Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 1 | #!/usr/bin/env python3 |
| 2 | |
| 3 | # A little tool to encrypt/decrypt git secrets. Kinda like password-store, but more purpose specific and portable. |
| 4 | |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 5 | import logging |
| 6 | import os |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 7 | import sys |
| 8 | import subprocess |
| 9 | |
| 10 | keys = [ |
Sergiusz Bazanski | 711c4a9 | 2019-01-13 00:02:10 +0100 | [diff] [blame] | 11 | "63DFE737F078657CC8A51C00C29ADD73B3563D82", # q3k |
| 12 | "482FF104C29294AD1CAF827BA43890A3DE74ECC7", # inf |
Sergiusz Bazanski | 41bd2b5 | 2019-01-17 23:37:36 +0100 | [diff] [blame] | 13 | "F07205946C07EEB2041A72FBC60C64879534F768", # cz2 |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 14 | #"0879F9FCA1C836677BB808C870FD60197E195C26", # implr (expired 2019-02-09) |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 15 | ] |
| 16 | |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 17 | |
| 18 | logger = logging.getLogger(__name__) |
| 19 | |
| 20 | |
Sergiusz Bazanski | de06180 | 2019-01-13 21:14:02 +0100 | [diff] [blame] | 21 | def encrypt(src, dst): |
| 22 | cmd = ['gpg' , '--encrypt', '--armor', '--batch', '--yes', '--output', dst] |
| 23 | for k in keys: |
| 24 | cmd.append('--recipient') |
| 25 | cmd.append(k) |
| 26 | cmd.append(src) |
| 27 | subprocess.check_call(cmd) |
| 28 | |
| 29 | def decrypt(src, dst): |
Sergiusz Bazanski | a9bb1d5 | 2019-04-28 17:13:12 +0200 | [diff] [blame] | 30 | cmd = ['gpg', '--decrypt', '--batch', '--yes', '--output', dst, src] |
Sergiusz Bazanski | de06180 | 2019-01-13 21:14:02 +0100 | [diff] [blame] | 31 | subprocess.check_call(cmd) |
| 32 | |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 33 | |
| 34 | class SecretStoreMissing(Exception): |
| 35 | pass |
| 36 | |
| 37 | |
| 38 | class SecretStore(object): |
| 39 | def __init__(self, plain_root, cipher_root): |
| 40 | self.proot = plain_root |
| 41 | self.croot = cipher_root |
| 42 | |
| 43 | def exists(self, suffix): |
| 44 | p = os.path.join(self.proot, suffix) |
| 45 | c = os.path.join(self.croot, suffix) |
| 46 | return os.path.exists(c) or os.path.exists(p) |
| 47 | |
| 48 | def plaintext(self, suffix): |
Piotr Dobrowolski | c10f00b | 2019-04-09 13:29:21 +0200 | [diff] [blame] | 49 | p = os.path.join(self.proot, suffix) |
| 50 | c = os.path.join(self.croot, suffix) |
| 51 | |
| 52 | if not os.path.exists(p) or os.path.getctime(p) < os.path.getctime(c): |
| 53 | logger.info("Decrypting {} ({})...".format(suffix, c)) |
| 54 | decrypt(c, p) |
| 55 | |
| 56 | return p |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 57 | |
| 58 | def open(self, suffix, mode, *a, **kw): |
| 59 | p = os.path.join(self.proot, suffix) |
| 60 | c = os.path.join(self.croot, suffix) |
| 61 | if 'w' in mode: |
Piotr Dobrowolski | c10f00b | 2019-04-09 13:29:21 +0200 | [diff] [blame] | 62 | return open(p, mode, *a, **kw) |
Sergiusz Bazanski | 73cef11 | 2019-04-07 00:06:23 +0200 | [diff] [blame] | 63 | |
| 64 | if not self.exists(suffix): |
| 65 | raise SecretStoreMissing("Secret {} does not exist".format(suffix)) |
| 66 | |
| 67 | if not os.path.exists(p) or os.path.getctime(p) < os.path.getctime(c): |
| 68 | logger.info("Decrypting {} ({})...".format(suffix, c)) |
| 69 | decrypt(c, p) |
| 70 | |
| 71 | return open(p, mode, *a, **kw) |
| 72 | |
| 73 | |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 74 | def main(): |
| 75 | if len(sys.argv) < 3 or sys.argv[1] not in ('encrypt', 'decrypt'): |
Sergiusz Bazanski | f2a812b | 2019-01-13 17:51:34 +0100 | [diff] [blame] | 76 | sys.stderr.write("Usage: {} encrypt/decrypt file\n".format(sys.argv[0])) |
| 77 | sys.stderr.flush() |
| 78 | return 1 |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 79 | |
| 80 | action = sys.argv[1] |
| 81 | src = sys.argv[2] |
| 82 | |
| 83 | if action == 'encrypt': |
Sergiusz Bazanski | de06180 | 2019-01-13 21:14:02 +0100 | [diff] [blame] | 84 | encrypt(src, '-') |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 85 | else: |
Sergiusz Bazanski | de06180 | 2019-01-13 21:14:02 +0100 | [diff] [blame] | 86 | decrypt(src, '-') |
Serge Bazanski | a5be0d8 | 2018-12-23 01:35:07 +0100 | [diff] [blame] | 87 | |
| 88 | if __name__ == '__main__': |
| 89 | sys.exit(main() or 0) |