7 Commits

Author SHA1 Message Date
github-actions[bot]
e37b80a262 bump: version 0.2.1 → 0.2.2 [skip ci] 2025-09-30 22:03:17 +00:00
3ce62c272e build: Updated changelog format 2025-09-30 15:42:41 -06:00
21b771507c Merge remote-tracking branch 'origin/main' 2025-09-30 15:40:36 -06:00
508c8b7feb style: Reformatted code 2025-09-30 15:40:27 -06:00
github-actions[bot]
33a889fa67 chore: bump Cargo.toml to 0.2.2 2025-09-30 21:37:14 +00:00
github-actions[bot]
7ddb7812fc bump: version 0.2.1 → 0.2.2 [skip ci] 2025-09-30 21:37:04 +00:00
9e11648a7c refactor: Environment variable interpolation in config file works globally, not based on type 2025-09-30 15:35:48 -06:00
13 changed files with 42 additions and 368 deletions
+6
View File
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## v0.2.2 (2025-09-30)
### Refactor
- Environment variable interpolation in config file works globally, not based on type
## v0.2.1 (2025-09-30)
### Feat
Generated
+4 -4
View File
@@ -230,7 +230,7 @@ version = "1.14.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "879b6c89592deb404ba4dc0ae6b58ffd1795c78991cbb5b8bc441c48a070440d"
dependencies = [
"aws-lc-sys 0.32.1",
"aws-lc-sys 0.32.2",
"zeroize",
]
@@ -249,9 +249,9 @@ dependencies = [
[[package]]
name = "aws-lc-sys"
version = "0.32.1"
version = "0.32.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1ba2e2516bdf37af57fc6ff047855f54abad0066e5c4fdaaeb76dabb2e05bcf5"
checksum = "a2b715a6010afb9e457ca2b7c9d2b9c344baa8baed7b38dc476034c171b32575"
dependencies = [
"bindgen",
"cc",
@@ -1632,7 +1632,7 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
[[package]]
name = "gman"
version = "0.2.1"
version = "0.2.2"
dependencies = [
"anyhow",
"argon2",
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "gman"
version = "0.2.1"
version = "0.2.2"
edition = "2024"
authors = ["Alex Clarke <alex.j.tusa@gmail.com>"]
description = "Universal command line secret management and injection tool"
+1 -3
View File
@@ -89,6 +89,7 @@ gman aws sts get-caller-identity
- [Features](#features)
- [Installation](#installation)
- [Configuration](#configuration)
- [Environment Variable Interpolation](#environment-variable-interpolation)
- [Providers](#providers)
- [Local](#provider-local)
- [AWS Secrets Manager](#provider-aws_secrets_manager)
@@ -264,9 +265,6 @@ providers:
aws_region: us-east-1
```
**Important Note:** Environment variable interpolation is only supported in string or numeric fields. It is not
supported in lists or maps.
## Providers
`gman` supports multiple providers for secret storage. The default provider is `local`, which stores secrets in an
encrypted file on your filesystem. The CLI and config format are designed to be extensible so new providers can be
+3 -3
View File
@@ -257,7 +257,7 @@ pub fn parse_args(
pub fn run_config_completer(current: &OsStr) -> Vec<CompletionCandidate> {
let cur = current.to_string_lossy();
match load_config() {
match load_config(true) {
Ok(config) => {
if let Some(run_configs) = config.run_configs {
run_configs
@@ -282,7 +282,7 @@ pub fn run_config_completer(current: &OsStr) -> Vec<CompletionCandidate> {
pub fn provider_completer(current: &OsStr) -> Vec<CompletionCandidate> {
let cur = current.to_string_lossy();
match load_config() {
match load_config(true) {
Ok(config) => config
.providers
.iter()
@@ -300,7 +300,7 @@ pub fn provider_completer(current: &OsStr) -> Vec<CompletionCandidate> {
pub fn secrets_completer(current: &OsStr) -> Vec<CompletionCandidate> {
let cur = current.to_string_lossy();
match load_config() {
match load_config(true) {
Ok(config) => {
let mut provider_config = match config.extract_provider_config(None) {
Ok(pc) => pc,
+3 -14
View File
@@ -123,13 +123,6 @@ enum Commands {
/// configured in a corresponding run profile
#[command(external_subcommand)]
External(Vec<OsString>),
/// Generate shell completion scripts
Completions {
/// The shell to generate the script for
#[arg(value_enum)]
shell: clap_complete::Shell,
},
}
#[tokio::main]
@@ -157,7 +150,7 @@ async fn main() -> Result<()> {
exit(1);
}
let config = load_config()?;
let config = load_config(true)?;
let mut provider_config = config.extract_provider_config(cli.provider.clone())?;
let secrets_provider = provider_config.extract_provider();
@@ -238,7 +231,8 @@ async fn main() -> Result<()> {
}
}
Commands::Config {} => {
let config_yaml = serde_yaml::to_string(&config)
let uninterpolated_config = load_config(false)?;
let config_yaml = serde_yaml::to_string(&uninterpolated_config)
.with_context(|| "failed to serialize existing configuration")?;
let new_config = Editor::new()
.edit(&config_yaml)
@@ -267,11 +261,6 @@ async fn main() -> Result<()> {
Commands::External(tokens) => {
wrap_and_run_command(cli.provider, &config, tokens, cli.profile, cli.dry_run).await?;
}
Commands::Completions { shell } => {
let mut cmd = Cli::command();
let bin_name = cmd.get_name().to_string();
clap_complete::generate(shell, &mut cmd, bin_name, &mut io::stdout());
}
}
Ok(())
+23 -312
View File
@@ -46,19 +46,14 @@ use validator::{Validate, ValidationError};
#[validate(schema(function = "flags_or_files"))]
pub struct RunConfig {
#[validate(required)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub name: Option<String>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub provider: Option<String>,
#[validate(required)]
pub secrets: Option<Vec<String>>,
pub files: Option<Vec<PathBuf>>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub flag: Option<String>,
#[validate(range(min = 1))]
#[serde(default, deserialize_with = "deserialize_optional_usize_env_var")]
pub flag_position: Option<usize>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub arg_format: Option<String>,
}
@@ -198,7 +193,6 @@ impl ProviderConfig {
#[validate(schema(function = "default_provider_exists"))]
#[validate(schema(function = "providers_names_are_unique"))]
pub struct Config {
#[serde(deserialize_with = "deserialize_optional_env_var")]
pub default_provider: Option<String>,
#[validate(length(min = 1))]
#[validate(nested)]
@@ -293,10 +287,11 @@ impl Config {
///
/// ```no_run
/// # use gman::config::load_config;
/// let config = load_config().unwrap();
/// // Load config with environment variable interpolation enabled
/// let config = load_config(true).unwrap();
/// println!("loaded config: {:?}", config);
/// ```
pub fn load_config() -> Result<Config> {
pub fn load_config(interpolate: bool) -> Result<Config> {
let xdg_path = env::var_os("XDG_CONFIG_HOME").map(PathBuf::from);
let mut config: Config = if let Some(base) = xdg_path.as_ref() {
@@ -305,17 +300,20 @@ pub fn load_config() -> Result<Config> {
let yaml = app_dir.join("config.yaml");
if yml.exists() || yaml.exists() {
let load_path = if yml.exists() { &yml } else { &yaml };
let content = fs::read_to_string(load_path)
let mut content = fs::read_to_string(load_path)
.with_context(|| format!("failed to read config file '{}'", load_path.display()))?;
if interpolate {
content = interpolate_env_vars(&content);
}
let cfg: Config = serde_yaml::from_str(&content).with_context(|| {
format!("failed to parse YAML config at '{}'", load_path.display())
})?;
cfg
} else {
confy::load("gman", "config")?
load_confy_config(interpolate)?
}
} else {
confy::load("gman", "config")?
load_confy_config(interpolate)?
};
config.validate()?;
@@ -338,6 +336,19 @@ pub fn load_config() -> Result<Config> {
Ok(config)
}
fn load_confy_config(interpolate: bool) -> Result<Config> {
let load_path = confy::get_configuration_file_path("gman", "config")?;
let mut content = fs::read_to_string(&load_path)
.with_context(|| format!("failed to read config file '{}'", load_path.display()))?;
if interpolate {
content = interpolate_env_vars(&content);
}
let cfg: Config = serde_yaml::from_str(&content)
.with_context(|| format!("failed to parse YAML config at '{}'", load_path.display()))?;
Ok(cfg)
}
/// Returns the configuration file path that `confy` will use
pub fn get_config_file_path() -> Result<PathBuf> {
if let Some(base) = env::var_os("XDG_CONFIG_HOME").map(PathBuf::from) {
@@ -352,53 +363,6 @@ pub fn get_config_file_path() -> Result<PathBuf> {
Ok(confy::get_configuration_file_path("gman", "config")?)
}
pub fn deserialize_optional_env_var<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
where
D: serde::Deserializer<'de>,
{
let s: Option<String> = Option::deserialize(deserializer)?;
match s {
Some(value) => {
let interpolated = interpolate_env_vars(&value);
Ok(Some(interpolated))
}
None => Ok(None),
}
}
pub fn deserialize_optional_pathbuf_env_var<'de, D>(
deserializer: D,
) -> Result<Option<PathBuf>, D::Error>
where
D: serde::Deserializer<'de>,
{
let s: Option<String> = Option::deserialize(deserializer)?;
match s {
Some(value) => {
let interpolated = interpolate_env_vars(&value);
Ok(Some(interpolated.parse().unwrap()))
}
None => Ok(None),
}
}
fn deserialize_optional_usize_env_var<'de, D>(deserializer: D) -> Result<Option<usize>, D::Error>
where
D: serde::Deserializer<'de>,
{
let s: Option<String> = Option::deserialize(deserializer)?;
match s {
Some(value) => {
let interpolated = interpolate_env_vars(&value);
interpolated
.parse::<usize>()
.map(Some)
.map_err(serde::de::Error::custom)
}
None => Ok(None),
}
}
pub fn interpolate_env_vars(s: &str) -> String {
let result = s.to_string();
let scrubbing_regex = Regex::new(r#"[\s{}^()\[\]\\|`'"]+"#).unwrap();
@@ -430,261 +394,8 @@ pub fn interpolate_env_vars(s: &str) -> String {
#[cfg(test)]
mod tests {
use super::*;
use indoc::indoc;
use pretty_assertions::{assert_eq, assert_str_eq};
use serde::Deserialize;
use pretty_assertions::assert_str_eq;
use serial_test::serial;
use std::path::PathBuf;
#[derive(Default, Deserialize, PartialEq, Eq, Debug)]
struct TestConfig {
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
string_var: Option<String>,
#[serde(default, deserialize_with = "deserialize_optional_pathbuf_env_var")]
path_var: Option<PathBuf>,
#[serde(default, deserialize_with = "deserialize_optional_usize_env_var")]
usize_var: Option<usize>,
}
#[test]
#[serial]
fn test_deserialize_optional_env_var_is_present() {
unsafe { env::set_var("TEST_VAR_DESERIALIZE_OPTION", "localhost") };
let yaml_data = indoc!(
r#"
string_var: ${TEST_VAR_DESERIALIZE_OPTION}
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.string_var, Some("localhost".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.usize_var, Some(123));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION") };
}
#[test]
fn test_deserialize_optional_env_var_empty_env_var_uses_default_value_if_provided() {
let yaml_data = indoc!(
r#"
string_var: ${TEST_VAR_DESERIALIZE_OPTION_UNDEFINED:-localhost}
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.string_var, Some("localhost".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.usize_var, Some(123));
}
#[test]
#[serial]
fn test_deserialize_optional_env_var_does_not_overwrite_non_env_value() {
unsafe { env::set_var("TEST_VAR_DESERIALIZE_OPTION_NO_OVERWRITE", "localhost") };
let yaml_data = indoc!(
r#"
string_var: www.example.com
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.string_var, Some("www.example.com".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.usize_var, Some(123));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION_NO_OVERWRITE") };
}
#[test]
fn test_deserialize_optional_env_var_empty() {
let yaml_data = indoc!(
r#"
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.string_var, None);
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.usize_var, Some(123));
}
#[test]
#[serial]
fn test_deserialize_optional_pathbuf_env_var_is_present() {
unsafe { env::set_var("TEST_VAR_DESERIALIZE_OPTION_PATHBUF", "/some/path") };
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: ${TEST_VAR_DESERIALIZE_OPTION_PATHBUF}
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.usize_var, Some(123));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION_PATHBUF") };
}
#[test]
fn test_deserialize_optional_pathbuf_env_var_empty_env_var_uses_default_value_if_provided() {
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: ${TEST_VAR_DESERIALIZE_OPTION_PATHBUF_UNDEFINED:-/some/path}
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.usize_var, Some(123));
}
#[test]
#[serial]
fn test_deserialize_optional_pathbuf_env_var_does_not_overwrite_non_env_value() {
unsafe {
env::set_var(
"TEST_VAR_DESERIALIZE_OPTION_PATHBUF_NO_OVERWRITE",
"/something/else",
)
};
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.usize_var, Some(123));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION_PATHBUF_NO_OVERWRITE") };
}
#[test]
fn test_deserialize_optional_pathbuf_env_var_empty() {
let yaml_data = indoc!(
r#"
string_var: hithere
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.path_var, None);
assert_eq!(config.usize_var, Some(123));
}
#[test]
#[serial]
fn test_deserialize_optional_usize_env_var_is_present() {
unsafe { env::set_var("TEST_VAR_DESERIALIZE_OPTION_USIZE", "123") };
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
usize_var: ${TEST_VAR_DESERIALIZE_OPTION_USIZE}
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.usize_var, Some(123));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION_USIZE") };
}
#[test]
fn test_deserialize_optional_usize_env_var_uses_default_value_if_provided() {
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
usize_var: ${TEST_VAR_DESERIALIZE_OPTION_USIZE_UNDEFINED:-123}
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.usize_var, Some(123));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
}
#[test]
#[serial]
fn test_deserialize_optional_usize_env_var_does_not_overwrite_non_env_value() {
unsafe { env::set_var("TEST_VAR_DESERIALIZE_OPTION_NO_OVERWRITE_USIZE", "456") };
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
usize_var: 123
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.usize_var, Some(123));
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
unsafe { env::remove_var("TEST_VAR_DESERIALIZE_OPTION_NO_OVERWRITE_USIZE") };
}
#[test]
fn test_deserialize_optional_usize_env_var_invalid_number() {
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
usize_var: "holo"
"#
);
let result: Result<TestConfig, _> = serde_yaml::from_str(yaml_data);
assert!(result.is_err());
let err = result.unwrap_err().to_string();
assert!(err.contains("invalid digit found in string"));
}
#[test]
fn test_deserialize_optional_usize_env_var_empty() {
let yaml_data = indoc!(
r#"
string_var: hithere
path_var: /some/path
"#
);
let config: TestConfig = serde_yaml::from_str(yaml_data).unwrap();
assert_eq!(config.usize_var, None);
assert_eq!(config.string_var, Some("hithere".to_string()));
assert_eq!(config.path_var, Some(PathBuf::from("/some/path")));
}
#[test]
fn test_interpolate_env_vars_defaults_to_original_string_if_not_in_yaml_interpolation_format() {
-3
View File
@@ -1,4 +1,3 @@
use crate::config::deserialize_optional_env_var;
use crate::providers::SecretProvider;
use anyhow::Context;
use anyhow::Result;
@@ -33,10 +32,8 @@ use validator::Validate;
#[serde(deny_unknown_fields)]
pub struct AwsSecretsManagerProvider {
#[validate(required)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub aws_profile: Option<String>,
#[validate(required)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub aws_region: Option<String>,
}
-2
View File
@@ -1,4 +1,3 @@
use crate::config::deserialize_optional_env_var;
use crate::providers::SecretProvider;
use anyhow::{Context, Result};
use azure_identity::DefaultAzureCredential;
@@ -31,7 +30,6 @@ use validator::Validate;
#[serde(deny_unknown_fields)]
pub struct AzureKeyVaultProvider {
#[validate(required)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub vault_name: Option<String>,
}
-2
View File
@@ -1,4 +1,3 @@
use crate::config::deserialize_optional_env_var;
use crate::providers::SecretProvider;
use anyhow::{Context, Result, anyhow};
use gcloud_sdk::google::cloud::secretmanager::v1;
@@ -40,7 +39,6 @@ type SecretsManagerClient = GoogleApi<SecretManagerServiceClient<GoogleAuthMiddl
#[serde(deny_unknown_fields)]
pub struct GcpSecretManagerProvider {
#[validate(required)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub gcp_project_id: Option<String>,
}
-2
View File
@@ -1,4 +1,3 @@
use crate::config::deserialize_optional_env_var;
use crate::providers::{ENV_PATH, SecretProvider};
use anyhow::{Context, Result, anyhow};
use serde::{Deserialize, Serialize};
@@ -29,7 +28,6 @@ use validator::Validate;
#[derive(Debug, Default, Clone, Validate, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct GopassProvider {
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub store: Option<String>,
}
+1 -10
View File
@@ -1,5 +1,3 @@
use crate::config::deserialize_optional_env_var;
use crate::config::deserialize_optional_pathbuf_env_var;
use anyhow::{Context, anyhow, bail};
use secrecy::{ExposeSecret, SecretString};
use std::collections::HashMap;
@@ -52,21 +50,14 @@ use validator::Validate;
#[derive(Debug, Clone, Validate, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct LocalProvider {
#[serde(default, deserialize_with = "deserialize_optional_pathbuf_env_var")]
pub password_file: Option<PathBuf>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub git_branch: Option<String>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub git_remote_url: Option<String>,
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub git_user_name: Option<String>,
#[validate(email)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub git_user_email: Option<String>,
#[serde(default, deserialize_with = "deserialize_optional_pathbuf_env_var")]
pub git_executable: Option<PathBuf>,
#[serde(skip)]
#[serde(default, deserialize_with = "deserialize_optional_env_var")]
pub runtime_provider_name: Option<String>,
}
@@ -256,7 +247,7 @@ impl LocalProvider {
fn persist_git_settings_to_config(&self) -> Result<()> {
debug!("Saving updated config (only current local provider)");
let mut cfg = load_config().with_context(|| "failed to load existing config")?;
let mut cfg = load_config(true).with_context(|| "failed to load existing config")?;
let target_name = self.runtime_provider_name.clone();
let mut updated = false;
-12
View File
@@ -130,18 +130,6 @@ fn cli_shows_help() {
.stdout(predicate::str::contains("Usage").or(predicate::str::contains("Add")));
}
#[test]
fn cli_completions_bash() {
let (_td, cfg, cache) = setup_env();
let mut cmd = Command::cargo_bin("gman").unwrap();
cmd.env("XDG_CACHE_HOME", &cache)
.env("XDG_CONFIG_HOME", &cfg)
.args(["completions", "bash"]);
cmd.assert()
.success()
.stdout(predicate::str::contains("_gman").or(predicate::str::contains("complete -F")));
}
#[test]
fn cli_add_get_list_update_delete_roundtrip() {
let (td, xdg_cfg, xdg_cache) = setup_env();