update and fix implementation for eyaml

Author: mschuchard

CHANGELOG.md

@@ -2,6 +2,7 @@
 - Fix incorrect exit code `0` when `octocatalog` detects catalog compilation failure.
 - Avoid mutation of and optimize Rubocop argument interfacing.
 - Fix existing module install check when using Puppet Forge source for RSpec.
+- Upgrade EYAML validation functionality from beta to release candidate.
 
 ### 2.5.1
 - Fix explicit `fail_on_warnings` default value assignment.

lib/puppet-check/data_parser.rb

@@ -48,24 +48,8 @@ def self.eyaml(files, public, private)
       # load the file
       parsed = YAML.safe_load_file(file, permitted_classes: [Symbol], permitted_symbols: [], aliases: true)
 
-      # recursively decrypts ENC[PKCS7,...] leaf values in a parsed eyaml structure
-      decoded = case parsed
-      when Hash
-        # recurse into hash values and keys are never encrypted
-        parsed.transform_values { |v| decrypt_eyaml(v, rsa, x509) }
-      when Array
-        # recurse into array elements
-        parsed.map { |v| decrypt_eyaml(v, rsa, x509) }
-      when String
-        # leave plain (non-ENC) strings untouched
-        match = parsed.match(/\AENC\[PKCS7,(.+)\]\z/m)
-        return parsed unless match
-
-        # decode the base64 payload to DER and decrypt
-        OpenSSL::PKCS7.new(Base64.decode64(match[1])).decrypt(rsa, x509)
-      else
-        parsed
-      end
+      # decrypt any ENC[PKCS7,...] leaf values found in the parsed structure
+      decoded = decrypt_eyaml(parsed, rsa, x509)
     rescue StandardError => err
       PuppetCheck.files[:errors][file] = err.to_s.gsub("(#{file}): ", '').split("\n")
     else
@@ -79,6 +63,27 @@ def self.eyaml(files, public, private)
     end
   end
 
+  # recursively decrypts ENC[PKCS7,...] leaf values in a parsed eyaml structure
+  private_class_method def self.decrypt_eyaml(data, rsa, x509)
+    case data
+    when Hash
+      # recurse into hash values, keys are never encrypted
+      data.transform_values { |v| decrypt_eyaml(v, rsa, x509) }
+    when Array
+      # recurse into array elements
+      data.map { |v| decrypt_eyaml(v, rsa, x509) }
+    when String
+      # leave plain (non-ENC) strings untouched
+      match = data.match(/\AENC\[PKCS7,(.+)\]\z/m)
+      return data unless match
+
+      # decode the base64 payload to DER and decrypt
+      OpenSSL::PKCS7.new(Base64.decode64(match[1])).decrypt(rsa, x509)
+    else
+      data
+    end
+  end
+
   # metadata consts
   REQUIRED_KEYS = %w[name version author license summary source dependencies].freeze
   REQ_DEP_KEYS = %w[requirements dependencies].freeze