stack_orchestrator/deploy/webapp/deploy_webapp_from_registry.py

@@ -21,6 +21,7 @@ import sys
 import tempfile
 import time
 import uuid
+import yaml
 
 import click
 import gnupg
@@ -42,9 +43,6 @@ from stack_orchestrator.deploy.webapp.util import (
     skip_by_tag,
     confirm_payment,
 )
-from stack_orchestrator.util import get_yaml
-
-yaml = get_yaml()
 
 
 def process_app_deployment_request(
@@ -62,6 +60,7 @@ def process_app_deployment_request(
     recreate_on_deploy,
     deployer_record,
     gpg,
+    private_key_passphrase,
     config_upload_dir,
     logger,
 ):
@@ -121,8 +120,8 @@ def process_app_deployment_request(
                 f"{config_upload_dir}/{app_deployment_request.attributes.config.ref}",
                 "rb",
             ) as file:
-                decrypted = gpg.decrypt_file(file)
-                parsed = AttrDict(yaml.load(decrypted))
+                decrypted = gpg.decrypt_file(file, passphrase=private_key_passphrase)
+                parsed = AttrDict(yaml.safe_load(decrypted))
                 if "env" in parsed.config:
                     env.update(parsed.config.env)
 
@@ -354,6 +353,12 @@ def dump_known_requests(filename, requests, status="SEEN"):
 @click.option(
     "--private-key-file", help="The private key for decrypting config.", required=True
 )
+@click.option(
+    "--private-key-passphrase",
+    help="The passphrase for the private key.",
+    required=True,
+)
+@click.pass_context
 @click.pass_context
 def command(  # noqa: C901
     ctx,
@@ -379,6 +384,7 @@ def command(  # noqa: C901
     lrn,
     config_upload_dir,
     private_key_file,
+    private_key_passphrase,
     all_requests,
 ):
     if request_id and discover:
@@ -627,6 +633,7 @@ def command(  # noqa: C901
                         recreate_on_deploy,
                         deployer_record,
                         gpg,
+                        private_key_passphrase,
                         config_upload_dir,
                         build_logger,
                     )