Fix mac creation, enhance error handling, add tests/coverage #15
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Buffer
toUInt8Array
when usinginstanceof
Work to enable #14 for all use cases
Mac hash creation for some of the key encryption types was broken in the last update (10.2). The change from
Buffer
toUInt8Array
ingetKey
prevents some false-positive errors that I was seeing.UInt8Array
is a superclass ofBuffer
, and thePlaintext
field of the KMS output was aUInt8Array
for me, so theinstanceof
check was failing despite the duck typing being valid still. These changes should also bring theencryptionModifier
implementation in line with theget-sops/sops
implementation of theshouldBeEncrypted
function.In order to provide this improvement, I've also improved some of the error output for easier debugging, which also aligns the errors a bit more with the cli sops tool. I also simplified the
walkAndDecrypt
function, and factored out some logic fromdecryptScalar
to make it simpler to reason about.To assure correctness, I added some integration tests which encrypt various files using the
sops
cli client before trying to decrypt them usingdecodeFile
. The tests use a variety of key encryption modes (unencrypted_suffix, encrypted_regex, etc), data structures (various data types and nesting levels), and it has support for multiple decryption methods (kms, gcp, pgp, etc) for the future if needed. I also added a coverage library but did not mark any amount of coverage as mandatory (I recommend 100% function coverage for integration tests).With these changes, I was able to get the
update_aws
branch to run correctly with all tests passing.