pilfer 1.0.0__py3-none-any.whl

pilfer/__init__.py

@@ -0,0 +1,13 @@
+"""
+Pilfer - Bulk De/recrypt all ansible vault files in a project recursively for search/editing.
+
+This package provides a command-line tool for decrypting all Ansible vault files 
+in a project recursively for search/editing, then re-encrypting them when done.
+
+Borrows from the excellent, but no longer supported Ansible Toolkit (https://github.com/dellis23/ansible-toolkit)
+"""
+
+__version__ = "1.0.0"
+__author__ = "Tom Paine"
+__email__ = "github@aioue.net"
+__description__ = "Decrypt all ansible vault files in a project recursively for search/editing, then re-encrypt when done." 

pilfer/cli.py

@@ -0,0 +1,255 @@
+#!/usr/bin/env python3
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+# heavily borrows from this excellent repo https://github.com/dellis23/ansible-toolkit
+
+# pilfer - decrypt all ansible vault files recursively for search/editing
+# pilfer [open|close]
+
+import argparse
+import errno
+import hashlib
+import json
+import os
+import shutil
+import configparser
+from pathlib import Path
+
+# Use Ansible's official vault implementation instead of third-party library
+from ansible.constants import DEFAULT_VAULT_ID_MATCH
+from ansible.parsing.vault import VaultLib, VaultSecret
+
+
+temp_vault_file_list_path = "vaultedFileList.json"
+list_of_vault_encrypted_files = []
+temp_hidden_encrypted_copies_directory_path = '.vault'
+
+
+def get_vault_password_file():
+    """Get vault password file from ansible.cfg or fall back to default locations"""
+    # First try to read from ansible.cfg
+    try:
+        config = configparser.ConfigParser()
+        config.read('ansible.cfg')
+        if 'defaults' in config and 'vault_password_file' in config['defaults']:
+            vault_file = config['defaults']['vault_password_file']
+            # Expand tilde for home directory
+            vault_file = os.path.expanduser(vault_file)
+            if os.path.exists(vault_file):
+                return vault_file
+    except Exception:
+        pass
+    
+    # Fall back to common locations
+    fallback_locations = [
+        "../../vault_password_file",  # Original default
+        "~/.ansible-vault/.vault-file",  # Common location
+        ".vault_password",  # Local project file
+        "vault_password_file"  # Simple local file
+    ]
+    
+    for location in fallback_locations:
+        expanded_location = os.path.expanduser(location)
+        if os.path.exists(expanded_location):
+            return expanded_location
+    
+    raise FileNotFoundError("Could not find vault password file. Please ensure it exists or specify with -p argument.")
+
+
+# find all files that have the ansible vault header and write it to disk
+def write_vaulted_file_list():
+    walk_dir = os.path.abspath(os.getcwd())
+
+    for dirpath, dirnames, filenames in os.walk(walk_dir):
+
+        for name in filenames:
+            # print name
+
+            # disable filename filter since we might have encrypted everything
+            # yamlExtensions = ('yml','yaml')
+            # if name.endswith(yamlExtensions):
+            #     print name
+
+            # full path
+            filePath = os.path.join(dirpath, name)
+            # print filePath
+
+            # find all files with the ansible vault header
+            try:
+                with open(filePath, 'rb') as open_file:
+                    first_line = open_file.readline()
+
+                    if first_line.startswith(b'$ANSIBLE_VAULT;'):
+                        # print filePath
+                        list_of_vault_encrypted_files.append(filePath)
+            except (IOError, OSError, PermissionError):
+                # Skip files we can't read
+                continue
+
+    # print vaultedFileList
+    with open(temp_vault_file_list_path, 'w') as open_file:
+        json.dump(list_of_vault_encrypted_files, open_file, indent=2)
+
+
+def decrypt_vault_files(vault_password_file_path=None):
+    # load the list of encrypted files
+    with open(temp_vault_file_list_path, 'r') as vaultListFile:
+        vaultedFileList = json.load(vaultListFile)
+
+        # list the detected encrypted files
+        # print json.dumps(vaultedFileList, indent=2)
+
+    # determine vault password file
+    if vault_password_file_path:
+        vault_file = vault_password_file_path
+    else:
+        vault_file = get_vault_password_file()
+
+    # load vault password into memory
+    with open(vault_file, 'r') as vault_password_file:
+        vaultPassword = vault_password_file.read().strip()
+
+    # create VaultLib instance using Ansible's official implementation
+    vault = VaultLib([
+        (DEFAULT_VAULT_ID_MATCH, VaultSecret(vaultPassword.encode('utf-8')))
+    ])
+
+    # iterate over the list of vaulted files
+    for vaultedFilePath in vaultedFileList:
+        try:
+            # recursively build a mirror directory structure for this file
+            mkdir_p(os.path.join(temp_hidden_encrypted_copies_directory_path + vaultedFilePath))
+
+            # make a copy of the encrypted file
+            shutil.copy2(vaultedFilePath, temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/encrypted')
+
+            # decrypt the file using Ansible's official vault implementation
+            # Read encrypted data as bytes to preserve exact formatting
+            with open(vaultedFilePath, 'rb') as f:
+                encrypted_data = f.read()
+                # VaultLib.decrypt() returns bytes, preserving binary data and line endings
+                decrypted_bytes = vault.decrypt(encrypted_data)
+
+            # write a hash of the decrypted content (bytes) to disk in the temporary directory
+            file_hash = hashlib.sha256(decrypted_bytes).hexdigest()
+            with open(temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/hash', 'w') as decryptedVaultFileHash:
+                decryptedVaultFileHash.write(file_hash)
+
+            # write the decrypted data to disk as bytes to preserve exact formatting
+            with open(vaultedFilePath, 'wb') as decryptedVaultFile:
+                decryptedVaultFile.write(decrypted_bytes)
+                
+        except Exception as e:
+            print(f"Failed to decrypt {vaultedFilePath}: {e}")
+            continue
+
+
+def mkdir_p(path):
+    try:
+        os.makedirs(path)
+    except OSError as exc:  # Python >2.5
+        if exc.errno == errno.EEXIST and os.path.isdir(path):
+            pass
+        else:
+            raise
+
+
+def recrypt_vault_files(vault_password_file_path=None):
+    with open(temp_vault_file_list_path, 'r') as vaultListFile:
+        vaultedFileList = json.load(vaultListFile)
+
+    # determine vault password file
+    if vault_password_file_path:
+        vault_file = vault_password_file_path
+    else:
+        vault_file = get_vault_password_file()
+
+    # load vault password into memory
+    with open(vault_file, 'r') as vault_password_file:
+        vaultPassword = vault_password_file.read().strip()
+
+    # create VaultLib instance using Ansible's official implementation
+    vault = VaultLib([
+        (DEFAULT_VAULT_ID_MATCH, VaultSecret(vaultPassword.encode('utf-8')))
+    ])
+
+    # iterate over the list of vaulted files
+    for vaultedFilePath in vaultedFileList:
+        try:
+            # Load stored encrypted data as bytes
+            with open(temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/encrypted', 'rb') as f:
+                old_encrypted_data = f.read()
+
+            with open(temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/hash', 'r') as f:
+                old_hash = f.read().strip()
+
+            # Load (potentially) new data from original path as bytes
+            with open(vaultedFilePath, 'rb') as f:
+                new_data_bytes = f.read()
+                new_hash = hashlib.sha256(new_data_bytes).hexdigest()
+
+            # Determine whether to re-encrypt
+            if old_hash != new_hash:
+                # File was modified, re-encrypt it using Ansible's official vault implementation
+                # VaultLib.encrypt() expects and returns bytes
+                new_encrypted_data = vault.encrypt(new_data_bytes)
+            else:
+                # File unchanged, restore original encrypted version
+                new_encrypted_data = old_encrypted_data
+
+            # Update file with bytes to preserve exact formatting
+            with open(vaultedFilePath, 'wb') as f:
+                f.write(new_encrypted_data)
+
+            # Clean vault
+            try:
+                os.remove(temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/encrypted')
+                os.remove(temp_hidden_encrypted_copies_directory_path + vaultedFilePath + '/hash')
+                os.removedirs(temp_hidden_encrypted_copies_directory_path + vaultedFilePath)
+            except Exception as e:
+                print(f"Warning: Failed to clean temp files for {vaultedFilePath}: {e}")
+        except Exception as e:
+            print(f"Failed to process {vaultedFilePath}: {e}")
+            continue
+    
+    try:
+        os.removedirs(temp_hidden_encrypted_copies_directory_path)
+    except Exception:
+        pass
+
+    try:
+        os.remove(temp_vault_file_list_path)
+    except Exception:
+        pass
+
+
+def main():
+    """Main CLI entry point for pilfer"""
+    # Parse Args
+    parser = argparse.ArgumentParser(
+        prog='pilfer',
+        description='Decrypt all ansible vault files in a project recursively for search/editing, then re-encrypt them when done'
+    )
+    parser.add_argument('action', choices=['open', 'close'], 
+                       help="'open' to decrypt all vault files, 'close' to re-encrypt modified files")
+    parser.add_argument('-p', '--vault-password-file', type=str,
+                        help="Path to vault password file")
+    args = parser.parse_args()
+
+    # Open / Close Vault
+    if args.action == 'open':
+        # check for an existing encrypted file list
+        # if one exists, decrypt the files
+        # if it doesn't, make one
+        if Path(temp_vault_file_list_path).is_file():
+            # print "path exists, skipping file creation"
+            decrypt_vault_files(args.vault_password_file)
+        else:
+            write_vaulted_file_list()
+            decrypt_vault_files(args.vault_password_file)
+
+    elif args.action == 'close':
+        recrypt_vault_files(args.vault_password_file)
+
+
+if __name__ == '__main__':
+    main() 

pilfer-1.0.0.dist-info/METADATA

@@ -0,0 +1,228 @@
+Metadata-Version: 2.4
+Name: pilfer
+Version: 1.0.0
+Summary: Decrypt all ansible vault files in a project recursively for search/editing, then re-encrypt when done.
+Author-email: Tom Paine <github@aioue.net>
+Project-URL: Homepage, https://github.com/aioue/pilfer
+Project-URL: Repository, https://github.com/aioue/pilfer
+Project-URL: Issues, https://github.com/aioue/pilfer/issues
+Keywords: ansible,vault,encryption,devops,automation
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+Requires-Dist: ansible>=2.9.0
+
+# pilfer
+Decrypt *all* ansible vault files in a project recursively for search/editing, then re-encrypt them all at once when you're done.
+
+Borrows heavily from the excellent, but no longer supported [Ansible Toolkit](https://github.com/dellis23/ansible-toolkit).
+
+**Updated for Python 3 compatibility with modern features and ansible.cfg integration.**
+
+Tested with Ansible v2.18.x and Python 3.12.x
+
+## Features
+
+- **Python 3 compatible** - Modernized for current Python versions
+- **ansible.cfg integration** - Automatically reads `vault_password_file` from your ansible.cfg
+- **Change detection** - Only re-encrypts files that were actually modified (using SHA256)
+- **Safe operation** - Preserves original encrypted content for unchanged files
+- **No third-party dependencies** - Uses Ansible's official vault implementation directly
+- **Binary data preservation** - Preserves exact line endings and formatting (critical for certificates)
+
+## Usage
+```
+pilfer [open|close] [-p VAULT_PASSWORD_FILE]
+```
+
+### Basic Usage
+
+**Option 1: Standalone Script (No Installation)**
+- Download `pilfer.py` and place it in your Ansible project directory
+- Run `python pilfer.py open` to decrypt all vaulted files recursively
+- Edit/search plaintext as needed
+- Run `python pilfer.py close` to re-encrypt any changed files
+
+**Option 2: Installed via pipx (Recommended)**
+- Install pilfer via pipx: `pipx install pilfer`
+- Run `pilfer open` to decrypt all vaulted files recursively
+- Edit/search plaintext as needed
+- Run `pilfer close` to re-encrypt any changed files
+
+Any unchanged files will be returned to their original state.
+
+### Vault Password File Detection
+
+The script automatically detects your vault password file in this order:
+
+1. **Command line argument**: `-p /path/to/vault/file`
+2. **ansible.cfg**: Reads `vault_password_file` from `[defaults]` section
+3. **Common locations**: 
+   - `~/.ansible-vault/.vault-file`
+   - `../../vault_password_file` 
+   - `.vault_password`
+   - `vault_password_file`
+
+### Examples
+
+**Using the installed version:**
+```bash
+# Use ansible.cfg vault_password_file setting (recommended)
+pilfer open
+
+# Specify custom vault password file
+pilfer open -p ~/.my-vault-password
+
+# Close and re-encrypt modified files
+pilfer close
+```
+
+**Using the standalone script:**
+```bash
+# Use ansible.cfg vault_password_file setting (recommended)
+python pilfer.py open
+
+# Specify custom vault password file
+python pilfer.py open -p ~/.my-vault-password
+
+# Close and re-encrypt modified files
+python pilfer.py close
+```
+
+## Installation
+
+### Option 1: Standalone Script (No Installation Required)
+
+Download and use the standalone script directly:
+
+```bash
+# Download the standalone script
+curl -O https://raw.githubusercontent.com/aioue/pilfer/main/pilfer.py
+
+# Make it executable (required for ./pilfer.py usage)
+chmod +x pilfer.py
+
+# Use it directly
+./pilfer.py open
+# OR
+python pilfer.py open
+```
+
+### Option 2: Install via pipx (Recommended for Regular Use)
+
+**Python 3.6+** is required. Install pilfer using pipx for isolated CLI tool management:
+
+```bash
+# Install pilfer via pipx (recommended)
+pipx install pilfer
+
+# Verify installation
+pilfer --help
+```
+
+### Alternative Installation Methods
+
+If you prefer other installation methods:
+
+```bash
+# Install from source (in development mode)
+git clone https://github.com/aioue/pilfer.git
+cd pilfer
+pip install -e .
+
+# Direct pip installation (not recommended for CLI tools)
+pip install pilfer
+```
+
+### Requirements
+
+Pilfer requires **Ansible** to be available. If not already installed:
+
+```bash
+# Using pipx (recommended for CLI tools)
+pipx install ansible
+
+# Using pip
+pip install ansible
+
+# System package manager
+# Ubuntu/Debian:
+sudo apt update && sudo apt install ansible
+
+# RHEL/CentOS/Fedora:
+sudo dnf install ansible
+
+# macOS:
+brew install ansible
+```
+
+### ansible.cfg Setup (Recommended)
+
+Add to your `ansible.cfg`:
+```ini
+[defaults]
+vault_password_file = ~/.ansible-vault/.vault-file
+```
+
+This eliminates the need to manually configure vault password paths.
+
+## Development and Publishing
+
+### For Developers
+
+To set up for development:
+
+```bash
+# Clone the repository
+git clone https://github.com/aioue/pilfer.git
+cd pilfer
+
+# Install in development mode
+pip install -e .
+
+# Make changes and test
+pilfer --help
+```
+
+### Publishing to PyPI
+
+Prerequisites:
+```bash
+# Install build tools
+pip install build twine
+
+# Configure PyPI credentials
+# ~/.pypirc or use environment variables
+```
+
+Build and publish:
+```bash
+# Make the script executable
+chmod +x build_and_publish.sh
+
+# Publish to TestPyPI first
+./build_and_publish.sh test
+
+# After testing, publish to production PyPI
+./build_and_publish.sh prod
+```
+
+The build script will:
+1. Clean previous builds
+2. Build the package using modern Python packaging
+3. Upload to PyPI/TestPyPI using twine
+4. Provide installation instructions

pilfer-1.0.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+pilfer/__init__.py,sha256=3N7TCsFQL2mNLlrM2WJT2c8tPo7km-zwU16n7KIkUtU,584
+pilfer/cli.py,sha256=cjJbjDWR0eXNq7DnldZIY2zTd_RgySnc6ur-BfDF-KE,9709
+pilfer-1.0.0.dist-info/METADATA,sha256=VtKu9hZkuiLm7jqTo6y3ULzQo5ZKYXdadBeBhuWYmu4,6113
+pilfer-1.0.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+pilfer-1.0.0.dist-info/entry_points.txt,sha256=z0AIRa_eNRWZUUqPzZc2nQNpYYXI3sKvxjpPO-KKiRI,43
+pilfer-1.0.0.dist-info/top_level.txt,sha256=hl-KQi0BEX35OJTEv3Fl0HKr1k0mRzXtPHrJyur0tCM,7
+pilfer-1.0.0.dist-info/RECORD,,

pilfer-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.9.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

pilfer-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+pilfer = pilfer.cli:main

pilfer-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+pilfer