symmetric-encryption 4.2.1 → 4.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40e60b20cfaf40c1b3ad68fb05b12fd766886ac3d4527a02c8d456906e45b705
-  data.tar.gz: 3c87cffcfc26fe8a057619b3559c3f93ff5a3951c219eb90deb1c2054ae4495f
+  metadata.gz: 17ec7e95cd640a1bc8b960bff9244557e3dcd58bb58744b054e4bb7ef95a051a
+  data.tar.gz: 36230ce36bf337f98d5cf70e45c5ed1658faeed8ce650cd9b4b7d12354a477df
 SHA512:
-  metadata.gz: 479105df621736ea8ccaddc73129f4c6d9ebad8a6918a793044d9d3329f547e3a7cbd404719bcbd9918a5cedb0c18694f22173201e799ab70d3a8032a7a90ac6
-  data.tar.gz: dd8fd1b290bc1e2e55311234e8a06660dbc6f0849382189bc9408432caa519f973a1cbb7835eb97805136699eaf357772531cb7dfe6dbe2a62c33b4600c141f5
+  metadata.gz: 4d880e284b3aa211e2a4bdeb872ff294d8c8743eb033edcafd6ec7ee569da3390b12821e555b1efe98503b2e4c4c05d0380f5da6d09577dfcd57badc12c0bce2
+  data.tar.gz: 36453ff31c896a7b7359b66cd53d3777f71b6855d53d8f002a77d7af91e3fe21c1a346869c0414aecbe8cc92c7e93dd73701edaa751072df6dcdd9459dd74752

data/README.md

@@ -1,9 +1,9 @@
 # Symmetric Encryption
-![](https://img.shields.io/gem/v/symmetric-encryption.svg) ![](https://img.shields.io/travis/rocketjob/symmetric-encryption.svg) ![](https://img.shields.io/gem/dt/symmetric-encryption.svg)  ![](https://img.shields.io/badge/status-production%20ready-blue.svg)
+[![Gem Version](https://img.shields.io/gem/v/symmetric-encryption.svg)](https://rubygems.org/gems/symmetric-encryption) [![Build Status](https://github.com/reidmorrison/symmetric-encryption/workflows/build/badge.svg)](https://github.com/reidmorrison/symmetric-encryption/actions?query=workflow%3Abuild) [![Downloads](https://img.shields.io/gem/dt/symmetric-encryption.svg)](https://rubygems.org/gems/symmetric-encryption) [![License](https://img.shields.io/badge/license-Apache%202.0-brightgreen.svg)](http://opensource.org/licenses/Apache-2.0) ![](https://img.shields.io/badge/status-Production%20Ready-blue.svg) 
 
-* http://github.com/rocketjob/symmetric-encryption
+* https://encryption.rocketjob.io/
 
-Transparently encrypt ActiveRecord, Mongoid, and MongoMapper attributes. Encrypt passwords in configuration files. Encrypt entire files at rest.
+Transparently encrypt ActiveRecord, and Mongoid attributes. Encrypt passwords in configuration files. Encrypt entire files at rest.
 
 ## Introduction
 
@@ -19,9 +19,7 @@ expose all the encryption algorithms supported by OpenSSL.
 
 ## Documentation
 
-[Symmetric Encryption Guide](http://rocketjob.github.io/symmetric-encryption)
-
-[Reference Documentation](http://www.rubydoc.info/gems/symmetric-encryption/)
+[Symmetric Encryption Guide](https://encryption.rocketjob.io/)
 
 ## Rocket Job
 
@@ -168,7 +166,7 @@ may have backward compatibility issues:
 
 [Reid Morrison](https://github.com/reidmorrison)
 
-[Contributors](https://github.com/rocketjob/symmetric-encryption/graphs/contributors)
+[Contributors](https://github.com/reidmorrison/symmetric-encryption/graphs/contributors)
 
 ## Versioning
 

data/Rakefile

@@ -1,30 +1,30 @@
 # Setup bundler to avoid having to run bundle exec all the time.
-require 'rubygems'
-require 'bundler/setup'
+require "rubygems"
+require "bundler/setup"
 
-require 'rake/testtask'
-require_relative 'lib/symmetric_encryption/version'
+require "rake/testtask"
+require_relative "lib/symmetric_encryption/version"
 
 task :gem do
-  system 'gem build symmetric-encryption.gemspec'
+  system "gem build symmetric-encryption.gemspec"
 end
 
 task publish: :gem do
   system "git tag -a v#{SymmetricEncryption::VERSION} -m 'Tagging #{SymmetricEncryption::VERSION}'"
-  system 'git push --tags'
+  system "git push --tags"
   system "gem push symmetric-encryption-#{SymmetricEncryption::VERSION}.gem"
   system "rm symmetric-encryption-#{SymmetricEncryption::VERSION}.gem"
 end
 
 Rake::TestTask.new(:test) do |t|
-  t.pattern = 'test/**/*_test.rb'
+  t.pattern = "test/**/*_test.rb"
   t.verbose = true
   t.warning = false
 end
 
 # By default run tests against all appraisals
-if !ENV['APPRAISAL_INITIALIZED'] && !ENV['TRAVIS']
-  require 'appraisal'
+if !ENV["APPRAISAL_INITIALIZED"] && !ENV["TRAVIS"]
+  require "appraisal"
   task default: :appraisal
 else
   task default: :test

data/bin/symmetric-encryption

@@ -1,5 +1,5 @@
 #!/usr/bin/env ruby
 
-require 'symmetric_encryption'
+require "symmetric_encryption"
 
 SymmetricEncryption::CLI.run!(ARGV)

data/lib/symmetric-encryption.rb

@@ -1 +1 @@
-require 'symmetric_encryption'
+require "symmetric_encryption"

data/lib/symmetric_encryption/{railties → active_record}/attr_encrypted.rb

@@ -1,5 +1,5 @@
 module SymmetricEncryption
-  module Railties
+  module ActiveRecord
     module AttrEncrypted
       def self.included(base)
         base.extend ClassMethods
@@ -39,7 +39,7 @@ module SymmetricEncryption
         #       compression
         #       Note: Adds a 6 byte header prior to encoding, only if :random_iv is false
         #       Default: false
-        def attr_encrypted(*params)
+        def attr_encrypted(*attributes, random_iv: nil, type: :string, compress: false)
           # Ensure ActiveRecord has created all its methods first
           # Ignore failures since the table may not yet actually exist
           begin
@@ -48,10 +48,21 @@ module SymmetricEncryption
             nil
           end
 
-          options = params.last.is_a?(Hash) ? params.pop.dup : {}
+          random_iv = true if random_iv.nil? && SymmetricEncryption.randomize_iv?
 
-          params.each do |attribute|
-            SymmetricEncryption::Generator.generate_decrypted_accessors(self, attribute, "encrypted_#{attribute}", options)
+          if random_iv.nil?
+            warn("attr_encrypted() no longer allows a default value for option `random_iv`. Add `random_iv: false` if it is required.")
+          end
+
+          attributes.each do |attribute|
+            SymmetricEncryption::Generator.generate_decrypted_accessors(
+              self,
+              attribute,
+              "encrypted_#{attribute}",
+              random_iv: random_iv,
+              type:      type,
+              compress:  compress
+            )
             encrypted_attributes[attribute.to_sym] = "encrypted_#{attribute}".to_sym
           end
         end

data/lib/symmetric_encryption/active_record/encrypted_attribute.rb

@@ -0,0 +1,37 @@
+module SymmetricEncryption
+  module ActiveRecord
+    class EncryptedAttribute < ::ActiveModel::Type::String
+      def initialize(random_iv: true, compress: false, type: :string)
+        @random_iv      = random_iv
+        @compress       = compress
+        @encrypted_type = type
+      end
+
+      def deserialize(value)
+        return if value.nil?
+
+        SymmetricEncryption.decrypt(value, type: encrypted_type)
+      end
+
+      def serialize(value)
+        return if value.nil?
+
+        SymmetricEncryption.encrypt(
+          value,
+          type:      encrypted_type,
+          compress:  compress,
+          random_iv: random_iv
+        )
+      end
+
+      private
+
+      # Symmetric Encryption uses coercible gem to handle casting
+      def cast_value(value)
+        value
+      end
+
+      attr_reader :random_iv, :compress, :encrypted_type
+    end
+  end
+end

data/lib/symmetric_encryption/cipher.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require "openssl"
 module SymmetricEncryption
   # Hold all information related to encryption keys
   # as well as encrypt and decrypt data using those keys.
@@ -12,7 +12,7 @@ module SymmetricEncryption
     attr_writer :key
 
     # Returns [Cipher] from a cipher config instance.
-    def self.from_config(cipher_name: 'aes-256-cbc',
+    def self.from_config(cipher_name: "aes-256-cbc",
                          version: 0,
                          always_add_header: true,
                          encoding: :base64strict,
@@ -50,6 +50,8 @@ module SymmetricEncryption
     #       This is the recommended format since newlines in the values to
     #       SQL queries are cumbersome. Also the newline reformatting is unnecessary
     #       It is not the default for backward compatibility
+    #     :base64urlsafe
+    #       Same as base64strict except that base64urlsafe uses '-' instead of '+' and '_' instead of '/'.
     #     :base64
     #       Return as a base64 encoded string
     #     :base16
@@ -58,7 +60,7 @@ module SymmetricEncryption
     #       Return as raw binary data string. Note: String can contain embedded nulls
     #     Default: :base64strict
     #
-    #   version [Fixnum]
+    #   version [Integer]
     #     Optional. The version number of this encryption key
     #     Used by SymmetricEncryption to select the correct key when decrypting data
     #     Valid Range: 0..255
@@ -72,7 +74,7 @@ module SymmetricEncryption
     #     Default: true
     def initialize(key:,
                    iv: nil,
-                   cipher_name: 'aes-256-cbc',
+                   cipher_name: "aes-256-cbc",
                    version: 0,
                    always_add_header: true,
                    encoding: :base64strict)
@@ -84,7 +86,9 @@ module SymmetricEncryption
       @version           = version.to_i
       @always_add_header = always_add_header
 
-      raise(ArgumentError, "Cipher version has a valid range of 0 to 255. #{@version} is too high, or negative") if (@version > 255) || @version.negative?
+      return unless (@version > 255) || @version.negative?
+
+      raise(ArgumentError, "Cipher version has a valid range of 0 to 255. #{@version} is too high, or negative")
     end
 
     # Change the encoding
@@ -112,7 +116,7 @@ module SymmetricEncryption
     #     to convert it to a string
     #
     #   random_iv [true|false]
-    #     Whether the encypted value should use a random IV every time the
+    #     Whether the encrypted value should use a random IV every time the
     #     field is encrypted.
     #     Notes:
     #     * Setting random_iv to true will result in a different encrypted output for
@@ -131,7 +135,7 @@ module SymmetricEncryption
     #     * Should only be used for large strings since compression overhead and
     #       the overhead of adding the encryption header may exceed any benefits of
     #       compression
-    def encrypt(str, random_iv: false, compress: false, header: always_add_header)
+    def encrypt(str, random_iv: SymmetricEncryption.randomize_iv?, compress: false, header: always_add_header)
       return if str.nil?
 
       str = str.to_s
@@ -167,7 +171,9 @@ module SymmetricEncryption
       decrypted = binary_decrypt(decoded)
 
       # Try to force result to UTF-8 encoding, but if it is not valid, force it back to Binary
-      decrypted.force_encoding(SymmetricEncryption::BINARY_ENCODING) unless decrypted.force_encoding(SymmetricEncryption::UTF8_ENCODING).valid_encoding?
+      unless decrypted.force_encoding(SymmetricEncryption::UTF8_ENCODING).valid_encoding?
+        decrypted.force_encoding(SymmetricEncryption::BINARY_ENCODING)
+      end
 
       decrypted
     end
@@ -180,7 +186,7 @@ module SymmetricEncryption
     #
     # Returned string is UTF8 encoded except for encoding :none
     def encode(binary_string)
-      return binary_string if binary_string.nil? || (binary_string == '')
+      return binary_string if binary_string.nil? || (binary_string == "")
 
       encoder.encode(binary_string)
     end
@@ -190,7 +196,7 @@ module SymmetricEncryption
     #
     # Returned string is Binary encoded
     def decode(encoded_string)
-      return encoded_string if encoded_string.nil? || (encoded_string == '')
+      return encoded_string if encoded_string.nil? || (encoded_string == "")
 
       encoder.decode(encoded_string)
     end
@@ -246,7 +252,7 @@ module SymmetricEncryption
     #     Default: `always_add_header`
     #
     # See #encrypt to encrypt and encode the result as a string.
-    def binary_encrypt(str, random_iv: false, compress: false, header: always_add_header)
+    def binary_encrypt(str, random_iv: SymmetricEncryption.randomize_iv?, compress: false, header: always_add_header)
       return if str.nil?
 
       string = str.to_s
@@ -316,8 +322,8 @@ module SymmetricEncryption
 
       openssl_cipher = ::OpenSSL::Cipher.new(header.cipher_name || cipher_name)
       openssl_cipher.decrypt
-      openssl_cipher.key  = header.key || @key
-      if (iv              = header.iv || @iv)
+      openssl_cipher.key = header.key || @key
+      if (iv = header.iv || @iv)
         openssl_cipher.iv = iv
       end
       result = openssl_cipher.update(data)
@@ -327,7 +333,7 @@ module SymmetricEncryption
 
     # Returns the magic header after applying the encoding in this cipher
     def encoded_magic_header
-      @encoded_magic_header ||= encoder.encode(SymmetricEncryption::Header::MAGIC_HEADER).delete('=').strip
+      @encoded_magic_header ||= encoder.encode(SymmetricEncryption::Header::MAGIC_HEADER).delete("=").strip
     end
 
     # Returns [String] object represented as a string, filtering out the key

data/lib/symmetric_encryption/cli.rb

@@ -1,5 +1,5 @@
-require 'optparse'
-require 'fileutils'
+require "optparse"
+require "fileutils"
 module SymmetricEncryption
   class CLI
     attr_reader :key_path, :app_name, :encrypt, :config_file_path,
@@ -16,11 +16,11 @@ module SymmetricEncryption
 
     def initialize(argv)
       @version          = current_version
-      @environment      = ENV['SYMMETRIC_ENCRYPTION_ENV'] || ENV['RACK_ENV'] || ENV['RAILS_ENV'] || 'development'
-      @config_file_path = File.expand_path(ENV['SYMMETRIC_ENCRYPTION_CONFIG'] || 'config/symmetric-encryption.yml')
-      @app_name         = 'symmetric-encryption'
+      @environment      = ENV["SYMMETRIC_ENCRYPTION_ENV"] || ENV["RACK_ENV"] || ENV["RAILS_ENV"] || "development"
+      @config_file_path = File.expand_path(ENV["SYMMETRIC_ENCRYPTION_CONFIG"] || "config/symmetric-encryption.yml")
+      @app_name         = "symmetric-encryption"
       @key_path         = "#{ENV['HOME']}/.symmetric-encryption"
-      @cipher_name      = 'aes-256-cbc'
+      @cipher_name      = "aes-256-cbc"
       @rolling_deploy   = false
       @prompt           = false
       @show_version     = false
@@ -34,7 +34,7 @@ module SymmetricEncryption
     end
 
     def run!
-      raise(ArgumentError, 'Cannot cleanup keys and rotate keys at the same time') if cleanup_keys && rotate_keys
+      raise(ArgumentError, "Cannot cleanup keys and rotate keys at the same time") if cleanup_keys && rotate_keys
 
       if show_version
         puts "Symmetric Encryption v#{VERSION}"
@@ -70,11 +70,11 @@ module SymmetricEncryption
     end
 
     def parser
-      @parser     ||= OptionParser.new do |opts|
+      @parser ||= OptionParser.new do |opts|
         opts.banner = <<~BANNER
           Symmetric Encryption v#{VERSION}
 
-            For more information, see: https://rocketjob.github.io/symmetric-encryption/
+            For more information, see: https://encryption.rocketjob.io/
 
             Note:
               It is recommended to backup the current configuration file, or place it in version control before running
@@ -83,113 +83,129 @@ module SymmetricEncryption
           symmetric-encryption [options]
         BANNER
 
-        opts.on '-e', '--encrypt [FILE_NAME]', 'Encrypt a file, or read from stdin if no file name is supplied.' do |file_name|
+        opts.on "-e", "--encrypt [FILE_NAME]", "Encrypt a file, or read from stdin if no file name is supplied." do |file_name|
           @encrypt = file_name || STDIN
         end
 
-        opts.on '-d', '--decrypt [FILE_NAME]', 'Decrypt a file, or read from stdin if no file name is supplied.' do |file_name|
+        opts.on "-d", "--decrypt [FILE_NAME]", "Decrypt a file, or read from stdin if no file name is supplied." do |file_name|
           @decrypt = file_name || STDIN
         end
 
-        opts.on '-o', '--output FILE_NAME', 'Write encrypted or decrypted file to this file, otherwise output goes to stdout.' do |file_name|
+        opts.on "-o", "--output FILE_NAME",
+                "Write encrypted or decrypted file to this file, otherwise output goes to stdout." do |file_name|
           @output_file_name = file_name
         end
 
-        opts.on '-P', '--prompt', 'When encrypting or decrypting, prompt for a string encrypt or decrypt.' do
+        opts.on "-P", "--prompt", "When encrypting or decrypting, prompt for a string encrypt or decrypt." do
           @prompt = true
         end
 
-        opts.on '-z', '--compress', 'Compress encrypted output file. [Default for encrypting files]' do
+        opts.on "-z", "--compress", "Compress encrypted output file. [Default for encrypting files]" do
           @compress = true
         end
 
-        opts.on '-Z', '--no-compress', 'Does not compress the output file. [Default for encrypting strings]' do
+        opts.on "-Z", "--no-compress", "Does not compress the output file. [Default for encrypting strings]" do
           @compress = false
         end
 
-        opts.on '-E', '--env ENVIRONMENT', "Environment to use in the config file. Default: SYMMETRIC_ENCRYPTION_ENV || RACK_ENV || RAILS_ENV || 'development'" do |environment|
+        opts.on "-E", "--env ENVIRONMENT",
+                "Environment to use in the config file. Default: SYMMETRIC_ENCRYPTION_ENV || RACK_ENV || RAILS_ENV || 'development'" do |environment|
           @environment = environment
         end
 
-        opts.on '-c', '--config CONFIG_FILE_PATH', 'File name & path to the Symmetric Encryption configuration file. Default: config/symmetric-encryption.yml or Env var: `SYMMETRIC_ENCRYPTION_CONFIG`' do |path|
+        opts.on "-c", "--config CONFIG_FILE_PATH",
+                "File name & path to the Symmetric Encryption configuration file. Default: config/symmetric-encryption.yml or Env var: `SYMMETRIC_ENCRYPTION_CONFIG`" do |path|
           @config_file_path = path
         end
 
-        opts.on '-m', '--migrate', 'Migrate configuration file to new format.' do
+        opts.on "-m", "--migrate", "Migrate configuration file to new format." do
           @migrate = true
         end
 
-        opts.on '-r', '--re-encrypt [PATTERN]', 'ReEncrypt all files matching the pattern. Default:  "**/*.{yml,rb}"' do |pattern|
-          @re_encrypt = pattern || '**/*.{yml,rb}'
+        opts.on "-r", "--re-encrypt [PATTERN]",
+                'ReEncrypt all files matching the pattern. Default:  "**/*.{yml,rb}"' do |pattern|
+          @re_encrypt = pattern || "**/*.{yml,rb}"
         end
 
-        opts.on '-n', '--new-password [SIZE]', 'Generate a new random password using only characters that are URL-safe base64. Default size is 22.' do |size|
+        opts.on "-n", "--new-password [SIZE]",
+                "Generate a new random password using only characters that are URL-safe base64. Default size is 22." do |size|
           @random_password = (size || 22).to_i
         end
 
-        opts.on '-g', '--generate', 'Generate a new configuration file and encryption keys for every environment.' do |config|
+        opts.on "-g", "--generate", "Generate a new configuration file and encryption keys for every environment." do |config|
           @generate = config
         end
 
-        opts.on '-s', '--keystore heroku|environment|file|aws|gcp', 'Which keystore to use during generation or re-encryption.' do |keystore|
-          @keystore = (keystore || 'file').downcase.to_sym
+        opts.on "-s", "--keystore heroku|environment|file|aws|gcp",
+                "Which keystore to use during generation or re-encryption." do |keystore|
+          @keystore = (keystore || "file").downcase.to_sym
         end
 
-        opts.on '-B', '--regions [us-east-1,us-east-2,us-west-1,us-west-2]', 'AWS KMS Regions to encrypt data key with.' do |regions|
-          @regions = regions.to_s.split(',').collect(&:strip) if regions
+        opts.on "-B", "--regions [us-east-1,us-east-2,us-west-1,us-west-2]",
+                "AWS KMS Regions to encrypt data key with." do |regions|
+          @regions = regions.to_s.split(",").collect(&:strip) if regions
         end
 
-        opts.on '-K', '--key-path KEY_PATH', 'Output path in which to write generated key files. Default: ~/.symmetric-encryption' do |path|
+        opts.on "-K", "--key-path KEY_PATH",
+                "Output path in which to write generated key files. Default: ~/.symmetric-encryption" do |path|
           @key_path = path
         end
 
-        opts.on '-a', '--app-name NAME', 'Application name to use when generating a new configuration. Default: symmetric-encryption' do |name|
+        opts.on "-a", "--app-name NAME",
+                "Application name to use when generating a new configuration. Default: symmetric-encryption" do |name|
           @app_name = name
         end
 
-        opts.on '-S', '--environments ENVIRONMENTS', 'Comma separated list of environments for which to generate the config file. Default: development,test,release,production' do |environments|
-          @environments = environments.split(',').collect(&:strip).collect(&:to_sym)
+        opts.on "-S", "--environments ENVIRONMENTS",
+                "Comma separated list of environments for which to generate the config file. Default: development,test,release,production" do |environments|
+          @environments = environments.split(",").collect(&:strip).collect(&:to_sym)
         end
 
-        opts.on '-C', '--cipher-name NAME', 'Name of the cipher to use when generating a new config file, or when rotating keys. Default: aes-256-cbc' do |name|
+        opts.on "-C", "--cipher-name NAME",
+                "Name of the cipher to use when generating a new config file, or when rotating keys. Default: aes-256-cbc" do |name|
           @cipher_name = name
         end
 
-        opts.on '-R', '--rotate-keys', 'Generates a new encryption key version, encryption key files, and updates the configuration file.' do
+        opts.on "-R", "--rotate-keys",
+                "Generates a new encryption key version, encryption key files, and updates the configuration file." do
           @rotate_keys = true
         end
 
-        opts.on '-U', '--rotate-kek', 'Replace the existing key encrypting keys only, the data encryption key is not changed, and updates the configuration file.' do
+        opts.on "-U", "--rotate-kek",
+                "Replace the existing key encrypting keys only, the data encryption key is not changed, and updates the configuration file." do
           @rotate_kek = true
         end
 
-        opts.on '-D', '--rolling-deploy', 'During key rotation, support a rolling deploy by placing the new key second in the list so that it is not activated yet.' do
+        opts.on "-D", "--rolling-deploy",
+                "During key rotation, support a rolling deploy by placing the new key second in the list so that it is not activated yet." do
           @rolling_deploy = true
         end
 
-        opts.on '-A', '--activate-key', 'Activates the key by moving the key with the highest version to the top.' do
+        opts.on "-A", "--activate-key", "Activates the key by moving the key with the highest version to the top." do
           @activate_key = true
         end
 
-        opts.on '-X', '--cleanup-keys', 'Removes all encryption keys, except the one with the highest version from the configuration file.' do
+        opts.on "-X", "--cleanup-keys",
+                "Removes all encryption keys, except the one with the highest version from the configuration file." do
           @cleanup_keys = true
         end
 
-        opts.on '-V', '--key-version NUMBER', 'Encryption key version to use when encrypting or re-encrypting. Default: (Current global version).' do |number|
+        opts.on "-V", "--key-version NUMBER",
+                "Encryption key version to use when encrypting or re-encrypting. Default: (Current global version)." do |number|
           @version = number.to_i
         end
 
-        opts.on '-L', '--ciphers', 'List available OpenSSL ciphers.' do
+        opts.on "-L", "--ciphers", "List available OpenSSL ciphers." do
           puts "OpenSSL v#{OpenSSL::VERSION}. Available Ciphers:"
           puts OpenSSL::Cipher.ciphers.join("\n")
           exit
         end
 
-        opts.on '-v', '--version', 'Display Symmetric Encryption version.' do
+        opts.on "-v", "--version", "Display Symmetric Encryption version." do
           @show_version = true
         end
 
-        opts.on('-h', '--help', 'Prints this help.') do
+        opts.on("-h", "--help", "Prints this help.") do
           puts opts
           exit
         end
@@ -212,7 +228,7 @@ module SymmetricEncryption
 
       config_file_does_not_exist!
       self.environments ||= %i[development test release production]
-      args                = {
+      args = {
         app_name:     app_name,
         environments: environments,
         cipher_name:  cipher_name
@@ -237,7 +253,8 @@ module SymmetricEncryption
       end
 
       config = Config.read_file(config_file_path)
-      SymmetricEncryption::Keystore.rotate_keys!(config, environments: environments || [], app_name: app_name, rolling_deploy: rolling_deploy, keystore: keystore)
+      SymmetricEncryption::Keystore.rotate_keys!(config, environments: environments || [], app_name: app_name,
+rolling_deploy: rolling_deploy, keystore: keystore)
       Config.write_file(config_file_path, config)
       puts "Existing configuration file updated with new keys: #{config_file_path}"
     end
@@ -255,7 +272,7 @@ module SymmetricEncryption
         next if environments && !environments.include?(env.to_sym)
         next unless ciphers = cfg[:ciphers]
 
-        highest             = ciphers.max_by { |i| i[:version] }
+        highest = ciphers.max_by { |i| i[:version] }
         ciphers.clear
         ciphers << highest
       end
@@ -270,7 +287,7 @@ module SymmetricEncryption
         next if environments && !environments.include?(env.to_sym)
         next unless ciphers = cfg[:ciphers]
 
-        highest             = ciphers.max_by { |i| i[:version] }
+        highest = ciphers.max_by { |i| i[:version] }
         ciphers.delete(highest)
         ciphers.unshift(highest)
       end
@@ -280,7 +297,8 @@ module SymmetricEncryption
     end
 
     def encrypt_file(input_file_name)
-      SymmetricEncryption::Writer.encrypt(source: input_file_name, target: output_file_name || STDOUT, compress: compress, version: version)
+      SymmetricEncryption::Writer.encrypt(source: input_file_name, target: output_file_name || STDOUT, compress: compress,
+version: version)
     end
 
     def decrypt_file(input_file_name)
@@ -289,22 +307,22 @@ module SymmetricEncryption
 
     def decrypt_string
       begin
-        require 'highline'
+        require "highline"
       rescue LoadError
         puts("\nPlease install gem highline before using the command line task to decrypt an entered string.\n   gem install \"highline\"\n\n")
         exit(-2)
       end
 
-      encrypted = HighLine.new.ask('Enter the value to decrypt:')
+      encrypted = HighLine.new.ask("Enter the value to decrypt:")
       text      = SymmetricEncryption.cipher(version).decrypt(encrypted)
 
       puts("\n\nEncrypted: #{encrypted}")
-      output_file_name ? File.open(output_file_name, 'wb') { |f| f << text } : puts("Decrypted: #{text}\n\n")
+      output_file_name ? File.open(output_file_name, "wb") { |f| f << text } : puts("Decrypted: #{text}\n\n")
     end
 
     def encrypt_string
       begin
-        require 'highline'
+        require "highline"
       rescue LoadError
         puts("\nPlease install gem highline before using the command line task to encrypt an entered string.\n   gem install \"highline\"\n\n")
         exit(-2)
@@ -313,14 +331,14 @@ module SymmetricEncryption
       value2 = 0
 
       while value1 != value2
-        value1 = HighLine.new.ask('Enter the value to encrypt:') { |q| q.echo = '*' }
-        value2 = HighLine.new.ask('Re-enter the value to encrypt:') { |q| q.echo = '*' }
+        value1 = HighLine.new.ask("Enter the value to encrypt:") { |q| q.echo = "*" }
+        value2 = HighLine.new.ask("Re-enter the value to encrypt:") { |q| q.echo = "*" }
 
-        puts('Values do not match, please try again') if value1 != value2
+        puts("Values do not match, please try again") if value1 != value2
       end
       compress  = false if compress.nil?
       encrypted = SymmetricEncryption.cipher(version).encrypt(value1, compress: compress)
-      output_file_name ? File.open(output_file_name, 'wb') { |f| f << encrypted } : puts("\n\nEncrypted: #{encrypted}\n\n")
+      output_file_name ? File.open(output_file_name, "wb") { |f| f << encrypted } : puts("\n\nEncrypted: #{encrypted}\n\n")
     end
 
     def gen_random_password(size)
@@ -328,7 +346,7 @@ module SymmetricEncryption
       puts("\nGenerated Password: #{p}")
       encrypted = SymmetricEncryption.encrypt(p)
       puts("Encrypted: #{encrypted}\n\n")
-      File.open(output_file_name, 'wb') { |f| f << encrypted } if output_file_name
+      File.open(output_file_name, "wb") { |f| f << encrypted } if output_file_name
     end
 
     def current_version

data/lib/symmetric_encryption/coerce.rb

@@ -14,7 +14,7 @@ module SymmetricEncryption
     # Coerce given value into given type
     # Does not coerce json or yaml values
     def self.coerce(value, type, from_type = nil)
-      return value if value.nil? || (value == '')
+      return value if value.nil? || (value == "")
 
       from_type ||= value.class
       case type
@@ -32,7 +32,7 @@ module SymmetricEncryption
     # Note: if the type is :string, then the value is returned as is, and the
     #   coercible gem is not used at all.
     def self.coerce_from_string(value, type)
-      return value if value.nil? || (value == '')
+      return value if value.nil? || (value == "")
 
       case type
       when :string
@@ -50,7 +50,7 @@ module SymmetricEncryption
     # Note: if the type is :string, and value is not nil, then #to_s is called
     #   on the value and the coercible gem is not used at all.
     def self.coerce_to_string(value, type)
-      return value if value.nil? || (value == '')
+      return value if value.nil? || (value == "")
 
       case type
       when :string