrade clients and replace legacy tokens through the dashboard. A stolen
|
|
117
|
+
HTTP credential cannot decrypt environment payloads, but stealing the full
|
|
118
|
+
local bundle still exposes the private key. Treat the full bundle as a secret.
|
data/lib/seekrit/client.rb
CHANGED
|
@@ -29,6 +29,7 @@ module Seekrit
|
|
|
29
29
|
raise Error, "no service token: pass token: or set SEEKRIT_TOKEN" unless @token && !@token.empty?
|
|
30
30
|
|
|
31
31
|
@key = Crypto::TokenKey.parse(@token) # fail fast on a bad token
|
|
32
|
+
@token = Crypto.service_token_auth(@token)
|
|
32
33
|
@api_url = (api_url || ENV["SEEKRIT_API_URL"] || DEFAULT_API_URL).sub(%r{/+\z}, "")
|
|
33
34
|
@with = with || {}
|
|
34
35
|
@open_timeout = open_timeout
|
data/lib/seekrit/crypto.rb
CHANGED
|
@@ -14,17 +14,24 @@ module Seekrit
|
|
|
14
14
|
# 3. Decrypt each secret (Crypto.decrypt_secret).
|
|
15
15
|
#
|
|
16
16
|
# Blob formats (all segments base64url, no padding):
|
|
17
|
-
# token skt_<id>
|
|
17
|
+
# token skt_<id>_v2.<auth secret>.<pkcs8 private key>
|
|
18
18
|
# wrapped DEK wd1.<ephemeral pub (raw SEC1)>.<hkdf salt>.<iv>.<ciphertext||tag>
|
|
19
19
|
# secret sc1.<iv>.<ciphertext||tag>
|
|
20
20
|
module Crypto
|
|
21
21
|
HKDF_INFO = "seekrit/wrap-dek/v1"
|
|
22
22
|
CURVE = "prime256v1" # NIST P-256 / secp256r1
|
|
23
23
|
# Only the first two underscores are separators; the key segment may contain "_".
|
|
24
|
-
TOKEN_RE = /\A(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)\z/.freeze
|
|
24
|
+
TOKEN_RE = /\A(skt_[0-9A-Za-z]+)_(?:v2\.[A-Za-z0-9_-]{43}\.)?([A-Za-z0-9_-]+)\z/.freeze
|
|
25
25
|
|
|
26
26
|
module_function
|
|
27
27
|
|
|
28
|
+
def service_token_auth(token)
|
|
29
|
+
match = /\A(skt_[0-9A-Za-z]+_v2\.[A-Za-z0-9_-]{43})(?:\.[A-Za-z0-9_-]+)?\z/.match(token)
|
|
30
|
+
raise CryptoError, "a v2 service token is required for API access; replace legacy tokens in the dashboard" unless match
|
|
31
|
+
|
|
32
|
+
match[1]
|
|
33
|
+
end
|
|
34
|
+
|
|
28
35
|
def b64url_decode(text)
|
|
29
36
|
Base64.urlsafe_decode64(text + ("=" * ((4 - (text.length % 4)) % 4)))
|
|
30
37
|
end
|
data/lib/seekrit/version.rb
CHANGED
data/testdata/vectors.json
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
{
|
|
2
|
-
"token": "
|
|
2
|
+
"token": "skt_6EYgmoh8LuiPPAbM0SaVtc_v2.bh8OFkiEBdTJM4MBX75AMCPsR2Arp1i32sg8Ej0Vw7o.MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgra6e_i8D2dIWlz-43EVbrHz-g698-kxY22MCp95L7VGhRANCAATA4nkyQKLq4hD5YvzXLtNtKAK_g-H4LF260zk0bInSWMbDfx0vTTtOg0tRWoDYWbuIN0vb1YMZ5z13xH5aBsDx",
|
|
3
|
+
"authToken": "skt_6EYgmoh8LuiPPAbM0SaVtc_v2.bh8OFkiEBdTJM4MBX75AMCPsR2Arp1i32sg8Ej0Vw7o",
|
|
3
4
|
"tokenId": "skt_6EYgmoh8LuiPPAbM0SaVtc",
|
|
4
5
|
"publicKeyJwk": "{\"key_ops\":[],\"ext\":true,\"kty\":\"EC\",\"x\":\"wOJ5MkCi6uIQ-WL81y7TbSgCv4Ph-CxdutM5NGyJ0lg\",\"y\":\"xsN_HS9NO06DS1FagNhZu4g3S9vVgxnnPXfEfloGwPE\",\"crv\":\"P-256\"}",
|
|
5
6
|
"resolve": {
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: seekrit-sdk
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.5.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- seekrit
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-
|
|
11
|
+
date: 2026-10-27 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: |
|
|
14
14
|
Read-path SDK for seekrit, the zero-knowledge secrets manager. Authenticate
|
|
@@ -38,8 +38,9 @@ licenses:
|
|
|
38
38
|
- MIT
|
|
39
39
|
metadata:
|
|
40
40
|
homepage_uri: https://seekrit.dev
|
|
41
|
-
documentation_uri: https://seekrit.dev/docs
|
|
41
|
+
documentation_uri: https://seekrit.dev/docs/guides/sdks
|
|
42
42
|
source_code_uri: https://github.com/seekritdev/ruby-sdk
|
|
43
|
+
bug_tracker_uri: https://github.com/seekritdev/ruby-sdk/issues
|
|
43
44
|
rubygems_mfa_required: 'true'
|
|
44
45
|
post_install_message:
|
|
45
46
|
rdoc_options: []
|