{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/17","labels_url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/17/comments","events_url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/17/events","html_url":"https://github.com/alphagov/multicloud-deploy/pull/17","id":82483912,"number":17,"title":"[#95710624] Use GPG to encrypt the vault password","user":{"login":"jimconner","id":9944861,"avatar_url":"https://avatars.githubusercontent.com/u/9944861?v=3","gravatar_id":"","url":"https://api.github.com/users/jimconner","html_url":"https://github.com/jimconner","followers_url":"https://api.github.com/users/jimconner/followers","following_url":"https://api.github.com/users/jimconner/following{/other_user}","gists_url":"https://api.github.com/users/jimconner/gists{/gist_id}","starred_url":"https://api.github.com/users/jimconner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimconner/subscriptions","organizations_url":"https://api.github.com/users/jimconner/orgs","repos_url":"https://api.github.com/users/jimconner/repos","events_url":"https://api.github.com/users/jimconner/events{/privacy}","received_events_url":"https://api.github.com/users/jimconner/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"dcarley","id":260438,"avatar_url":"https://avatars.githubusercontent.com/u/260438?v=3","gravatar_id":"","url":"https://api.github.com/users/dcarley","html_url":"https://github.com/dcarley","followers_url":"https://api.github.com/users/dcarley/followers","following_url":"https://api.github.com/users/dcarley/following{/other_user}","gists_url":"https://api.github.com/users/dcarley/gists{/gist_id}","starred_url":"https://api.github.com/users/dcarley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcarley/subscriptions","organizations_url":"https://api.github.com/users/dcarley/orgs","repos_url":"https://api.github.com/users/dcarley/repos","events_url":"https://api.github.com/users/dcarley/events{/privacy}","received_events_url":"https://api.github.com/users/dcarley/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-05-29T15:58:02Z","updated_at":"2015-06-01T13:56:38Z","closed_at":"2015-06-01T13:56:30Z","pull_request":{"url":"https://api.github.com/repos/alphagov/multicloud-deploy/pulls/17","html_url":"https://github.com/alphagov/multicloud-deploy/pull/17","diff_url":"https://github.com/alphagov/multicloud-deploy/pull/17.diff","patch_url":"https://github.com/alphagov/multicloud-deploy/pull/17.patch"},"body":"Distributing the ansible vault password throughout the team is a needless challenge which we can avoid by using multi-key encryption via GPG. The ansible-vault is still encrypted\r\n\r\n**Makefile**\r\n\r\n* Addition of a import-gpg-keys stanza to the Makefile which will import keys listed in gpg.recipients into the GPG keyring\r\n* Addition of a recrypt stanza to the Makefile which will decrypt the vault, generate a new pass-phrase, PGP-encrypt the pass-phrase and then re-encrypt the vault\r\n\r\n**ansible.cfg**\r\n\r\n* A change to the ansible.cfg to tell ansible to use the open_the_vault.sh script to get the vault decryption password\r\n\r\n**gpg.recipients**\r\n\r\n* Addition of a gpg.recipients file which lists KEY-ID and email address for each approved recipient\r\n\r\n**open_the_vault.sh**\r\n\r\n* Addition of an open_the_vault.sh script which uses GPG to decrypt the vault pass-phrase and outpus it on stdout\r\n\r\n**vault_passphrase.gpg**\r\n\r\n* Addition of the GPG-encrypted vault passphrase\r\n\r\n**vault**\r\n\r\n* Re-encrypted with new passphrase for GPG recipients\r\n\r\n**vault_password.txt**\r\n\r\n* Deprecated - no longer needed - removed."},"comment":{"url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/comments/107494640","html_url":"https://github.com/alphagov/multicloud-deploy/pull/17#issuecomment-107494640","issue_url":"https://api.github.com/repos/alphagov/multicloud-deploy/issues/17","id":107494640,"user":{"login":"dcarley","id":260438,"avatar_url":"https://avatars.githubusercontent.com/u/260438?v=3","gravatar_id":"","url":"https://api.github.com/users/dcarley","html_url":"https://github.com/dcarley","followers_url":"https://api.github.com/users/dcarley/followers","following_url":"https://api.github.com/users/dcarley/following{/other_user}","gists_url":"https://api.github.com/users/dcarley/gists{/gist_id}","starred_url":"https://api.github.com/users/dcarley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcarley/subscriptions","organizations_url":"https://api.github.com/users/dcarley/orgs","repos_url":"https://api.github.com/users/dcarley/repos","events_url":"https://api.github.com/users/dcarley/events{/privacy}","received_events_url":"https://api.github.com/users/dcarley/received_events","type":"User","site_admin":false},"created_at":"2015-06-01T13:56:38Z","updated_at":"2015-06-01T13:56:38Z","body":"Thanks :+1: "}}