puzzle / ccli Goto Github PK

Currently, only username and password work with the ccli, since Cryptopus 5.0, new attributes were introduced, such as pin, token, email and also a custom attribute. We have to adjust some parts of ccli for this to work to, encrypted_data structure is still the same for every attribute. We just have to include them everywhere we need in ccli

I would like to sync from a source (cryptopus, openshift, kubernetes) to the local file system to edit the secrets there. These secrets do not need to be in plain-text. They could be encrypted and editable only by another command like cry edit ....

My main pain point is that I want fewer moving parts. Also, I want to have a little more control from where and to where I transfer the secrets.

We haven't pinned down the reason 100% but it seems that the ccli can come to a point when syncing secrets that it tries to Base64-decode non-Base64 encoded strings.

This method:

def decoded_data(data)
    return {} unless data

    data.transform_values do |value|
      Base64.strict_decode64(value)
    rescue ArgumentError
      value
    end
end

is probably the biggest culprit as normally a non Base64 encoded String will just throw an error and return its value but in my case a non-Base64 encoded string was recognized as Base64, was therefore decoded and broke everything.

I have an example string for this case that I can share when needed.