golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils

File/Folder	Size	Actions
__init__.py	237 B
__pycache__	-
aggregation.py	5.17 KB
ansible.py	1.48 KB
args.py	18.33 KB
asynchronous.py	4.06 KB
atomicfile.py	5.33 KB
aws.py	20.37 KB
azurearm.py	11.42 KB
beacons.py	517 B
boto3mod.py	8.36 KB
boto_elb_tag.py	3.02 KB
botomod.py	7.98 KB
cache.py	11.49 KB
channel.py	489 B
cloud.py	116.3 KB
color.py	2.72 KB
compat.py	1.89 KB
configcomparer.py	3.88 KB
configparser.py	10.82 KB
context.py	6.8 KB
crypt.py	5 KB
ctx.py	1.42 KB
data.py	53.03 KB
dateutils.py	2.3 KB
debug.py	4.19 KB
decorators	-
dictdiffer.py	16.48 KB
dicttrim.py	3.9 KB
dictupdate.py	11.33 KB
dns.py	35.21 KB
doc.py	2.25 KB
dockermod	-
entrypoints.py	1.83 KB
environment.py	2.2 KB
error.py	1.18 KB
etcd_util.py	33.25 KB
event.py	52.45 KB
extend.py	8.87 KB
extmods.py	6.04 KB
filebuffer.py	3.15 KB
files.py	27.94 KB
find.py	22.08 KB
fsutils.py	3.29 KB
functools.py	6.02 KB
gitfs.py	130.41 KB
github.py	1.52 KB
gzip_util.py	2.86 KB
hashutils.py	5.91 KB
http.py	33.9 KB
iam.py	1.22 KB
icinga2.py	754 B
idem.py	1.22 KB
immutabletypes.py	2.46 KB
itertools.py	2.36 KB
jid.py	3 KB
jinja.py	33.92 KB
job.py	6.89 KB
json.py	3.78 KB
kickstart.py	41.04 KB
kinds.py	493 B
lazy.py	3.06 KB
listdiffer.py	10.9 KB
locales.py	2.06 KB
mac_utils.py	14.01 KB
mako.py	3.97 KB
master.py	29.7 KB
mattermost.py	1.77 KB
memcached.py	3.56 KB
migrations.py	1.46 KB
mine.py	3.68 KB
minion.py	4.13 KB
minions.py	43.38 KB
mount.py	1.15 KB
msazure.py	5.36 KB
msgpack.py	4.69 KB
nacl.py	13.65 KB
namecheap.py	4.32 KB
napalm.py	23.22 KB
nb_popen.py	7.24 KB
network.py	73.86 KB
nxos.py	12.94 KB
nxos_api.py	4 KB
odict.py	13.21 KB
openstack	-
oset.py	6.41 KB
pagerduty.py	3.03 KB
parsers.py	122.69 KB
path.py	11.24 KB
pbm.py	9.81 KB
pkg	-
platform.py	5.84 KB
powershell.py	4.15 KB
preseed.py	2.64 KB
process.py	40.76 KB
profile.py	3.21 KB
proxy.py	331 B
psutil_compat.py	3.63 KB
pushover.py	4.51 KB
pycrypto.py	5.41 KB
pydsl.py	13.74 KB
pyobjects.py	10.75 KB
reactor.py	18.99 KB
reclass.py	752 B
roster_matcher.py	3.55 KB
rsax931.py	8.42 KB
s3.py	8.78 KB
saltclass.py	14.27 KB
sanitizers.py	2.51 KB
schedule.py	71.81 KB
schema.py	54.26 KB
sdb.py	4.04 KB
slack.py	3.58 KB
smb.py	11.16 KB
smtp.py	3.27 KB
ssdp.py	14.75 KB
ssh.py	769 B
state.py	8.43 KB
stringio.py	355 B
stringutils.py	16.95 KB
systemd.py	5.51 KB
templates.py	24.03 KB
textformat.py	5.03 KB
thin.py	31.91 KB
timed_subprocess.py	4.06 KB
timeout.py	1.53 KB
timeutil.py	2.4 KB
url.py	5 KB
user.py	11.86 KB
validate	-
value.py	247 B
vault.py	21.74 KB
verify.py	25.34 KB
versions.py	17.17 KB
virt.py	3.24 KB
virtualbox.py	22.43 KB
vmware.py	129.74 KB
vsan.py	17.18 KB
vt.py	31.47 KB
vt_helper.py	4.4 KB
win_chcp.py	3.7 KB
win_dacl.py	95.49 KB
win_dotnet.py	4.74 KB
win_functions.py	12.69 KB
win_lgpo_auditpol.py	8.48 KB
win_lgpo_netsh.py	17.87 KB
win_lgpo_reg.py	16.98 KB
win_network.py	16.35 KB
win_osinfo.py	2.83 KB
win_pdh.py	13.85 KB
win_reg.py	30.82 KB
win_runas.py	10.53 KB
win_service.py	5.2 KB
win_system.py	14.47 KB
win_update.py	40.36 KB
winapi.py	818 B
x509.py	73.19 KB
xdg.py	316 B
xmlutil.py	13.91 KB
yaml.py	349 B
yamldumper.py	3.37 KB
yamlencoding.py	1.55 KB
yamllint.py	1.61 KB
yamlloader.py	6.04 KB
yamlloader_old.py	8.15 KB
yast.py	619 B
zeromq.py	1.74 KB
zfs.py	19.15 KB

Edit: nacl.py

"""
Common code shared between the nacl module and runner.
"""

import base64
import os

import salt.syspaths
import salt.utils.files
import salt.utils.platform
import salt.utils.stringutils
import salt.utils.versions
import salt.utils.win_dacl
import salt.utils.win_functions

REQ_ERROR = None
try:
    import nacl.public
    import nacl.secret
except (ImportError, OSError) as e:
    REQ_ERROR = (
        "PyNaCl import error, perhaps missing python PyNaCl package or should update."
    )

__virtualname__ = "nacl"

def __virtual__():
    if __opts__["fips_mode"] is True:
        return False, "nacl utils not available in FIPS mode"
    return check_requirements()

def check_requirements():
    """
    Check required libraries are available
    """
    return (REQ_ERROR is None, REQ_ERROR)

def _get_config(**kwargs):
    """
    Return configuration
    """
    sk_file = kwargs.get("sk_file")
    if not sk_file:
        sk_file = os.path.join(kwargs["opts"].get("pki_dir"), "master/nacl")

pk_file = kwargs.get("pk_file")
    if not pk_file:
        pk_file = os.path.join(kwargs["opts"].get("pki_dir"), "master/nacl.pub")

config = {
        "box_type": kwargs.get("box_type", "sealedbox"),
        "sk": None,
        "sk_file": sk_file,
        "pk": None,
        "pk_file": pk_file,
    }

config_key = "{}.config".format(__virtualname__)
    try:
        config.update(__salt__["config.get"](config_key, {}))
    except (NameError, KeyError) as e:
        # likely using salt-run so fallback to __opts__
        config.update(kwargs["opts"].get(config_key, {}))
    # pylint: disable=C0201
    for k in set(config.keys()) & set(kwargs.keys()):
        config[k] = kwargs[k]
    return config

def _get_sk(**kwargs):
    """
    Return sk
    """
    config = _get_config(**kwargs)
    key = None
    if config["sk"]:
        key = salt.utils.stringutils.to_str(config["sk"])
    sk_file = config["sk_file"]
    if not key and sk_file:
        try:
            with salt.utils.files.fopen(sk_file, "rb") as keyf:
                key = salt.utils.stringutils.to_unicode(keyf.read()).rstrip("\n")
        except OSError:
            raise Exception("no key or sk_file found")
    return base64.b64decode(key)

def _get_pk(**kwargs):
    """
    Return pk
    """
    config = _get_config(**kwargs)
    pubkey = None
    if config["pk"]:
        pubkey = salt.utils.stringutils.to_str(config["pk"])
    pk_file = config["pk_file"]
    if not pubkey and pk_file:
        try:
            with salt.utils.files.fopen(pk_file, "rb") as keyf:
                pubkey = salt.utils.stringutils.to_unicode(keyf.read()).rstrip("\n")
        except OSError:
            raise Exception("no pubkey or pk_file found")
    pubkey = str(pubkey)
    return base64.b64decode(pubkey)

def keygen(sk_file=None, pk_file=None, **kwargs):
    """
    Use PyNaCl to generate a keypair.

If no `sk_file` is defined return a keypair.

If only the `sk_file` is defined `pk_file` will use the same name with a postfix `.pub`.

When the `sk_file` is already existing, but `pk_file` is not. The `pk_file` will be generated
    using the `sk_file`.

CLI Examples:

.. code-block:: bash

salt-call nacl.keygen
        salt-call nacl.keygen sk_file=/etc/salt/pki/master/nacl
        salt-call nacl.keygen sk_file=/etc/salt/pki/master/nacl pk_file=/etc/salt/pki/master/nacl.pub
        salt-call --local nacl.keygen

if sk_file is None:
        kp = nacl.public.PrivateKey.generate()
        return {
            "sk": base64.b64encode(kp.encode()),
            "pk": base64.b64encode(kp.public_key.encode()),
        }

if pk_file is None:
        pk_file = "{}.pub".format(sk_file)

if sk_file and pk_file is None:
        if not os.path.isfile(sk_file):
            kp = nacl.public.PrivateKey.generate()
            with salt.utils.files.fopen(sk_file, "wb") as keyf:
                keyf.write(base64.b64encode(kp.encode()))
            if salt.utils.platform.is_windows():
                cur_user = salt.utils.win_functions.get_current_user()
                salt.utils.win_dacl.set_owner(sk_file, cur_user)
                salt.utils.win_dacl.set_permissions(
                    sk_file,
                    cur_user,
                    "full_control",
                    "grant",
                    reset_perms=True,
                    protected=True,
                )
            else:
                # chmod 0600 file
                os.chmod(sk_file, 1536)
            return "saved sk_file: {}".format(sk_file)
        else:
            raise Exception("sk_file:{} already exist.".format(sk_file))

if sk_file is None and pk_file:
        raise Exception("sk_file: Must be set inorder to generate a public key.")

if os.path.isfile(sk_file) and os.path.isfile(pk_file):
        raise Exception(
            "sk_file:{} and pk_file:{} already exist.".format(sk_file, pk_file)
        )

if os.path.isfile(sk_file) and not os.path.isfile(pk_file):
        # generate pk using the sk
        with salt.utils.files.fopen(sk_file, "rb") as keyf:
            sk = salt.utils.stringutils.to_unicode(keyf.read()).rstrip("\n")
            sk = base64.b64decode(sk)
        kp = nacl.public.PublicKey(sk)
        with salt.utils.files.fopen(pk_file, "wb") as keyf:
            keyf.write(base64.b64encode(kp.encode()))
        return "saved pk_file: {}".format(pk_file)

kp = nacl.public.PublicKey.generate()
    with salt.utils.files.fopen(sk_file, "wb") as keyf:
        keyf.write(base64.b64encode(kp.encode()))
    if salt.utils.platform.is_windows():
        cur_user = salt.utils.win_functions.get_current_user()
        salt.utils.win_dacl.set_owner(sk_file, cur_user)
        salt.utils.win_dacl.set_permissions(
            sk_file, cur_user, "full_control", "grant", reset_perms=True, protected=True
        )
    else:
        # chmod 0600 file
        os.chmod(sk_file, 1536)
    with salt.utils.files.fopen(pk_file, "wb") as keyf:
        keyf.write(base64.b64encode(kp.encode()))
    return "saved sk_file:{}  pk_file: {}".format(sk_file, pk_file)

def enc(data, **kwargs):
    """
    Alias to `{box_type}_encrypt`

box_type: secretbox, sealedbox(default)

sk_file
      Path to where there secret key exists.
      The argrument ``keyfile`` was deprecated
      in favor of ``sk_file``. ``keyfile`` will
      continue to work to ensure backwards
      compatbility, but please use the preferred
      ``sk_file``.
    sk
      Secret key contents. The argument ``key``
      was deprecated in favor of ``sk``. ``key``
      will continue to work to ensure backwards
      compatibility, but please use the preferred
      ``sk``.
    """
    if "keyfile" in kwargs:
        kwargs["sk_file"] = kwargs["keyfile"]

# set boxtype to `secretbox` to maintain backward compatibility
        kwargs["box_type"] = "secretbox"

if "key" in kwargs:
        kwargs["sk"] = kwargs["key"]

# set boxtype to `secretbox` to maintain backward compatibility
        kwargs["box_type"] = "secretbox"

box_type = _get_config(**kwargs)["box_type"]
    if box_type == "secretbox":
        return secretbox_encrypt(data, **kwargs)
    return sealedbox_encrypt(data, **kwargs)

def enc_file(name, out=None, **kwargs):
    """
    This is a helper function to encrypt a file and return its contents.

You can provide an optional output file using `out`

`name` can be a local file or when not using `salt-run` can be a url like `salt://`, `https://` etc.

CLI Examples:

.. code-block:: bash

salt-run nacl.enc_file name=/tmp/id_rsa
        salt-call nacl.enc_file name=salt://crt/mycert out=/tmp/cert
        salt-run nacl.enc_file name=/tmp/id_rsa box_type=secretbox \
            sk_file=/etc/salt/pki/master/nacl.pub
    """
    try:
        data = __salt__["cp.get_file_str"](name)
    except Exception as e:  # pylint: disable=broad-except
        # likly using salt-run so fallback to local filesystem
        with salt.utils.files.fopen(name, "rb") as f:
            data = salt.utils.stringutils.to_unicode(f.read())
    d = enc(data, **kwargs)
    if out:
        if os.path.isfile(out):
            raise Exception("file:{} already exist.".format(out))
        with salt.utils.files.fopen(out, "wb") as f:
            f.write(salt.utils.stringutils.to_bytes(d))
        return "Wrote: {}".format(out)
    return d

def dec(data, **kwargs):
    """
    Alias to `{box_type}_decrypt`

box_type: secretbox, sealedbox(default)

# set boxtype to `secretbox` to maintain backward compatibility
        kwargs["box_type"] = "secretbox"

if "key" in kwargs:
        kwargs["sk"] = kwargs["key"]

# set boxtype to `secretbox` to maintain backward compatibility
        kwargs["box_type"] = "secretbox"

box_type = _get_config(**kwargs)["box_type"]
    if box_type == "secretbox":
        return secretbox_decrypt(data, **kwargs)

return sealedbox_decrypt(data, **kwargs)

def dec_file(name, out=None, **kwargs):
    """
    This is a helper function to decrypt a file and return its contents.

You can provide an optional output file using `out`

`name` can be a local file or when not using `salt-run` can be a url like `salt://`, `https://` etc.

CLI Examples:

.. code-block:: bash

salt-run nacl.dec_file name=/tmp/id_rsa.nacl
        salt-call nacl.dec_file name=salt://crt/mycert.nacl out=/tmp/id_rsa
        salt-run nacl.dec_file name=/tmp/id_rsa.nacl box_type=secretbox \
            sk_file=/etc/salt/pki/master/nacl.pub
    """
    try:
        data = __salt__["cp.get_file_str"](name)
    except Exception as e:  # pylint: disable=broad-except
        # likly using salt-run so fallback to local filesystem
        with salt.utils.files.fopen(name, "rb") as f:
            data = salt.utils.stringutils.to_unicode(f.read())
    d = dec(data, **kwargs)
    if out:
        if os.path.isfile(out):
            raise Exception("file:{} already exist.".format(out))
        with salt.utils.files.fopen(out, "wb") as f:
            f.write(salt.utils.stringutils.to_bytes(d))
        return "Wrote: {}".format(out)
    return d

def sealedbox_encrypt(data, **kwargs):
    """
    Encrypt data using a public key generated from `nacl.keygen`.
    The encryptd data can be decrypted using `nacl.sealedbox_decrypt` only with the secret key.

CLI Examples:

.. code-block:: bash

salt-run nacl.sealedbox_encrypt datatoenc
        salt-call --local nacl.sealedbox_encrypt datatoenc pk_file=/etc/salt/pki/master/nacl.pub
        salt-call --local nacl.sealedbox_encrypt datatoenc pk='vrwQF7cNiNAVQVAiS3bvcbJUnF0cN6fU9YTZD9mBfzQ='
    """
    # ensure data is in bytes
    data = salt.utils.stringutils.to_bytes(data)

pk = _get_pk(**kwargs)
    keypair = nacl.public.PublicKey(pk)
    b = nacl.public.SealedBox(keypair)
    return base64.b64encode(b.encrypt(data))

def sealedbox_decrypt(data, **kwargs):
    """
    Decrypt data using a secret key that was encrypted using a public key with `nacl.sealedbox_encrypt`.

CLI Examples:

.. code-block:: bash

salt-call nacl.sealedbox_decrypt pEXHQM6cuaF7A=
        salt-call --local nacl.sealedbox_decrypt data='pEXHQM6cuaF7A=' sk_file=/etc/salt/pki/master/nacl
        salt-call --local nacl.sealedbox_decrypt data='pEXHQM6cuaF7A=' sk='YmFkcGFzcwo='
    """
    if data is None:
        return None

# ensure data is in bytes
    data = salt.utils.stringutils.to_bytes(data)

sk = _get_sk(**kwargs)
    keypair = nacl.public.PrivateKey(sk)
    b = nacl.public.SealedBox(keypair)
    return b.decrypt(base64.b64decode(data))

def secretbox_encrypt(data, **kwargs):
    """
    Encrypt data using a secret key generated from `nacl.keygen`.
    The same secret key can be used to decrypt the data using `nacl.secretbox_decrypt`.

CLI Examples:

.. code-block:: bash

salt-run nacl.secretbox_encrypt datatoenc
        salt-call --local nacl.secretbox_encrypt datatoenc sk_file=/etc/salt/pki/master/nacl
        salt-call --local nacl.secretbox_encrypt datatoenc sk='YmFkcGFzcwo='
    """
    # ensure data is in bytes
    data = salt.utils.stringutils.to_bytes(data)

sk = _get_sk(**kwargs)
    b = nacl.secret.SecretBox(sk)
    return base64.b64encode(b.encrypt(data))

def secretbox_decrypt(data, **kwargs):
    """
    Decrypt data that was encrypted using `nacl.secretbox_encrypt` using the secret key
    that was generated from `nacl.keygen`.

CLI Examples:

.. code-block:: bash

salt-call nacl.secretbox_decrypt pEXHQM6cuaF7A=
        salt-call --local nacl.secretbox_decrypt data='pEXHQM6cuaF7A=' sk_file=/etc/salt/pki/master/nacl
        salt-call --local nacl.secretbox_decrypt data='pEXHQM6cuaF7A=' sk='YmFkcGFzcwo='
    """
    if data is None:
        return None

# ensure data is in bytes
    data = salt.utils.stringutils.to_bytes(data)

key = _get_sk(**kwargs)
    b = nacl.secret.SecretBox(key=key)
    return b.decrypt(base64.b64decode(data))