Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 10.12.0
-
Fix Version/s: 11.0.0
-
Component/s: Chef Client, Knife
-
Labels:
Description
The EncryptedDataBagItem uses YAML to serialize values prior to encrypting them. Ruby 1.9 introduces multiple YAML implementations as engines. Using a different YAML engine on encryption and decryption can cause subtle errors in output values.
Chef should fixate one of the two YAML Engines in code to ensure the same engine is used when creating/uploading an encrypted data bag from file and within chef-client during a configuration run.
I've created a pull request on the opscode/chef repo to fix this issue:
https://github.com/opscode/chef/pull/378
I've also created a simple example data bag and a shell script to swap the YAML Engines showing the bug in action to help reproduce the issue, in the following gist:
https://gist.github.com/2564a3cc61702d3852e3
This bug resulted in un-parseable values being generated from our encrypted data bags, which store critical application secrets and ids.
Fixed in linked Pull Request.