From 334b0788557ecc9bfc40d800990a2f63a982fcbd Mon Sep 17 00:00:00 2001 From: Vokhmin Alexey V Date: Wed, 19 Dec 2012 22:18:00 +0400 Subject: [PATCH] #794: update KeyPair model, write migration --- Gemfile | 2 + Gemfile.lock | 4 ++ app/models/key_pair.rb | 59 +++++++++++++------ config/locales/models/key_pair.en.yml | 3 + config/locales/models/key_pair.ru.yml | 3 + ...22905_add_encrypted_secret_to_key_pairs.rb | 22 +++++++ db/schema.rb | 16 ++++- 7 files changed, 90 insertions(+), 19 deletions(-) create mode 100644 db/migrate/20121219122905_add_encrypted_secret_to_key_pairs.rb diff --git a/Gemfile b/Gemfile index cea408700..a6bb3f7f0 100644 --- a/Gemfile +++ b/Gemfile @@ -56,6 +56,8 @@ gem 'rails-backbone', '~> 0.7.2' gem 'rack-throttle' gem 'rest-client', '~> 1.6.6' +gem 'attr_encrypted', '1.2.1' + group :assets do gem 'sass-rails', '~> 3.2.5' gem 'coffee-rails', '~> 3.2.2' diff --git a/Gemfile.lock b/Gemfile.lock index c4c90b960..c5579510d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -58,6 +58,8 @@ GEM ancestry (1.3.0) activerecord (>= 2.3.14) arel (3.0.2) + attr_encrypted (1.2.1) + encryptor (>= 1.1.1) bcrypt-ruby (3.0.1) blankslate (2.1.2.4) bluepill (0.0.60) @@ -102,6 +104,7 @@ GEM diff-display (0.0.1) diff-lcs (1.1.3) ejs (1.0.0) + encryptor (1.1.3) erubis (2.7.0) escape_utils (0.2.4) eventmachine (0.12.10) @@ -364,6 +367,7 @@ DEPENDENCIES RedCloth airbrake (~> 3.1.2) ancestry (~> 1.3.0) + attr_encrypted (= 1.2.1) bluepill (~> 0.0.60) cancan (= 1.6.7) cape diff --git a/app/models/key_pair.rb b/app/models/key_pair.rb index 25c5c50d5..654033f3e 100644 --- a/app/models/key_pair.rb +++ b/app/models/key_pair.rb @@ -2,34 +2,59 @@ class KeyPair < ActiveRecord::Base belongs_to :repository belongs_to :user - attr_accessor :secret + attr_accessor :fingerprint attr_accessible :public, :secret, :repository_id + attr_encrypted :secret, :key => APP_CONFIG['secret_key'] validates :repository_id, :public, :user_id, :presence => true validates :secret, :presence => true, :on => :create validates :repository_id, :uniqueness => {:message => I18n.t("activerecord.errors.key_pair.repo_key_exists")} + validate :check_keys - before_create :key_create_call - before_destroy :rm_key_call + before_create :set_key_id protected - def key_create_call - result, self.key_id = BuildServer.import_gpg_key_pair(public, secret) - raise "Failed to create key_pairs for repository #{repository_id} with code #{result}." if result == 4 - if result != 0 || self.key_id.nil? - errors.add(:public, I18n.t("activerecord.errors.key_pair.rpc_error_#{result}")) - return false - end - result = BuildServer.set_repository_key(repository.platform.name, repository.name, self.key_id) - raise "Failed to sign repository #{repository.name} in platform #{repository.platform.name} - using key_id #{self.key_id} with code #{result}." unless result.zero? + def set_key_id + self.key_id = @fingerprint end - def rm_key_call - result = BuildServer.rm_repository_key(repository.platform.name, repository.name) - raise "Failed to desroy repository key #{repository.name} in platform - #{repository.platform.name} with code #{result}." unless result.zero? + def check_keys + p_key_fingerprint = fingerprint_of_key(:public) + s_key_fingerprint = fingerprint_of_key(:secret) + if p_key_fingerprint && s_key_fingerprint + if p_key_fingerprint != s_key_fingerprint + errors.add :secret, I18n.t('activerecord.errors.key_pair.rpc_error_3') + else + @fingerprint = p_key_fingerprint + end + end end + + def fingerprint_of_key(field) + key = self.send(field) + tmp_file = "key-#{repository_id}-#{user_id}" + file = Tempfile.new tmp_file + file.write key + file.close + str = %x[ gpg --with-fingerprint #{file.path} | sed -n 1,2p] + info = str.strip.split("\n") + if info.size != 2 || (fingerprint = info[1].gsub(/.*\=/, '').strip.gsub(/\s/, ':') && fingerprint.present?) + errors.add field, I18n.t('activerecord.errors.key_pair.wrong_key') + return nil + end + prefix = field == :public ? 'pub' : 'sec' + if info[0] !~ /^#{prefix}/ + errors.add field, I18n.t("activerecord.errors.key_pair.contains_#{field}_key") + return nil + end + return fingerprint + ensure + if file + file.close + file.unlink # deletes the temp file + end + end + end diff --git a/config/locales/models/key_pair.en.yml b/config/locales/models/key_pair.en.yml index 9b685612a..4d78aa08b 100644 --- a/config/locales/models/key_pair.en.yml +++ b/config/locales/models/key_pair.en.yml @@ -21,6 +21,9 @@ en: rpc_error_1: could not import public key rpc_error_2: could not import secret key rpc_error_3: keys are imported, but it is not a key pair (ids differ) + wrong_key: wrong + contains_public_key: contains secret key + contains_secret_key: contains public key models: key_pair: Key Pair attributes: diff --git a/config/locales/models/key_pair.ru.yml b/config/locales/models/key_pair.ru.yml index 465ab0052..43df76d20 100644 --- a/config/locales/models/key_pair.ru.yml +++ b/config/locales/models/key_pair.ru.yml @@ -21,6 +21,9 @@ ru: rpc_error_1: Проблемы с импортром публичного ключа rpc_error_2: Проблемы с импортром секретного ключа rpc_error_3: Ключи импортированы, но не являются парой (идентификаторы не совпадают) + wrong_key: неправильный + contains_public_key: содержит секретный ключ + contains_secret_key: содержит публичный ключ models: key_pair: Подпись attributes: diff --git a/db/migrate/20121219122905_add_encrypted_secret_to_key_pairs.rb b/db/migrate/20121219122905_add_encrypted_secret_to_key_pairs.rb new file mode 100644 index 000000000..0e35c4726 --- /dev/null +++ b/db/migrate/20121219122905_add_encrypted_secret_to_key_pairs.rb @@ -0,0 +1,22 @@ +class AddEncryptedSecretToKeyPairs < ActiveRecord::Migration + def up + rename_table :key_pairs, :key_pairs_backup + rename_index :key_pairs_backup, 'index_key_pairs_on_repository_id', 'index_key_pairs_backup_on_repository_id' + + create_table :key_pairs do |t| + t.text :public, :null => false + t.text :encrypted_secret, :null => false + t.string :key_id, :null => false + t.references :user, :null => false + t.references :repository, :null => false + t.timestamps + end + add_index :key_pairs, :repository_id, :unique => true + end + + def down + drop_table :key_pairs + rename_table :key_pairs_backup, :key_pairs + rename_index :key_pairs, 'index_key_pairs_backup_on_repository_id', 'index_key_pairs_on_repository_id' + end +end diff --git a/db/schema.rb b/db/schema.rb index cf6ffe34e..420d673a8 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -11,7 +11,7 @@ # # It's strongly recommended to check this file into your version control system. -ActiveRecord::Schema.define(:version => 20121214145009) do +ActiveRecord::Schema.define(:version => 20121219122905) do create_table "activity_feeds", :force => true do |t| t.integer "user_id", :null => false @@ -207,6 +207,18 @@ ActiveRecord::Schema.define(:version => 20121214145009) do add_index "issues", ["project_id", "serial_id"], :name => "index_issues_on_project_id_and_serial_id", :unique => true create_table "key_pairs", :force => true do |t| + t.text "public", :null => false + t.text "encrypted_secret", :null => false + t.string "key_id", :null => false + t.integer "user_id", :null => false + t.integer "repository_id", :null => false + t.datetime "created_at", :null => false + t.datetime "updated_at", :null => false + end + + add_index "key_pairs", ["repository_id"], :name => "index_key_pairs_on_repository_id", :unique => true + + create_table "key_pairs_backup", :force => true do |t| t.integer "repository_id", :null => false t.integer "user_id", :null => false t.string "key_id", :null => false @@ -215,7 +227,7 @@ ActiveRecord::Schema.define(:version => 20121214145009) do t.datetime "updated_at", :null => false end - add_index "key_pairs", ["repository_id"], :name => "index_key_pairs_on_repository_id", :unique => true + add_index "key_pairs_backup", ["repository_id"], :name => "index_key_pairs_backup_on_repository_id", :unique => true create_table "labelings", :force => true do |t| t.integer "label_id", :null => false