10 files changed
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1045,7 +1045,10 @@
"ed25519-dalek",
"fleet-shared",
"hex",
+ "hmac",
+ "pbkdf2",
"rand 0.10.1",
+ "sha2",
"x25519-dalek",
]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,6 +31,7 @@
futures = "0.3.31"
futures-util = { version = "0.3.31", features = ["sink"] }
hex = "0.4.3"
+hmac = "0.12"
hostname = "0.4.1"
human-repr = "1.1"
hyper = "1.8.1"
@@ -40,11 +41,12 @@
linked-hash-map = "0.5.6"
nix = { version = "0.31.2", features = ["fs", "user"] }
nom = "8.0.0"
+openssh = "0.11.5"
opentelemetry = "0.31.0"
+opentelemetry-appender-tracing = "0.31.1"
opentelemetry-otlp = { version = "0.31.0", features = ["grpc-tonic", "gzip-tonic", "http-json", "reqwest-rustls"] }
opentelemetry_sdk = "0.31.0"
-opentelemetry-appender-tracing = "0.31.1"
-openssh = "0.11.5"
+pbkdf2 = "0.12"
peg = "0.8.5"
pkg-config = "0.3.30"
rand = "0.10.0"
@@ -52,6 +54,7 @@
serde = { version = "1.0", features = ["derive"] }
serde-transcode = "1.1.1"
serde_json = "1.0"
+sha2 = "0.10"
shlex = "1.3"
tabled = "0.20.0"
tempfile = "3.20"
--- a/cmds/fleet/Cargo.toml
+++ b/cmds/fleet/Cargo.toml
@@ -44,12 +44,12 @@
indicatif = { workspace = true, optional = true }
nom.workspace = true
opentelemetry.workspace = true
+opentelemetry-appender-tracing.workspace = true
+opentelemetry-exporter-env.workspace = true
opentelemetry_sdk.workspace = true
thiserror.workspace = true
tracing-indicatif = { workspace = true, optional = true }
tracing-opentelemetry.workspace = true
-opentelemetry-exporter-env.workspace = true
-opentelemetry-appender-tracing.workspace = true
[features]
default = ["indicatif"]
--- a/cmds/generator-helper/Cargo.toml
+++ b/cmds/generator-helper/Cargo.toml
@@ -13,5 +13,8 @@
base64.workspace = true
ed25519-dalek.workspace = true
hex.workspace = true
+hmac.workspace = true
+pbkdf2.workspace = true
rand.workspace = true
+sha2.workspace = true
x25519-dalek.workspace = true
10 ssh::{ParseRecipientKeyError, Recipient as SshRecipient},10 ssh::{ParseRecipientKeyError, Recipient as SshRecipient},
11};11};
12use anyhow::{Context, Result, anyhow, bail, ensure};12use anyhow::{Context, Result, anyhow, bail, ensure};
13use base64::{Engine as _, engine::general_purpose::STANDARD, write::EncoderWriter};
13use clap::{Parser, ValueEnum};14use clap::{Parser, ValueEnum};
14use ed25519_dalek::SecretKey;15use ed25519_dalek::SecretKey;
15use fleet_shared::SecretData;16use fleet_shared::SecretData;
17use hmac::Mac as _;
16use rand::{18use rand::{
17 Rng as _,19 Rng as _,
18 distr::{Alphanumeric, Distribution, SampleString, Uniform},20 distr::{Alphanumeric, Distribution, SampleString, Uniform},
19 rng,21 rng,
20};22};
23use sha2::Digest as _;
24
25fn gen_password(rng: &mut impl rand::Rng, size: usize, no_symbols: bool) -> String {
26 if no_symbols {
27 Alphanumeric.sample_string(rng, size)
28 } else {
29 const GEN_ASCII_SYMBOLS: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
30 let uniform = Uniform::new(0, GEN_ASCII_SYMBOLS.len()).expect("range is valid");
31 (0..size)
32 .map(|_| uniform.sample(rng))
33 .map(|i| GEN_ASCII_SYMBOLS[i] as char)
34 .collect::<String>()
35 }
36}
2137
22fn write_output_file(out: &str) -> Result<File> {38fn write_output_file(out: &str) -> Result<File> {
23 let file = OpenOptions::new()39 let file = OpenOptions::new()
105 match encoding {121 match encoding {
106 OutputEncoding::Raw => coerce(w),122 OutputEncoding::Raw => coerce(w),
107 OutputEncoding::Base64 => {123 OutputEncoding::Base64 => {
108 use base64::{engine::general_purpose::STANDARD, write::EncoderWriter};
109
110 let writer = EncoderWriter::new(w, &STANDARD);124 let writer = EncoderWriter::new(w, &STANDARD);
111 coerce(writer)125 coerce(writer)
177 #[arg(long, short = 'e', value_enum, default_value_t)]191 #[arg(long, short = 'e', value_enum, default_value_t)]
178 encoding: OutputEncoding,192 encoding: OutputEncoding,
179 },193 },
194 PostgresPassword {
195 #[arg(long, short = 's')]
196 secret: String,
197 #[arg(long, short = 'H')]
198 hash: String,
199 #[arg(long, default_value_t = 24)]
200 size: usize,
201 #[arg(long, default_value_t = 4096)]
202 iterations: u32,
203 #[arg(long, short = 'n')]
204 no_symbols: bool,
205 },
180 Bytes {206 Bytes {
181 #[arg(long, short = 'o')]207 #[arg(long, short = 'o')]
182 output: String,208 output: String,
280 no_symbols,306 no_symbols,
281 output,307 output,
282 encoding,308 encoding,
283 } => {309 } => {
310 ensure!(
311 size >= 6,
312 "misconfiguration? password is shorter than 6 chars"
313 );
314 let recipients = load_identities()?;
315 let out = gen_password(&mut rng, size, no_symbols);
316 write_private(&recipients, &output, out.as_bytes(), encoding)?;
317 }
318 Generate::PostgresPassword {
319 secret,
320 hash,
321 size,
322 iterations,
323 no_symbols,
324 } => {
284 ensure!(325 ensure!(
285 size >= 6,326 size >= 6,
286 "misconfiguration? password is shorter than 6 chars"327 "misconfiguration? password is shorter than 6 chars"
287 );328 );
288 let recipients = load_identities()?;329 let recipients = load_identities()?;
289 let out = if no_symbols {330 let password = gen_password(&mut rng, size, no_symbols);
290 Alphanumeric.sample_string(&mut rng, size)331
291 } else {332 let mut salt = [0u8; 16];
292 333 rng.fill_bytes(&mut salt);
293 const GEN_ASCII_SYMBOLS: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";334 let salted = pbkdf2::pbkdf2_hmac_array::<sha2::Sha256, 32>(
335 password.as_bytes(),
336 &salt,
337 iterations,
338 );
339
340 type HmacSha256 = hmac::Hmac<sha2::Sha256>;
294 let uniform =341 let mut mac = <HmacSha256 as hmac::Mac>::new_from_slice(&salted)
295 Uniform::new(0, GEN_ASCII_SYMBOLS.len()).expect("range is valid");342 .expect("HMAC accepts any key length");
343 mac.update(b"Client Key");
344 let client_key = mac.finalize().into_bytes();
345
296 (0..size)346 let mut hasher = sha2::Sha256::new();
297 .map(|_| uniform.sample(&mut rng))347 hasher.update(client_key);
298 .map(|i| GEN_ASCII_SYMBOLS[i] as char)348 let stored_key = hasher.finalize();
349
350 let mut mac = <HmacSha256 as hmac::Mac>::new_from_slice(&salted)
351 .expect("HMAC accepts any key length");
352 mac.update(b"Server Key");
299 .collect::<String>()353 let server_key = mac.finalize().into_bytes();
300 };354
355 let hash_str = format!(
356 "SCRAM-SHA-256${}:{}${}:{}",
357 iterations,
358 STANDARD.encode(salt),
359 STANDARD.encode(stored_key),
360 STANDARD.encode(server_key),
361 );
362
301 write_private(&recipients, &output, out.as_bytes(), encoding)?;363 write_private(
364 &recipients,
365 &secret,
366 password.as_bytes(),
367 OutputEncoding::Raw,
368 )?;
369 write_public(&hash, hash_str.as_bytes(), OutputEncoding::Raw)?;
302 }370 }
303 Generate::Bytes {371 Generate::Bytes {
304 output,372 output,
--- a/crates/nix-eval/src/lib.rs
+++ b/crates/nix-eval/src/lib.rs
@@ -26,9 +26,8 @@
clear_err, copy_value, err_NIX_ERR_KEY, err_NIX_ERR_NIX_ERROR, err_NIX_ERR_OVERFLOW,
err_NIX_ERR_UNKNOWN, err_code, err_info_msg, err_msg, eval_state_build,
eval_state_builder_load, eval_state_builder_new, eval_state_builder_set_eval_setting,
- expr_eval_from_string, fetchers_settings,
- fetchers_settings_free, fetchers_settings_new, flake_lock, flake_lock_flags,
- flake_lock_flags_free, flake_lock_flags_new, flake_reference,
+ expr_eval_from_string, fetchers_settings, fetchers_settings_free, fetchers_settings_new,
+ flake_lock, flake_lock_flags, flake_lock_flags_free, flake_lock_flags_new, flake_reference,
flake_reference_and_fragment_from_string, flake_reference_parse_flags,
flake_reference_parse_flags_free, flake_reference_parse_flags_new,
flake_reference_parse_flags_set_base_directory, flake_settings, flake_settings_free,
@@ -323,7 +322,9 @@
thread_local! {
static THREAD_STATE: RefCell<ThreadState> = RefCell::new(ThreadState::new().expect("thread state init shouldn't fail"));
}
-pub(crate) fn with_default_context<T>(f: impl FnOnce(*mut c_context, *mut c_eval_state) -> T) -> Result<T> {
+pub(crate) fn with_default_context<T>(
+ f: impl FnOnce(*mut c_context, *mut c_eval_state) -> T,
+) -> Result<T> {
let global = &GLOBAL_STATE.state;
let (ctx, state) = THREAD_STATE.with_borrow_mut(|w| (w.ctx.0, global.0));
let mut ctx = NixContext(ctx);
@@ -439,7 +440,11 @@
}
}
-pub(crate) unsafe extern "C" fn copy_nix_str(start: *const c_char, n: c_uint, user_data: *mut c_void) {
+pub(crate) unsafe extern "C" fn copy_nix_str(
+ start: *const c_char,
+ n: c_uint,
+ user_data: *mut c_void,
+) {
let s = unsafe { slice::from_raw_parts(start.cast::<u8>(), n as usize) };
let s = std::str::from_utf8(s).expect("c string has invalid utf-8");
unsafe { *user_data.cast::<String>() = s.to_owned() };
@@ -1128,8 +1133,8 @@
let test_result: String = nix_go_json!(builtins.uppercaseSuffix2("test")("suffix"));
assert_eq!(test_result, "TESTsuffix");
- let drv_path = nix_go!(attrs.packages["x86_64-linux"]["fleet-install-secrets"].drvPath)
- .to_string()?;
+ let drv_path =
+ nix_go!(attrs.packages["x86_64-linux"]["fleet-install-secrets"].drvPath).to_string()?;
let graph = drv::DrvGraph::resolve(&drv_path)?;
eprintln!(
"fleet-install-secrets dependency graph: {} nodes",
--- a/crates/nix-eval/src/logging.rs
+++ b/crates/nix-eval/src/logging.rs
@@ -351,12 +351,15 @@
if let Some(entry) = drv_graph.get_mut(dep_path) {
entry.refcount += 1;
} else {
- drv_graph.insert(dep_path.clone(), DrvGraphEntry {
- name: dep_node.name.clone(),
- parent: Some(path.clone()),
- span: None,
- refcount: 1,
- });
+ drv_graph.insert(
+ dep_path.clone(),
+ DrvGraphEntry {
+ name: dep_node.name.clone(),
+ parent: Some(path.clone()),
+ span: None,
+ refcount: 1,
+ },
+ );
}
paths.push(dep_path.clone());
queue.push_back(dep_path.clone());
--- a/crates/opentelemetry-exporter-env/src/lib.rs
+++ b/crates/opentelemetry-exporter-env/src/lib.rs
@@ -11,10 +11,7 @@
#[derive(thiserror::Error, Debug)]
pub enum Error {
#[error("environment variable {env} contains invalid UTF-8: {value:?}")]
- InvalidUtf8 {
- env: &'static str,
- value: OsString,
- },
+ InvalidUtf8 { env: &'static str, value: OsString },
#[error("environment variable {env}={value:?}: {error}")]
EnvParse {
env: &'static str,
@@ -103,13 +100,30 @@
#[cfg_attr(feature = "clap", derive(clap::Parser))]
pub struct SignalExporterSettings {
/// Traces exporter to be used.
- #[cfg_attr(feature = "clap", arg(long = "otel-traces-exporter", env = "OTEL_TRACES_EXPORTER", value_enum))]
+ #[cfg_attr(
+ feature = "clap",
+ arg(
+ long = "otel-traces-exporter",
+ env = "OTEL_TRACES_EXPORTER",
+ value_enum
+ )
+ )]
pub traces: Option<ExporterKind>,
/// Metrics exporter to be used.
- #[cfg_attr(feature = "clap", arg(long = "otel-metrics-exporter", env = "OTEL_METRICS_EXPORTER", value_enum))]
+ #[cfg_attr(
+ feature = "clap",
+ arg(
+ long = "otel-metrics-exporter",
+ env = "OTEL_METRICS_EXPORTER",
+ value_enum
+ )
+ )]
pub metrics: Option<ExporterKind>,
/// Logs exporter to be used.
- #[cfg_attr(feature = "clap", arg(long = "otel-logs-exporter", env = "OTEL_LOGS_EXPORTER", value_enum))]
+ #[cfg_attr(
+ feature = "clap",
+ arg(long = "otel-logs-exporter", env = "OTEL_LOGS_EXPORTER", value_enum)
+ )]
pub logs: Option<ExporterKind>,
}
--- a/crates/opentelemetry-exporter-env/src/otlp.rs
+++ b/crates/opentelemetry-exporter-env/src/otlp.rs
@@ -55,15 +55,13 @@
}
builder.build()
}
- OtlpProtocol::HttpProtobuf | OtlpProtocol::HttpJson => {
- <$exporter>::builder()
- .with_http()
- .with_endpoint(&s.endpoint)
- .with_headers(to_hashmap(s.headers.as_deref()))
- .with_protocol(s.protocol.into())
- .with_timeout(s.timeout)
- .build()
- }
+ OtlpProtocol::HttpProtobuf | OtlpProtocol::HttpJson => <$exporter>::builder()
+ .with_http()
+ .with_endpoint(&s.endpoint)
+ .with_headers(to_hashmap(s.headers.as_deref()))
+ .with_protocol(s.protocol.into())
+ .with_timeout(s.timeout)
+ .build(),
}
}};
}
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -89,6 +89,44 @@
);
/**
+ Generate a random password suitable for PostgreSQL role authentication.
+
+ Options:
+ size: generated password length in ascii characters (bytes).
+ iterations: PBKDF2 iteration count (PG default: 4096).
+ noSymbols: by default, character set includes various special characters ($ , ! + * : ~), and might
+ not be accepted in some contexts, this option switches charset to just [A-Za-z0-9].
+
+ Output:
+ secret: encrypted password.
+ hash: SCRAM-SHA-256 hash of the password to be used by postgres.
+ */
+ # It is not possible to extract it into a scram-sha-256 generic generator because there is no estabilished format
+ # for it, and mongodb for example encodes it differently.
+ mkPostgresPassword =
+ {
+ size ? 32,
+ iterations ? 4096,
+ noSymbols ? false,
+ }:
+ (
+ { mkSecretGenerator }:
+ mkSecretGenerator {
+ script = ''
+ mkdir $out
+ gh generate postgres-password \
+ -s $out/secret \
+ -H $out/hash \
+ --size ${toString size} \
+ --iterations ${toString iterations} \
+ ${optionalString noSymbols "--no-symbols"}
+ '';
+ parts.secret.encrypted = true;
+ parts.hash.encrypted = false;
+ }
+ );
+
+ /**
Generate a random ed25519 keypair
Options:
@@ -205,8 +243,7 @@
mkAskFile {
inherit part;
header = builtins.concatStringsSep "\n" (
- (map (l: "# ${l}") (lib.splitString "\n" header))
- ++ (map (v: "${v}=") variables)
+ (map (l: "# ${l}") (lib.splitString "\n" header)) ++ (map (v: "${v}=") variables)
);
};
@@ -306,6 +343,7 @@
inherit (secrets)
mkPassword
+ mkPostgresPassword
mkEd25519
mkX25519
mkRsa