Class: Shojiku::LocalPem

Inherits:
Object
  • Object
show all
Defined in:
lib/shojiku/local_pem.rb

Overview

A signing provider backed by a PEM key and certificate.

The only provider this release has. KMS and HSM providers are a recorded deferral, which is why this is a named class rather than a pair of arguments on sign — a second provider then adds a class, not a signature change in seven languages.

The material comes either from paths (key: / cert:) or from bytes already in memory (key_pem: / cert_pem:), so a key fetched from a secret manager never has to be written to disk first. Which one you passed is explicit rather than sniffed: guessing whether a string is a path or a PEM body is exactly the kind of cleverness that reads the wrong file.

Nothing here logs key material, and the engine builds its refusals from fixed strings, so a rejection cannot echo it back either.

Constant Summary collapse

FORMS = 
"`%<what>s:` (a path) or `%<what>s_pem:` (bytes)"

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(key: nil, cert: nil, key_pem: nil, cert_pem: nil, passphrase: nil) ⇒ LocalPem

Returns a new instance of LocalPem.



24
25
26
27
28
29
30
31
32
 
# File 'lib/shojiku/local_pem.rb', line 24

def initialize(key: nil, cert: nil, key_pem: nil, cert_pem: nil, passphrase: nil)
  @key_path = key
  @cert_path = cert
  @key_pem = key_pem
  @cert_pem = cert_pem
  @passphrase = passphrase
  one_source!(key, key_pem, "key")
  one_source!(cert, cert_pem, "cert")
end

Instance Attribute Details

#passphrase ⇒ Object (readonly)

Returns the value of attribute passphrase.



22
23
24
 
# File 'lib/shojiku/local_pem.rb', line 22

def passphrase
  @passphrase
end

Instance Method Details

#certificate ⇒ Object 



52
53
54
 
# File 'lib/shojiku/local_pem.rb', line 52

def certificate
  @certificate ||= @cert_pem || Material.read(@cert_path, "certificate_unreadable")
end

#inspect ⇒ Object

Redacted, deliberately.

The default #inspect prints every instance variable, which here is the private key and the passphrase — into a console, a binding.irb, an exception reporter's local-variable dump, or any log line that interpolates the provider. None of that is worth showing, so nothing is shown but the class and which FORM each half came from. Registering the provider once (see Shojiku::Lockdown) shrinks this surface further: material loads into one object instead of being rebuilt per request.



43
44
45
46
 
# File 'lib/shojiku/local_pem.rb', line 43

def inspect
  "#<#{self.class.name} key=#{form(@key_path)} cert=#{form(@cert_path)} " \
    "passphrase=#{@passphrase ? "[redacted]" : "none"}>"
end

#key ⇒ Object 



48
49
50
 
# File 'lib/shojiku/local_pem.rb', line 48

def key
  @key ||= @key_pem || Material.read(@key_path, "key_unreadable")
end