azohra / lyra Goto Github PK

Secret management would be a great new feature for lyra as it doesn't really have any.

Goals:

• Integrate hashicorp vault with lyra

#4 Would require a configuration file to ensure ease of use. Upcoming branches specifically features/locker could benefit from a configuration file.

Specs:

• Configuration format: toml
• Filename: lconf.toml
• Path of conf file: ~/.lyra

Lyra allows the user to encrypt their secrets when they are being their best selves, but sometimes we forget to re encrypt before committing changes to git.

It would be awesome to have a git integration that stopes the commit of secret private assets when they are unencrypted.

Lyra can be tool the CI to fail when unencrypted secret files are pushed; but this still exposes sensitive information and makes it vulnerable. Even worse, the user must be git savvy to amend the commits in such a way as to remove the lingering commits containing the file.

It would be super cool to have Lyra install and uninstall these githooks globally and/or to the individual project with a sub command and/or when you lyra init into a git project.

terminal.ReadPassord() does not work on windows. Input terminates immediately before users can type in passphrases.

39d4517#diff-055e3e2c833cd88c8c82b8fe7a1e2693R159 changes from hardcoded 0 to a variable from package syscall however the values are not the same for unix and windows. There will need to be code to handle this change.

Bug Description

• OS: Windows 10
• Go Version: v1.10

Bug Description

Lyra panics when specifying invalid files.

Files similar to these will panic:

• Empty files.
• Auth params too short/long or are simply invalid such as a single char.

• OS: MacOS 10.12.6
• Go Version: go version go1.10 darwin/amd64
• Output:

⋊> ~/g/s/g/a/lyra on dev ⨯ ./lyra decrypt aae 
Enter passphrase: 
panic: runtime error: slice bounds out of range

goroutine 1 [running]:
github.com/azohra/lyra/pkg/lfile.(*SecureLyraFile).ParseFile(0xc42008e190, 0x7fff5fbffc3f, 0x3, 0x0, 0x0)
	/Users//go/src/github.com/azohra/lyra/pkg/lfile/secure_lyra_file.go:111 +0x40a
github.com/azohra/lyra/pkg/lfile.NewParsedSLFile(0x7fff5fbffc3f, 0x3, 0xc4200160a0, 0xc420053d60, 0x1040938)
	/Users//go/src/github.com/azohra/lyra/pkg/lfile/secure_lyra_file.go:36 +0x58
main.decrypt(0x7fff5fbffc3f, 0x3, 0x0, 0x0, 0x0, 0xc4200160a0, 0x1, 0x8, 0x112d200, 0x0)
	/Users//go/src/github.com/azohra/lyra/cmd/lyra/decrypt.go:113 +0x39
main.(*decryptcmd).Run(0xc42000e3c0, 0xc42000e0e0, 0x1, 0x1, 0x0, 0x0)
	/Users//go/src/github.com/azohra/lyra/cmd/lyra/decrypt.go:96 +0xe2
main.main()
	/Users//go/src/github.com/azohra/lyra/cmd/lyra/lyra.go:110 +0x3dd

Steps to Reproduce

1. Create an empty file and/or a file that has an invalid auth parameter
2. lyra decrypt file