janware/jw-pkg
Watch
1
Code Pull requests 1 Activity Actions
jw-pkg/src/python/jw/pkg/cmds/CmdSecrets.py

13 lines
374 B
Python
Raw Normal View History

cmds.CmdSecrets: Add command class + subcommands jw-pkg.py secrets [sub-command] [packages] is a set of utility commands designed to manage configuration files containing secrets. To keep secrets from leaking via version control or packages, a _template_ should be packaged for every sensitive configuration file. Then, during post-install, configuration files can be generated from packaged templates via jw-pkg.py secrets compile-templates <package> <package> ... During post-uninstall jw-pkg.py secrets rm-compilation-output <package> <package> ... removes them. Not specifying any packages will compile or remove all templates on the system. To identify which files to consider and generate or remove, the compilation scans <package> for files ending in .jw-tmpl. For each match, e.g. /path/to/some.conf.jw-tmpl it will read key-value pairs from /path/to/some.conf.jw-secret and generate /path/to/some.conf from it, replacing all keys by their respective values. The file attributes of the generated file can be determined by the first line: of some.conf.jw-tmpl or some.conf.jw-secret: # conf: owner=mysql; group=mysql; mode=0640 There are other commands for managing all secrets on the system at once, see jw-pkg.py secrets --help: compile-templates Compile package template files list-compilation-output List package compilation output files list-secrets List package secret files list-templates List package template files rm-compilation-output Remove package compilation output files Signed-off-by: Jan Lindemann <jan@janware.com>
2026-03-05 11:01:18 +01:00
from argparse import ArgumentParser
from ..App import App
from .Cmd import Cmd as CmdBase
jw.pkg: Fix "make check" static code check fallout The previous commits have put rules for linting and formatting via ruff, yapf, mypy and pyright into place. They are checked with the make check target, and this commit adds the fixes for the target to succeed. It does some refactoring where type checking dug up dirty bits, and also adds lots of churn in the Python code. To a good deal, that's owed to mere formatting changes. It would have been better to seperate those from syntax and refactoring fixes into multiple commits, so that the interesting changes don't drown in the formatting nose. However, that would have been a lot of additional work only to be thrown away by later commits, hence this commit has a big diff in one piece. The size of the diff is regrettable but hopefully a one-off: What it buys is automatic format checking for CI and predictble formats for smaller diffs in the future. Rules that "make check" enforces are, in the following order - Syntax checkers: - ruff check . - mypy . - pyright - Format check: - yapf --diff --recursive . The refactoring includes: - Turn the Result class into a more elaborate object, capable of doing more heavy lifting around stderr and stdout decoding, summarizing outcome, and matching error strings. Aside from fixing broken type checks, this also removes lots of boilerplate calling code which is currently used for handling possible call outcome scenarios. Trying to access an inexistent, decoded string should raise a meaningful exception by itself now, which removes lots of code with case distinctions. - Fix Cmd type hierarchy: - Add the AbstractCmd class above Cmd. This is necessary because the checker rightfully complains it can't instantiate a Cmd instance where constructor arguments were needed. They never were, but the type used at the instantiating code's location in jw.pkg.App so claims. - Lots of sub- and sub-subcommands are derived from the base class of the invoking command. That provides some properties shared across the ancestor hierarchy of a command, but is semantically unsound. Fix that by introducing jw.pkg.BaseCmd class as a place to provide basic helpers shared across all commands used in a jw.pkg.App's context, and derive all command classes from that afresh. The parent command is still reachable via a common parent property. Formatting changes are conforming to PEP-8, mostly, with minor tweaks. All in all they include the following changes. - Remove # -*- coding: utf-8 -*- The line was needed by Python 2 which is not supported anylonger. For Python 3, the default encoding is UTF-8, anyway. - Allow to run "make py-format" without having it produce any changes. It's basically "yapf --in-place --recursive ." with some code style settings, see conf/topdir/pyproject.toml. The settings may be debatable. I've had custom tweaks in place on that target, too, but then again, IDEs would have more hassle to integrate that. - Introduce a 88 character line length limit - One import per line, reshuffle them semantically, see [tool.isort] in pyproject.toml. - Hide imports needed for type-checking only behind if TYPE_CHECKING - Spaces around assignments accounts for much churn. Having having no spaces in inline parameter list assignments and default parameter values would arguably be more compact where it's useful. On the other hand, I have not found a code formatter which allows spaces around assignments in parameter lists broken into one per line and that's often better than a wall of text. - Add two spaces before # export, as this seems to be mandated by PEP-8 - Use single quotes by default Signed-off-by: Jan Lindemann <jan@janware.com>
2026-05-27 07:16:05 +02:00
class CmdSecrets(CmdBase): # export
cmds.CmdSecrets: Add command class + subcommands jw-pkg.py secrets [sub-command] [packages] is a set of utility commands designed to manage configuration files containing secrets. To keep secrets from leaking via version control or packages, a _template_ should be packaged for every sensitive configuration file. Then, during post-install, configuration files can be generated from packaged templates via jw-pkg.py secrets compile-templates <package> <package> ... During post-uninstall jw-pkg.py secrets rm-compilation-output <package> <package> ... removes them. Not specifying any packages will compile or remove all templates on the system. To identify which files to consider and generate or remove, the compilation scans <package> for files ending in .jw-tmpl. For each match, e.g. /path/to/some.conf.jw-tmpl it will read key-value pairs from /path/to/some.conf.jw-secret and generate /path/to/some.conf from it, replacing all keys by their respective values. The file attributes of the generated file can be determined by the first line: of some.conf.jw-tmpl or some.conf.jw-secret: # conf: owner=mysql; group=mysql; mode=0640 There are other commands for managing all secrets on the system at once, see jw-pkg.py secrets --help: compile-templates Compile package template files list-compilation-output List package compilation output files list-secrets List package secret files list-templates List package template files rm-compilation-output Remove package compilation output files Signed-off-by: Jan Lindemann <jan@janware.com>
2026-03-05 11:01:18 +01:00
def __init__(self, parent: App) -> None:
jw.pkg: Fix "make check" static code check fallout The previous commits have put rules for linting and formatting via ruff, yapf, mypy and pyright into place. They are checked with the make check target, and this commit adds the fixes for the target to succeed. It does some refactoring where type checking dug up dirty bits, and also adds lots of churn in the Python code. To a good deal, that's owed to mere formatting changes. It would have been better to seperate those from syntax and refactoring fixes into multiple commits, so that the interesting changes don't drown in the formatting nose. However, that would have been a lot of additional work only to be thrown away by later commits, hence this commit has a big diff in one piece. The size of the diff is regrettable but hopefully a one-off: What it buys is automatic format checking for CI and predictble formats for smaller diffs in the future. Rules that "make check" enforces are, in the following order - Syntax checkers: - ruff check . - mypy . - pyright - Format check: - yapf --diff --recursive . The refactoring includes: - Turn the Result class into a more elaborate object, capable of doing more heavy lifting around stderr and stdout decoding, summarizing outcome, and matching error strings. Aside from fixing broken type checks, this also removes lots of boilerplate calling code which is currently used for handling possible call outcome scenarios. Trying to access an inexistent, decoded string should raise a meaningful exception by itself now, which removes lots of code with case distinctions. - Fix Cmd type hierarchy: - Add the AbstractCmd class above Cmd. This is necessary because the checker rightfully complains it can't instantiate a Cmd instance where constructor arguments were needed. They never were, but the type used at the instantiating code's location in jw.pkg.App so claims. - Lots of sub- and sub-subcommands are derived from the base class of the invoking command. That provides some properties shared across the ancestor hierarchy of a command, but is semantically unsound. Fix that by introducing jw.pkg.BaseCmd class as a place to provide basic helpers shared across all commands used in a jw.pkg.App's context, and derive all command classes from that afresh. The parent command is still reachable via a common parent property. Formatting changes are conforming to PEP-8, mostly, with minor tweaks. All in all they include the following changes. - Remove # -*- coding: utf-8 -*- The line was needed by Python 2 which is not supported anylonger. For Python 3, the default encoding is UTF-8, anyway. - Allow to run "make py-format" without having it produce any changes. It's basically "yapf --in-place --recursive ." with some code style settings, see conf/topdir/pyproject.toml. The settings may be debatable. I've had custom tweaks in place on that target, too, but then again, IDEs would have more hassle to integrate that. - Introduce a 88 character line length limit - One import per line, reshuffle them semantically, see [tool.isort] in pyproject.toml. - Hide imports needed for type-checking only behind if TYPE_CHECKING - Spaces around assignments accounts for much churn. Having having no spaces in inline parameter list assignments and default parameter values would arguably be more compact where it's useful. On the other hand, I have not found a code formatter which allows spaces around assignments in parameter lists broken into one per line and that's often better than a wall of text. - Add two spaces before # export, as this seems to be mandated by PEP-8 - Use single quotes by default Signed-off-by: Jan Lindemann <jan@janware.com>
2026-05-27 07:16:05 +02:00
super().__init__(parent, 'secrets', help = 'Manage package secrets')
lib.Cmd.load_subcommands(): Add method Push cmds.Cmd._add_subcommands() as lib.Cmd.load_subcommands() one step up to the top of the type hierarchy ladder. By default, it does the same thing, i.e. load subcommands matching frobnicate.Cmd* if called on class CmdFrobnicate. This commit also replaces invocations of Cmd._add_subcommands() by invocations of this new method. Signed-off-by: Jan Lindemann <jan@janware.com>
2026-05-01 10:17:24 +02:00
self.load_subcommands()
cmds.CmdSecrets: Add command class + subcommands jw-pkg.py secrets [sub-command] [packages] is a set of utility commands designed to manage configuration files containing secrets. To keep secrets from leaking via version control or packages, a _template_ should be packaged for every sensitive configuration file. Then, during post-install, configuration files can be generated from packaged templates via jw-pkg.py secrets compile-templates <package> <package> ... During post-uninstall jw-pkg.py secrets rm-compilation-output <package> <package> ... removes them. Not specifying any packages will compile or remove all templates on the system. To identify which files to consider and generate or remove, the compilation scans <package> for files ending in .jw-tmpl. For each match, e.g. /path/to/some.conf.jw-tmpl it will read key-value pairs from /path/to/some.conf.jw-secret and generate /path/to/some.conf from it, replacing all keys by their respective values. The file attributes of the generated file can be determined by the first line: of some.conf.jw-tmpl or some.conf.jw-secret: # conf: owner=mysql; group=mysql; mode=0640 There are other commands for managing all secrets on the system at once, see jw-pkg.py secrets --help: compile-templates Compile package template files list-compilation-output List package compilation output files list-secrets List package secret files list-templates List package template files rm-compilation-output Remove package compilation output files Signed-off-by: Jan Lindemann <jan@janware.com>
2026-03-05 11:01:18 +01:00
def add_arguments(self, p: ArgumentParser) -> None:
super().add_arguments(p)
Copy permalink