feat: add thycotic/dsv-cli

[sheldonhull]

#6892 thycotic/dsv-cli: Delinea DevOps Secrets Vault is a cli tool for retrieval of secrets, cert generation, key/value retrieval, and general management of the DSV system from the cli.

Disclaimer: I recently transitioned to working on the team that builds this. I'm planning on publishing some homebrew, maybe snap and others publishing methods, but as I've adopted aqua this week in my own workflow (and also adding to public devcontainer setup!), I wanted to get this added to make folks lives easier who might use it for secrets. My contribution is mine alone as a dev, and not initiated or asked for the company.

aqua g -i thycotic/dsv-cli

How to confirm if this package works well

dsv --version

It's an interface to a backend system

Fully leveraging the tool as it's an interface for the cloud product can be done via a free account dsv. Note that the wording says trial, but it's a free tier product that's fully usable by an individual.

Sorta similar to running the hashi vault cli, which says:

The Vault CLI is a single static binary. It is a thin wrapper around the HTTP API. Every CLI command maps directly to the HTTP API internally. vault commands

Use Example

I'm going to do a write-up to publish soon on how to use in local development, but here's a brief example I just found a really nice use for. I don't expect the reviewer to do this, but capturing a use I just knocked out that helped me in home/work usage in removing more sensitive values from plaintext files.

I use direnv and have it hooked into zsh. I setup projects to source $HOME/.envrc so my secrets stay out of the projects in any way.

However, I also want to strip out secrets being in the $HOME/.envrc, but I still want to leverage many devops tools that are much easier to work with if GITHUB_TOKEN and other variables are setup (like Pulumi, gh cli, and even aqua).

So after fighting another cli that kept prompting every single terminal session and annoyed me, I setup a new dsv account for myself, and ran dsv init. I choose a long caching session since it's for me, and means I'll never worry about running out of free tier calls.

Before

export GH_TOKEN="plaintexttoken"
export GITHUB_TOKEN="plaintexttoken"
export AQUA_GITHUB_TOKEN="plaintexttoken"

After

export GH_TOKEN="$(dsv-cli secret read --path "core-services:tokens:github-pat:github-pat" --filter '.data.github-token' --plain --profile mycustomprofilename)" # uses jq expressions
export GITHUB_TOKEN=$GH_TOKEN
export AQUA_GITHUB_TOKEN=$GH_TOKEN

Since it's cached it's blazing fast (I don't even notice it anymore during load!) and I have a step further towards more secure local development practices.

Reference

• cli reference docs
• example github action integration I recently published

[suzuki-shunsuke]

Thank you for your contribution!

[suzuki-shunsuke]

Let me fix same as #6889 (comment) .

[sheldonhull]

@suzuki-shunsuke i can do it. You said to just re-run those commands to get it up to speed right?

[sheldonhull]

I didn't put this under thycotic/dsv because it's going to change repos in the next month. I set the name explicitly to dsv. Please let me know if I need to change something or got it wrong :-)

[suzuki-shunsuke]

@suzuki-shunsuke i can do it. You said to just re-run those commands to get it up to speed right?

Yes. But in case of this tool, we have to fix generated configuration manually.

$ rm -R pkgs/dsv
$ aqua-registry scaffold thycotic/dsv-cli # The command would fail. We have to fix the configuration
$ vim pkgs/thycotic/dsv-cli/registry.yaml # Fix manually

• Fix checksum configuration
• Fix command name with files

packages:
  - type: github_release
    repo_owner: thycotic
    repo_name: dsv-cli
    asset: dsv-{{.OS}}-{{.Arch}}
    format: raw
    replacements:
      amd64: x64
      windows: win
    supported_envs:
      - darwin
      - amd64
    files: # Added
      - name: dsv
    checksum:
      type: github_release
      asset: "{{.Asset}}-sha256.txt" # Fixed
      file_format: regexp
      algorithm: sha256
      pattern:
        checksum: "^(\\b[A-Fa-f0-9]{64}\\b)"
        file: "^\\b[A-Fa-f0-9]{64}\\b\\s+\\./(\\S+)$" # Fixed

[suzuki-shunsuke]

I didn't put this under thycotic/dsv because it's going to change repos in the next month. I set the name explicitly to dsv. Please let me know if I need to change something or got it wrong :-)

aqua supports renaming the package, so the package name should be thycotic/dsv.
After the repository will be renamed or transferred, let's add aliases.

e.g. #6674

https://aquaproj.github.io/docs/reference/registry-config/aliases

[sheldonhull]

@suzuki-shunsuke ok hopefully i got it right this time 👍🏻 cheers

[suzuki-shunsuke]

Suggested change

src: 'dsv-{{.OS}}-{{.Arch}}'

If the format is raw, files[].src isn't needed

https://aquaproj.github.io/docs/reference/registry-style-guide#if-the-format-is-raw-filessrc-isnt-needed

[sheldonhull]

Without that it comes up as dsv-cli. I need it to be dsv. The files section seemed to rename it correctly. Suggestion?

[suzuki-shunsuke]

You should specify only name.

files:
  - name: dsv

[suzuki-shunsuke]

https://github.com/aquaproj/aqua-registry/actions/runs/3208474025/jobs/5244366179

Please run aqua-registry gr to reflect the update of pkgs/**/registry.yaml to registry.yaml.

$ aqua-registry gr

[sheldonhull]

Working on it! Will have to pick up later and resolve it.

Would you be interested in a pre-commit hook config that would ensure aqua generate results in no changes before pushing? That can be added for contributors so it doesn't get missed if you'd like something.

[suzuki-shunsuke]

Would you be interested in a pre-commit hook config that would ensure aqua generate results in no changes before pushing? That can be added for contributors so it doesn't get missed if you'd like something.

It is good, but we don't want to add dependencies as much as possible.
For example, we don't want to add package.json for husky or something.
And we'd like to keep the setup simple.

[suzuki-shunsuke]

Oh, the format of checksum file is different.
We have to specify overrides.

dsv-linux-x64-sha256.txt

7d7222c0f979dd75d9b9c5290d7eec8e9373793714b2561fa3c98d2d51420f89  dsv-linux-x64

dsv-darwin-arm64-sha256.txt: ./ is added

13113ae749bcbbcff2f6c6a04f77c99283d7095b3dce9d456c1568e326f2f1f7  ./dsv-darwin-arm64

dsv-win-x64.exe-sha256.txt

BBFCD8B6B25E450EF92CAA56D915BB46016940006DB7A353DCAE86348D55D276

dsv-darwin-x64-sha256.txt

6ebba10da5cd2b4bed10f736f8b2941a1b652b26ff1f0783b7ebccfac8ebd400  ./dsv-darwin-x64

[suzuki-shunsuke]

#6892 (comment)

Fixed the checksum config. cd671d0

[suzuki-shunsuke]

Released. https://github.com/aquaproj/aqua-registry/releases/tag/v3.71.0

[sheldonhull]

Thank you 🙏
Much appreciated!