Error saved in secrets.yml.enc blocking decryption

[leopirolo]

Steps to reproduce

Saving an error of syntax in rails secrets:edit leads to block the file forever.

Example:

login: *login # Here is the syntax error
  username: 'me@myself.andi'
  password: '1234'

development:
  <<: *login

Expected behavior

While running rails secrets:edit again, open the file without error

Actual behavior

/Users/leo/.rvm/rubies/ruby-2.4.1/lib/ruby/2.4.0/psych.rb:377:in 'parse': (<unknown>): did not find expected key while parsing a block mapping at line 2 column 1 (Psych::SyntaxError)

System configuration

Rails version:
5.1.2
Ruby version:
2.4.1p111 (2017-03-22 revision 58053) [x86_64-darwin16]

(Not sure if the issue is already reported, if so, my bad, I must have missed it)

[meinac]

I see this is an annoying issue. As a workaround you can set config.read_encrypted_secrets to false. By setting this configuration to false you say Rails to not try to read encrypted yml files as a result of this you will be able to open the file and edit the content. The fix for this can be capturing errors only on development environment and giving warning instead of raising exception.

[rails-bot]

This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails team are limited, and so we are asking for your help.
If you can still reproduce this error on the 5-1-stable branch or on master, please reply with all of the information you have about it in order to keep the issue open.
Thank you for all your contributions.

[nijeesh4all]

Am still having the issue

D029:assignment-5 nijeesh$ EDITOR="mate --wait" rails credentials:edit
/Users/nijeesh/.rvm/rubies/ruby-2.4.4/lib/ruby/2.4.0/psych.rb:377:in `parse': (/Users/nijeesh/assignment-5/config/credentials.yml.enc): found character that cannot start any token while scanning for the next token at line 8 column 1 (Psych::SyntaxError)
        from /Users/nijeesh/.rvm/rubies/ruby-2.4.4/lib/ruby/2.4.0/psych.rb:377:in `parse_stream'
        from /Users/nijeesh/.rvm/rubies/ruby-2.4.4/lib/ruby/2.4.0/psych.rb:325:in `parse'
        from /Users/nijeesh/.rvm/rubies/ruby-2.4.4/lib/ruby/2.4.0/psych.rb:252:in `load'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/activesupport-5.2.0/lib/active_support/encrypted_configuration.rb:46:in `deserialize'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/activesupport-5.2.0/lib/active_support/encrypted_configuration.rb:27:in `write'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/activesupport-5.2.0/lib/active_support/encrypted_file.rb:68:in `writing'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/activesupport-5.2.0/lib/active_support/encrypted_file.rb:54:in `change'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/commands/credentials/credentials_command.rb:50:in `change_credentials_in_system_editor'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/commands/credentials/credentials_command.rb:27:in `block in edit'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/command/helpers/editor.rb:26:in `catch_editing_exceptions'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/commands/credentials/credentials_command.rb:26:in `edit'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/thor-0.20.0/lib/thor/command.rb:27:in `run'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/thor-0.20.0/lib/thor/invocation.rb:126:in `invoke_command'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/thor-0.20.0/lib/thor.rb:387:in `dispatch'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/command/base.rb:65:in `perform'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/command.rb:46:in `invoke'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/railties-5.2.0/lib/rails/commands.rb:18:in `<top (required)>'
        from /Users/nijeesh/assignment-5/bin/rails:9:in `require'
        from /Users/nijeesh/assignment-5/bin/rails:9:in `<top (required)>'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/client/rails.rb:28:in `load'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/client/rails.rb:28:in `call'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/client/command.rb:7:in `call'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/client.rb:30:in `run'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/bin/spring:49:in `<top (required)>'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/binstub.rb:31:in `load'
        from /Users/nijeesh/.rvm/gems/ruby-2.4.4/gems/spring-2.0.2/lib/spring/binstub.rb:31:in `<top (required)>'
        from /Users/nijeesh/assignment-5/bin/spring:15:in `require'
        from /Users/nijeesh/assignment-5/bin/spring:15:in `<top (required)>'
        from bin/rails:3:in `load'
        from bin/rails:3:in `<main>'
D029:assignment-5 nijeesh$ 

ruby '2.4.4'
'rails' 5.2.0'

[kaspth]

@nijeesh4all hey, sorry you're hitting that.

I can't reproduce in a test app. We block introducing syntax errors:

$ EDITOR="atom --wait" r credentials:edit
Traceback (most recent call last):
	19: from bin/rails:4:in `<main>'
	18: from bin/rails:4:in `require'
	17: from /Users/kasperhansen/code/rails/railties/lib/rails/commands.rb:18:in `<top (required)>'
	16: from /Users/kasperhansen/code/rails/railties/lib/rails/command.rb:46:in `invoke'
	15: from /Users/kasperhansen/code/rails/railties/lib/rails/command/base.rb:65:in `perform'
	14: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/gems/2.5.0/gems/thor-0.20.0/lib/thor.rb:387:in `dispatch'
	13: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/gems/2.5.0/gems/thor-0.20.0/lib/thor/invocation.rb:126:in `invoke_command'
	12: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/gems/2.5.0/gems/thor-0.20.0/lib/thor/command.rb:27:in `run'
	11: from /Users/kasperhansen/code/rails/railties/lib/rails/commands/credentials/credentials_command.rb:26:in `edit'
	10: from /Users/kasperhansen/code/rails/railties/lib/rails/command/helpers/editor.rb:26:in `catch_editing_exceptions'
	 9: from /Users/kasperhansen/code/rails/railties/lib/rails/commands/credentials/credentials_command.rb:27:in `block in edit'
	 8: from /Users/kasperhansen/code/rails/railties/lib/rails/commands/credentials/credentials_command.rb:50:in `change_credentials_in_system_editor'
	 7: from /Users/kasperhansen/code/rails/activesupport/lib/active_support/encrypted_file.rb:54:in `change'
	 6: from /Users/kasperhansen/code/rails/activesupport/lib/active_support/encrypted_file.rb:68:in `writing'
	 5: from /Users/kasperhansen/code/rails/activesupport/lib/active_support/encrypted_configuration.rb:27:in `write'
	 4: from /Users/kasperhansen/code/rails/activesupport/lib/active_support/encrypted_configuration.rb:42:in `deserialize'
	 3: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/2.5.0/psych.rb:263:in `load'
	 2: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/2.5.0/psych.rb:350:in `parse'
	 1: from /Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/2.5.0/psych.rb:402:in `parse_stream'
/Users/kasperhansen/.rbenv/versions/2.5.0/lib/ruby/2.5.0/psych.rb:402:in `parse': (/Users/kasperhansen/code/encsec/config/credentials.yml.enc): mapping values are not allowed in this context at line 7 column 5 (Psych::SyntaxError)

Can rails credentials:show at least output your credentials, so there's a chance to fix your issue that way?

Oh, man, this is really annoying... I have a syntax error and now I can't access my keys anymore, since I did not store them anywhere else for security reasons... No suggestion from this topic worked for me. Anything new I can try?

[rnickmccandless]

Same issue here, I added a complex password as a value that the YAML parser didn't seem to like. I was able to save the credentials file without error, but now I'm not able to reopen it anymore.

Error when rails credentials:edit & rails credentials:show:

`parse': (<unknown>): found character that cannot start any token while scanning for the next token at line 43 column 13 (Psych::SyntaxError)

Setting config.read_encrypted_secrets = false doesn't seem to have an impact.

Rails 5.2.3, Ruby 2.6.2

[rnickmccandless]

I figured out my issue and hope that this may help someone with similar circumstances.

It wasn't an issue with the secrets, it was an issue with one of my configs injecting the secret value. I have some YAML configs injecting values from the secrets:

Sample API config:

test:
  api_key: <%= SecureRandom.alphanumeric(44) %>
  account_id: <%= SecureRandom.alphanumeric(32) %>

development:
  api_key: <%= ENV.fetch('SOME_PRIVATE_KEY', nil) %>
  account_id: some_val

staging:
  api_key: <%= Rails.application.credentials.some_private_key %>
  account_id: some_val

production:
  api_key: <%= Rails.application.credentials.some_private_key %>
  account_id: some_prod_val

As you can see, I wasn't quoting the values that were rendering from the secrets, even though the secrets were quoted too. The error message displayed wasn't very helpful to troubleshoot the issue.

Quoting the injected value fixed the issue:

production:
  api_key: '<%= Rails.application.credentials.some_private_key %>'