{"id":13647631,"url":"https://github.com/voxpupuli/hiera-eyaml","last_synced_at":"2026-02-22T01:36:01.729Z","repository":{"id":9154283,"uuid":"10948481","full_name":"voxpupuli/hiera-eyaml","owner":"voxpupuli","description":"A backend for Hiera that provides per-value asymmetric encryption of sensitive data","archived":false,"fork":false,"pushed_at":"2026-01-12T13:10:22.000Z","size":719,"stargazers_count":534,"open_issues_count":64,"forks_count":135,"subscribers_count":66,"default_branch":"master","last_synced_at":"2026-02-12T03:35:01.763Z","etag":null,"topics":["hacktoberfest"],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/voxpupuli.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"vox-pupuli","github":"voxpupuli"}},"created_at":"2013-06-25T19:54:09.000Z","updated_at":"2026-01-23T16:28:31.000Z","dependencies_parsed_at":"2026-01-14T01:00:20.460Z","dependency_job_id":null,"html_url":"https://github.com/voxpupuli/hiera-eyaml","commit_stats":{"total_commits":373,"total_committers":64,"mean_commits":5.828125,"dds":0.868632707774799,"last_synced_commit":"f38257df1794b1740297403bec7592f3c3e0acc6"},"previous_names":["tompoulton/hiera-eyaml"],"tags_count":26,"template":false,"template_full_name":null,"purl":"pkg:github/voxpupuli/hiera-eyaml","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fhiera-eyaml","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fhiera-eyaml/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fhiera-eyaml/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fhiera-eyaml/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/voxpupuli","download_url":"https://codeload.github.com/voxpupuli/hiera-eyaml/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fhiera-eyaml/sbom","scorecard":{"id":1240513,"data":{"date":"2025-12-08","repo":{"name":"github.com/voxpupuli/hiera-eyaml","commit":"be50d541f340d9c2a702010ddc038d1ba0473ed3"},"scorecard":{"version":"v5.4.1-0.20251208185525-fedd44def304","commit":"fedd44def304f712772e49d65a5ae068d252c9dd"},"score":7.4,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#binary-artifacts"}},{"name":"Maintained","score":6,"reason":"6 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 6","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:39","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:88","Info: found token with 'none' permissions: .github/workflows/release.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:11"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/test.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/test.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/test.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/voxpupuli/hiera-eyaml/test.yml/master?enable=pin","Info:   0 out of   8 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   6 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.txt:0","Info: FSF or OSI recognized license: MIT License: LICENSE.txt:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#fuzzing"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yml:67"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#packaging"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/voxpupuli/.github/SECURITY.md:1","Info: Found linked content: github.com/voxpupuli/.github/SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: github.com/voxpupuli/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#security-policy"}},{"name":"SAST","score":2,"reason":"SAST tool is not run on all commits -- score normalized to 2","details":["Warn: 8 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/fedd44def304f712772e49d65a5ae068d252c9dd/docs/checks.md#sast"}}]},"last_synced_at":"2025-12-18T23:22:48.137Z","repository_id":9154283,"created_at":"2025-12-18T23:22:48.137Z","updated_at":"2025-12-18T23:22:48.137Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29666809,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-20T19:49:36.704Z","status":"ssl_error","status_checked_at":"2026-02-20T19:44:05.372Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest"],"created_at":"2024-08-02T01:03:40.833Z","updated_at":"2026-02-22T01:36:01.703Z","avatar_url":"https://github.com/voxpupuli.png","language":"Ruby","funding_links":["https://opencollective.com/vox-pupuli","https://github.com/sponsors/voxpupuli"],"categories":["Ruby","Tools","Secret Management"],"sub_categories":["Modules Management"],"readme":"# Hiera eyaml\n\n\n[![License](https://img.shields.io/github/license/voxpupuli/hiera-eyaml.svg)](https://github.com/voxpupuli/hiera-eyaml/blob/master/LICENSE.txt)\n[![Test](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/test.yml/badge.svg)](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/test.yml)\n[![codecov](https://codecov.io/gh/voxpupuli/hiera-eyaml/branch/master/graph/badge.svg)](https://codecov.io/gh/voxpupuli/hiera-eyaml)\n[![Release](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/release.yml/badge.svg)](https://github.com/voxpupuli/hiera-eyaml/actions/workflows/release.yml)\n[![RubyGem Version](https://img.shields.io/gem/v/hiera-eyaml.svg)](https://rubygems.org/gems/hiera-eyaml)\n[![RubyGem Downloads](https://img.shields.io/gem/dt/hiera-eyaml.svg)](https://rubygems.org/gems/hiera-eyaml)\n\nhiera-eyaml is a backend for Hiera that provides per-value encryption of sensitive data within yaml files\nto be used by Puppet.\n\n-------------------------\n:new: **hiera-eyaml is now part of Vox Pupuli**\n\nhiera-eyaml has a new home https://github.com/voxpupuli/hiera-eyaml.\n\nHopefully this will mean more frequent feature updates and bug fixes!\n\nAdvantages over hiera-gpg\n-------------------------\n\nA few people found that [hiera-gpg](https://github.com/crayfishx/hiera-gpg) just wasn't cutting it for all use cases,\none of the best expressed frustrations was\n[written back in June 2013](http://slashdevslashrandom.wordpress.com/2013/06/03/my-griefs-with-hiera-gpg/). So\n[Tom created an initial version](http://themettlemonkey.wordpress.com/2013/07/15/hiera-eyaml-per-value-encrypted-backend-for-hiera-and-puppet/)\nand this was refined into an elegant solution over the following months.\n\nUnlike `hiera-gpg`, `hiera-eyaml`:\n\n - only encrypts the values (which allows files to be swiftly reviewed without decryption)\n - encrypts the value of each key individually (this means that `git diff` is meaningful)\n - includes a command line tool for encrypting, decrypting, editing and rotating keys (makes it almost as\n   easy as using clear text files)\n - uses basic asymmetric encryption (PKCS#7) by default (doesn't require any native libraries that need to\n   be compiled \u0026 allows users without the private key to encrypt values that the puppet master can decrypt)\n - has a pluggable encryption framework (e.g. GPG encryption ([hiera-eyaml-gpg](https://github.com/voxpupuli/hiera-eyaml-gpg)) can be used\n   if you have the need for multiple keys and easier key rotation)\n\nThe Hiera eyaml backend uses yaml formatted files with the .eyaml extension. The encrypted strings are prefixed with the encryption\nmethod, wrapped with ENC[] and placed in an eyaml file. You can mix your plain values in as well or separate them into different files.\nEncrypted values can occur within arrays, hashes, nested arrays and nested hashes.\n\nFor instance:\n\n```yaml\n---\nplain-property: You can see me\n\nencrypted-property: \u003e\n    ENC[PKCS7,Y22exl+OvjDe+drmik2XEeD3VQtl1uZJXFFF2NnrMXDWx0csyqLB/2NOWefv\n    NBTZfOlPvMlAesyr4bUY4I5XeVbVk38XKxeriH69EFAD4CahIZlC8lkE/uDh\n    jJGQfh052eonkungHIcuGKY/5sEbbZl/qufjAtp/ufor15VBJtsXt17tXP4y\n    l5ZP119Fwq8xiREGOL0lVvFYJz2hZc1ppPCNG5lwuLnTekXN/OazNYpf4CMd\n    /HjZFXwcXRtTlzewJLc+/gox2IfByQRhsI/AgogRfYQKocZgFb/DOZoXR7wm\n    IZGeunzwhqfmEtGiqpvJJQ5wVRdzJVpTnANBA5qxeA==]\n```\n\nTo edit this you can use the command `eyaml edit important.eyaml` which will decrypt the file, fire up an editor with\nthe decrypted values and re-encrypt any edited values when you exit the editor. This tool makes editing your encrypted\nfiles as simple as clear text files.\n\n\nSetup\n-----\n\n### Installing hiera-eyaml\n\n#### RubyGems\n\n    $ gem install hiera-eyaml\n\n#### Apt (Ubuntu 18.04+)\n\n    $ sudo apt install hiera-eyaml\n\n### Installing hiera-eyaml for [puppetserver](https://github.com/puppetlabs/puppetserver)\n\nAll commands need to be executed as root. Puppet Enterprise vendors hiera-eyaml\nalready, so you don't need to install it there.\n\n```sh\npuppetserver gem install hiera-eyaml\n```\n\nor via puppet:\n\n```sh\npuppet resource package hiera-eyaml ensure=installed provider=puppetserver_gem\n```\n\nor via Puppet DSL:\n\n```puppet\npackage { 'hiera-eyaml':\n  ensure   =\u003e 'installed',\n  provider =\u003e 'puppetserver_gem',\n}\n```\n\n### Generate keys\n\nThe first step is to create a pair of keys:\n\n    $ eyaml createkeys\n\nThis creates a public and private key with default names in the default location. (./keys)\n\n#### Storing the keys securely when using Puppet\n\nSince the point of using this module is to securely store sensitive information, it's important to store these keys securely.\nIf using Hiera with Puppet, Your puppetmaster will need to access these keys to perform decryption when the puppet agent runs on a remote node.\nSo for this reason, a suggested location might be to store them in `/etc/puppetlabs/puppet/eyaml` or `/var/lib/puppet/keys` depending on your setup.\n\nThe permissions for this folder should allow the puppet user (normally 'puppet') execute access to the keys directory, read only access to the keys themselves and restrict everyone else:\n\n    $ chown -R puppet:puppet /etc/puppetlabs/puppet/eyaml\n    $ chmod -R 0500 /etc/puppetlabs/puppet/eyaml\n    $ chmod 0400 /etc/puppetlabs/puppet/eyaml/*.pem\n    $ ls -lha /etc/puppetlabs/puppet/eyaml\n    -r-------- 1 puppet puppet 1.7K Sep 24 16:24 private_key.pkcs7.pem\n    -r-------- 1 puppet puppet 1.1K Sep 24 16:24 public_key.pkcs7.pem\n\nYou may also load the keypair into an environment variable and use the `pkcs7_private_key_env_var` and `pkcs7_public_key_env_var` options to specify the environment variable names to avoid writing the secret key to disk.\n\n\nBasic usage\n-----------\n\n### Encryption\n\nTo encrypt something, you only need the public_key, so distribute that to people creating hiera properties\n\n    $ eyaml encrypt -f filename            # Encrypt a file\n    $ eyaml encrypt -s 'hello there'       # Encrypt a string\n    $ eyaml encrypt -p                     # Encrypt a password (prompt for it)\n\nUse the -l parameter to pass in a label for the encrypted value,\n\n    $ eyaml encrypt -l 'some_easy_to_use_label' -s 'yourSecretString'\n\n\n### Decryption\n\nTo decrypt something, you need the private_key.\n\nTo test decryption you can use the eyaml tool\n\n    $ eyaml decrypt -f filename               # Decrypt a file\n    $ eyaml decrypt -s 'ENC[PKCS7,.....]'     # Decrypt a string\n\n### Editing files with a mixture of eyaml-encrypted and plain-text content\n\nThis is, perhaps, the most common use of eyaml where you have created a few\neyaml files, with a mixture of encrypted and non-encrypted properties, you can\nedit the encrypted values in place, using the special edit mode of the eyaml\nutility. Edit mode opens a decrypted copy of the eyaml file in your `$EDITOR`\nand will encrypt and modified values when you exit the editor.\n\n    $ eyaml edit filename.eyaml         # Edit an eyaml file in place\n\nWhen editing eyaml files, you will see that the unencrypted plaintext is marked to allow the eyaml tool to\nidentify each encrypted block, along with the encryption method. This is used to make sure that the block\nis encrypted again only if the clear text value has changed, and is encrypted using the\noriginal encryption mechanism (see plugable encryption later).\n\nA decrypted file might look like this:\n\n```yaml\n---\nplain-property: You can see me\n\ncipher-property : \u003e\n    DEC(1)::PKCS7[You can't see me]!\n\nenvironments:\n    development:\n        host: localhost\n        password: password\n    production:\n        host: prod.org.com\n        password: \u003e\n            DEC(2)::PKCS7[securepassword]!\n\nthings:\n    - thing 1\n    -   - nested thing 1.0\n        - \u003e\n            DEC(3)::PKCS7[secure nested thing 1.1]!\n    -   - nested thing 2.0\n        - nested thing 2.1\n```\n\nWhilst editing you can delete existing values and add new one using the same format (as below). Note that it is important to\nomit the number in brackets for new values. If any duplicate IDs are found then the re-encryption process will be abandoned\nby the eyaml tool.\n\n    some_new_key: DEC::PKCS7[a new value to encrypt]!\n\n### Encrypting an entire file\n\nWhile not as common, sometimes you need to encrypt an entire file.  Maybe this\nfile is binary data that isn't meant for loading into an editor.  One example\nmight be a Kerberos keytab file.  No problem!  Just encrypt the entire file:\n\n    $ eyaml encrypt -f filename\n\nAs with encrypting short strings on the command-line, the encrypted equivalent\nwill be sent to stdout as an ASCII text string and thus now plays nice with\nyour editor.  Notice that the file itself, however, remains unchanged.  The\noutput is presented in two blocks: once as a single, long string and once in\na nice line-wrapped form.  Copy the one of your preference, starting with the\n`ENC[` and ending at the matching `]`.  Paste this into your Puppet or Hiera\nfile just like any other eyaml string and your done.  If the file is rather\nlarge, you may wish to use a helper like `xclip` to copy the stdout directly to\nyour clipboard.\n\n### Encrypting multiline values\n\nThe following step-by-step example shows you how to encrypt multiline values.\n\n- Copy the YAML text below to a file named `multiline_example.eyaml`\n```\n---\naccounts::key_sets:\n  dummy:\n    private: |\n      ---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n      Comment: \"dummy-key-hiera-eyaml-issue-rsa-key-20200911\"\n      P2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS\n      1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw\n      JWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj\n      2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr\n      QEPM5xLW0unCsQ==\n      ---- END SSH2 ENCRYPTED PRIVATE KEY ----\n```\n\n- Use `edit` to ...\n  - replace '|' with '\u003e',\n  - prepend `DEC::PKCS7[` before the first line,\n  - remove all whitespaces used for indentation,\n  - and append `]!` to the last line of the multiline value.\n\n`eyaml edit multiline_example.eyaml`\n```\n---\naccounts::key_sets:\n  dummy:\n    private: \u003e\n      DEC::PKCS7[---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\nComment: \"dummy-key-hiera-eyaml-issue-rsa-key-20170123\"\nP2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS\n1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw\nJWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj\n2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr\nQEPM5xLW0unCsQ==\n---- END SSH2 ENCRYPTED PRIVATE KEY ----]!\n```\n```\n# resulting encrypted file\n---\naccounts::key_sets:\n  dummy:\n    private: \u003e\n      ENC[PKCS7,MIIDTQYJKoZIhvcNAQcDoIIDPjCCAzoCAQAxggEhMIIBHQIBADAFMAACAQEw\n      DQYJKoZIhvcNAQEBBQAEggEAXH7xB1xuzoMAqA/3jSXO0ZUR6+UCb3DsTTj3\n      Lsrcx5oQBnJ/ml7GfBCPxBKfArZunLcnxmSk4hECKXdfgKsVjAa++JQWvtEm\n      HUNTFqvwd76Ku+nMfI9c8g+X+l6obLjzWfJdg3t6Ja7CJKl8UNFtSmbfYKVi\n      nZ0xBubgdY4plLAFcZyD5/A/lNFqwb051TRLbZOIRRfLUlRL7RNkKRC59Aog\n      S5aJXjmqx6vRzFifNK0JFZvYHGD75TiHJ5LFjg4rjgFd43AnK8iNo773ZWP2\n      48Gly5Zx7qVQDCDDi1YBgNFb0NIBQw+kWy7HcPH2REvPnXu/HV2FWvDP3Ond\n      yr2EbTCCAg4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEH+CjZJ1gKfaQIrr\n      N5zef7OAggHgBmRVsfaoiNEOzhmHZ5SxxZztmpBNtLv7mteaSqSL5o0TtKQh\n      SDgxBhaQmlL51+JM1Jsnvqm57ikZhj7Vtek/vr5DhYhWs0AxttH5rNaw0zKU\n      4bMppVu+SNKCtT+2Qw31x/S7gF7yVl+mwmXhq3qAj9ExWRX3d/8/zTuC61Io\n      f+7O6YUOucZ/m/YPrQnC5v7bDSKlIf1aFaKqukjM3QO8FZlAOHGPvRuWV2Om\n      QIgxQE6F8r+bTkW3KiVIx5FEIthRZ90VS3tz/2wjj77svddBhlid9ov/0ard\n      GGVNGsl1BFpLqxC0mpZXz237cL/aM58naqmX52J6YmC0xQM3DNmahWlYx1HV\n      J/Ogk12pOYPLJB/09OuoHPzKC4WfpB9B7wAC6pghRkO/84cOw6rgSdbzze5W\n      WMPvo181Y74BSBKhJDdO3lWYmEcDyx4TEsMUlpxd9PBDcOHqf9qHviXrwGzO\n      oSm2bUV0Fum5ueU+D2vu3mO0yIQ6fwyvDZLBRjfJV7K/PyDz81feWT6+g38t\n      AC27c0h8wk9b7HYfqG28nZE7F13qrhwCKnOaYLglsmbszNpRrBhfo1IHF6oM\n      YZRZrnrGQg5qQcxMsLq37RAfRgkY0rRLs78EEAhkf4NDxw0A/ovt]\n```\n- Output of `eyaml decrypt -f multiline_example.eyaml`:\n```\n---\naccounts::key_sets:\n  dummy:\n    private: |\n  ---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n  Comment: \"dummy-key-hiera-eyaml-issue-rsa-key-20200911\"\n  P2/56wAAANwAAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS\n  1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAAjQAAAIkAAAAGJQAAAP93ZtrMIRZutZ/SZUyw\n  JWwyI4YxNvr5tBt9UnSJ7K0+rQAAAQDohO1ykUahsogS+ymM6o9WEmdROJZpWShCqdv8Dj\n  2roQAAAIDG1G8hY90Xlz/YiFhDZLLWAAAAgOzMWTfAlHbJ4AdEhG5uU/EAAACA+1/AlcSr\n  QEPM5xLW0unCsQ==\n  ---- END SSH2 ENCRYPTED PRIVATE KEY ----\n```\n  - The output *does NOT* have to be valid YAML for usage with Puppet.\n\nHiera\n-----\n\nTo use eyaml with hiera and puppet, first configure hiera.yaml to use the eyaml backend.\n\nEyaml works with [Hiera 3.x](https://docs.puppet.com/hiera/latest), as well as with [Hiera 5](https://docs.puppet.com/puppet/latest/hiera_intro.html) (Puppet 4.9.3 and later).\n\n### With Hiera 5\n\nIn Hiera 5, each hierarchy level has one designated backend, as well as its own independent configuration for that backend.\n\nHierarchy levels that use eyaml must set the following keys:\n\n* `name`.\n* `lookup_key` (must be set to `eyaml_lookup_key`).\n* `path`/`paths`/`glob`/`globs` (choose one).\n* `datadir` (can be omitted if you've set a default).\n* `options` — a hash of eyaml-specific settings; by default, this should include `pkcs7_private_key` and `pkcs7_public_key`, or `pkcs7_public_key_env_var` and `pkcs7_private_key_env_var`, but alternate encryption plugins use alternate options. Anything from the old `:eyaml` config section (except `datadir`) goes here.\n\n    You do not need to specify key names as `:symbols`; normal strings are fine.\n\n``` yaml\n---\nversion: 5\ndefaults:\n  datadir: data\nhierarchy:\n  - name: \"Secret data: per-node, per-datacenter, common\"\n    lookup_key: eyaml_lookup_key # eyaml backend\n    paths:\n      - \"secrets/nodes/%{trusted.certname}.eyaml\"  # Include explicit file extension\n      - \"secrets/location/%{facts.whereami}.eyaml\"\n      - \"common.eyaml\"\n    options:\n      pkcs7_private_key: /etc/puppetlabs/puppet/eyaml/private_key.pkcs7.pem\n      pkcs7_public_key:  /etc/puppetlabs/puppet/eyaml/public_key.pkcs7.pem\n  - name: \"Normal data\"\n    data_hash: yaml_data # Standard yaml backend\n    paths:\n      - \"nodes/%{trusted.certname}.yaml\"\n      - \"location/%{facts.whereami}/%{facts.group}.yaml\"\n      - \"groups/%{facts.group}.yaml\"\n      - \"os/%{facts.os.family}.yaml\"\n      - \"common.yaml\"\n```\n\nUnlike with Hiera 3, there's no default file extension for eyaml files, so you can specify your own file extension directly in the path name.\n\nFor more details, see the [hiera.yaml (version 5) reference page](https://docs.puppet.com/puppet/latest/hiera_config_yaml_5.html).\n\n### With Hiera 3\n\nIn Hiera 3, hierarchy levels don't have a backend assigned to them, and Hiera loops through the entire hierarchy for each backend. Options for the backend are set globally, in an `:eyaml` config section.\n\n```yaml\n---\n:backends:\n    - eyaml\n    - yaml\n\n:hierarchy:\n    - %{environment}\n    - common\n\n:yaml:\n    :datadir: '/etc/puppet/hieradata'\n:eyaml:\n    :datadir: '/etc/puppet/hieradata'\n\n    # If using the pkcs7 encryptor (default)\n    :pkcs7_private_key: /path/to/private_key.pkcs7.pem\n    :pkcs7_public_key:  /path/to/public_key.pkcs7.pem\n\n    # Optionally cache decrypted data (default: false)\n    :cache_decrypted: false\n```\n\nThen, edit your hiera yaml files, and insert your encrypted values. The default eyaml file extension is .eyaml, however this can be configured in the :eyaml block to set :extension,\n\n```yaml\n:eyaml:\n    :extension: 'yaml'\n```\n\n### Data formatting note\n\n*Important Note:*\nThe eyaml backend will not parse internally json formatted yaml files, whereas the regular yaml backend will.\nYou'll need to ensure any existing yaml files using json format are converted to syntactically correct yaml format.\n\n```yaml\n---\nplain-property: You can see me\n\ncipher-property : \u003e\n    ENC[PKCS7,Y22exl+OvjDe+drmik2XEeD3VQtl1uZJXFFF2NnrMXDWx0csyqLB/2NOWefv\n    NBTZfOlPvMlAesyr4bUY4I5XeVbVk38XKxeriH69EFAD4CahIZlC8lkE/uDh\n    jJGQfh052eonkungHIcuGKY/5sEbbZl/qufjAtp/ufor15VBJtsXt17tXP4y\n    l5ZP119Fwq8xiREGOL0lVvFYJz2hZc1ppPCNG5lwuLnTekXN/OazNYpf4CMd\n    /HjZFXwcXRtTlzewJLc+/gox2IfByQRhsI/AgogRfYQKocZgFb/DOZoXR7wm\n    IZGeunzwhqfmEtGiqpvJJQ5wVRdzJVpTnANBA5qxeA==]\n\nenvironments:\n    development:\n        host: localhost\n        password: password\n    production:\n        host: prod.org.com\n        password: \u003e\n            ENC[PKCS7,Y22exl+OvjDe+drmik2XEeD3VQtl1uZJXFFF2NnrMXDWx0csyqLB/2NOWefv\n            NBTZfOlPvMlAesyr4bUY4I5XeVbVk38XKxeriH69EFAD4CahIZlC8lkE/uDh\n            jJGQfh052eonkungHIcuGKY/5sEbbZl/qufjAtp/ufor15VBJtsXt17tXP4y\n            l5ZP119Fwq8xiREGOL0lVvFYJz2hZc1ppPCNG5lwuLnTekXN/OazNYpf4CMd\n            /HjZFXwcXRtTlzewJLc+/gox2IfByQRhsI/AgogRfYQKocZgFb/DOZoXR7wm\n            IZGeunzwhqfmEtGiqpvJJQ5wVRdzJVpTnANBA5qxeA==]\n\nthings:\n    - thing 1\n    -   - nested thing 1.0\n        - \u003e\n            ENC[PKCS7,Y22exl+OvjDe+drmik2XEeD3VQtl1uZJXFFF2NnrMXDWx0csyqLB/2NOWefv\n            NBTZfOlPvMlAesyr4bUY4I5XeVbVk38XKxeriH69EFAD4CahIZlC8lkE/uDh\n            jJGQfh052eonkungHIcuGKY/5sEbbZl/qufjAtp/ufor15VBJtsXt17tXP4y\n            l5ZP119Fwq8xiREGOL0lVvFYJz2hZc1ppPCNG5lwuLnTekXN/OazNYpf4CMd\n            /HjZFXwcXRtTlzewJLc+/gox2IfByQRhsI/AgogRfYQKocZgFb/DOZoXR7wm\n            IZGeunzwhqfmEtGiqpvJJQ5wVRdzJVpTnANBA5qxeA==]\n    -   - nested thing 2.0\n        - nested thing 2.1\n```\n\nConfiguration file for eyaml\n----------------------------\n\nDefault parameters for the eyaml command line tool can be provided by creating a configuration YAML file.\n\nConfig files will be read in following order:\n* first from system-wide `/etc/eyaml/config.yaml`\n* then from user home directory `~/.eyaml/config.yaml`\n* then from current working directory `.eyaml/config.yaml`\n* finally by anything referenced in the `EYAML_CONFIG` environment variable\n\nThe file takes any long form argument that you can provide on the command line. For example, to override the pkcs7 keys:\n```yaml\n---\npkcs7_private_key: './keys/eyaml/private_key.pkcs7.pem'\npkcs7_public_key: './keys/eyaml/public_key.pkcs7.pem'\n```\n\nOr to override to use GPG by default:\n```yaml\n---\nencrypt_method: 'gpg'\ngpg_gnupghome: './alternative_gnupghome'\ngpg_recipients: 'sihil@example.com,gtmtech@example.com,tpoulton@example.com'\n```\n\nPluggable Encryption\n--------------------\n\nhiera-eyaml backend is pluggable, so that further encryption types can be added as separate gems to the general mechanism which hiera-eyaml uses. Hiera-eyaml ships with one default mechanism of 'pkcs7', the encryption type widely used to sign smime email messages.\n\nOther encryption types (if the gems for them have been loaded) can be specified using the following formats:\n\n    ENC[PKCS7,SOME_ENCRYPTED_VALUE]         # a PKCS7 encrypted value\n    ENC[GPG,SOME_ENCRYPTED_VALUE]           # a GPG encrypted value (hiera-eyaml-gpg)\n    ... etc ...\n\nWhen editing eyaml files, you will see that the unencrypted plaintext is marked in such a way as to identify the encryption method. This is so that the eyaml tool knows to encrypt it back using the correct method afterwards:\n\n    some_key: DEC(1)::PKCS7[very secret password]!\n\n### Encryption plugins\n\nThis is a list of available plugins:\n\n - [hiera-eyaml-gpg](https://github.com/sihil/hiera-eyaml-gpg) - Provide GPG encryption\n - [hiera-eyaml-plaintext](https://github.com/gtmtechltd/hiera-eyaml-plaintext) - This is a no-op encryption plugin that\n   simply base64 encodes the values. It exists as an example plugin to create your own and to do integration tests on\n   hiera-eyaml. **THIS SHOULD NOT BE USED IN PRODUCTION**\n - [hiera-eyaml-twofac](https://github.com/gtmtechltd/hiera-eyaml-twofac) - PKCS7 keypair + AES256 symmetric password for two-factor encryption\n   Note that this plugin mandates the user enter a password. It is useful for non-automated scenarios, and is not advised to be used\n   in conjunction with puppet, as it requires entry of a password over a terminal.\n - [hiera-eyaml-kms](https://github.com/adenot/hiera-eyaml-kms) - Encryption using AWS Key Management Service (KMS)\n - [hiera-eyaml-gkms](https://github.com/craigwatson/hiera-eyaml-gkms) - Encryption using Google Cloud KMS\n - [hiera-eyaml-vault](https://github.com/crayfishx/hiera-eyaml-vault) - Use the transit secrets engine from Vault for providing encryption.\n\n\n### How-To's:\n\n - [How to use different Hiera/Eyaml keys for different environments using the AWS Parameter Store to store the encryption keys for Hiera/Eyaml](https://gist.github.com/FransUrbo/88b26033cb513a8aa569bd5392a427b1).\n\nNotes\n-----\n\nIf you do not specify an encryption method within ENC[] tags, it will be assumed to be PKCS7\n\nAlso remember that after encrypting your sensitive properties, if anyone has access to your git source,\nthey will see what the property was in previous commits before you encrypted. It's recommended that you\nroll any passwords when switching from unencrypted to encrypted properties. eg, Developers having write\naccess to a DEV branch will be able to read/view the contents of the PRD branch, as per the design of GIT.\n\nGithub has a great guide on removing sensitive data from repos here:\nhttps://help.github.com/articles/remove-sensitive-data\n\n\nTroubleshooting\n---------------\n\n### Installing from behind a corporate/application proxy\n\n    $ export HTTP_PROXY=http://yourcorporateproxy:3128/\n    $ export HTTPS_PROXY=http://yourcorporateproxy:3128/\n\nthen run your install\n\n    $ gem install hiera-eyaml\n\n\nIssues\n------\n\nIf you have found a bug then please raise an issue here on github.\n\nSome of us hang out on #voxpupuli on [Libera.Chat](https://libera.chat/), please drop by if you want to say hi or have a question.\n\n\nTests\n-----\n\n**NOTE** Some testing requirements are not supported on Windows\n\nIn order to run the tests, simply run `cucumber` in the top level directory of the project.\n\nYou'll need to have a few requirements installed:\n\n  * `expect` (via yum/apt-get or system package)\n  * `aruba` (gem)\n  * `cucumber` (gem)\n  * `puppet` (gem)\n  * `hiera-eyaml-plaintext` (gem)\n\n\nAuthors\n-------\n\n- [Tom Poulton](http://github.com/TomPoulton) - Initial author. eyaml backend.\n- [Geoff Meakin](http://github.com/gtmtech) - Major contributor. eyaml command, tests, CI\n- [Simon Hildrew](http://github.com/sihil) - Contributor. eyaml edit sub command.\n- [Robert Fielding](http://github.com/rooprob) - Contributor. eyaml recrypt sub command.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fhiera-eyaml","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoxpupuli%2Fhiera-eyaml","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fhiera-eyaml/lists"}