ID-39: use key file instead of passphrase

Author: mlookaxw

CHANGELOG.adoc

@@ -15,8 +15,7 @@ Use the `--base-dir` parameter of the configuration tool or the `axway.config.ce
 |Support for confidential properties.
 
 For confidential properties the configuration tools supports to pass a secrets file.
-It is a JSON file where the values of the properties are encrypted by a passphrase.
-
+It is a JSON file where the values of the properties are encrypted by a key.
 |===
 
 == Version 0.12.0

doc/manual/_config-tool.adoc

@@ -61,8 +61,8 @@ Options:
   --secrets-file=FILEPATH
                         Path of JSON file containing confidential propertiers
                         [optional]
-  --secrets-passphrase=PASSPHRASE
-                        Passphrase to decrypt confidential properties [optional]
+  --secrets-key=FILEPATH
+                        Path to key file to decrypt confidential properties [optional]
 ....
 
 If environmentalized fields or certificates are not configured, the build fails.
@@ -160,10 +160,15 @@ If specified relative path to certificate files is based on this directory.
 |Path of JSON file containing confidential properties.
 The file has to be created by the `encrypt` tool.
 
-|--secrets-passphrase
-|Passphrase to decryt confidential properties.
-This parameter is requried if a secrets file is specified.
-The passphrase has to be the same as on creating the secrets file.
+|--secrets-key
+|Path to key file to decrypt confidential properties.
+
+This a file containing any arbitrary bytes.
+If you edit this file with a text editor be aware of the encoding and the end of line sequence.
+
+The key file has to be the same as on creating the secrets file.
+
+This parameter is required if a secrets file is specified.
 |===
 
 
@@ -172,7 +177,7 @@ The passphrase has to be the same as on creating the secrets file.
 The `encrypt` tools is used to generate an initial secrets file and to encrypt the values of the properties.
 The script is invoked with the `jython` interpreter provided with the package and deployment tools of the API Gateway.
 
-The tool requries a path to the secrets file and a passphrase to encryt the values.
+The tool requires a path to the secrets file and a passphrase to encrypt the values.
 If the secrets file doesn't exist a new file will be created.
 For existing files the given passphrase is checked against the passphrase used on file creation.
 
@@ -186,8 +191,8 @@ Options:
   -v, --verbose         Enable verbose messages [optional]
   --secrets-file=FILEPATH
                         Path of JSON file containing confidential properties
-  --secrets-passphrase=PASSPHRASE
-                        Passphrase to decrypt confidential values
+  --secrets-key=FILEPATH
+                        Path to key file to decrypt confidential properties
 
 Encrypt credentials.
 ....
@@ -200,9 +205,15 @@ Encrypt credentials.
 |--secrets-file
 |Path of JSON file containing confidential properties.
 
-|--secrets-passphrase
-|Passphrase to decrypt confidential properties.
-This parameter is requried if a secrets file is specified.
+|--secrets-key
+|Path to key file to decrypt confidential properties.
+
+This a file containing any arbitrary bytes.
+
+If you edit this file with a text editor be aware of the encoding and the end of line sequence.
+In this case use ASCII characters in a single line (no line feed at the end).
+
+This parameter is required if a secrets file is specified.
 |===
 
 To add new properties tag the values with the `encrypt:` prefix.
@@ -218,11 +229,11 @@ Values having this prefix will be encrypted on running the tool.
   }
 }
 ----
-<1> Marker to check the passphrase. Don't delete or change it.
+<1> Marker to check the key. Don't delete or change it.
 <2> The prefix `encrypt:` indicates that the value `changeme` has to be encrypted.
 <3> Values without the prefix are already encrypted and will not be changed.
 
-NOTE: The `encrypt` tool use the cipher of the entity store.
+NOTE: The `encrypt` tool use the same cipher as the entity store.
 
 == Configuration Files
 
@@ -507,8 +518,8 @@ For the build process the property file may be temporarily generated from the co
 === Secrets
 
 A secrets file is used to store confidential configurations (e.g. passwords).
-The values of the properties are encrypted and can be access with a passphrase only.
-All values are encrypted with the same passphrase.
+The values of the properties are encrypted and can be access with a key only.
+All values are encrypted with the same key.
 
 .gateway.crypt.json
 [source,json]
@@ -522,6 +533,6 @@ All values are encrypted with the same passphrase.
 }
 ----
 <1> The `secrets` property is requried.
-<2> Marker to check the passphrase. Don't delete or change it.
+<2> Marker to check the key. Don't delete or change it.
 <3> The prefix `encrypt:` indicates that the value `changeme` has to be encrypted by the `encrypt` tool.
 <4> Values without the prefix are already encrypted.

doc/manual/_reference.adoc

@@ -376,8 +376,8 @@ NOTE: It is not checked if the source files are newer than the target artifact.
 |axway.config.secrets.file
 |Path to file storing secrets.
 
-|axway.config.secrets.passphrase
-|Passphrase to decrypt/encrypt values of secrets file.
+|axway.config.secrets.key
+|Path to key file to decrypt/encrypt values of secrets file.
 |===
 
 == Plugin Configuration
@@ -408,7 +408,7 @@ The plugin can also be configured in the `pom.xml` via the <configuration> eleme
     <configCertsBaseDir>${basedir}/src/main/axwgw/certs</configCertsBaseDir> <!--5-->
 
     <configSecretsFile>${basedir}/src/main/axwgw/gateway.crypt.json</configSecretsFile> <!--6-->
-    <configSecretsPassphrase>changeme</configSecretsPassphrase> <!--7-->
+    <configSecretsKey>${user.home}/secrets.key</configSecretsKey> <!--7-->
   </configuration>
 </plugin>
 <!- ... ->
@@ -419,4 +419,4 @@ The plugin can also be configured in the `pom.xml` via the <configuration> eleme
 <4> Location of a list of configuration files for properties.
 <5> Base directory for certificate files.
 <6> Path to secrets file.
-<7> Passphrase to decrypt/encrypt values of secrets file.
+<7> Key file to decrypt/encrypt values of secrets file.

example/config-tool/README.adoc

@@ -91,21 +91,29 @@ Remember to use the passphrase `changeme` for the `.pol`and `.env` archive and t
 
 == How does it work?
 
-We have three configuration files in the `config` folder:
+We have a set of configuration files in the `config` folder:
 
  * `gateway.config.json`: used to configure the environmentalized fields.
  * `gateway.certs.json`: used to replace certificates identified by their alias.
  * `gateway.props.json`: used for properties not applicable in the configuration or certs file.
  This file may be generated during the build process with values from external resources (e.g. configuration DB or secured vault).
+ * `gateway.crypt.json`: used for confidential properties.
+ All values in this file are encrypted.
 
 NOTE: For a description of the configuration files please check the link:../../doc/manual/user-guide.adoc[User Guide]
 
+To decrypt the confidential values there is a `key.binary` file.
+This a file containing any arbitrary bytes.
+If you edit this file with a text editor be aware of the encoding and the end of line sequence.
+
+CAUTION: Never store the key file in the source code repository. Here it's only for demonstration.
+
 In this example some environment variables (`INFO_NAME` and `NEW_SERVER_PASSWORD`) are set.
 Then the `buildfed` tool will be invoked with the following parameters:
 
-* `-e src\gateway.env`: specifies the path to the input `.env` archive
-* `-p src\gateway.pol`: specifies the path to the input `.pol` archive
-* `-c config\gateway.config.json`: specifies the path to the environmentalized fields configuration file
+* `-e src/gateway.env`: specifies the path to the input `.env` archive
+* `-p src/gateway.pol`: specifies the path to the input `.pol` archive
+* `-c config/gateway.config.json`: specifies the path to the environmentalized fields configuration file
 * `--cert=config/gateway.certs.json`: specifies the path to the certificates configuration file
 * `--prop=config/gateway.props.json`: specifies the path to a properties file
 * `--prop=config/passwords.props.json`: specifies the path to a second properties file
@@ -114,6 +122,8 @@ Then the `buildfed` tool will be invoked with the following parameters:
 * `--passphrase-out=changed`: passphrase for the generated `.fed` file
 * `-D artifact:demo-1.0.0`: specifies the value of property `artifact` via the command line instead of from the configuration files
 * `-F info.descr:config/description.txt`: specifies to set the value of property `info.descr` from the content of the `config/description.txt` file
+* `--secrets-file=config/gateway.crypt.json`: specifies the path to a properties file containing confidential values
+* `--secrets-key=key.binary`: specifies the path to the key file for decrypting the confidential values
 
 The tool reads the source archives, configures the environmentalized fields, replaces the certificates and write the configured `.fed` file.
 

example/config-tool/encrypt.cmd

@@ -4,5 +4,5 @@ SET CMD_HOME=%~dp0
 CD /d "%CMD_HOME%"
 SET ENCRYPT="..\..\src\main\resources\scripts\encrypt.cmd"
 
-CALL %ENCRYPT% --secrets-file=config/gateway.crypt.json --secrets-passphrase=changeme
+CALL %ENCRYPT% --secrets-file=config/gateway.crypt.json --secrets-key=key.binary
 ENDLOCAL

example/config-tool/key.binary

@@ -0,0 +1 @@
+changeme

example/config-tool/run.cmd

@@ -8,5 +8,5 @@ REM Define environment variables for field value and password configuration
 SET INFO_NAME=Demo
 SET NEW_SERVER_PASSWORD=changeme
 
-CALL %BUILDFED% -v -e src\gateway.env -p src\gateway.pol -c config\gateway.config.json --cert=config\gateway.certs.json --prop=config\gateway.props.json --secrets-file=config\gateway.crypt.json --secrets-passphrase=changeme -D artifact:demo-1.0.0 -F info.descr:config\description.txt --output-fed=gateway.fed --passphrase-in=changeme --passphrase-out=changed --base-dir=config/certs
+CALL %BUILDFED% -v -e src\gateway.env -p src\gateway.pol -c config\gateway.config.json --cert=config\gateway.certs.json --prop=config\gateway.props.json --secrets-file=config\gateway.crypt.json --secrets-key=key.binary -D artifact:demo-1.0.0 -F info.descr:config\description.txt --output-fed=gateway.fed --passphrase-in=changeme --passphrase-out=changed --base-dir=config/certs
 ENDLOCAL

src/main/java/com/axway/maven/apigw/AbstractGatewayMojo.java

@@ -107,8 +107,8 @@ public abstract class AbstractGatewayMojo extends AbstractMojo {
 	@Parameter(property = "axway.config.secrets.file", required = false)
 	protected File configSecretsFile = null;
 
-	@Parameter(property = "axway.config.secrets.passphrase", required = false)
-	protected String configSecretsPassphrase = null;
+	@Parameter(property = "axway.config.secrets.key", required = false)
+	protected File configSecretsKey = null;
 
 
 	@Parameter(defaultValue = "${project}", readonly = true)

src/main/java/com/axway/maven/apigw/DeploymentArchiveMojo.java

@@ -170,9 +170,9 @@ private void buildFedArchive(File targetDir, File srcPolFile, File srcEnvFile, F
 			fedBuilder.setCertificatesBasePath(this.configCertsBaseDir);
 		}
 		if (this.configSecretsFile != null) {
-			if (this.configSecretsPassphrase == null)
+			if (this.configSecretsKey == null)
 				throw new MojoExecutionException("Passphrase for secrets file not specified!");
-			fedBuilder.setSecrets(this.configSecretsFile, this.configSecretsPassphrase);
+			fedBuilder.setSecrets(this.configSecretsFile, this.configSecretsKey);
 		}
 
 		fedBuilder.setPassphrasePol(this.passphrasePol);

src/main/java/com/axway/maven/apigw/DeploymentMojo.java

@@ -134,9 +134,9 @@ private File configFed(File pol, File env, File info) throws MojoExecutionExcept
 		fb.enableVerboseMode(this.verboseCfgTools);
 
 		if (this.configSecretsFile != null) {
-			if (this.configSecretsPassphrase == null)
-				throw new MojoExecutionException("Passphrase for secrets file not specified!");
-			fb.setSecrets(this.configSecretsFile, this.configSecretsPassphrase);
+			if (this.configSecretsKey == null)
+				throw new MojoExecutionException("Key file for secrets is not specified!");
+			fb.setSecrets(this.configSecretsFile, this.configSecretsKey);
 		}
 
 		File fed = new File(getTempDir(), PROJECT_NAME + ".fed");