如何处理 Rails ENCRYPTED 凭证文件中的合并冲突

Question

使用 rails 6（或 5.2）加密凭据，我在管理和解决 credentials.yml.enc 文件中的合并冲突时遇到了困难。如文档中所述，其目的是可以将加密凭据添加到源代码控制 (https://guides.rubyonrails.org/security.html#custom-credentials)

例如 branch_a 为 service a 添加凭据并合并到主控 branch_b 为 service b 添加凭据，并且在重新定位时，credentials.yml.enc 文件中的冲突如下所示：

<<<<<<< HEAD
sahdkajshdkajhsdkjahsdkjahsdkajhsdkjahsdkjahdskjahsdjkahsdencryptedstring-a09dpjmcas==
=======
laskdjalksjdlakjsdlaksjdlakjsdlaksjdlakjsdlajsdlkajsdlkjasdljalsdajsdencryptedstringrere=
>>>>>>> branch_b

我可以在每个分支上查看未加密的credentials.yml.enc 并手动解决冲突，但有没有更好的方法来管理凭据，以避免这些凭据冲突。

Answer 1

我不相信有更好的方法，不。

由于加密的性质，无法在加密状态下解决它。如果这是可能的，则意味着您可以以某种方式知道处于加密状态的文件的值和密钥。

进行合并时，应解决源文件中的所有冲突，然后重新运行生成加密文件的命令，然后完成合并。

Answer 2

这是可能的。来自rails credentials的用法：

=== Set up Git to Diff Credentials

Rails provides `rails credentials:diff --enroll` to instruct Git to call `rails credentials:diff`
when `git diff` is run on a credentials file.

Running the command enrolls the project such that all credentials files use the
"rails_credentials" diff driver in .gitattributes.

Additionally since Git requires the driver itself to be set up in a config file
that isn't tracked Rails automatically ensures it's configured when running
`credentials:edit`.

Otherwise each co-worker would have to run enable manually, including on each new
repo clone.

Answer 3

如果你没有rails credentials:diff...

可以合并它们，但你必须解密它们。

在处理合并冲突时，你可以运行git mergetool，它应该会生成4个文件：

config/credentials.yml_BACKUP_84723.enc
config/credentials.yml_LOCAL_84723.enc
config/credentials.yml_BASE_84723.enc
config/credentials.yml_LOCAL_84723.enc

您可能需要在一个终端窗口中运行git mergetool，并在另一个终端窗口中运行此脚本： 请注意，这将在本地计算机上公开您的凭据。

# Temporarily move credentials file to another location
mv config/credentials.yml.enc ~/Desktop/credentials_temp.yml.enc

# Copy local file to original location
cp config/credentials.yml_LOCAL_* config/credentials.yml.enc

# Decrypt and send decrypted credentials to desktop
rails credentials:show > ~/Desktop/credentials_local.yaml

# Delete the copied local file
rm config/credentials.yml.enc

# Copy remote file to original location
cp config/credentials.yml_REMOTE_* config/credentials.yml.enc

# Decrypt and send decrypted credentials to desktop
rails credentials:show > ~/Desktop/credentials_remote.yaml

# Delete the copied remote file
rm config/credentials.yml.enc

# Move credentials file back
mv ~/Desktop/credentials_temp.yml.enc config/credentials.yml.enc

# See diffs or open both
diff ~/Desktop/credentials_local.yaml ~/Desktop/credentials_remote.yaml

# Delete the decrypted files
rm ~/Desktop/credentials_local.yaml ~/Desktop/credentials_remote.yaml

本地在左侧。遥控器在右边。 享受吧。

Answer 4

通常建议忽略版本控制中的凭据，即.gitignore，并通过环境变量配置它们。