240 lines
8.5 KiB
Plaintext
240 lines
8.5 KiB
Plaintext
|
use std
|
||
|
|
use ../utils/error.nu throw-error
|
||
|
|
use ../utils/interface.nu _print
|
||
|
|
|
||
|
|
def find_file [
|
||
|
|
start_path: string
|
||
|
|
match_path: string
|
||
|
|
only_first: bool
|
||
|
|
] {
|
||
|
|
mut found_path = ""
|
||
|
|
mut search_path = $start_path
|
||
|
|
let home_root = ($env.HOME | path dirname)
|
||
|
|
while $found_path == "" and $search_path != "/" and $search_path != $home_root {
|
||
|
|
if $search_path == "" { break }
|
||
|
|
let res = if $only_first {
|
||
|
|
(^find $search_path -type f -name $match_path -print -quit | complete)
|
||
|
|
} else {
|
||
|
|
(^find $search_path -type f -name $match_path err> (if $nu.os-info.name == "windows" { "NUL" } else { "/dev/null" }) | complete)
|
||
|
|
}
|
||
|
|
if $res.exit_code == 0 { $found_path = ($res.stdout | str trim ) }
|
||
|
|
$search_path = ($search_path | path dirname)
|
||
|
|
}
|
||
|
|
$found_path
|
||
|
|
}
|
||
|
|
|
||
|
|
export def run_cmd_kms [
|
||
|
|
task: string
|
||
|
|
cmd: string
|
||
|
|
source_path: string
|
||
|
|
error_exit: bool
|
||
|
|
]: nothing -> string {
|
||
|
|
let kms_config = get_kms_config
|
||
|
|
if ($kms_config | is-empty) {
|
||
|
|
if $error_exit {
|
||
|
|
(throw-error $"🛑 KMS configuration error" $"(_ansi red)No KMS configuration found(_ansi reset)"
|
||
|
|
"run_cmd_kms" --span (metadata $task).span)
|
||
|
|
} else {
|
||
|
|
_print $"🛑 KMS configuration error (_ansi red)No KMS configuration found(_ansi reset)"
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let kms_cmd = build_kms_command $cmd $source_path $kms_config
|
||
|
|
let res = (^bash -c $kms_cmd | complete)
|
||
|
|
|
||
|
|
if $res.exit_code != 0 {
|
||
|
|
if $error_exit {
|
||
|
|
(throw-error $"🛑 KMS error" $"(_ansi red)($source_path)(_ansi reset) ($res.stdout)"
|
||
|
|
$"on_kms ($task)" --span (metadata $res).span)
|
||
|
|
} else {
|
||
|
|
_print $"🛑 KMS error (_ansi red)($source_path)(_ansi reset) ($res.exit_code)"
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return $res.stdout
|
||
|
|
}
|
||
|
|
|
||
|
|
export def on_kms [
|
||
|
|
task: string
|
||
|
|
source_path: string
|
||
|
|
output_path?: string
|
||
|
|
...args
|
||
|
|
--check (-c)
|
||
|
|
--error_exit
|
||
|
|
--quiet
|
||
|
|
]: nothing -> string {
|
||
|
|
match $task {
|
||
|
|
"encrypt" | "encode" | "e" => {
|
||
|
|
if not ( $source_path | path exists ) {
|
||
|
|
if not $quiet { _print $"🛑 No file ($source_path) found to encrypt with KMS " }
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
if (is_kms_file $source_path) {
|
||
|
|
if not $quiet { _print $"🛑 File ($source_path) already encrypted with KMS " }
|
||
|
|
return (open -r $source_path)
|
||
|
|
}
|
||
|
|
let result = (run_cmd_kms "encrypt" "encrypt" $source_path $error_exit)
|
||
|
|
if ($output_path | is-not-empty) {
|
||
|
|
$result | save -f $output_path
|
||
|
|
if not $quiet { _print $"Result saved in ($output_path) " }
|
||
|
|
}
|
||
|
|
return $result
|
||
|
|
},
|
||
|
|
"decrypt" | "decode" | "d" => {
|
||
|
|
if not ( $source_path | path exists ) {
|
||
|
|
if not $quiet { _print $"🛑 No file ($source_path) found to decrypt with KMS " }
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
if not (is_kms_file $source_path) {
|
||
|
|
if not $quiet { _print $"🛑 File ($source_path) is not encrypted with KMS " }
|
||
|
|
return (open -r $source_path)
|
||
|
|
}
|
||
|
|
let result = (run_cmd_kms "decrypt" "decrypt" $source_path $error_exit)
|
||
|
|
if ($output_path | is-not-empty) {
|
||
|
|
$result | save -f $output_path
|
||
|
|
if not $quiet { _print $"Result saved in ($output_path) " }
|
||
|
|
}
|
||
|
|
return $result
|
||
|
|
},
|
||
|
|
"is_kms" | "i" => {
|
||
|
|
return (is_kms_file $source_path)
|
||
|
|
},
|
||
|
|
_ => {
|
||
|
|
(throw-error $"🛑 Option " $"(_ansi red)($task)(_ansi reset) undefined")
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
export def is_kms_file [
|
||
|
|
target: string
|
||
|
|
]: nothing -> bool {
|
||
|
|
if not ($target | path exists) {
|
||
|
|
(throw-error $"🛑 File (_ansi green_italic)($target)(_ansi reset)"
|
||
|
|
$"(_ansi red_bold)Not found(_ansi reset)"
|
||
|
|
$"is_kms_file ($target)"
|
||
|
|
--span (metadata $target).span
|
||
|
|
)
|
||
|
|
}
|
||
|
|
let file_content = (open $target --raw)
|
||
|
|
# Check for KMS-specific markers in the encrypted file
|
||
|
|
if ($file_content | find "-----BEGIN KMS ENCRYPTED DATA-----" | length) > 0 { return true }
|
||
|
|
if ($file_content | find "kms:" | length) > 0 { return true }
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
export def decode_kms_file [
|
||
|
|
source: string
|
||
|
|
target: string
|
||
|
|
quiet: bool
|
||
|
|
]: nothing -> nothing {
|
||
|
|
if $quiet {
|
||
|
|
on_kms "decrypt" $source --quiet
|
||
|
|
} else {
|
||
|
|
on_kms "decrypt" $source
|
||
|
|
} | save --force $target
|
||
|
|
}
|
||
|
|
|
||
|
|
def get_kms_config [] {
|
||
|
|
if $env.PROVISIONING_KMS_SERVER? == null {
|
||
|
|
return {}
|
||
|
|
}
|
||
|
|
|
||
|
|
{
|
||
|
|
server_url: ($env.PROVISIONING_KMS_SERVER | default ""),
|
||
|
|
auth_method: ($env.PROVISIONING_KMS_AUTH_METHOD | default "certificate"),
|
||
|
|
client_cert: ($env.PROVISIONING_KMS_CLIENT_CERT | default ""),
|
||
|
|
client_key: ($env.PROVISIONING_KMS_CLIENT_KEY | default ""),
|
||
|
|
ca_cert: ($env.PROVISIONING_KMS_CA_CERT | default ""),
|
||
|
|
api_token: ($env.PROVISIONING_KMS_API_TOKEN | default ""),
|
||
|
|
username: ($env.PROVISIONING_KMS_USERNAME | default ""),
|
||
|
|
password: ($env.PROVISIONING_KMS_PASSWORD | default ""),
|
||
|
|
timeout: ($env.PROVISIONING_KMS_TIMEOUT | default "30" | into int),
|
||
|
|
verify_ssl: ($env.PROVISIONING_KMS_VERIFY_SSL | default "true" | into bool)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def build_kms_command [
|
||
|
|
operation: string
|
||
|
|
file_path: string
|
||
|
|
config: record
|
||
|
|
]: nothing -> string {
|
||
|
|
mut cmd_parts = []
|
||
|
|
|
||
|
|
# Base command - using curl to interact with Cosmian KMS REST API
|
||
|
|
$cmd_parts = ($cmd_parts | append "curl")
|
||
|
|
|
||
|
|
# SSL verification
|
||
|
|
if not $config.verify_ssl {
|
||
|
|
$cmd_parts = ($cmd_parts | append "-k")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Timeout
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--connect-timeout ($config.timeout)")
|
||
|
|
|
||
|
|
# Authentication
|
||
|
|
match $config.auth_method {
|
||
|
|
"certificate" => {
|
||
|
|
if ($config.client_cert | is-not-empty) and ($config.client_key | is-not-empty) {
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--cert ($config.client_cert)")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--key ($config.client_key)")
|
||
|
|
}
|
||
|
|
if ($config.ca_cert | is-not-empty) {
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--cacert ($config.ca_cert)")
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"token" => {
|
||
|
|
if ($config.api_token | is-not-empty) {
|
||
|
|
$cmd_parts = ($cmd_parts | append $"-H 'Authorization: Bearer ($config.api_token)'")
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"basic" => {
|
||
|
|
if ($config.username | is-not-empty) and ($config.password | is-not-empty) {
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--user ($config.username):($config.password)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Operation specific parameters
|
||
|
|
match $operation {
|
||
|
|
"encrypt" => {
|
||
|
|
$cmd_parts = ($cmd_parts | append "-X POST")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"($config.server_url)/encrypt")
|
||
|
|
},
|
||
|
|
"decrypt" => {
|
||
|
|
$cmd_parts = ($cmd_parts | append "-X POST")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
|
||
|
|
$cmd_parts = ($cmd_parts | append $"($config.server_url)/decrypt")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
($cmd_parts | str join " ")
|
||
|
|
}
|
||
|
|
|
||
|
|
export def get_def_kms_config [
|
||
|
|
current_path: string
|
||
|
|
]: nothing -> string {
|
||
|
|
if $env.PROVISIONING_USE_KMS == "" { return ""}
|
||
|
|
let start_path = if ($current_path | path exists) {
|
||
|
|
$current_path
|
||
|
|
} else {
|
||
|
|
$"($env.PROVISIONING_KLOUD_PATH)/($current_path)"
|
||
|
|
}
|
||
|
|
let kms_file = "kms.yaml"
|
||
|
|
mut provisioning_kms = (find_file $start_path $kms_file true )
|
||
|
|
if $provisioning_kms == "" and ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file | path exists ) {
|
||
|
|
$provisioning_kms = ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file )
|
||
|
|
}
|
||
|
|
if $provisioning_kms == "" and ($env.HOME | path join ".provisioning"| path join $kms_file | path exists ) {
|
||
|
|
$provisioning_kms = ($env.HOME | path join ".provisioning"| path join $kms_file )
|
||
|
|
}
|
||
|
|
if $provisioning_kms == "" {
|
||
|
|
_print $"❗Error no (_ansi red_bold)($kms_file)(_ansi reset) file for KMS operations found "
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
($provisioning_kms | default "")
|
||
|
|
}
|