Metadata-Version: 2.1
Name: secrets-tool
Version: 0.1.0
Summary: A lightweight tool to easily encrypt/decrypt secrets inside a repository
Home-page: https://github.com/defreng/secrets-tool
License: MIT
Author: Alexander Hungenberg
Author-email: alexander.hungenberg@gmail.com
Requires-Python: >=3.8,<4.0
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Requires-Dist: cryptography (>=2.9.2,<3.0.0)
Requires-Dist: ruamel.yaml (>=0.16.10,<0.17.0)
Project-URL: Repository, https://github.com/defreng/secrets-tool
Description-Content-Type: text/markdown

# Secrets Tool
This is a small tool which helps to encrypt secrets that must be committed to a Git repository.

It has the advantage to natively support partial encryption of YAML files. This is of great advantage, as it allows to see the YAML file structure even when some of its contents are encrypted (your PR reviewers and diff tools will thank you)

## Prerequisites
* Python >= 3.7
* Having the following packages installed: `pip install ruamel.yaml cryptography`

## Usage
The tool reads a list of files to encrypt/decrypt from a `.gitignore` file. In there it will only consider files that are sorrounded by a comment block as in the following example:

```
# BEGIN ENCRYPTED
kaas-rubik-stage/values.yaml
# END ENCRYPTED
```

Run the tool by giving the `.gitignore` file as an argument, together with either a `encrypt` or `decrypt` command:

```
cd <REPOSITORY_ROOT>
python -m utils.secrets_tool k8s_helm/.gitignore encrypt
```

## Syntax
The tool provides different encryption handlers for all kind of file types.
* `yaml` for YAML files that are used by tools which are okay having a `!decrypted` tag in front of strings
* `yamlcompat` for tools that don't like the additional 'encryption marker' tag.
* `generic` for all other file types. It encrypts the complete file.

The desired encryption handler is inferred from the filetype - or it can be given explicitly in the gitignore file using the `# type:` hint:

```
# BEGIN ENCRYPTED
kaas-rubik-stage/values.yaml

# type: yaml
kaas-rubik-stage/values2.txt
# END ENCRYPTED
```

### yamlcompat
This encryption handler can encrypt individual YAML keys without relying on 'parser visible' changes in the YAML file structure.
Instead of marking the desired keys directly in the file, they are listed in the .gitignore file using a `# data: ` comment:

```
# BEGIN ENCRYPTED
kaas-rubik-stage/values.yaml

# type: yamlcompat
# data: splunk.apiToken
# data: splunk.host
kaas-rubik-stage/values2.yaml
# END ENCRYPTED
```

*WARNING* It is recommended to use the normal YAML handler whenever possible. When using the yamlcompat module, you split up your encryption logic over multiple files, which might lead to errors (especially on fragile YAML files that contain unnamed structures - like lists)

