Bug 411156 - [RFE] Add option to open and decrypt ansible vaults
Summary: [RFE] Add option to open and decrypt ansible vaults
Status: RESOLVED WAITINGFORINFO
Alias: None
Product: kate
Classification: Applications
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Fedora RPMs Linux
: NOR wishlist
Target Milestone: ---
Assignee: KWrite Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-22 10:09 UTC by Peter Tselios
Modified: 2023-04-16 16:41 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Tselios 2019-08-22 10:09:20 UTC
SUMMARY
Currently, Kate opens the Ansible Vault files in their encrypted form. 
Ideally, Kate should understand that the file is an ansible vault and ask for the decryption password, decrypt it and then open it. 

Obviously, when we save the vault it should ensure that it's encrypted.
Comment 1 Nate Graham 2019-08-23 18:01:12 UTC
God I would have loved this in my last job. Not sure how feasible it would be to implement, but if so... killer feature for Linux sysadmins.
Comment 2 Dominik Haumann 2019-08-23 19:05:11 UTC
I don't even know what an ansible vault is, nor how it relates to a simple text editor... I can only guess, and my guess tells me this is rather out of scope for a text editor.

@Nate: Since you seem to know this, could you please clarify? The only option I could see is to add a plugin that allows to decrypt a text buffer that contains an ansible vault... But then you have the plain text in a text buffer, this sounds like a security risk, especially if the user next presses Ctrl+S to save the current document.

If we cannot find a simple way to give you what you want, we have to be honest here and tell you this likely will never be implemented, since it's out of scope (wont-fix).
Comment 3 Nate Graham 2019-08-23 21:03:35 UTC
Ansible is a template-driven multi-machine configuration management system created by Red Hat for easing the difficulty of configuring and deploying Linux, macOS, and Windows computers (though using it for Windows makes you question your sanity). It's similar to Puppet, Chef, or Salt, if you've heard of or used any of those.

Ansible supports the concept of a "vault", which is a piece of text that's been encrypted and stored as ciphertext in a text file. To see the real value, you need to decrypt the vault by entering the vault's password, which displays the contents in a terminal window. The process of doing so is irritating, painful, and as hard to remember as assembling a tar command from memory, which is probably why Peter wants Kate to do it automatically.

This is a pretty niche feature, and if it's implementable at all, it would probably make sense to do it in a dedicated Ansible plugin. I share your concern that decrypting the vault would inherently involve creating a save-able text buffer with the cleartext contents in it, unless Kate could display the cleartext in a read-only view whose contents was stored securely.
Comment 4 Dominik Haumann 2019-08-24 06:23:39 UTC
Kate can read also from archives such as tar, zip, ... However, the logic is in karchive, kate doesn't implement anything itself.

Would this be solvable also via an external tool script, once the external tools plugin is merged?
Comment 5 Peter Tselios 2019-12-23 07:58:35 UTC
(In reply to Dominik Haumann from comment #4)
> Kate can read also from archives such as tar, zip, ... However, the logic is
> in karchive, kate doesn't implement anything itself.
> 
> Would this be solvable also via an external tool script, once the external
> tools plugin is merged?

Can you please provide me with a like describing what the external tools plugin will do?
Comment 6 Dominik Haumann 2019-12-29 10:36:49 UTC
The External Tools plugin is described here: https://kate-editor.org/post/2019/2019-09-21-external-tools-plugin/

What I had in mind is 1. Run tool to decrypt file, 2. Open decrypted file, 3. Run tool to encrypt again. Or something more smart like, 1. Tool to decrypt and paste into new empty text buffer, 2. Tool to put current text buffer content back to the encrypted file.
Comment 7 Christoph Cullmann 2023-04-16 16:41:39 UTC
Dear user, this wish list item is now closed, as it wasn't touched in the last two years and no contributor stepped up to implement it.

The Kate/KTextEditor team is small and we can just try to keep up with fixing bugs.

Therefore wishes that show no activity for a years or more will be closed from now on to keep at least a bit overview about 'current' wishs of the users.
If you want your feature to be implemented, please step up to provide some patch for it.

If you think it is really needed, you can reopen your request, but keep in mind,
if no new good arguments are made and no people get attracted to help out to implement it,
it will expire in a year again.

We have a nice website https://kate-editor.org that provides all the information needed to contribute, please make use of it.

e.g. see the information at https://kate-editor.org/join-us/ for details

Greetings
Christoph Cullmann