varlock 1.23.0-arm64-darwin

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4908570f3de01fb33e593e5bdb5d12349ccfc19cc58e4910029ce040f1ab84a1
+  data.tar.gz: 22d18a012d7c4c57dde5d24ced89ee8774ba8fb384d5faee165acd62340e884e
+SHA512:
+  metadata.gz: cb4c1692f513632711a046633517011a4f716bb84844d8052a5e743f504b1dc956f991f0516caf138da37b7c93650657376e592d7052337e2c53ff011e8d4aba
+  data.tar.gz: c6eb22d4fc0dae28deb989e868120459bcf0e1d3305762e25b950dc798543fa8731554e88741c4caa9b068aa894a47f8e4a7a554b046159adf83cb908acc8843

data/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 1.23.0 (unreleased)
+
+Initial Ruby gem release, bundling Varlock CLI 1.23.0.
+
+- Ship platform gems for macOS ARM64 and Linux x86_64 with glibc, with verified upstream downloads and encryption helpers.
+- Load typed configuration with `Varlock.load!`, apply values with `Varlock.load_and_set!`, and access the last successful load through `Varlock.config`.
+- Provide an optional Rails boot integration and the `varlock:check` Rake task.
+- Forward CLI arguments, streams, and exit status through `bundle exec varlock`.
+
+Requires Ruby 2.7 or later. Rails is optional and has its own Ruby requirements.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 akodkod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,259 @@
+# Varlock for Ruby
+
+A small, unofficial Ruby wrapper around the [Varlock CLI](https://varlock.dev).
+Varlock resolves and validates your configuration; this gem returns typed Ruby values and can apply them to `ENV`.
+
+## Setup
+
+Platform gems include Varlock 1.23.0 for macOS ARM64 (`arm64-darwin`) or Linux
+x86_64 with glibc (`x86_64-linux-gnu`). No separate Varlock or Node.js installation
+is needed. Alpine/musl, Intel macOS, Linux ARM64, and Windows are not packaged.
+Configure your `.env.schema` and `.env` files using Varlock.
+
+For a source checkout, run `ruby script/build.rb` before `bundle install` to
+download and package the host binary. Published platform gems need no download
+at installation or runtime.
+
+Once the release is published to RubyGems, add:
+
+```ruby
+# Gemfile
+gem "varlock", "~> 1.23.0"
+```
+
+Then run `bundle install`. Before publication, use `path: "/path/to/varlock"`
+in your Gemfile or install the built platform gem from `pkg/`.
+
+```sh
+bundle exec varlock --version
+bundle exec varlock load
+bundle exec varlock run -- ruby app.rb
+```
+
+The Ruby launcher directly executes the bundled binary, forwarding arguments,
+streams, and exit status. It never searches `PATH` for another `varlock`.
+
+## Ruby
+
+```ruby
+require "varlock"
+
+config = Varlock.load! # Typed values; leaves ENV unchanged
+config.fetch("DATABASE_URL")
+
+Varlock.load_and_set! # Stringifies values and updates ENV
+ENV.fetch("DATABASE_URL")
+
+# Optional settings:
+Varlock.load_and_set!(path: "/path/to/app", env: "production", executable: "/usr/local/bin/varlock")
+Varlock.load_and_set!(path: "/path/to/monorepo", env: nil, filter: "#api")
+```
+
+Both methods accept the same options and invoke `varlock load --format json` without a shell. With no path,
+Varlock uses its default search location. The environment defaults to
+`ENV["RAILS_ENV"] || ENV["RACK_ENV"] || "development"`, evaluated on each call.
+Pass `env:` to override it, or `env: nil` to omit the CLI's `--env` option.
+A schema's `@currentEnv` takes
+precedence over `env:`. By default, the loader uses the bundled binary.
+The executable option is a single program path, not a shell command.
+
+`load!` returns a hash with the original JSON types, including nil values, without
+changing `ENV`. `load_and_set!` returns a hash of the strings applied to `ENV`. Matching existing keys
+are overwritten with Varlock's resolved values; unrelated keys are preserved.
+Strings are kept verbatim, numbers and booleans become strings, and arrays/objects
+are JSON encoded. Null values and omitted keys are skipped, preserving any existing
+value. All output is parsed and checked before any environment variables are changed.
+Call at startup, before starting application threads. Each call resolves again.
+
+`Varlock.config` contains the original JSON values from the last successful load,
+with unchanged string keys and native Ruby numbers, booleans, arrays, hashes, and
+nil values. It is nil before the first successful load. Each successful load replaces
+it; failed loads leave it unchanged. Both methods update `Varlock.config`.
+
+Code that previously used `load!` to populate `ENV` should use `load_and_set!`.
+
+For a Sorbet struct, transform keys in your application's `env.rb` and instantiate
+the struct directly after loading. For example, given schema keys `APP_PORT` and
+`APP_DEBUG`:
+
+```ruby
+class EnvConfig < T::Struct
+  const :port, Integer
+  const :debug, T::Boolean
+end
+
+config = T.must(Varlock.config)
+attributes = config.transform_keys { |key| key.delete_prefix("APP_").downcase.to_sym }
+Env = T.let(EnvConfig.new(**attributes), EnvConfig)
+```
+
+The config keys must match the struct's fields after transformation. Custom enum
+values still need conversion to their Ruby enum instances. No `sorbet-schema`
+deserialization or custom coercer is needed for native JSON types.
+
+On CLI failure, missing executable, or invalid output, `Varlock::Error` is raised.
+CLI failures include Varlock's stderr diagnostics, showing configuration errors
+automatically without resolving a second time. Varlock handles redaction of its
+diagnostics; custom executables should also avoid writing secrets to stderr.
+Captured JSON stdout and JSON parse details are never included in errors.
+If the CLI provides no diagnostics, the error suggests running `bundle exec varlock load`.
+
+## Rails
+
+Use the optional Rails entry point instead of the default require:
+
+```ruby
+# Gemfile
+gem "varlock", "~> 1.23.0", require: "varlock/rails"
+```
+
+The Railtie calls `Varlock.load_and_set!` in `before_configuration`, using the application
+root and `Rails.env`. It runs in all environments, including tests, and a failure
+stops application boot. Rails remains an optional dependency.
+
+For variables needed earlier (for example, by another gem at require time), use
+`require: false` in the Gemfile and load explicitly in `config/boot.rb`, immediately
+after `require "bundler/setup"`:
+
+```ruby
+require "varlock"
+Varlock.load_and_set!(path: File.expand_path("..", __dir__))
+```
+
+Choose either explicit boot loading or the Rails adapter to avoid resolving twice.
+Avoid loading a second dotenv loader afterward, which could overwrite validated values.
+
+If you already launch through `varlock run -- bundle exec rails server`, you can
+use the injected `ENV` directly without this gem. The adapter does not detect or
+skip a surrounding `varlock run`, and this gem does not add runtime log redaction.
+
+## Checking configuration
+
+With the Rails adapter, the validation task is registered automatically:
+
+```sh
+bin/rails varlock:check
+RAILS_ENV=production bin/rails varlock:check
+# Or: bundle exec rake varlock:check
+```
+
+For a plain Ruby project, add this to your `Rakefile`:
+
+```ruby
+require "varlock/tasks"
+```
+
+Then run `bundle exec rake varlock:check`. The task runs `varlock load --format pretty`
+with native stdout and stderr, including Varlock's validation summary and redaction.
+It preserves the CLI's exit code on validation failure. It does not apply values
+to `ENV` or update `Varlock.config`.
+
+Configure the task using `VARLOCK_PATH`, `VARLOCK_FILTER`, and `VARLOCK_ENV`:
+
+```sh
+VARLOCK_PATH=/path/to/app VARLOCK_FILTER='#api' bundle exec rake varlock:check
+VARLOCK_PATH=/path/to/app VARLOCK_FILTER='#api' VARLOCK_ENV=production bin/rails varlock:check
+VARLOCK_FILTER='APP_*,!APP_SECRET' bundle exec rake varlock:check
+```
+
+The task accepts configuration only through environment variables. Without overrides,
+plain Rake uses the loader's default path and environment; Rails uses the application
+root and `Rails.env`. `VARLOCK_ENV` overrides the default environment in both cases.
+The filter controls which items the CLI shows.
+
+The task does not initialize the Rails application. When `varlock:check` is the
+only requested task, the Rails adapter skips its auto-loading hook, so validation
+runs once with the supplied overrides. If you request additional tasks in the same
+command, the hook still runs to supply their environment configuration.
+
+## Development
+
+```sh
+ruby script/build.rb
+bundle install
+bundle exec rake test
+ruby script/smoke.rb
+```
+
+Default tests use a fixture executable and do not need Varlock or real secrets. To include
+the actual Rails boot test, install with `RAILS_VERSION='~> 7.2.0' bundle install`
+and run `RAILS_VERSION='~> 7.2.0' bundle exec rake test` on Ruby 3.2+.
+CI builds and tests Linux x86_64 and macOS ARM64 packages, including the installed
+gem launcher and real CLI integration. Ruby 2.7+ is accepted by the gem;
+Rails has its own newer Ruby requirements.
+
+### RuboCop
+
+Use Ruby 3.2+ for development tooling, then run `bundle install` and
+`bundle exec rubocop`. The configuration is adapted from 811spotter's API,
+keeping core Ruby rules, `rubocop-performance`, and the pinned `rubocop-sane`
+plugin. Rails, RSpec, GraphQL, Sorbet, and app-specific rules are omitted.
+Test exclusions use `test/` rather than `spec/`.
+
+The lint target is Ruby 2.7, the oldest target supported by this RuboCop version;
+the gem's runtime requirement remains Ruby 2.7+. Existing files have not been
+bulk-formatted as part of importing these rules.
+
+### Testing with the real Varlock CLI
+
+Build the bundled CLI, then enable the optional integration tests:
+
+```sh
+ruby script/build.rb
+VARLOCK_INTEGRATION=1 bundle exec rake test
+# Include the Rails test too, after installing its dependency as described above:
+RAILS_VERSION='~> 7.2.0' VARLOCK_INTEGRATION=1 bundle exec rake test
+```
+
+The real CLI tests copy `test/fixtures/schema/.env.schema` into a temporary
+directory. They check defaults, numbers/booleans, interpolation, synthetic sensitive
+values, empty/undefined values, `.env.test` overrides, and failures for an invalid
+number or missing required value. No real credentials or external services are used.
+These tests were verified locally with Varlock 1.23.0 and Ruby 3.3.5.
+
+To try the fixture directly from this checkout:
+
+```sh
+ruby -Ilib -rvarlock -e 'Varlock.load_and_set!(path: "test/fixtures/schema"); puts ENV.fetch("VARLOCK_REAL_URL")'
+# http://localhost:3000
+```
+
+The Ruby wrapper is available under the [MIT license](LICENSE). The bundled
+Varlock CLI retains its [upstream MIT license](licenses/VARLOCK-MIT.txt).
+See [RELEASING.md](RELEASING.md) for validation and publishing instructions.
+
+## Building platform gems
+
+```sh
+ruby script/build.rb arm64-darwin
+ruby script/build.rb x86_64-linux-gnu
+```
+
+Both commands can run on either supported host; executing the result requires
+the matching platform. Packages are written to `pkg/`. Each contains only its
+platform's executable and upstream encryption helpers, plus the upstream MIT
+license in `licenses/VARLOCK-MIT.txt`. Downloads are cached under `vendor/downloads`
+by CLI version and checked against pinned SHA-256 hashes in `lib/varlock/release.json`.
+Source maps are omitted. Binaries and built gems are ignored by Git.
+
+## Updating bundled Varlock
+
+```sh
+ruby script/update_binaries.rb 1.23.0  # Replace with the desired release version
+RAILS_VERSION='~> 7.2.0' VARLOCK_INTEGRATION=1 bundle exec rake test
+ruby script/smoke.rb
+```
+
+The updater downloads the release's `checksums.txt`, both platform archives, and
+its license. It verifies both archives before updating the version/checksum pins
+in `lib/varlock/release.json`, refreshes the license, and rebuilds both gems in
+`pkg/`. A failed download or checksum check leaves the existing pins and binaries
+unchanged. If a build fails after the pins are updated, rerun `script/build.rb`
+for that platform. An explicit stable release version is required; the script
+does not silently select the latest version or publish packages.
+
+Review the manifest and license changes and run runtime tests on both hosts.
+The gem version matches the embedded CLI version. The updater generates
+`lib/varlock/version.rb` from the verified release version before building both
+packages, so there is no separate manual version bump. Versioned download caches
+prevent reuse of older archives.

data/RELEASING.md

@@ -0,0 +1,67 @@
+# Releasing
+
+The gem version follows the bundled CLI version. The first prepared release is
+1.23.0. Publishing is manual; building or updating binaries never uploads gems.
+
+## Prepare and validate
+
+Use Ruby 3.2+ for development tooling. For a new CLI release, first run
+`ruby script/update_binaries.rb VERSION` and review the manifest and upstream license.
+For a wrapper-only follow-up, use a fourth version component (for example
+1.23.0.1) and update the version-equality checks and updater policy before releasing.
+RubyGems versions cannot be replaced after publication.
+
+1. Update `CHANGELOG.md`, replacing `unreleased` with the release date.
+2. Build both platform gems:
+
+   ```sh
+   ruby script/build.rb arm64-darwin
+   ruby script/build.rb x86_64-linux-gnu
+   ```
+
+3. On each supported host, run the checks used by CI:
+
+   ```sh
+   RAILS_VERSION='~> 7.2.0' bundle install
+   bundle exec rubocop
+   RAILS_VERSION='~> 7.2.0' VARLOCK_INTEGRATION=1 bundle exec rake test
+   ruby script/smoke.rb
+   ```
+
+   The smoke test installs the host package into a temporary gem directory and
+   exercises its CLI, Ruby loader, and exit status. Cross-building does not test
+   the other platform's executable. Require passing Linux and macOS CI before publishing.
+
+4. Review and commit the release changes. Confirm both packages contain `LICENSE`,
+   `licenses/VARLOCK-MIT.txt`, the release manifest, and only the intended platform's
+   binaries. Keep the resulting artifacts for publication.
+
+Use `script/build.rb`, not plain `gem build`: the build script verifies upstream
+checksums and sets the platform explicitly. The source-checkout specification uses
+the generic Ruby platform for Bundler; that generic package must not be published.
+Avoid wildcard pushes because `pkg/` may contain artifacts from older versions.
+
+## Publish
+
+Confirm the `varlock` name is available or owned by your RubyGems account. Enable
+MFA on the account (required by the gem metadata), and authenticate using your
+normal RubyGems credentials. Do not commit API keys.
+
+For version 1.23.0, publish exactly these artifacts after validation:
+
+```sh
+gem push pkg/varlock-1.23.0-arm64-darwin.gem
+gem push pkg/varlock-1.23.0-x86_64-linux-gnu.gem
+```
+
+Verify both platforms appear on RubyGems, then tag the committed release:
+
+```sh
+git tag -a v1.23.0 -m 'Release 1.23.0'
+git push origin v1.23.0
+```
+
+If only one upload succeeds, retry only the missing platform. Verify a fresh
+`gem install varlock -v 1.23.0` on each supported host and create a GitHub release
+using the changelog notes. Update the README's prepublication wording when the
+packages are live.

data/exe/varlock

@@ -0,0 +1,11 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "varlock"
+
+begin
+  exec(Varlock.executable_path, *ARGV)
+rescue Varlock::Error, SystemCallError => e
+  warn "varlock: #{e.message}"
+  exit 1
+end

data/lib/varlock/binary.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "rubygems"
+require "json"
+
+module Varlock
+  class Error < StandardError; end
+
+  RELEASE = JSON.parse(File.read(File.join(__dir__, "release.json")))
+  CLI_VERSION = RELEASE.fetch("version").freeze
+  SUPPORTED_PLATFORMS = RELEASE.fetch("platforms").keys.freeze
+
+  def self.binary_platform
+    platform = Gem::Platform.local
+    return "arm64-darwin" if platform.os == "darwin" && platform.cpu == "arm64"
+
+    if platform.os == "linux" && platform.cpu == "x86_64" && platform.version != "musl"
+      return "x86_64-linux-gnu"
+    end
+
+    raise Error, "No bundled Varlock for #{platform}. Pass executable: to use your own CLI."
+  end
+
+  def self.executable_path
+    path = File.expand_path("../../vendor/#{binary_platform}/varlock", __dir__)
+
+    unless File.executable?(path)
+      raise Error, "Bundled Varlock is missing. Reinstall the platform gem or run ruby script/build.rb in a source checkout."
+    end
+
+    path
+  end
+end

data/lib/varlock/rails.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "varlock"
+require "rails/railtie"
+
+module Varlock
+  class Railtie < Rails::Railtie
+    rake_tasks do
+      require "varlock/tasks"
+    end
+
+    config.before_configuration do |app|
+      next if defined?(Rake) && Rake.application.top_level_tasks == ["varlock:check"]
+
+      Varlock.load_and_set!(path: app.root.to_s, env: Rails.env.to_s)
+    end
+  end
+end

data/lib/varlock/release.json

@@ -0,0 +1,13 @@
+{
+  "version": "1.23.0",
+  "platforms": {
+    "arm64-darwin": {
+      "archive": "varlock-macos-arm64.tar.gz",
+      "sha256": "7d14daeb9d749b24355280954a9c1b7087533855296b3ac44df6c46ba7d582bc"
+    },
+    "x86_64-linux-gnu": {
+      "archive": "varlock-linux-x64.tar.gz",
+      "sha256": "a40d86ceddde2f032cd8bdc594feca74f60754d01615c1a11031c9f4ca97e8ed"
+    }
+  }
+}

data/lib/varlock/tasks.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require "rake"
+require "varlock"
+
+namespace :varlock do
+  desc "Validate configuration with native Varlock output (VARLOCK_PATH, VARLOCK_FILTER, VARLOCK_ENV)"
+  task :check do
+    rails_app = Rails.application if defined?(Rails) && Rails.respond_to?(:application)
+
+    path = ENV["VARLOCK_PATH"] || rails_app&.root&.to_s
+    filter = ENV["VARLOCK_FILTER"]
+    env = ENV["VARLOCK_ENV"] || (rails_app ? Rails.env.to_s : ENV["RAILS_ENV"] || ENV["RACK_ENV"] || "development")
+
+    command = [Varlock.executable_path.to_s, "load", "--format", "pretty"]
+    command.push("--path", path) if path
+    command.push("--filter", filter) if filter
+    command.push("--env", env)
+
+    success = system(*command)
+    raise Varlock::Error, "Could not start the Varlock executable. Check its path and permissions." if success.nil?
+
+    exit(Process.last_status.exitstatus || 1) unless success
+  end
+end

data/lib/varlock/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Generated by script/update_binaries.rb from the pinned Varlock release
+module Varlock
+  VERSION = "1.23.0"
+end

data/lib/varlock.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require_relative "varlock/version"
+require_relative "varlock/binary"
+
+module Varlock
+  # Original JSON values from the last successful load, or nil before loading
+  def self.config
+    @config
+  end
+
+  # Resolve and validate configuration without changing ENV. Preserve JSON types.
+  def self.load!(**options)
+    config, = resolve_values(**options)
+    @config = config
+  end
+
+  # Resolve and validate everything before changing ENV. Returned values are strings.
+  def self.load_and_set!(**options)
+    config, values = resolve_values(**options)
+    ENV.update(values)
+    @config = config
+    values
+  end
+
+  def self.resolve_values(path: nil, env: ENV["RAILS_ENV"] || ENV["RACK_ENV"] || "development", filter: nil, executable: executable_path)
+    command = [executable.to_s, "load", "--format", "json"]
+    command.push("--path", path.to_s) if path
+    command.push("--env", env.to_s) if env
+    command.push("--filter", filter.to_s) if filter
+    stdout, stderr, status = Open3.capture3(*command)
+
+    unless status.success?
+      message = "Varlock failed (exit #{status.exitstatus || 'signal'})."
+      diagnostics = stderr.strip
+      message += diagnostics.empty? ? " Run bundle exec varlock load to inspect configuration." : "\n#{diagnostics}"
+      raise Error, message
+    end
+
+    parse_values(stdout)
+  rescue Errno::ENOENT
+    raise Error, "Varlock executable not found. Install the Varlock CLI or pass executable:.", cause: nil
+  rescue Errno::EACCES
+    raise Error, "Varlock executable is not executable. Check its permissions.", cause: nil
+  end
+  private_class_method :resolve_values
+
+  def self.parse_values(output)
+    data = JSON.parse(output)
+    raise Error, "Varlock output must be a JSON object." unless data.is_a?(Hash)
+
+    values = data.each_with_object({}) do |(key, value), result|
+      if key.empty? || key.include?("=") || key.include?("\0")
+        raise Error, "Varlock returned an invalid environment variable name."
+      end
+
+      next if value.nil?
+
+      string = value.is_a?(String) ? value : JSON.generate(value)
+      raise Error, "Varlock returned a value containing a null byte." if string.include?("\0")
+
+      result[key] = string
+    end
+
+    [data, values]
+  rescue JSON::ParserError, JSON::GeneratorError
+    # Parser exceptions can contain secrets from the input. Do not chain them.
+    raise Error, "Varlock returned invalid JSON.", cause: nil
+  end
+  private_class_method :parse_values
+end

data/licenses/VARLOCK-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DMNO Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/vendor/arm64-darwin/VarlockEnclave.app/Contents/Info.plist

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleIdentifier</key>
+    <string>dev.varlock.enclave</string>
+    <key>CFBundleName</key>
+    <string>Varlock</string>
+    <key>CFBundleDisplayName</key>
+    <string>Varlock</string>
+    <key>CFBundleExecutable</key>
+    <string>varlock-local-encrypt</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleVersion</key>
+    <string>1.0.0</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0.0</string>
+    <key>LSUIElement</key>
+    <true/>
+    <key>CFBundleIconFile</key>
+    <string>AppIcon</string>
+    <key>VarlockBuildMode</key>
+    <string>release</string>
+    <key>VarlockMenuTitle</key>
+    <string>Varlock Secure Enclave</string>
+</dict>
+</plist>

data/vendor/arm64-darwin/VarlockEnclave.app/Contents/_CodeSignature/CodeResources

@@ -0,0 +1,150 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>files</key>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<data>
+		7pqZoA5SEXJ19XbUt8/+uKcwwo4=
+		</data>
+		<key>Resources/varlock-menu-locked.pdf</key>
+		<data>
+		1xwT5rifR1mshOLBddpLZXh4a4w=
+		</data>
+		<key>Resources/varlock-menu-unlocked.pdf</key>
+		<data>
+		qFcSJbv7hIQVNODaABBNfrU9hMk=
+		</data>
+	</dict>
+	<key>files2</key>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			/1DSpeGQVKvj2oN3sO/RD/dB0eXP4xPOmQdRBI7CY0k=
+			</data>
+		</dict>
+		<key>Resources/varlock-menu-locked.pdf</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			hpN+eYA2piZx5N1Kn6SZ2dFLP3U33pvpbXD7/nvArJc=
+			</data>
+		</dict>
+		<key>Resources/varlock-menu-unlocked.pdf</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			dI9uwfrFy56f2fT7KGmvDNmNzFUi+/KnOSAzRDOHa9c=
+			</data>
+		</dict>
+	</dict>
+	<key>rules</key>
+	<dict>
+		<key>^Resources/</key>
+		<true/>
+		<key>^Resources/.*\.lproj/</key>
+		<dict>
+			<key>optional</key>
+			<true/>
+			<key>weight</key>
+			<real>1000</real>
+		</dict>
+		<key>^Resources/.*\.lproj/locversion.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>1100</real>
+		</dict>
+		<key>^Resources/Base\.lproj/</key>
+		<dict>
+			<key>weight</key>
+			<real>1010</real>
+		</dict>
+		<key>^version.plist$</key>
+		<true/>
+	</dict>
+	<key>rules2</key>
+	<dict>
+		<key>.*\.dSYM($|/)</key>
+		<dict>
+			<key>weight</key>
+			<real>11</real>
+		</dict>
+		<key>^(.*/)?\.DS_Store$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>2000</real>
+		</dict>
+		<key>^(Frameworks|SharedFrameworks|PlugIns|Plug-ins|XPCServices|Helpers|MacOS|Library/(Automator|Spotlight|LoginItems))/</key>
+		<dict>
+			<key>nested</key>
+			<true/>
+			<key>weight</key>
+			<real>10</real>
+		</dict>
+		<key>^.*</key>
+		<true/>
+		<key>^Info\.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^PkgInfo$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^Resources/</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^Resources/.*\.lproj/</key>
+		<dict>
+			<key>optional</key>
+			<true/>
+			<key>weight</key>
+			<real>1000</real>
+		</dict>
+		<key>^Resources/.*\.lproj/locversion.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>1100</real>
+		</dict>
+		<key>^Resources/Base\.lproj/</key>
+		<dict>
+			<key>weight</key>
+			<real>1010</real>
+		</dict>
+		<key>^[^/]+$</key>
+		<dict>
+			<key>nested</key>
+			<true/>
+			<key>weight</key>
+			<real>10</real>
+		</dict>
+		<key>^embedded\.provisionprofile$</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^version\.plist$</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+	</dict>
+</dict>
+</plist>

data/vendor/arm64-darwin/varlock

@@ -0,0 +1,4 @@
+[diffend] Oversized file quarantined before diffing.
+name: data/vendor/arm64-darwin/varlock
+size: 69938034 bytes
+sha256: 19f505aebe3dc068b14ca80ebcb5c09bd72a74cd93f16940c6178b0f4d5bc54f

metadata

@@ -0,0 +1,104 @@
+--- !ruby/object:Gem::Specification
+name: varlock
+version: !ruby/object:Gem::Version
+  version: 1.23.0
+platform: arm64-darwin
+authors:
+- akodkod
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: open3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+description: A small wrapper around the Varlock CLI with an optional Rails boot integration.
+executables:
+- varlock
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- RELEASING.md
+- exe/varlock
+- lib/varlock.rb
+- lib/varlock/binary.rb
+- lib/varlock/rails.rb
+- lib/varlock/release.json
+- lib/varlock/tasks.rb
+- lib/varlock/version.rb
+- licenses/VARLOCK-MIT.txt
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/CodeResources
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/Info.plist
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/Resources/AppIcon.icns
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/Resources/varlock-menu-locked.pdf
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/Resources/varlock-menu-unlocked.pdf
+- vendor/arm64-darwin/VarlockEnclave.app/Contents/_CodeSignature/CodeResources
+- vendor/arm64-darwin/varlock
+homepage: https://github.com/akodkod/varlock
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/akodkod/varlock
+  bug_tracker_uri: https://github.com/akodkod/varlock/issues
+  changelog_uri: https://github.com/akodkod/varlock/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.7'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.20
+specification_version: 4
+summary: Load validated environment variables into Ruby using Varlock.
+test_files: []