TomPoulton/hiera-eyaml — pull request #7 by sihil (2013-07-20 16:28:48+00:00)
Title: Add --eyaml mode to operate on whole files

This pull request has a couple of parts to it (I can break it down if you don't want to take it all).

The first part is a change to the way input and output is handled. Input can now come from --string, --password or a filename that is the last argument on the command line. If none are supplied, the script will assume it should try to read from stdin. Output formatting can be overriden from the examples given to output more script friendly format by setting --output to block or string.

The second part is adding a new --eyaml option. When invoked in this mode, eyaml will assume that file input is supplied that is in the eyaml format (i.e. YAML with ENC[] blocks). Whole files can be decrypted and encrypted. As it is currently implemented, when a whole file is decrypted it is marked using `ENC![your plain text is here]!` where format is STRING or BLOCK depending on how it was originally formatted (either with or without newlines and spaces breaking up the encoded ciphertext). It is blocks of text in this format that will be picked up by the --encrypt action when in eyaml mode.

I'm afraid ruby isn't a language I use much so I'm not familiar with the normal idioms, feel free to amend.

These actions are the first stage in having a new --edit action in eyaml that will decrypt an entire eyaml file, pass that decrypted file to the user for editing in their $EDITOR and then re-encrypt the content again. The only complex part remaining of this is tracking each individual block so that blocks are not needlessly re-encrypted (because the re-encrypted cipher would not match the original, so it would show as edited in VCS diffs). Thoughts welcome.