yaml_recrypt 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +47 -13
- data/exe/yaml_recrypt +4 -1
- data/lib/yaml_recrypt/version.rb +1 -1
- data/lib/yaml_recrypt.rb +7 -3
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 706a7b37ab2e8fa258932696bf423a90eff36ba5
|
|
4
|
+
data.tar.gz: 3e98b9b601e5174e2406e5741463d34f7a9e6668
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9ba6efca12ddc88d3e81938232eed6e367602937e8bf7f4add01e25ab18be6a02366b485e547c00f3abe4c785ae674942442dce71e56a4754dfe2ea9bf199d1c
|
|
7
|
+
data.tar.gz: c81e67c223ab326fb5c5fc4f336794a92432831cd6334bae3849806b0e519a05595d8608bae310eec979bcc2d89b3c96d5b33eb5c84ad80d325fa7d427e137d4
|
data/README.md
CHANGED
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
[](https://travis-ci.org/GeoffWilliams/yaml_recrypt)
|
|
2
2
|
# YamlRecrypt
|
|
3
3
|
|
|
4
|
-
Handy small tool for parsing YAML files and finding the keys that are encrypted with
|
|
5
|
-
|
|
4
|
+
Handy small tool for parsing YAML files and finding the keys that are currently encrypted with [hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg/)(not to be confused with [hiera-gpg](https://github.com/crayfishx/hiera-gpg) which encrypts entire yaml fies). While `hiera-eyaml-gpg` is a cool idea, the complexities of GPG can negate some of its benefits in practice , so this tool was developed to allow conversion to regular eyaml.
|
|
6
5
|
|
|
7
6
|
## Installation
|
|
8
7
|
|
|
@@ -22,14 +21,49 @@ Or install it yourself as:
|
|
|
22
21
|
|
|
23
22
|
## Usage
|
|
24
23
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
24
|
+
### Re-encrypting your hiera data
|
|
25
|
+
At present, `yaml_recrypt` only offers one mode of operation which is to recursively process files in the current directory, decrypting any `hiera-eyaml-gpg` data and then re-encrypting it with plain hiera-eyaml.
|
|
26
|
+
|
|
27
|
+
To do this, `yaml_recrypt` needs:
|
|
28
|
+
* Some data to decrypt
|
|
29
|
+
* Your GPG PKI (directory of gpg keychains, etc - usually at `~/.gpg`)
|
|
30
|
+
* Your hiera-eyaml public key (usually at `/etc/puppetlabs/puppet/keys`)
|
|
31
|
+
|
|
32
|
+
`yaml_recrypt` should not be run inside the `/etc/puppet*` directory to avoid the risk of updating files which are currently in use. Ideally, data should be copied off the puppet server for rencryption (eg a workstation - must be running Linux) as:
|
|
33
|
+
* This prevents altering the `gems` installed on the production master
|
|
34
|
+
* The conversion can be done in a safe and controlled environment
|
|
35
|
+
* Files can be easilty deleted afterwards
|
|
36
|
+
|
|
37
|
+
A conversion workflow should look something like this:
|
|
38
|
+
1. Obtain the existing hiera data (tar + scp on master or git checkout if your using version control)
|
|
39
|
+
2. Obtain GPG keychain from master (need the entire directory described in the `:gpg_gnupghome:` key in `hiera.yaml`)
|
|
40
|
+
3. Obtain the hiera-eyaml public key from the (new?) master
|
|
41
|
+
4. Run the conversion:
|
|
42
|
+
```shell
|
|
43
|
+
yaml_recrypt convert --gpg-home gpghome/ --eyaml-pub-key keys/public_key.pkcs7.pem
|
|
44
|
+
```
|
|
45
|
+
Worked example:
|
|
46
|
+
```shell
|
|
47
|
+
cd /home/geoff/tmp/hieradata
|
|
48
|
+
yaml_recrypt convert --gpg-home /home/geoff/tmp/gpghome --eyaml-pub-key /home/geoff/tmp/keys/public_key.pkcs7.pem
|
|
49
|
+
```
|
|
50
|
+
5. Check results and commit changed data back to git
|
|
51
|
+
6. When happy with conversion results, don't forget to remove the old GPG keychain files from your system - it's a security risk, to leave they lying around
|
|
52
|
+
|
|
53
|
+
## Development and Contributing
|
|
54
|
+
There are a few additional things this codebase could be extended to cover if there's interest:
|
|
55
|
+
* hiera-gpg (whole file encrypted) to hiera-eyaml
|
|
56
|
+
* hiera-eyaml to hiera-eyaml-gpg
|
|
57
|
+
* hiera-eyaml to ...something else
|
|
58
|
+
* something else... to hiera-eyaml
|
|
59
|
+
|
|
60
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/GeoffWilliams/yaml_recrypt.
|
|
61
|
+
|
|
62
|
+
There are no plans to develop this software beyond its initial capabilities.
|
|
63
|
+
|
|
64
|
+
## Acknowledgement
|
|
65
|
+
Contains adapted sourcecode from:
|
|
66
|
+
* [hiera-eyaml](https://github.com/voxpupuli/hiera-eyaml)
|
|
67
|
+
* [hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg/)
|
|
68
|
+
|
|
69
|
+
See the file `LICENCE` for licencing information (MIT)
|
data/exe/yaml_recrypt
CHANGED
|
@@ -3,7 +3,10 @@ require 'escort'
|
|
|
3
3
|
require 'yaml_recrypt'
|
|
4
4
|
require 'yaml_recrypt/version'
|
|
5
5
|
|
|
6
|
-
#
|
|
6
|
+
# help message if nothing selected
|
|
7
|
+
if ARGV.size == 0
|
|
8
|
+
ARGV.unshift('help')
|
|
9
|
+
end
|
|
7
10
|
Escort::App.create do |app|
|
|
8
11
|
app.version YamlRecrypt::VERSION
|
|
9
12
|
app.summary "yaml_recrypt"
|
data/lib/yaml_recrypt/version.rb
CHANGED
data/lib/yaml_recrypt.rb
CHANGED
|
@@ -10,17 +10,21 @@ require 'gpgme'
|
|
|
10
10
|
require 'openssl'
|
|
11
11
|
|
|
12
12
|
module YamlRecrypt
|
|
13
|
-
GPG_MAGIC
|
|
14
|
-
BACKUP_EXT
|
|
13
|
+
GPG_MAGIC = "-----BEGIN PGP MESSAGE-----"
|
|
14
|
+
BACKUP_EXT = "orig"
|
|
15
|
+
# match /etc/puppet and /etc/puppetlabs to protect all customers
|
|
16
|
+
REAL_PUPPET_DIR = "/etc/puppet"
|
|
15
17
|
|
|
16
18
|
def self.recrypt_file(filename, gpg_home, eyaml_pub_key)
|
|
19
|
+
if filename.start_with? REAL_PUPPET_DIR
|
|
20
|
+
abort("Detected being run from the #{REAL_PUPPET_DIR}*! Refusing to run to avoid trashing live puppet master")
|
|
21
|
+
end
|
|
17
22
|
Escort::Logger.output.puts "Processing #{filename}"
|
|
18
23
|
|
|
19
24
|
# load the yaml into a hash
|
|
20
25
|
hash_wip = YAML.load(File.readlines(filename).join("\n"))
|
|
21
26
|
|
|
22
27
|
# descend every key until a string (or terminal) is reached
|
|
23
|
-
#converted =
|
|
24
28
|
replaced, converted = descend(gpg_home, eyaml_pub_key, hash_wip)
|
|
25
29
|
|
|
26
30
|
if replaced > 0
|