Move v2_key to v2_key.dev, force developers to generate or copy it.

We currently have v2_key checked in as a developer key.
We have appliances generate a new v2_key on first boot, overwriting the original.
This causes the appliances to have a dirty git status.

They are two different things, so make them a developer key and the normal one.
Developers will have to copy their v2_key.dev to v2_key initially.

Alternative to ManageIQ#4082

.gitignore

@@ -18,6 +18,7 @@
 /vmdb/
 BUILD
 ca/root
+certs/v2_key
 coverage/
 Gemfile.dev.rb
 Gemfile.lock*
@@ -165,4 +166,4 @@ spa_ui/self_service/reports
 public/self_service
 
 ### .gitignore overrides ###
-!spa_ui/self_service/**/region
+!spa_ui/self_service/**/region

.travis.yml

@@ -23,6 +23,7 @@ before_install:
 - "echo 'gem: --no-ri --no-rdoc --no-document' > ~/.gemrc"
 - "[[ -n \"$GEM\" ]] || echo \"1\" > REGION"
 - "[[ -n \"$GEM\" ]] || cp config/database.pg.yml config/database.yml"
+- "[[ -n \"$GEM\" ]] || cp certs/v2_key.dev certs/v2_key"
 - "[[ -n \"$GEM\" ]] || psql -c \"CREATE USER root SUPERUSER PASSWORD 'smartvm';\" -U postgres"
 - "[[ -z \"$GEM\" ]] || cd gems/$GEM"
 - "export BUNDLE_WITHOUT=qpid"

gems/pending/spec/util/miq-password_spec.rb

@@ -246,6 +246,7 @@
 
       expect(MiqPassword.v0_key).to be_nil
       expect(MiqPassword.v1_key).to be_nil
+      expect(Kernel).to receive(:warn).with(/v2_key doesn't exist/)
       expect(MiqPassword.v2_key).to be_false
     end
 
@@ -263,6 +264,18 @@
     end
   end
 
+  context ".v2_key" do
+    it "when missing" do
+      MiqPassword.key_root = "."
+      expect(Kernel).to receive(:warn).with(/v2_key doesn't exist/)
+      expect(MiqPassword.v2_key).to be_false
+    end
+
+    it "when present" do
+      expect(MiqPassword.v2_key.to_s).to eq "5ysYUd3Qrjj7DDplmEJHmnrFBEPS887JwOQv0jFYq2g="
+    end
+  end
+
   def erberize(password, passmethod = "MiqPassword")
     "<%= #{passmethod}.decrypt(\"#{password}\") %>"
   end

gems/pending/util/miq-password.rb

@@ -123,7 +123,23 @@ def self.clear_keys
   end
 
   def self.v2_key
-    @v2_key ||= ez_load("#{key_root}/v2_key")
+    @v2_key ||= begin
+      key_file = File.expand_path("v2_key", key_root)
+      if File.exist?(key_file)
+        ez_load(key_file)
+      else
+        msg = <<-EOS
+#{key_file} doesn't exist!
+On an appliance, it should be generated on boot by evmserverd.
+
+If you're a developer, you can copy the #{key_file}.dev to #{key_file}.
+
+Caution, using the developer key will allow anyone with the public developer key to decrypt the two-way
+passwords in your database.
+EOS
+        Kernel.warn msg
+      end
+    end
   end
 
   def self.add_legacy_key(filename, type = :v1)