Skip to content

Commit d9aec9a

Browse files
nicolas-grekasnicolas-grekas
committed
Restrict secrets management to sodium+filesystem
1 parent 02b5d74 commit d9aec9a

35 files changed

+1061
-938
lines changed

‎.travis.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ install:
207207
208208
if [[ ! $deps ]]; then
209209
php .github/build-packages.php HEAD^ src/Symfony/Bridge/PhpUnit src/Symfony/Contracts
210+
composer remove --dev --no-update paragonie/sodium_compat
210211
else
211212
export SYMFONY_DEPRECATIONS_HELPER=weak &&
212213
cp composer.json composer.json.orig &&

‎composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@
113113
"monolog/monolog": "^1.25.1",
114114
"nyholm/psr7": "^1.0",
115115
"ocramius/proxy-manager": "^2.1",
116+
"paragonie/sodium_compat": "^1.8",
116117
"php-http/httplug": "^1.0|^2.0",
117118
"predis/predis": "~1.1",
118119
"psr/http-client": "^1.0",

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ CHANGELOG
1717
* Added new `error_controller` configuration to handle system exceptions
1818
* Added sort option for `translation:update` command.
1919
* [BC Break] The `framework.messenger.routing.senders` config key is not deep merged anymore.
20-
* Added secrets management.
20+
* Added `secrets:*` commands and `%env(secret:...)%` processor to deal with secrets seamlessly.
2121

2222
4.3.0
2323
-----

‎src/Symfony/Bundle/FrameworkBundle/Command/SecretsAddCommand.php

Lines changed: 0 additions & 70 deletions
This file was deleted.

‎src/Symfony/Bundle/FrameworkBundle/Command/SecretsDecryptToLocalCommand.php

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\FrameworkBundle\Command;
13+
14+
use Symfony\Bundle\FrameworkBundle\Secrets\AbstractVault;
15+
use Symfony\Component\Console\Command\Command;
16+
use Symfony\Component\Console\Input\InputInterface;
17+
use Symfony\Component\Console\Input\InputOption;
18+
use Symfony\Component\Console\Output\ConsoleOutputInterface;
19+
use Symfony\Component\Console\Output\OutputInterface;
20+
use Symfony\Component\Console\Style\SymfonyStyle;
21+
22+
/**
23+
* @author Nicolas Grekas <p@tchwork.com>
24+
*/
25+
final class SecretsDecryptToLocalCommand extends Command
26+
{
27+
protected static $defaultName = 'secrets:decrypt-to-local';
28+
29+
private $vault;
30+
private $localVault;
31+
32+
public function __construct(AbstractVault $vault, AbstractVault $localVault = null)
33+
{
34+
$this->vault = $vault;
35+
$this->localVault = $localVault;
36+
37+
parent::__construct();
38+
}
39+
40+
protected function configure()
41+
{
42+
$this
43+
->setDescription('Decrypts all secrets and stores them in the local vault.')
44+
->addOption('force', 'f', InputOption::VALUE_NONE, 'Forces overriding of secrets that already exist in the local vault')
45+
->setHelp(<<<'EOF'
46+
The <info>%command.name%</info> command list decrypts all secrets and stores them in the local vault..
47+
48+
<info>%command.full_name%</info>
49+
50+
When the option <info>--force</info> is provided, secrets that already exist in the local vault are overriden.
51+
52+
<info>%command.full_name% --force</info>
53+
EOF
54+
)
55+
;
56+
}
57+
58+
protected function execute(InputInterface $input, OutputInterface $output): int
59+
{
60+
$io = new SymfonyStyle($input, $output instanceof ConsoleOutputInterface ? $output->getErrorOutput() : $output);
61+
62+
if (null === $this->localVault) {
63+
$io->error('The local vault is disabled.');
64+
65+
return 1;
66+
}
67+
68+
$secrets = $this->vault->list(true);
69+
70+
if (!$input->getOption('force')) {
71+
foreach ($this->localVault->list() as $k => $v) {
72+
unset($secrets[$k]);
73+
}
74+
}
75+
76+
foreach ($secrets as $k => $v) {
77+
if (null === $v) {
78+
$io->error($this->vault->getLastMessage());
79+
80+
return 1;
81+
}
82+
83+
$this->localVault->seal($k, $v);
84+
}
85+
86+
return 0;
87+
}
88+
}

‎src/Symfony/Bundle/FrameworkBundle/Command/SecretsEncryptFromLocalCommand.php

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\FrameworkBundle\Command;
13+
14+
use Symfony\Bundle\FrameworkBundle\Secrets\AbstractVault;
15+
use Symfony\Component\Console\Command\Command;
16+
use Symfony\Component\Console\Input\InputInterface;
17+
use Symfony\Component\Console\Input\InputOption;
18+
use Symfony\Component\Console\Output\ConsoleOutputInterface;
19+
use Symfony\Component\Console\Output\OutputInterface;
20+
use Symfony\Component\Console\Style\SymfonyStyle;
21+
22+
/**
23+
* @author Nicolas Grekas <p@tchwork.com>
24+
*/
25+
final class SecretsEncryptFromLocalCommand extends Command
26+
{
27+
protected static $defaultName = 'secrets:encrypt-from-local';
28+
29+
private $vault;
30+
private $localVault;
31+
32+
public function __construct(AbstractVault $vault, AbstractVault $localVault = null)
33+
{
34+
$this->vault = $vault;
35+
$this->localVault = $localVault;
36+
37+
parent::__construct();
38+
}
39+
40+
protected function configure()
41+
{
42+
$this
43+
->setDescription('Encrypts all local secrets to the vault.')
44+
->addOption('force', 'f', InputOption::VALUE_NONE, 'Forces overriding of secrets that already exist in the vault')
45+
->setHelp(<<<'EOF'
46+
The <info>%command.name%</info> command list encrypts all local secrets and stores them in the vault..
47+
48+
<info>%command.full_name%</info>
49+
50+
When the option <info>--force</info> is provided, secrets that already exist in the vault are overriden.
51+
52+
<info>%command.full_name% --force</info>
53+
EOF
54+
)
55+
;
56+
}
57+
58+
protected function execute(InputInterface $input, OutputInterface $output): int
59+
{
60+
$io = new SymfonyStyle($input, $output instanceof ConsoleOutputInterface ? $output->getErrorOutput() : $output);
61+
62+
if (null === $this->localVault) {
63+
$io->error('The local vault is disabled.');
64+
65+
return 1;
66+
}
67+
68+
$secrets = $this->localVault->list(true);
69+
70+
if (!$input->getOption('force')) {
71+
foreach ($this->vault->list() as $k => $v) {
72+
unset($secrets[$k]);
73+
}
74+
}
75+
76+
foreach ($secrets as $k => $v) {
77+
if (null === $v) {
78+
$io->error($this->localVault->getLastMessage());
79+
80+
return 1;
81+
}
82+
83+
$this->vault->seal($k, $v);
84+
}
85+
86+
return 0;
87+
}
88+
}

‎src/Symfony/Bundle/FrameworkBundle/Command/SecretsGenerateKeyCommand.php

Lines changed: 0 additions & 97 deletions
This file was deleted.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy