azurator 0.1.0a1__tar.gz

azurator-0.1.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jan T. Müller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

azurator-0.1.0a1/PKG-INFO

@@ -0,0 +1,145 @@
+Metadata-Version: 2.4
+Name: azurator
+Version: 0.1.0a1
+Summary: Rotate shared-key credentials for Azure services and update supported places where they are stored.
+Author-email: "Jan T. Müller" <mail@jantmueller.com>
+License-Expression: MIT
+Project-URL: homepage, https://github.com/janthmueller/azurator
+Project-URL: documentation, https://janthmueller.github.io/azurator/
+Project-URL: source, https://github.com/janthmueller/azurator
+Project-URL: tracker, https://github.com/janthmueller/azurator/issues
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: azure-ai-projects<2.4,>=2.3
+Requires-Dist: azure-core<2,>=1.37
+Requires-Dist: azure-identity<2,>=1.25
+Requires-Dist: azure-mgmt-cognitiveservices<14.2,>=14.1
+Requires-Dist: azure-mgmt-core<2,>=1.6
+Requires-Dist: azure-mgmt-storage<25.2,>=25.1
+Requires-Dist: azure-mgmt-web<11.1,>=11.0.1
+Requires-Dist: openai<3,>=2.8
+Requires-Dist: platformdirs<5,>=4.3
+Requires-Dist: pydantic<3,>=2.12
+Requires-Dist: rich<15,>=14
+Requires-Dist: typer<1,>=0.24
+Provides-Extra: audit
+Requires-Dist: pip-audit<3,>=2.9; extra == "audit"
+Provides-Extra: dev
+Requires-Dist: hypothesis>=6; extra == "dev"
+Requires-Dist: pyright>=1.1; extra == "dev"
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=6; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+Provides-Extra: release
+Requires-Dist: build>=1; extra == "release"
+Requires-Dist: pyinstaller>=6; extra == "release"
+Requires-Dist: python-semantic-release<11,>=10; extra == "release"
+Requires-Dist: twine>=5; extra == "release"
+Dynamic: license-file
+
+# Azurator
+
+Azurator rotates shared-key credentials for Azure services and updates
+supported places where they are stored.
+
+> [!WARNING]
+> Azurator is pre-alpha. Key rotation changes Azure and cannot be rolled back.
+> Review the displayed changes before confirming them.
+
+## Installation
+
+Python installations require Python 3.10 or newer. The default login uses the
+[Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli).
+
+```bash
+pipx install azurator
+```
+
+Other install paths:
+
+- `pip install azurator`
+- prebuilt archives from the [latest release](https://github.com/janthmueller/azurator/releases/latest)
+- `nix run github:janthmueller/azurator -- --help`
+
+The optional SOPS workflow also requires SOPS 3.13.x. See the
+[installation guide](https://janthmueller.github.io/azurator/getting-started/installation/)
+for details.
+
+## Quick Start
+
+Rotate keys already stored in a dotenv file:
+
+```bash
+azurator login
+azurator rotate --env-file .env
+```
+
+Azurator matches the file values to supported Azure keys, shows every planned
+change, asks once for confirmation, rotates the keys, and updates the file and
+supported Azure configuration that stores the same values.
+
+Inspect or preview first when needed:
+
+```bash
+azurator match --env-file .env
+azurator plan --env-file .env
+```
+
+## Other Workflows
+
+- `azurator rotate` selects keys interactively.
+- `azurator rotate --sops-file secrets.enc.env` updates a SOPS-encrypted dotenv file.
+- `azurator export --sops-out azure-keys.enc.env` creates a new SOPS-encrypted dotenv file.
+- `azurator export --out azure-keys.env` creates a new dotenv file from selected keys.
+- `azurator discover` lists supported key resources without retrieving key values.
+
+## Current Scope
+
+Azurator rotates Storage Account keys and the `Key1` and `Key2` credentials
+exposed by Azure AI, Cognitive Services, and Azure OpenAI. When the same key is
+stored in a selected dotenv file, a supported Foundry project connection, or an
+App Service application setting, Azurator can update that configuration during
+the rotation.
+
+Azurator checks only the documented configuration types. It does not discover
+every Azure secret or prove that a running workload uses a key.
+
+See [Supported Key Resources and Bindings](https://janthmueller.github.io/azurator/reference/supported-keys-and-bindings/)
+for the exact current coverage.
+
+## Shared Keys and Microsoft Entra ID
+
+Shared keys are useful for prototypes and existing integrations, but they must
+be stored, distributed, and rotated. Prefer Microsoft Entra ID when the service
+and workload support it. Use Azurator when shared keys remain the practical
+choice.
+
+Read Microsoft's guidance for
+[secretless authentication](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/secretless-authentication),
+[Foundry authentication](https://learn.microsoft.com/en-us/azure/foundry/concepts/authentication-authorization-foundry),
+and [Azure Storage Shared Key](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent).
+
+## Documentation
+
+See the [documentation](https://janthmueller.github.io/azurator/) for setup,
+supported workflows, and recovery.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE)

azurator-0.1.0a1/README.md

@@ -0,0 +1,94 @@
+# Azurator
+
+Azurator rotates shared-key credentials for Azure services and updates
+supported places where they are stored.
+
+> [!WARNING]
+> Azurator is pre-alpha. Key rotation changes Azure and cannot be rolled back.
+> Review the displayed changes before confirming them.
+
+## Installation
+
+Python installations require Python 3.10 or newer. The default login uses the
+[Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli).
+
+```bash
+pipx install azurator
+```
+
+Other install paths:
+
+- `pip install azurator`
+- prebuilt archives from the [latest release](https://github.com/janthmueller/azurator/releases/latest)
+- `nix run github:janthmueller/azurator -- --help`
+
+The optional SOPS workflow also requires SOPS 3.13.x. See the
+[installation guide](https://janthmueller.github.io/azurator/getting-started/installation/)
+for details.
+
+## Quick Start
+
+Rotate keys already stored in a dotenv file:
+
+```bash
+azurator login
+azurator rotate --env-file .env
+```
+
+Azurator matches the file values to supported Azure keys, shows every planned
+change, asks once for confirmation, rotates the keys, and updates the file and
+supported Azure configuration that stores the same values.
+
+Inspect or preview first when needed:
+
+```bash
+azurator match --env-file .env
+azurator plan --env-file .env
+```
+
+## Other Workflows
+
+- `azurator rotate` selects keys interactively.
+- `azurator rotate --sops-file secrets.enc.env` updates a SOPS-encrypted dotenv file.
+- `azurator export --sops-out azure-keys.enc.env` creates a new SOPS-encrypted dotenv file.
+- `azurator export --out azure-keys.env` creates a new dotenv file from selected keys.
+- `azurator discover` lists supported key resources without retrieving key values.
+
+## Current Scope
+
+Azurator rotates Storage Account keys and the `Key1` and `Key2` credentials
+exposed by Azure AI, Cognitive Services, and Azure OpenAI. When the same key is
+stored in a selected dotenv file, a supported Foundry project connection, or an
+App Service application setting, Azurator can update that configuration during
+the rotation.
+
+Azurator checks only the documented configuration types. It does not discover
+every Azure secret or prove that a running workload uses a key.
+
+See [Supported Key Resources and Bindings](https://janthmueller.github.io/azurator/reference/supported-keys-and-bindings/)
+for the exact current coverage.
+
+## Shared Keys and Microsoft Entra ID
+
+Shared keys are useful for prototypes and existing integrations, but they must
+be stored, distributed, and rotated. Prefer Microsoft Entra ID when the service
+and workload support it. Use Azurator when shared keys remain the practical
+choice.
+
+Read Microsoft's guidance for
+[secretless authentication](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/secretless-authentication),
+[Foundry authentication](https://learn.microsoft.com/en-us/azure/foundry/concepts/authentication-authorization-foundry),
+and [Azure Storage Shared Key](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent).
+
+## Documentation
+
+See the [documentation](https://janthmueller.github.io/azurator/) for setup,
+supported workflows, and recovery.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE)

azurator-0.1.0a1/azurator/__init__.py

@@ -0,0 +1,10 @@
+"""Discover and safely rotate shared-key credentials for Azure services."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("azurator")
+except PackageNotFoundError:  # pragma: no cover - source trees are normally installed editable
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["__version__"]

azurator-0.1.0a1/azurator/__main__.py

@@ -0,0 +1,6 @@
+"""Module entry point for PyInstaller and ``python -m azurator``."""
+
+from azurator.cli import app
+
+if __name__ == "__main__":
+    app()