git-secret-protector 0.2.0__tar.gz → 0.3.0__tar.gz

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: git-secret-protector
-Version: 0.2.0
+Version: 0.3.0
 Summary: A tool for managing secrets in Git with AWS Parameter Store integration.
 Author: Duc Duong
 Author-email: duc.duong@c0x12c.com
@@ -30,7 +30,6 @@ Description-Content-Type: text/markdown
 ### Requirements
 
 - pipx ([Download](https://pipx.pypa.io/stable/installation/))
-- Poetry ([Download](https://python-poetry.org/docs/#installation))
 
 You can install the `git-secret-protector` module via pipx:
 
@@ -42,25 +41,35 @@ pipx install git-secret-protector
 
 ### 1. Initial Setup
 
-Before using the tool, ensure you have the necessary AWS permissions to manage AWS MKS & SSM. Then, initialize your repository for secret protection by installing Git clean and smudge filter and setting up the module.
+#### Set up AES key
+
+Before using the tool, ensure you have the necessary AWS permissions to manage AWS MKS & SSM.
 
 ```sh
-git-secret-protector install
+git-secret-protector init <filter_name>
 ```
 
-### 2. Pull AES Key
+**NOTE: Perform this setup once per repository during initial configuration.**
+
+### 2. Configure Git Filters
 
-Before encrypting or decrypting files, you need to pull the relevant AES keys from AWS Parameter Store for a specific filter:
+onfigure the Git clean and smudge filters for the specified filter name
 
 ```sh
-git-secret-protector pull-aes-key <filter_name>
+git-secret-protector init <filter_name>
 ```
 
-This command will pull the latest AES data key from AWS Parameter Store for the specified filter and cache it locally.
+### 3. Pull AES Key and IV
+
+Before encrypting or decrypting files, it's necessary to retrieve the relevant AES keys from the AWS Parameter Store for specific filters:
+
+```sh
+git-secret-protector pull-aes-key <filter_name>
+```
 
-This command will decrypt the files in your working directory for the specified filter, making them available for editing.
+This command fetches the latest AES data key and IV from AWS Parameter Store for the designated filter and caches them locally for subsequent operations. This step ensures that you have the correct keys for encryption or decryption tasks related to the specified filter.
 
-### 3. Key Rotation
+### 4. Key Rotation
 
 #### Command to Rotate Keys
 
@@ -81,7 +90,7 @@ git rm --cached -r .
 git reset --hard
 ```
 
-### 4. View Encryption Status
+### 5. View Encryption Status
 
 Command to obtain a comprehensive overview of the encryption status of files within the repository:
 
@@ -93,7 +102,6 @@ git-secret-protector status
 
 All configurations are managed through a `config.ini` file located in the `.git-secret-protector` directory. You can customize the following settings:
 
-- **AWS Configuration**: Set your AWS region, profile, and other credentials.
 - **Logging**: Configure the log file path and rotation settings.
 - **Module Name**: Specify a custom module name for organizing keys in AWS Parameter Store.
 
@@ -102,8 +110,8 @@ All configurations are managed through a `config.ini` file located in the `.git-
 Define which files to encrypt in your `.gitattributes` file:
 
 ```
-secrets/*.tfstate filter=git-crypt-app diff=git-crypt-app
-config/**/credentials/* filter=git-crypt-shared diff=git-crypt-shared
+secrets/*.tfstate filter=sample-app diff=sample-app
+config/**/credentials/* filter=sample-shared diff=sample-shared
 ```
 
 ### Logging

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/README.md

@@ -15,7 +15,6 @@
 ### Requirements
 
 - pipx ([Download](https://pipx.pypa.io/stable/installation/))
-- Poetry ([Download](https://python-poetry.org/docs/#installation))
 
 You can install the `git-secret-protector` module via pipx:
 
@@ -27,25 +26,35 @@ pipx install git-secret-protector
 
 ### 1. Initial Setup
 
-Before using the tool, ensure you have the necessary AWS permissions to manage AWS MKS & SSM. Then, initialize your repository for secret protection by installing Git clean and smudge filter and setting up the module.
+#### Set up AES key
+
+Before using the tool, ensure you have the necessary AWS permissions to manage AWS MKS & SSM.
 
 ```sh
-git-secret-protector install
+git-secret-protector init <filter_name>
 ```
 
-### 2. Pull AES Key
+**NOTE: Perform this setup once per repository during initial configuration.**
+
+### 2. Configure Git Filters
 
-Before encrypting or decrypting files, you need to pull the relevant AES keys from AWS Parameter Store for a specific filter:
+onfigure the Git clean and smudge filters for the specified filter name
 
 ```sh
-git-secret-protector pull-aes-key <filter_name>
+git-secret-protector init <filter_name>
 ```
 
-This command will pull the latest AES data key from AWS Parameter Store for the specified filter and cache it locally.
+### 3. Pull AES Key and IV
+
+Before encrypting or decrypting files, it's necessary to retrieve the relevant AES keys from the AWS Parameter Store for specific filters:
+
+```sh
+git-secret-protector pull-aes-key <filter_name>
+```
 
-This command will decrypt the files in your working directory for the specified filter, making them available for editing.
+This command fetches the latest AES data key and IV from AWS Parameter Store for the designated filter and caches them locally for subsequent operations. This step ensures that you have the correct keys for encryption or decryption tasks related to the specified filter.
 
-### 3. Key Rotation
+### 4. Key Rotation
 
 #### Command to Rotate Keys
 
@@ -66,7 +75,7 @@ git rm --cached -r .
 git reset --hard
 ```
 
-### 4. View Encryption Status
+### 5. View Encryption Status
 
 Command to obtain a comprehensive overview of the encryption status of files within the repository:
 
@@ -78,7 +87,6 @@ git-secret-protector status
 
 All configurations are managed through a `config.ini` file located in the `.git-secret-protector` directory. You can customize the following settings:
 
-- **AWS Configuration**: Set your AWS region, profile, and other credentials.
 - **Logging**: Configure the log file path and rotation settings.
 - **Module Name**: Specify a custom module name for organizing keys in AWS Parameter Store.
 
@@ -87,8 +95,8 @@ All configurations are managed through a `config.ini` file located in the `.git-
 Define which files to encrypt in your `.gitattributes` file:
 
 ```
-secrets/*.tfstate filter=git-crypt-app diff=git-crypt-app
-config/**/credentials/* filter=git-crypt-shared diff=git-crypt-shared
+secrets/*.tfstate filter=sample-app diff=sample-app
+config/**/credentials/* filter=sample-shared diff=sample-shared
 ```
 
 ### Logging

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "git-secret-protector"
-version = "0.2.0"
+version = "0.3.0"
 description = "A tool for managing secrets in Git with AWS Parameter Store integration."
 authors = ["Duc Duong <duc.duong@c0x12c.com>"]
 readme = "README.md"

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/src/git_secret_protector/aes_key_manager.py

@@ -113,8 +113,7 @@ class AesKeyManager:
         try:
             self.ssm_client.get_parameter(Name=parameter_name, WithDecryption=True)
             return True
-        except ClientError as e:
-            logging.error("Failed to check if parameter '%s': {%s}", parameter_name, str(e))
+        except ClientError:
             return False
 
     def _ssm_parameter_name(self, filter_name):

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/src/git_secret_protector/git_attributes_parser.py

@@ -1,11 +1,19 @@
 import fnmatch
 import glob
+import logging
 import os
 import re
 
+from git_secret_protector.settings import get_settings
+
+logger = logging.getLogger(__name__)
+
 
 class GitAttributesParser:
-    def __init__(self, git_attributes_file='.gitattributes'):
+    def __init__(self):
+        settings = get_settings()
+        git_attributes_file = os.path.join(settings.base_dir, '.gitattributes')
+
         self.git_attributes_file = git_attributes_file
         self.patterns = self._parse_patterns()
 

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/src/git_secret_protector/main.py

@@ -1,21 +1,61 @@
 import argparse
+import configparser
 import logging
 import subprocess
 import sys
+from pathlib import Path
 
 from git_secret_protector.aes_key_manager import AesKeyManager
 from git_secret_protector.encryption_manager import EncryptionManager
 from git_secret_protector.git_attributes_parser import GitAttributesParser
 from git_secret_protector.key_rotator import KeyRotator
 from git_secret_protector.logging import configure_logging
+from git_secret_protector.settings import get_settings
 
 logger = logging.getLogger(__name__)
 
+MODULE_FOLDER = '.git_secret_protector'
+
+
+def init_module_folder():
+    module_path = Path(get_settings().module_dir)
+
+    if not module_path.exists():
+        module_path.mkdir(parents=True, exist_ok=True)
+        (module_path / 'cache').mkdir(exist_ok=True)
+        (module_path / 'logs').mkdir(exist_ok=True)
+
+    # Check if config.ini exists, if not, create it with default settings
+    config_file = module_path / 'config.ini'
+    if not config_file.exists():
+        config = configparser.ConfigParser()
+        config['DEFAULT'] = {
+            'module_name': 'git-secret-protector',
+            'log_level': 'WARN',
+            'log_max_size': '10485760'  # 10MB
+        }
+
+        with open(config_file, 'w') as configfile:
+            config.write(configfile)
+
+
+def setup_aes_key(args):
+    filter_name = args.filter_name
+    logger.info("Set up AES key for filter: %s", filter_name)
+
+    init_module_folder()
+
+    key_manager = AesKeyManager()
+    key_manager.setup_aes_key_and_iv(args.filter_name)
+    logger.info(f"Filters for '{filter_name}' have been set up successfully.")
+
 
 def init_filter(args):
     filter_name = args.filter_name
     logger.info("Initializing filter: %s", filter_name)
 
+    init_module_folder()
+
     # Check for existing Git filters
     check_clean = subprocess.getoutput(f'git config --get filter.{filter_name}.clean')
     check_smudge = subprocess.getoutput(f'git config --get filter.{filter_name}.smudge')
@@ -32,10 +72,6 @@ def init_filter(args):
     subprocess.run(['git', 'config', f'filter.{filter_name}.required', 'true'], check=True)
     logger.debug("Git clean & smudge filters for '%s' have been set up successfully.", filter_name)
 
-    key_manager = AesKeyManager()
-    key_manager.setup_aes_key_and_iv(args.filter_name)
-    logger.info(f"Filters for '{filter_name}' have been set up successfully.")
-
 
 def pull_aes_key(args):
     key_manager = AesKeyManager()
@@ -106,6 +142,33 @@ def encrypt_stdin(args):
     sys.stdout.buffer.flush()
 
 
+def decrypt_files_by_filter(args):
+    filter_name = args.filter_name
+    logger.info("Decrypting files for filter: %s", filter_name)
+
+    try:
+        git_attributes_parser = GitAttributesParser()
+        files = git_attributes_parser.get_files_for_filter(filter_name)
+
+        if not files:
+            logger.info("No files to decrypt for filter: %s", filter_name)
+            return
+
+        key_manager = AesKeyManager()
+        aes_key, iv = key_manager.retrieve_key_and_iv(filter_name)
+        encryption_manager = EncryptionManager(aes_key, iv, git_attributes_parser)
+
+        for file in files:
+            logger.debug("Decrypting file: %s", file)
+            encryption_manager.decrypt_file(file)
+            logger.debug("Successfully decrypted: %s", file)
+
+        logger.info("All files decrypted for filter: %s", filter_name)
+    except Exception as e:
+        logger.error("Failed to decrypt files for filter %s: %s", filter_name, e)
+        raise
+
+
 def status_command(args):
     logger.info("Gathering status of all filters and their files...")
     git_attributes_parser = GitAttributesParser()
@@ -132,9 +195,14 @@ def main():
     subparsers = parser.add_subparsers(help="Available commands")
 
     # Command to init filter
-    parser_setup_aes_key = subparsers.add_parser('init', help="Init a filter with AES key and update git config")
-    parser_setup_aes_key.add_argument('filter_name', type=str, help="The filter name")
-    parser_setup_aes_key.set_defaults(func=init_filter)
+    parser_init = subparsers.add_parser('init', help="Init filter actions in git config")
+    parser_init.add_argument('filter_name', type=str, help="The filter name")
+    parser_init.set_defaults(func=init_filter)
+
+    # Command to set up AES key
+    parser_setup_aes_key = subparsers.add_parser('setup-aes-key', help="Set up AES key for a filter")
+    parser_setup_aes_key.add_argument('filter_name', type=str, help="The filter name for the AES key")
+    parser_setup_aes_key.set_defaults(func=setup_aes_key)
 
     # Command to pull AES key
     parser_pull_aes_key = subparsers.add_parser('pull-aes-key', help="Pull AES key for a filter")
@@ -156,6 +224,11 @@ def main():
     parser_encrypt_stdin.add_argument('file_name', type=str, help="Filename for encryption")
     parser_encrypt_stdin.set_defaults(func=encrypt_stdin)
 
+    # Command to decrypt files for a specific filter
+    parser_decrypt_files = subparsers.add_parser('decrypt-files', help="Decrypt files for a specific filter")
+    parser_decrypt_files.add_argument('filter_name', type=str, help="The filter name whose files to decrypt")
+    parser_decrypt_files.set_defaults(func=decrypt_files_by_filter)
+
     # Status command
     parser_status = subparsers.add_parser('status', help="List all filters and file statuses")
     parser_status.set_defaults(func=status_command)

{git_secret_protector-0.2.0 → git_secret_protector-0.3.0}/src/git_secret_protector/settings.py

@@ -2,28 +2,45 @@ import configparser
 import os
 from dataclasses import dataclass, field
 
-BASE_DIR = '.git_secret_protector'
-
 
 @dataclass
 class Settings:
-    _instance: 'Settings' = field(default=None, init=False, repr=False, compare=False)
+    BASE_DIR_LOOKUP_FOLDER = ".git"
 
-    config_file: str = os.path.join(BASE_DIR, 'config.ini')
-    cache_dir: str = os.path.join(BASE_DIR, 'cache')
-    log_dir: str = os.path.join(BASE_DIR, 'logs')
+    _instance: 'Settings' = field(default=None, init=False, repr=False, compare=False)
+    module_folder: str = '.git_secret_protector'
+    base_dir: str = field(init=False)
+    module_dir: str = field(init=False)
+    config_file: str = field(init=False)
+    cache_dir: str = field(init=False)
+    log_dir: str = field(init=False)
     module_name: str = 'git-secret-protector'
-    log_file: str = field(init=False, default='')
+    log_file: str = field(init=False)
     log_level: str = 'INFO'
     log_max_size: int = 10485760  # 10MB
     log_backup_count: int = 3
-    config: configparser.ConfigParser = field(init=False, default=None)
+    config: configparser.ConfigParser = field(init=False)
 
     def __post_init__(self):
-        self.config = configparser.ConfigParser()
+        self.base_dir = self.find_base_dir()
+        self.module_dir = os.path.join(self.base_dir, self.module_folder)
+        self.config_file = os.path.join(self.module_dir, 'config.ini')
+        self.cache_dir = os.path.join(self.module_dir, 'cache')
+        self.log_dir = os.path.join(self.module_dir, 'logs')
         self.log_file = os.path.join(self.log_dir, 'git_secret_protector.log')
+        self.config = configparser.ConfigParser()
         self._load_config()
 
+    def find_base_dir(self):
+        current_dir = os.getcwd()
+        while current_dir != os.path.dirname(current_dir):  # Traverse up to the root directory
+            possible_dir = os.path.join(current_dir, Settings.BASE_DIR_LOOKUP_FOLDER)
+            if os.path.exists(possible_dir):
+                return current_dir
+            current_dir = os.path.dirname(current_dir)
+        raise FileNotFoundError(
+            "The git-secret-protector module folder was not found in any ascendant directories. Please ensure the module is set up correctly.")
+
     def _load_config(self):
         if os.path.exists(self.config_file):
             self.config.read(self.config_file)