yaml_vault 1.1.3 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5acc1523b3bc454d4a73628874710b40427a6dd75ad476786597a30033b95d6
-  data.tar.gz: b8dce922143c7eb87977c0c84bf6148c9eba014887bdd40a726e8ed32f1e0034
+  metadata.gz: e89611f7bd2e7ca8692e1b689c0087babeec416a2350d1513e35b05d3c1e6758
+  data.tar.gz: 0b10d6e6dca3dfd371cb6dc19b1131ffd046d32b8718d02acea57f058559ee4b
 SHA512:
-  metadata.gz: 5d94c3dfbb3be2dd235989e88e5a639a32f56a638392e09b93f5601c392445550a226e7bf919721f4ce585a35f2fa31af29f83c4dcc6e8b0ce83e870f8fa15ef
-  data.tar.gz: 6c3a2897d5a265de39fb12b730ee7bba29152604b769ee5cba085712c47a7ae4dda7c3140537bbadc45ec9c9ecf23ea699ca53a3ec0a8497e531b9467d9c1722
+  metadata.gz: 735ba23c5e3c063da8f3fb98ad73486bb0bff7ee99d83fdc7a26875dbd9b53ff4666f0cf6cb2d8ecb7687f690b960c877e1dd2ceb10ef319b91dce07a003170c
+  data.tar.gz: 422238e47e86038790fe12aa481d20b832e7f6a8eb66996db8c3df304d493835202003cfd3a4ecd330265ef27425cf8d4a3e7c7964148de723f8c3974b060cc5

data/.github/workflows/rspec.yml

@@ -0,0 +1,27 @@
+name: RSpec
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['2.7', '3.0', '3.1']
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby
+    # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
+    # change this to (see https://github.com/ruby/setup-ruby#versioning):
+    # uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@v1.110.0
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - name: Run tests
+      run: bundle exec rake

data/.gitignore

@@ -9,3 +9,4 @@
 /tmp/
 
 .envrc
+.idea

data/README.md

@@ -1,6 +1,6 @@
 # YamlVault
 [![Gem Version](https://badge.fury.io/rb/yaml_vault.svg)](https://badge.fury.io/rb/yaml_vault)
-[![Build Status](https://travis-ci.org/joker1007/yaml_vault.svg?branch=master)](https://travis-ci.org/joker1007/yaml_vault)
+[![RSpec](https://github.com/joker1007/yaml_vault/actions/workflows/rspec.yml/badge.svg)](https://github.com/joker1007/yaml_vault/actions/workflows/rspec.yml)
 
 Yaml file encryption/decryption helper.
 
@@ -180,6 +180,18 @@ vault:
 
 ex. `$.production.:slaves.[0].*.:password`
 
+You can also use the `--prefix` and `--suffix` options to format the encrypted value. i.e by providing `--prefix "ENC(" --suffix ")"` you can get the following output from the above example:
+
+```yml
+# encrypted_secrets.yml
+
+default: &default
+...
+vault:
+  secret_data: ENC(SzZoOGlpcSs4UlBaQnhTYWx0YlN3NHk2QXhiZGYvVmpsc0c3ckllSlh1TT0tLU13ZERzRWsxaGc0Y090blNIdXVVMmc9PQ==--24b2af56d2563776ca316dbfa243333dd053fea1)
+...
+```
+
 #### AWS KMS Encryption
 
 Max encryptable size is 4096 bytes. (value size as encoded by Base64)
@@ -215,6 +227,8 @@ Enter passphrase: <enter your passphrase>
 
 If `ENV["YAML_VAULT_PASSPHRASE"]`, use it as passphrase
 
+Note to pass the same `--suffix` and `--prefix` if the yaml was encrypted using these options.
+
 #### AWS KMS Decryption
 
 ```

data/exe/yaml_vault

@@ -8,6 +8,8 @@ class YamlVault::Cli < Thor
   include Thor::Actions
 
   class_option :key, aliases: "-k", type: :string, banner: "KEYNAME (format: \"KEY1.INNER_KEY,KEY2\")", desc: "target key", default: "$"
+  class_option :prefix, type: :string, banner: "PREFIX", desc: "prefix string to add to the encrypted value"
+  class_option :suffix, type: :string, banner: "SUFFIX", desc: "suffix string to add to the encrypted value"
   class_option :cryptor, type: :string, enum: %w(simple aws-kms gcp-kms), default: "simple"
 
   class_option :salt, aliases: "-s", type: :string
@@ -34,6 +36,8 @@ class YamlVault::Cli < Thor
       yaml_file,
       target_keys,
       options[:cryptor],
+      options[:prefix],
+      options[:suffix],
       passphrase: passphrase,
       sign_passphrase: sign_passphrase,
       salt: options[:salt], cipher: options[:cipher], key_len: options[:key_len],
@@ -58,6 +62,8 @@ class YamlVault::Cli < Thor
       yaml_file,
       target_keys,
       options[:cryptor],
+      options[:prefix],
+      options[:suffix],
       passphrase: passphrase,
       sign_passphrase: sign_passphrase,
       salt: options[:salt], cipher: options[:cipher], digest: options[:digest],

data/lib/yaml_vault/rails.rb

@@ -23,7 +23,7 @@ module YamlVault
           # Fallback to config.secret_key_base if secrets.secret_key_base isn't set
           secrets.secret_key_base ||= config.secret_key_base
           # Fallback to config.secret_token if secrets.secret_token isn't set
-          secrets.secret_token ||= config.secret_token
+          secrets.secret_token ||= config&.secret_token if config.respond_to?(:secret_token)
 
           secrets
         end

data/lib/yaml_vault/version.rb

@@ -1,3 +1,3 @@
 module YamlVault
-  VERSION = "1.1.3"
+  VERSION = "1.3.2"
 end

data/lib/yaml_vault/yaml_compat.rb

@@ -0,0 +1,21 @@
+module YamlVault
+  module YAMLCompat
+    refine YAML.singleton_class do
+      def load(yaml, **kw)
+        if YAML.respond_to?(:unsafe_load)
+          YAML.unsafe_load(yaml, **kw)
+        else
+          super(yaml, **kw)
+        end
+      end
+
+      def load_file(filename, **kw)
+        if YAML.respond_to?(:unsafe_load_file)
+          YAML.unsafe_load_file(filename, **kw)
+        else
+          super(filename, **kw)
+        end
+      end
+    end
+  end
+end

data/lib/yaml_vault/yaml_tree_builder.rb

@@ -3,11 +3,13 @@ require 'yaml'
 
 module YamlVault
   class YAMLTreeBuilder < YAML::TreeBuilder
-    def initialize(target_paths, cryptor, mode)
+    def initialize(target_paths, prefix, suffix, cryptor, mode)
       super()
 
       @path_stack = []
       @target_paths = target_paths
+      @prefix = prefix
+      @suffix = suffix
       @cryptor = cryptor
       @mode = mode
     end
@@ -74,7 +76,9 @@ module YamlVault
           else
             result.value = @cryptor.encrypt(value)
           end
+          result.value = add_prefix_and_suffix(result.value)
         else
+          value = remove_prefix_and_suffix(value)
           decrypted_value = @cryptor.decrypt(value).to_s
           if decrypted_value =~ /\A(!.*?)\s+(.*)\z/
             result.tag = $1
@@ -100,6 +104,20 @@ module YamlVault
 
     private
 
+    def add_prefix_and_suffix(value)
+      return "#{@prefix}#{value}#{@suffix}"
+    end
+
+    def remove_prefix_and_suffix(value)
+      if @prefix != nil && value.start_with?(@prefix)
+        value = value.delete_prefix(@prefix)
+      end
+      if @suffix != nil && value.end_with?(@suffix)
+        value = value.delete_suffix(@suffix)
+      end
+      value
+    end
+
     def match_path?
       @target_paths.any? do |target_path|
         target_path.each_with_index.all? do |path, i|

data/lib/yaml_vault.rb

@@ -7,26 +7,30 @@ require 'pp'
 
 require 'yaml_vault/key_parser'
 require 'yaml_vault/yaml_tree_builder'
+require 'yaml_vault/yaml_compat'
 
 module YamlVault
+  using YamlVault::YAMLCompat
   class Main
     class << self
-      def from_file(filename, keys, cryptor_name = nil, **options)
+      def from_file(filename, keys, cryptor_name = nil, prefix = nil, suffix = nil, **options)
         yaml_content = ERB.new(File.read(filename)).result
-        new(yaml_content, keys, cryptor_name, **options)
+        new(yaml_content, keys, cryptor_name, prefix, suffix, **options)
       end
 
       alias :from_content :new
     end
 
     def initialize(
-      yaml_content, keys, cryptor_name = nil,
+      yaml_content, keys, cryptor_name = nil, prefix = nil, suffix = nil,
       passphrase: nil, sign_passphrase: nil, salt: nil, cipher: "aes-256-cbc", key_len: 32, signature_key_len: 64, digest: "SHA256",
       aws_kms_key_id: nil, aws_region: nil, aws_access_key_id: nil, aws_secret_access_key: nil, aws_profile: nil,
       gcp_kms_resource_id: nil, gcp_credential_file: nil
     )
       @yaml = yaml_content
       @keys = keys
+      @prefix = prefix
+      @suffix = suffix
 
       @passphrase = passphrase
       @sign_passphrase = sign_passphrase
@@ -49,12 +53,12 @@ module YamlVault
     end
 
     def encrypt
-      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @cryptor, :encrypt))
+      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @prefix, @suffix, @cryptor, :encrypt))
       parser.parse(@yaml).handler.root
     end
 
     def decrypt
-      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @cryptor, :decrypt))
+      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @prefix, @suffix, @cryptor, :decrypt))
       parser.parse(@yaml).handler.root
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yaml_vault
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.3.2
 platform: ruby
 authors:
 - joker1007
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-07-10 00:00:00.000000000 Z
+date: 2022-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -89,6 +89,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".dockerignore"
+- ".github/workflows/rspec.yml"
 - ".gitignore"
 - ".rspec"
 - ".travis.yml"
@@ -104,13 +105,14 @@ files:
 - lib/yaml_vault/key_parser.rb
 - lib/yaml_vault/rails.rb
 - lib/yaml_vault/version.rb
+- lib/yaml_vault/yaml_compat.rb
 - lib/yaml_vault/yaml_tree_builder.rb
 - yaml_vault.gemspec
 homepage: https://github.com/joker1007/yaml_vault
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -125,8 +127,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
 summary: yaml encryption/decryption helper.
 test_files: []