0x10000040 $lY>C]qAB'ţ }2_a )gW@sddlmZmZmZeZddlmZddlZddl Z ddl m Z ddl m Z ddlmZddlmZddlmZmZdd lmZdd lmZmZmZdd lmZeZGd d d eZdddZ e!dkre dS))absolute_importdivisionprint_function)CLIN) constants)context)option_helpers)AnsibleOptionsError)to_textto_bytes) DataLoader) VaultEditorVaultLibmatch_encrypt_secret)DisplaycseZdZdZdZdZdZdZfddZfdd Z fd d Z fd d Z ddZ e d!ddZddZd"ddZddZddZddZddZdd ZZS)#VaultCLIa9 can encrypt any structured data file used by Ansible. This can include *group_vars/* or *host_vars/* inventory variables, variables loaded by *include_vars* or *vars_files*, or variable files passed on the ansible-playbook command line with *-e @file.yml* or *-e @file.json*. Role variables and defaults are also included! Because Ansible tasks, handlers, and other objects are data, these can also be encrypted with vault. If you'd like to not expose what variables you are using, you can keep an individual task file entirely encrypted. z ansible-vaultstdinzthe command line argszthe interactive promptcs>d|_d|_d|_d|_d|_d|_d|_tt| |dS)NF) Z b_vault_passZb_new_vault_passencrypt_string_read_stdinencrypt_secretencrypt_vault_idnew_encrypt_secretnew_encrypt_vault_idsuperr__init__)selfargs __class__5/usr/lib/python3.9/site-packages/ansible/cli/vault.pyr-szVaultCLI.__init__c stt|jddtjtjddtj j dd}t |t ||j jdd}d |_tj j dd}|jd dd d td tj j dd}|jdgddtdd|jdd||gd}|j|jd|jddddd|jdd||gd}|j|jd|jddddd|jdd||gd}|j|jd|jddddd|jd d!|gd}|j|jd|jddddd|jd"d#|||gd} | j|jd| jddddd|jd$d%|||gd} | j|jd| jdd&d'dd| jd(d)d*d+d,d-| jd.d/dd+d0d1| jd2d3d4d5d6d-| jd7d8dd9d:|jd;d<||gd} | j|jd| } | jd=dd>d?td | jd@ddAtdBdC| jddddddS)DNz4encryption/decryption utility for Ansible data fileszH See '%s --help' for more information on a specific command. r)ZdescepilogF)add_helpaction)destTz--output output_filez9output file name for encrypt or decrypt; use - for stdout)defaultr#helptypez--encrypt-vault-idrstorezMthe vault id used to encrypt (required if more than one vault-id is provided))r%r#r"r'r&createzCreate new vault encrypted file)r&parents)funcrZFilename file_name*)r&metavarnargsdecryptzDecrypt vault encrypted fileeditzEdit vault encrypted fileviewzView vault encrypted fileencryptzEncrypt YAML fileencrypt_stringzEncrypt a stringzString to encryptZstring_to_encryptz-pz--promptencrypt_string_prompt store_truez Prompt for the string to encrypt)r#r"r&z --show-inputshow_string_inputz9Do not hide input when prompted for the string to encrypt)r#r%r"r&z-nz--nameencrypt_string_namesappendzSpecify the variable namez --stdin-nameencrypt_string_stdin_namez#Specify the variable name for stdin)r#r%r&rekeyzRe-key a vault encrypted filez--new-vault-password-filenew_vault_password_filez!new vault password file for rekeyz--new-vault-id new_vault_idz'the new vault identity to use for rekey)r%r#r'r&)rr init_parserospathbasenamesysargvopt_helpargparseArgumentParserZadd_vault_optionsZadd_verbosity_optionsparseradd_subparsersrequired add_argumentZ unfrack_pathstr add_parser set_defaultsexecute_createexecute_decrypt execute_edit