chore: add current provisioning state before migration
This commit is contained in:
Jesús Pérez
parent
a9703b4748
commit
50745b0f22
660 changed files with 88126 additions and 0 deletions
240
core/nulib/lib_provisioning/kms/lib.nu
Normal file
240
core/nulib/lib_provisioning/kms/lib.nu
Normal file
|
|
@ -0,0 +1,240 @@
|
|||
use std
|
||||
use ../utils/error.nu throw-error
|
||||
use ../utils/interface.nu _print
|
||||
|
||||
def find_file [
|
||||
start_path: string
|
||||
match_path: string
|
||||
only_first: bool
|
||||
] {
|
||||
mut found_path = ""
|
||||
mut search_path = $start_path
|
||||
let home_root = ($env.HOME | path dirname)
|
||||
while $found_path == "" and $search_path != "/" and $search_path != $home_root {
|
||||
if $search_path == "" { break }
|
||||
let res = if $only_first {
|
||||
(^find $search_path -type f -name $match_path -print -quit | complete)
|
||||
} else {
|
||||
(^find $search_path -type f -name $match_path err> (if $nu.os-info.name == "windows" { "NUL" } else { "/dev/null" }) | complete)
|
||||
}
|
||||
if $res.exit_code == 0 { $found_path = ($res.stdout | str trim ) }
|
||||
$search_path = ($search_path | path dirname)
|
||||
}
|
||||
$found_path
|
||||
}
|
||||
|
||||
export def run_cmd_kms [
|
||||
task: string
|
||||
cmd: string
|
||||
source_path: string
|
||||
error_exit: bool
|
||||
]: nothing -> string {
|
||||
let kms_config = get_kms_config
|
||||
if ($kms_config | is-empty) {
|
||||
if $error_exit {
|
||||
(throw-error $"🛑 KMS configuration error" $"(_ansi red)No KMS configuration found(_ansi reset)"
|
||||
"run_cmd_kms" --span (metadata $task).span)
|
||||
} else {
|
||||
_print $"🛑 KMS configuration error (_ansi red)No KMS configuration found(_ansi reset)"
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
let kms_cmd = build_kms_command $cmd $source_path $kms_config
|
||||
let res = (^bash -c $kms_cmd | complete)
|
||||
|
||||
if $res.exit_code != 0 {
|
||||
if $error_exit {
|
||||
(throw-error $"🛑 KMS error" $"(_ansi red)($source_path)(_ansi reset) ($res.stdout)"
|
||||
$"on_kms ($task)" --span (metadata $res).span)
|
||||
} else {
|
||||
_print $"🛑 KMS error (_ansi red)($source_path)(_ansi reset) ($res.exit_code)"
|
||||
return ""
|
||||
}
|
||||
}
|
||||
return $res.stdout
|
||||
}
|
||||
|
||||
export def on_kms [
|
||||
task: string
|
||||
source_path: string
|
||||
output_path?: string
|
||||
...args
|
||||
--check (-c)
|
||||
--error_exit
|
||||
--quiet
|
||||
]: nothing -> string {
|
||||
match $task {
|
||||
"encrypt" | "encode" | "e" => {
|
||||
if not ( $source_path | path exists ) {
|
||||
if not $quiet { _print $"🛑 No file ($source_path) found to encrypt with KMS " }
|
||||
return ""
|
||||
}
|
||||
if (is_kms_file $source_path) {
|
||||
if not $quiet { _print $"🛑 File ($source_path) already encrypted with KMS " }
|
||||
return (open -r $source_path)
|
||||
}
|
||||
let result = (run_cmd_kms "encrypt" "encrypt" $source_path $error_exit)
|
||||
if ($output_path | is-not-empty) {
|
||||
$result | save -f $output_path
|
||||
if not $quiet { _print $"Result saved in ($output_path) " }
|
||||
}
|
||||
return $result
|
||||
},
|
||||
"decrypt" | "decode" | "d" => {
|
||||
if not ( $source_path | path exists ) {
|
||||
if not $quiet { _print $"🛑 No file ($source_path) found to decrypt with KMS " }
|
||||
return ""
|
||||
}
|
||||
if not (is_kms_file $source_path) {
|
||||
if not $quiet { _print $"🛑 File ($source_path) is not encrypted with KMS " }
|
||||
return (open -r $source_path)
|
||||
}
|
||||
let result = (run_cmd_kms "decrypt" "decrypt" $source_path $error_exit)
|
||||
if ($output_path | is-not-empty) {
|
||||
$result | save -f $output_path
|
||||
if not $quiet { _print $"Result saved in ($output_path) " }
|
||||
}
|
||||
return $result
|
||||
},
|
||||
"is_kms" | "i" => {
|
||||
return (is_kms_file $source_path)
|
||||
},
|
||||
_ => {
|
||||
(throw-error $"🛑 Option " $"(_ansi red)($task)(_ansi reset) undefined")
|
||||
return ""
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
export def is_kms_file [
|
||||
target: string
|
||||
]: nothing -> bool {
|
||||
if not ($target | path exists) {
|
||||
(throw-error $"🛑 File (_ansi green_italic)($target)(_ansi reset)"
|
||||
$"(_ansi red_bold)Not found(_ansi reset)"
|
||||
$"is_kms_file ($target)"
|
||||
--span (metadata $target).span
|
||||
)
|
||||
}
|
||||
let file_content = (open $target --raw)
|
||||
# Check for KMS-specific markers in the encrypted file
|
||||
if ($file_content | find "-----BEGIN KMS ENCRYPTED DATA-----" | length) > 0 { return true }
|
||||
if ($file_content | find "kms:" | length) > 0 { return true }
|
||||
return false
|
||||
}
|
||||
|
||||
export def decode_kms_file [
|
||||
source: string
|
||||
target: string
|
||||
quiet: bool
|
||||
]: nothing -> nothing {
|
||||
if $quiet {
|
||||
on_kms "decrypt" $source --quiet
|
||||
} else {
|
||||
on_kms "decrypt" $source
|
||||
} | save --force $target
|
||||
}
|
||||
|
||||
def get_kms_config [] {
|
||||
if $env.PROVISIONING_KMS_SERVER? == null {
|
||||
return {}
|
||||
}
|
||||
|
||||
{
|
||||
server_url: ($env.PROVISIONING_KMS_SERVER | default ""),
|
||||
auth_method: ($env.PROVISIONING_KMS_AUTH_METHOD | default "certificate"),
|
||||
client_cert: ($env.PROVISIONING_KMS_CLIENT_CERT | default ""),
|
||||
client_key: ($env.PROVISIONING_KMS_CLIENT_KEY | default ""),
|
||||
ca_cert: ($env.PROVISIONING_KMS_CA_CERT | default ""),
|
||||
api_token: ($env.PROVISIONING_KMS_API_TOKEN | default ""),
|
||||
username: ($env.PROVISIONING_KMS_USERNAME | default ""),
|
||||
password: ($env.PROVISIONING_KMS_PASSWORD | default ""),
|
||||
timeout: ($env.PROVISIONING_KMS_TIMEOUT | default "30" | into int),
|
||||
verify_ssl: ($env.PROVISIONING_KMS_VERIFY_SSL | default "true" | into bool)
|
||||
}
|
||||
}
|
||||
|
||||
def build_kms_command [
|
||||
operation: string
|
||||
file_path: string
|
||||
config: record
|
||||
]: nothing -> string {
|
||||
mut cmd_parts = []
|
||||
|
||||
# Base command - using curl to interact with Cosmian KMS REST API
|
||||
$cmd_parts = ($cmd_parts | append "curl")
|
||||
|
||||
# SSL verification
|
||||
if not $config.verify_ssl {
|
||||
$cmd_parts = ($cmd_parts | append "-k")
|
||||
}
|
||||
|
||||
# Timeout
|
||||
$cmd_parts = ($cmd_parts | append $"--connect-timeout ($config.timeout)")
|
||||
|
||||
# Authentication
|
||||
match $config.auth_method {
|
||||
"certificate" => {
|
||||
if ($config.client_cert | is-not-empty) and ($config.client_key | is-not-empty) {
|
||||
$cmd_parts = ($cmd_parts | append $"--cert ($config.client_cert)")
|
||||
$cmd_parts = ($cmd_parts | append $"--key ($config.client_key)")
|
||||
}
|
||||
if ($config.ca_cert | is-not-empty) {
|
||||
$cmd_parts = ($cmd_parts | append $"--cacert ($config.ca_cert)")
|
||||
}
|
||||
},
|
||||
"token" => {
|
||||
if ($config.api_token | is-not-empty) {
|
||||
$cmd_parts = ($cmd_parts | append $"-H 'Authorization: Bearer ($config.api_token)'")
|
||||
}
|
||||
},
|
||||
"basic" => {
|
||||
if ($config.username | is-not-empty) and ($config.password | is-not-empty) {
|
||||
$cmd_parts = ($cmd_parts | append $"--user ($config.username):($config.password)")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Operation specific parameters
|
||||
match $operation {
|
||||
"encrypt" => {
|
||||
$cmd_parts = ($cmd_parts | append "-X POST")
|
||||
$cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
|
||||
$cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
|
||||
$cmd_parts = ($cmd_parts | append $"($config.server_url)/encrypt")
|
||||
},
|
||||
"decrypt" => {
|
||||
$cmd_parts = ($cmd_parts | append "-X POST")
|
||||
$cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
|
||||
$cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
|
||||
$cmd_parts = ($cmd_parts | append $"($config.server_url)/decrypt")
|
||||
}
|
||||
}
|
||||
|
||||
($cmd_parts | str join " ")
|
||||
}
|
||||
|
||||
export def get_def_kms_config [
|
||||
current_path: string
|
||||
]: nothing -> string {
|
||||
if $env.PROVISIONING_USE_KMS == "" { return ""}
|
||||
let start_path = if ($current_path | path exists) {
|
||||
$current_path
|
||||
} else {
|
||||
$"($env.PROVISIONING_KLOUD_PATH)/($current_path)"
|
||||
}
|
||||
let kms_file = "kms.yaml"
|
||||
mut provisioning_kms = (find_file $start_path $kms_file true )
|
||||
if $provisioning_kms == "" and ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file | path exists ) {
|
||||
$provisioning_kms = ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file )
|
||||
}
|
||||
if $provisioning_kms == "" and ($env.HOME | path join ".provisioning"| path join $kms_file | path exists ) {
|
||||
$provisioning_kms = ($env.HOME | path join ".provisioning"| path join $kms_file )
|
||||
}
|
||||
if $provisioning_kms == "" {
|
||||
_print $"❗Error no (_ansi red_bold)($kms_file)(_ansi reset) file for KMS operations found "
|
||||
exit 1
|
||||
}
|
||||
($provisioning_kms | default "")
|
||||
}
|
||||
1
core/nulib/lib_provisioning/kms/mod.nu
Normal file
1
core/nulib/lib_provisioning/kms/mod.nu
Normal file
|
|
@ -0,0 +1 @@
|
|||
export use lib.nu *
|
||||
Loading…
Add table
Add a link
Reference in a new issue