1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
#!/bin/sh
# vault-merge
# This script handles conflicts generated by attempts to merge encrypted
# Ansible Vault files.
# Run `git merge` as usual; when git warns of a merge conflict,
# run this command to attempt a merge on the unencrypted versions of
# the file. If there are conflicts, you will be given a chance to correct them
# in $EDITOR (vim).
# Usage:
# $./vault-merge.sh -p <path/to/the/vault/KEY> <path/to/conflicted/vault>
# First, we ensure we ensure that a suitable e$EDITOR is set
export EDITOR=vim
# Next, we ensure we are inside the working directory of a git repo.
GIT_ROOT=`git rev-parse --show-toplevel`
if [ $? != 0 ]; then
exit $?
fi
# Next, we set a default location for a vault password file, and allow the user
# to override it if desired.
VAULT_PASSWORD_FILE="$GIT_ROOT/vaults/dev-vault-id"
while getopts "p:" opt; do
case $opt in
p)
VAULT_PASSWORD_FILE=$OPTARG
;;
\?)
# Invalid option (e.g., -p without an argument)
exit 1
;;
esac
done
shift $(($OPTIND - 1))
VAULT_OPT="--vault-password-file=$VAULT_PASSWORD_FILE"
VAULT_FILE=$1
# If no vault has been provided, abort!
if [ -z $VAULT_FILE ]; then
echo "Usage: $0 [-p PASSWORD_FILE] VAULT_FILE"
exit 1
fi
# If the password file doesn't exist, we prompt for the password and save it.
if [ ! -e $VAULT_PASSWORD_FILE ]; then
read -s -p "Vault Password: " VAULT_PASSWORD
echo
echo "Remembering password in $VAULT_PASSWORD_FILE"
echo $VAULT_PASSWORD > $VAULT_PASSWORD_FILE
else
echo "Using password saved in $VAULT_PASSWORD_FILE"
fi
# Fetch the base (common ancestor) version of the encrypted vault file, save
# it to a temporary location, and decrypt it. (Hat Tip to the git-merge manual
# page for tipping me off to the `git show :1:path` notation.)
BASE=`mktemp ${VAULT_FILE}.base.XXXX`
git show :1:${VAULT_FILE} > $BASE 2> /dev/null
if [ $? != 0 ]; then
echo "Path '${VAULT_FILE}' does not have any conflicts."
rm $BASE
exit 1
fi
ansible-vault decrypt $VAULT_OPT $BASE || exit $?
# Do the same with the current (branch we are merging INTO) version of the vault
# file.
CURRENT=`mktemp ${VAULT_FILE}.current.XXXX`
git show :2:${VAULT_FILE} > $CURRENT 2> /dev/null
ansible-vault decrypt $VAULT_OPT $CURRENT || exit $?
# And finally, with the other (branch we a merging FROM) version of the vault.
OTHER=`mktemp ${VAULT_FILE}.other.XXXX`
git show :3:${VAULT_FILE} > $OTHER 2> /dev/null
ansible-vault decrypt $VAULT_OPT $OTHER || exit $?
# Now that we have all three versions decrypted, ask git to attempt the merge
# again. If it fails again due to a conflict, open $EDITOR and let the user
# perform a manual merge.
git merge-file $CURRENT $BASE $OTHER
if [ $? == 0 ]; then
echo "Merge OK"
else
echo "Merge conflict; opening editor to resolve."
$EDITOR $CURRENT
fi
# Now that we're done, encrypt the file and move it into the repo, and clean up
# the temporary files (they contain secrets!).
ansible-vault encrypt $VAULT_OPT $CURRENT
cp $CURRENT $VAULT_FILE
rm $BASE $CURRENT $OTHER
echo "$VAULT_FILE has been updated."
echo " (use \"git add $VAULT_FILE\" to mark as resolved)"
echo " (or re-run this command to retry the merge)"
exit 0
|
