symmetric-encryption 4.3.0 → 4.3.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/symmetric_encryption/active_record/attr_encrypted.rb +1 -1
- data/lib/symmetric_encryption/keystore.rb +1 -1
- data/lib/symmetric_encryption/keystore/aws.rb +1 -1
- data/lib/symmetric_encryption/keystore/environment.rb +1 -1
- data/lib/symmetric_encryption/keystore/file.rb +11 -7
- data/lib/symmetric_encryption/keystore/gcp.rb +17 -15
- data/lib/symmetric_encryption/keystore/memory.rb +1 -1
- data/lib/symmetric_encryption/railtie.rb +5 -4
- data/lib/symmetric_encryption/symmetric_encryption.rb +1 -1
- data/lib/symmetric_encryption/utils/aws.rb +0 -2
- data/lib/symmetric_encryption/utils/files.rb +1 -1
- data/lib/symmetric_encryption/utils/re_encrypt_files.rb +3 -3
- data/lib/symmetric_encryption/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 860217558341999072c177c7d848fa6315667a7fcb12d9e1d9a518ecda43a2c4
|
4
|
+
data.tar.gz: f0aa6a3419a15edfba8fcc37b72a1282057efbbe09653a7a04ff4687dcc87bd6
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 870814f9d0d82dbd3edb405da82017c1d3533c4c7402e7ed0f9ac5e797a3c5e98500ac81912926076c84ddb90e3f287c097db65e5ff5202a22e5b053cfd83ba5
|
7
|
+
data.tar.gz: eba6e94c5ed7755795ac8bbfcf83cd0a08d6206888bcfbdc30d33bcc61dcb7403ae7afe0c6d187608cf02550f0a3bce6eeefeb464ac860b1b1d64282e4d047be
|
@@ -51,7 +51,7 @@ module SymmetricEncryption
|
|
51
51
|
random_iv = true if random_iv.nil? && SymmetricEncryption.randomize_iv?
|
52
52
|
|
53
53
|
if random_iv.nil?
|
54
|
-
warn(
|
54
|
+
warn('attr_encrypted() no longer allows a default value for option `random_iv`. Add `random_iv: false` if it is required.')
|
55
55
|
end
|
56
56
|
|
57
57
|
attributes.each do |attribute|
|
@@ -202,7 +202,7 @@ module SymmetricEncryption
|
|
202
202
|
def self.camelize(term)
|
203
203
|
string = term.to_s
|
204
204
|
string = string.sub(/^[a-z\d]*/, &:capitalize)
|
205
|
-
string.gsub!(
|
205
|
+
string.gsub!(%r{(?:_|(/))([a-z\d]*)}i) { "#{Regexp.last_match(1)}#{Regexp.last_match(2).capitalize}" }
|
206
206
|
string.gsub!('/'.freeze, '::'.freeze)
|
207
207
|
string
|
208
208
|
end
|
@@ -7,7 +7,7 @@ module SymmetricEncryption
|
|
7
7
|
# Returns [Hash] a new keystore configuration after generating the data key.
|
8
8
|
#
|
9
9
|
# Increments the supplied version number by 1.
|
10
|
-
def self.generate_data_key(cipher_name:, app_name:, environment:, version: 0, dek: nil, **
|
10
|
+
def self.generate_data_key(cipher_name:, app_name:, environment:, version: 0, dek: nil, **_args)
|
11
11
|
version >= 255 ? (version = 1) : (version += 1)
|
12
12
|
|
13
13
|
kek = SymmetricEncryption::Key.new(cipher_name: cipher_name)
|
@@ -8,7 +8,7 @@ module SymmetricEncryption
|
|
8
8
|
# Returns [Hash] a new keystore configuration after generating the data key.
|
9
9
|
#
|
10
10
|
# Increments the supplied version number by 1.
|
11
|
-
def self.generate_data_key(key_path:, cipher_name:, app_name:, environment:, version: 0, dek: nil, **
|
11
|
+
def self.generate_data_key(key_path:, cipher_name:, app_name:, environment:, version: 0, dek: nil, **_args)
|
12
12
|
version >= 255 ? (version = 1) : (version += 1)
|
13
13
|
|
14
14
|
dek ||= SymmetricEncryption::Key.new(cipher_name: cipher_name)
|
@@ -47,11 +47,15 @@ module SymmetricEncryption
|
|
47
47
|
|
48
48
|
# Returns the Encryption key in the clear.
|
49
49
|
def read
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
50
|
+
unless ::File.exist?(file_name)
|
51
|
+
raise(SymmetricEncryption::ConfigError,
|
52
|
+
"Symmetric Encryption key file: '#{file_name}' not found")
|
53
|
+
end
|
54
|
+
unless correct_permissions?
|
55
|
+
raise(SymmetricEncryption::ConfigError,
|
56
|
+
"Symmetric Encryption key file '#{file_name}' has the wrong "\
|
57
|
+
"permissions: #{::File.stat(file_name).mode.to_s(8)}. Expected 100600 or 100400.")
|
58
|
+
end
|
55
59
|
|
56
60
|
data = read_from_file(file_name)
|
57
61
|
key_encrypting_key ? key_encrypting_key.decrypt(data) : data
|
@@ -71,7 +75,7 @@ module SymmetricEncryption
|
|
71
75
|
def correct_permissions?
|
72
76
|
stat = ::File.stat(file_name)
|
73
77
|
|
74
|
-
stat.owned? && %w
|
78
|
+
stat.owned? && %w[100600 100400].include?(stat.mode.to_s(8))
|
75
79
|
end
|
76
80
|
end
|
77
81
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require 'google/cloud/kms/v1'
|
2
2
|
|
3
3
|
module SymmetricEncryption
|
4
4
|
module Keystore
|
@@ -8,9 +8,9 @@ module SymmetricEncryption
|
|
8
8
|
def self.generate_data_key(version: 0, cipher_name:, app_name:, environment:, key_path:)
|
9
9
|
version >= 255 ? (version = 1) : (version += 1)
|
10
10
|
|
11
|
-
dek
|
11
|
+
dek = SymmetricEncryption::Key.new(cipher_name: cipher_name)
|
12
12
|
file_name = "#{key_path}/#{app_name}_#{environment}_v#{version}.encrypted_key"
|
13
|
-
keystore
|
13
|
+
keystore = new(
|
14
14
|
key_file: file_name,
|
15
15
|
app_name: app_name,
|
16
16
|
environment: environment
|
@@ -18,21 +18,21 @@ module SymmetricEncryption
|
|
18
18
|
keystore.write(dek.key)
|
19
19
|
|
20
20
|
{
|
21
|
-
keystore:
|
22
|
-
cipher_name:
|
23
|
-
version:
|
24
|
-
key_file:
|
25
|
-
iv:
|
26
|
-
crypto_key:
|
21
|
+
keystore: :gcp,
|
22
|
+
cipher_name: dek.cipher_name,
|
23
|
+
version: version,
|
24
|
+
key_file: file_name,
|
25
|
+
iv: dek.iv,
|
26
|
+
crypto_key: keystore.crypto_key
|
27
27
|
}
|
28
28
|
end
|
29
29
|
|
30
30
|
def initialize(key_file:, app_name: nil, environment: nil, key_encrypting_key: nil, crypto_key: nil, project_id: nil, credentials: nil, location_id: nil)
|
31
|
-
@crypto_key
|
32
|
-
@app_name
|
31
|
+
@crypto_key = crypto_key
|
32
|
+
@app_name = app_name
|
33
33
|
@environment = environment
|
34
|
-
@file_name
|
35
|
-
@project_id
|
34
|
+
@file_name = key_file
|
35
|
+
@project_id = project_id
|
36
36
|
@credentials = credentials
|
37
37
|
@location_id = location_id
|
38
38
|
end
|
@@ -68,19 +68,21 @@ module SymmetricEncryption
|
|
68
68
|
end
|
69
69
|
|
70
70
|
def project_id
|
71
|
-
@project_id ||= ENV[
|
71
|
+
@project_id ||= ENV['GOOGLE_CLOUD_PROJECT']
|
72
72
|
raise 'GOOGLE_CLOUD_PROJECT must be set' if @project_id.nil?
|
73
|
+
|
73
74
|
@project_id
|
74
75
|
end
|
75
76
|
|
76
77
|
def credentials
|
77
78
|
@credentials ||= ENV['GOOGLE_CLOUD_KEYFILE']
|
78
79
|
raise 'GOOGLE_CLOUD_KEYFILE must be set' if @credentials.nil?
|
80
|
+
|
79
81
|
@credentials
|
80
82
|
end
|
81
83
|
|
82
84
|
def location_id
|
83
|
-
@location_id ||= ENV[
|
85
|
+
@location_id ||= ENV['GOOGLE_CLOUD_LOCATION'] || 'global'
|
84
86
|
end
|
85
87
|
end
|
86
88
|
end
|
@@ -12,7 +12,7 @@ module SymmetricEncryption
|
|
12
12
|
# Notes:
|
13
13
|
# * For development and testing purposes only!!
|
14
14
|
# * Never store the encrypted encryption key in the source code / config file.
|
15
|
-
def self.generate_data_key(cipher_name:, app_name:, environment:, version: 0, dek: nil, **
|
15
|
+
def self.generate_data_key(cipher_name:, app_name:, environment:, version: 0, dek: nil, **_args)
|
16
16
|
version >= 255 ? (version = 1) : (version += 1)
|
17
17
|
|
18
18
|
kek = SymmetricEncryption::Key.new(cipher_name: cipher_name)
|
@@ -29,7 +29,8 @@ module SymmetricEncryption #:nodoc:
|
|
29
29
|
config.before_configuration do
|
30
30
|
# Check if already configured
|
31
31
|
unless ::SymmetricEncryption.cipher?
|
32
|
-
|
32
|
+
parent_method = Module.method_defined?(:module_parent) ? 'module_parent' : 'parent'
|
33
|
+
app_name = Rails::Application.subclasses.first.send(parent_method).to_s.underscore
|
33
34
|
env_var = ENV['SYMMETRIC_ENCRYPTION_CONFIG']
|
34
35
|
config_file =
|
35
36
|
if env_var
|
@@ -41,11 +42,11 @@ module SymmetricEncryption #:nodoc:
|
|
41
42
|
if config_file.file?
|
42
43
|
begin
|
43
44
|
::SymmetricEncryption::Config.load!(file_name: config_file, env: ENV['SYMMETRIC_ENCRYPTION_ENV'] || Rails.env)
|
44
|
-
rescue ArgumentError =>
|
45
|
+
rescue ArgumentError => e
|
45
46
|
puts "\nSymmetric Encryption not able to read keys."
|
46
|
-
puts "#{
|
47
|
+
puts "#{e.class.name} #{e.message}"
|
47
48
|
puts "To generate a new config file and key files: symmetric-encryption --generate --app-name #{app_name}\n\n"
|
48
|
-
raise(
|
49
|
+
raise(e)
|
49
50
|
end
|
50
51
|
end
|
51
52
|
|
@@ -31,7 +31,7 @@ module SymmetricEncryption
|
|
31
31
|
key_path = ::File.dirname(file_name)
|
32
32
|
::FileUtils.mkdir_p(key_path) unless ::File.directory?(key_path)
|
33
33
|
::File.rename(file_name, "#{file_name}.#{Time.now.to_i}") if ::File.exist?(file_name)
|
34
|
-
::File.open(file_name, 'wb',
|
34
|
+
::File.open(file_name, 'wb', 0o600) { |file| file.write(data) }
|
35
35
|
end
|
36
36
|
|
37
37
|
# Read from the file, raising an exception if it is not found
|
@@ -117,8 +117,8 @@ module SymmetricEncryption
|
|
117
117
|
begin
|
118
118
|
count = re_encrypt_contents(file_name)
|
119
119
|
puts "Re-encrypted #{count} encrypted value(s) in: #{file_name}" if count.positive?
|
120
|
-
rescue StandardError =>
|
121
|
-
puts "Failed re-encrypting the file contents of: #{file_name}. #{
|
120
|
+
rescue StandardError => e
|
121
|
+
puts "Failed re-encrypting the file contents of: #{file_name}. #{e.class.name}: #{e.message}"
|
122
122
|
end
|
123
123
|
end
|
124
124
|
end
|
@@ -127,7 +127,7 @@ module SymmetricEncryption
|
|
127
127
|
private
|
128
128
|
|
129
129
|
def regexp
|
130
|
-
@regexp ||=
|
130
|
+
@regexp ||= %r{#{SymmetricEncryption.cipher.encoded_magic_header}([A-Za-z0-9+/]+[=\\n]*)}
|
131
131
|
end
|
132
132
|
|
133
133
|
# Returns [Integer] encrypted file key version.
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: symmetric-encryption
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.3.
|
4
|
+
version: 4.3.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Reid Morrison
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2019-
|
11
|
+
date: 2019-10-10 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: coercible
|