Module: YamlRecrypt

Defined in:
lib/yaml_recrypt/gpg.rb,
lib/yaml_recrypt.rb,
lib/yaml_recrypt/eyaml.rb,
lib/yaml_recrypt/version.rb,
lib/yaml_recrypt/postprocess.rb

Overview

Sourced from github.com/sihil/hiera-eyaml-gpg file: /lib/hiera/backend/eyaml/encryptors/gpg.rb

Defined Under Namespace

Modules: Eyaml, Gpg, PostProcess

Constant Summary collapse

GPG_MAGIC = 
"-----BEGIN PGP MESSAGE-----"
BACKUP_EXT = 
"orig"
REAL_PUPPET_DIR =

match /etc/puppet and /etc/puppetlabs to protect all customers

"/etc/puppet"
VERSION = 
"0.1.2"

Class Method Summary collapse

Class Method Details

.descend(gpg_home, eyaml_pub_key, value) ⇒ Object 



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/yaml_recrypt.rb', line 45

def self.descend(gpg_home, eyaml_pub_key, value)
  replaced = 0
  if value.class == Array
    i = 0
    value.each { |v|
      begin
        r, subtree  = descend(gpg_home, eyaml_pub_key, v)
        value[i]    = subtree
        replaced    += r
      rescue GPGME::Error::NoData
        raise("Invalid GPG data detected in element #{i}")
      end
      i += 1
    }
  elsif value.class == Hash
    value.each { |k,v|
      begin
        r, subtree  = descend(gpg_home, eyaml_pub_key, v)
        value[k]    = subtree
        replaced    += r
      rescue GPGME::Error::NoData
        raise("Invalid GPG data detected in key #{k}")
      end
    }
  else
    r, value = process_value(value, gpg_home, eyaml_pub_key)
    replaced += r
  end

  return replaced, value
end

.process_value(value, gpg_home, eyaml_pub_key) ⇒ Object 



77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/yaml_recrypt.rb', line 77

def self.process_value(value, gpg_home, eyaml_pub_key)
  split = value.split("\n")

  # PGP values are always broken onto newlines
  if split[0].strip == '' and split[1].strip == GPG_MAGIC
    value = recrypt(value, gpg_home, eyaml_pub_key)
    changed = 1
  else
    changed = 0
  end

  return changed, value
end

.recrypt(gpg_ct, gpg_home, eyaml_pub_key) ⇒ Object 



100
101
102
103
104
 
# File 'lib/yaml_recrypt.rb', line 100

def self.recrypt(gpg_ct, gpg_home, eyaml_pub_key)
  pt = YamlRecrypt::Gpg::decrypt(gpg_ct, gpg_home)

  YamlRecrypt::Eyaml::encrypt_and_encode(pt, eyaml_pub_key).strip
end

.recrypt_file(filename, gpg_home, eyaml_pub_key) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/yaml_recrypt.rb', line 18

def self.recrypt_file(filename, gpg_home, eyaml_pub_key)
  if filename.start_with? REAL_PUPPET_DIR
    abort("Detected being run from the #{REAL_PUPPET_DIR}*! Refusing to run to avoid trashing live puppet master")
  end
  Escort::Logger.output.puts "Processing #{filename}"

  # load the yaml into a hash
  hash_wip  = YAML.load(File.readlines(filename).join("\n"))

  # descend every key until a string (or terminal) is reached
  replaced, converted = descend(gpg_home, eyaml_pub_key, hash_wip)

  if replaced > 0
    Escort::Logger.output.puts "*** updated #{replaced} values in #{filename} ****"
    # save old file with .orig -- some fool might run this on a non-version
    # controlled directory...
    FileUtils.cp(filename, "#{filename}.#{BACKUP_EXT}")

    # save the new data
    File.open(filename, 'w') {|f| f.write hash_wip.to_yaml }

    # Post-process the data to convert yaml multi-line blocks into yaml folded
    # blocks
    YamlRecrypt::PostProcess::postprocess(filename)
  end
end

.recrypt_r(dir, gpg_home, eyaml_pub_key) ⇒ Object 



91
92
93
94
95
96
97
98
 
# File 'lib/yaml_recrypt.rb', line 91

def self.recrypt_r(dir, gpg_home, eyaml_pub_key)
  Find.find(dir) do |path|
    if path =~ /.*\.yaml$/
      recrypt_file(path, gpg_home, eyaml_pub_key)
    end
  end

end