StackExchange / blackbox

Safely store secrets in Git/Mercurial/Subversion
MIT License
6.69k stars 370 forks source link

Awareness of Blackbox enabled submodules #81

Open selfcommit opened 9 years ago

selfcommit commented 9 years ago

Currently blackbox is not aware of blackbox enabled git submodules. The end result is a behavior that blackbox_postdeploy does not attempt to unpack files in submodules of a repository.

The work around for this currently is to have a deploy agent call blackbox on each submodule, or to register files a second time in the main repo of a given project; Both of which are less than ideal.

A nice feature would be to have blackbox_postdeploy use the .gitmodule file to check for registered modules and attempt to unpack any files registered to that submodules project.

selfcommit commented 9 years ago

I started working out a solution for this:

    if [[ -f ".gitmodules" ]]; then
        # http://stackoverflow.com/questions/12641469/
        for MODULE in $(git submodule status --recursive | cut -d' ' -f3-3); do
            if is_blackbox_repo "$MODULE"; then
              change_to_vcs_root
              prepare_keychain
             # Decrypt:
             ...

I hit a wall with $REPOBASE. $REPOBASE is currently defined by a private function, but must be updated to the submodules base each time prepare_keychain is called.

tlimoncelli commented 9 years ago

REPOBASE is now handled differently. It may be easier to accomplish the goal now.

REPOBASE is set once in _blackbox_common.sh instead of on-demand.

selfcommit commented 9 years ago

I looked at this again since the update. I think the easiest solution might just be a script that traverses each submodule and then calls blackbox_postdeploy.
The script could be recursive, and could also be used for blackbox_shred_all and blackbox_update_all

tlimoncelli commented 9 years ago

That would be a fine addition to blackbox_update_all_files and blackbox_shred_all_files.