I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable:
I have a collection of chef recipes in git, defining labs e.g. a jenkins CI setup, which people will be able to fork and tailor to their own use
However, I can forsee circumstances when someone may want to add certain immutable sections of the cookbook, e.g. firewall settings
What strategy would make sense to lock certain sections of the file to validate that it hasn't been changed, while allowing arbitrary changes outside that
Ideally it would also solve the ability to obfuscate the sections if needed
Would I be adding my own DSL into the code - with a checksum for each protected block - pre-process it to unwrap and validate it before passing it to chef?
e.g. My first attempt at a format - still doesn't solve the problem of people just deleting all the signed sections - unless every file has to be signed
of course I might be thinking of this the whole wrong way around.
#---SIGNED-FILE SHA-256 507e74380188c07bad2fa66acb8cbbeeb63f84fcee5fd639499575654239cd49
#
# Cookbook Name:: jenkins
# Recipe:: default
#
# https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenkins+on+Ubuntu
# This is super-simple, compared to the other Chef cookbook I found
# for Jenkins (https://github.com/fnichol/chef-jenkins).
#
# This doesn't include Chef libraries for adding Jenkin's jobs via
# the command line, but it does get Jenkins up and running.
include_recipe "apt"
include_recipe "java"
#---SIGNED-SECTION-START SHA-256 e4d3d02f14ee2a6d815a91307c610c3e182979ce8fca92cef05e53ea9c90f5c7
apt_repository "jenkins" do
uri "http://pkg.jenkins-ci.org/debian"
key "http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key"
components ["binary/"]
action :add
end
#---SIGNED-SECTION-END
#---OBFUSCATED-SECTION-START SHA-256 5f536f2137dc7e2c5817de861d1329ead72b1e9d2dbb9dbe181ec7bc274dddeb
YXB0X3JlcG9zaXRvcnkgImplbmtpbnMiIGRvCiAgdXJpICJodHRwOi8vcGtnLmplbmtpbnMtY2kub3JnL2RlYmlhbiIKICBrZXkgImh0dHA6Ly9wa2cuamVua2lucy1jaS5vcmcvZGViaWFuL2plbmtpbnMtY2kub3JnLmtleSIKICBjb21wb25lbnRzIFsiYmluYXJ5LyJdCiAgYWN0aW9uIDphZGQKZW5k
#---OBFUSCATED-SECTION-END
package "jenkins"
service "jenkins" do
supports [:stop, :start, :restart]
action [:start, :enable]
end