sekrets 1.2.0 → 1.3.0

data/README

@@ -59,6 +59,14 @@ DESCRIPTION
 
       settings = Sekrets.settings_for('./config/settings.yml.enc')
       
+  RAILS
+    gem 'sekrets' # Gemfile
+
+    bundle install
+
+    rake sekrets:generate:key
+    rake sekrets:generate:editor
+    rake sekrets:generate:config
 
   DESCRIPTION
     sekrets provides commandline tools and a library to manage and access

data/bin/sekrets

@@ -3,11 +3,11 @@
 Main {
 #
   synopsis <<-__
-    ~> echo 'plaintext' | sekrets write sekrets.txt --key 42
+    ~> echo 'plaintext' | sekrets write sekrets.enc --key 42
 
-    ~> sekrets read sekrets.txt --key 42
+    ~> sekrets read sekrets.enc --key 42
 
-    ~> sekrets edit sekrets.txt
+    ~> sekrets edit sekrets.enc
   __
 
   description <<-__
@@ -142,6 +142,21 @@ Main {
 
 #
   mode(:write){
+    synopsis <<-__
+      write encrypted data to file
+    __
+
+    description <<-__
+      write mode writes it's input (default STDIN) to output (deafult STDOUT)
+      after encrypting it with key
+    __
+
+    examples <<-__
+      ~> echo 'the pazzw0rd' | sekrets write -k 42 > sekrets.enc
+
+      ~> sekrets write output.enc input.txt -k 42
+    __
+
     argument('output', 'o'){
       argument :required
       default STDOUT
@@ -171,6 +186,21 @@ Main {
 
 #
   mode(:read){
+    synopsis <<-__
+      reads encrypted data from a file
+    __
+
+    description <<-__
+      read mode reads it's input (default STDIN) and writes it's output
+      (default STDOUT) after decrypting it with key
+    __
+
+    examples <<-__
+      ~> cat output.enc | sekrets read -k 42
+
+      ~> sekrets read output.enc output.dec -k 42
+    __
+
     argument('input', 'i'){
       argument :required
       default STDIN
@@ -198,8 +228,75 @@ Main {
     end
   }
 
+
+#
+  mode(:recrypt){
+    synopsis <<-__
+      re-encrypts a file with a new key
+    __
+
+    description <<-__
+      provide the old and new key by using the --key option twice
+
+      the first key is the current decryption key
+
+      the second key is the new one
+
+      if you do not provide the keys as options you will be prompted for them
+    __
+
+    examples <<-__
+      ~> sekrets recrypt sekrets.enc -k current_key -k new_key
+    __
+
+    argument(:path)
+
+    option('key', 'k'){
+      argument :required
+    }
+
+    def run
+      path = params[:path].value
+
+      cur_key, new_key, *ignored = params[:key].values.first(2)
+
+      unless cur_key
+        cur_key = Sekrets.ask("#{ path } [cur key]")
+      end
+
+      unless new_key
+        new_key = Sekrets.ask("#{ path } [new key]")
+      end
+
+      decrypted = Sekrets.read(path, :key => cur_key)
+      encrypted = Sekrets.write(path, decrypted, :key => new_key)
+      decrypted = Sekrets.read(path, :key => new_key)
+      puts path
+    end
+  }
+
 #
   mode(:edit){
+    synopsis <<-__
+      spawn an external editor to edit an encrypted file
+    __
+
+    description <<-__
+      edit mode looks first to the unix environment variable SEKRETS_EDTIOR
+      or, if that is not found, the normal EDITOR variable to determine which
+      editor to launch.  it assumes that your editor can be launched from the
+      commandline with a file as single argument. vim is the default editor.
+
+      after the editor program exits succesfully the temporary file is
+      encrypted and saved.
+    __
+
+    examples <<-__
+      ~> sekrets edit my.passwords.txt -k
+
+      ~> EDITOR=mate sekrets edit my.passwords.txt -k
+    __
+
     argument(:path)
 
     option('key', 'k'){
@@ -252,13 +349,24 @@ Main {
 
 BEGIN {
   require 'pathname'
+
   bindir = Pathname.new(__FILE__).dirname.to_s
   root = File.dirname(bindir)
   libdir = File.join(root, 'lib')
+
   require "#{ libdir }/sekrets.rb"
+
   begin
     require 'pry'
   rescue Object
     nil
   end
+
+  trap('SIGINT'){ STDERR.puts; exit!(42) }
+
+  if((sekrets_argv = ENV['SEKRETS_ARGV']))
+    ENV.delete('SEKRETS_ARGV')
+    command = [$0, sekrets_argv, *ARGV].flatten.compact.join(' ')
+    exec(command)
+  end
 }

data/lib/sekrets.rb

@@ -242,6 +242,38 @@ class Sekrets
     path
   end
 
+  def Sekrets.binstub
+    @binstub ||= (
+      unindent(
+        <<-__
+          #! /usr/bin/env ruby
+          
+          require 'pathname'
+          ENV['BUNDLE_GEMFILE'] ||= File.expand_path("../../Gemfile",
+            Pathname.new(__FILE__).realpath)
+          
+          require 'rubygems'
+          require 'bundler/setup'
+        
+          ciphertext = File.expand_path('ciphertext',
+          File.dirname(__FILE__))
+          ENV['SEKRETS_ARGV'] = "edit \#{ ciphertext }"
+        
+          exec(Gem.bin_path('sekrets', 'sekrets'))
+        __
+      )
+    )
+  end
+
+  def Sekrets.unindent(string)
+    indent = string.split("\n").select {|line| !line.strip.empty? }.map {|line| line.index(/[^\s]/) }.compact.min || 0
+    string.gsub(/^[[:blank:]]{#{indent}}/, '')
+  end
+
+  def Sekrets.unindent!(string)
+    string.replace(string.unindent)
+  end
+
 #
   module Blowfish
     def cipher(mode, key, data)
@@ -286,7 +318,7 @@ BEGIN {
   require 'tmpdir'
 
   class Sekrets < ::String
-    Version = '1.2.0' unless defined?(Version)
+    Version = '1.3.0' unless defined?(Version)
 
     class << Sekrets
       def version
@@ -342,4 +374,124 @@ BEGIN {
 
     __
   }
+
+  if defined?(Rails)
+
+    class Sekrets
+      class Engine < Rails::Engine
+        engine_name :sekrets
+
+        rake_tasks do
+          namespace :sekrets do
+            namespace :generate do
+            #
+              desc 'generate a .sekrets.key'
+              task :key do
+                keyfile = File.join(Rails.root, '.sekrets.key')
+                abort("#{ keyfile } exists!") if test(?e, keyfile)
+                key = SecureRandom.hex
+                open(keyfile, 'wb'){|fd| fd.puts(key)}
+
+                begin
+                  gitignore = File.join(Rails.root, '.gitignore')
+                  buf = IO.read(gitignore)
+
+                  unless buf =~ /\.sekrets\.key/
+                    open(gitignore, 'a+') do |fd|
+                      fd.puts
+                      fd.puts '.sekrets.key'
+                      fd.puts
+                    end
+                  end
+                rescue Object
+                end
+
+                puts "created #{ Rails.root }/.sekrets.key"
+                puts "do *NOT* commit this file"
+                puts
+                puts "updated #{ Rails.root }/.gitignore"
+                puts "yes *DO* commit this file"
+                puts
+                puts "*** YOU NEED TO DISTRIBUTE THIS KEY TO YOUR TEAM ***"
+                puts
+                puts "*** YOU NEED DEPLOY THIS KEY WITH YOUR APPLICATION ***"
+                puts
+                puts "hint: require 'sekrets/capistrano' in your Capfile"
+                puts
+              end
+
+            #
+              desc 'generate a secure editor for plaintext application sekrets'
+              task :editor do
+                keyfile = File.join(Rails.root, '.sekrets.key')
+                abort("run 'rake sekrets:generate:key' first") unless test(?e, keyfile)
+                key = IO.binread(keyfile).strip
+
+                editor = File.join(Rails.root, 'sekrets', 'editor')
+                ciphertext = File.join(Rails.root, 'sekrets', 'ciphertext')
+
+                unless test(?s, editor)
+                  FileUtils.mkdir_p(File.dirname(editor))
+                  open(editor, 'wb'){|fd| fd.write(Sekrets.binstub)}
+                  File.chmod(0755, editor)
+                  puts "created #{ editor }"
+                end
+
+                unless test(?s, ciphertext)
+                  content = "# store sensitive infomation like credit cards, ssh keys, and passwords here\n\n\n"
+                  Sekrets.write(ciphertext, content, :key => key)
+                  puts "created #{ ciphertext }"
+                end
+
+                puts "run ./sekrets/editor to edit ./sekrets/ciphertext"
+              end
+
+            #
+              desc 'generate a secure config for application sekrets'
+              task :config do
+                keyfile = File.join(Rails.root, '.sekrets.key')
+                abort("run 'rake sekrets:generate:key' first") unless test(?e, keyfile)
+                key = IO.binread(keyfile).strip
+
+                config = File.join(Rails.root, 'config', 'sekrets.yml.enc')
+                unless test(?s, config)
+                  FileUtils.mkdir_p(File.dirname(config))
+                  require 'yaml' unless defined?(YAML)
+                  content = {'api_key' => 42}.to_yaml
+                  Sekrets.write(config, content, :key => key)
+                  puts "created #{ config }"
+                end
+
+                initializer = File.join(Rails.root, 'config', 'initializers', 'sekrets.rb')
+                unless test(?s, initializer)
+                  FileUtils.mkdir_p(File.dirname(initializer))
+                  open(initializer, 'wb') do |fd|
+                    code = <<-__
+
+                      config = File.join(Rails.root, 'config', 'sekrets.yml.enc')
+                      key = File.join(Rails.root, '.sekrets.key')
+
+                      if test(?e, config)
+                        if test(?e, key)
+                          SEKRETS = Sekrets.settings_for(config)
+                        else
+                          SEKRETS = Map.new
+                          warn "missing \#{ key }!"
+                        end
+                      end
+                      
+                    __
+                    fd.puts(code)
+                  end
+                  puts "created #{ initializer }"
+                end
+              end
+
+            end
+          end
+        end
+      end
+    end
+
+  end
 }

data/sekrets.gemspec

@@ -3,7 +3,7 @@
 
 Gem::Specification::new do |spec|
   spec.name = "sekrets"
-  spec.version = "1.2.0"
+  spec.version = "1.3.0"
   spec.platform = Gem::Platform::RUBY
   spec.summary = "sekrets"
   spec.description = "description: sekrets kicks the ass"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sekrets
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-21 00:00:00.000000000 Z
+date: 2013-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: highline