Skip to content

Commit 60fdbf8

Browse files
chuckp22chuckp22
authored
Merge pull request #436 from github/enterprise-3.8-backport-351-backup-restore-secret-scanning-encryption-keys
Backport 351 for 3.8: Backup and restore secret scanning encrypted secrets encryption keys
2 parents 58e1a8b + 37afc17 commit 60fdbf8

File tree

6 files changed

+151
-0
lines changed

6 files changed

+151
-0
lines changed

‎bin/ghe-restore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,12 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
386386
fi
387387
ghe-restore-column-encryption-keys "$GHE_HOSTNAME"
388388

389+
# Always restore secret scanning encryption keys
390+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
391+
log_info "Always restore secret scanning encryption keys on GHES verions 3.8.0+"
392+
ghe-restore-secret-scanning-encryption-keys "$GHE_HOSTNAME"
393+
fi
394+
389395
# Make sure mysql and elasticsearch are prep'd and running before restoring.
390396
# These services will not have been started on appliances that have not been
391397
# configured yet.

‎share/github-backup-utils/ghe-backup-settings

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,11 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
8686
cat "$GHE_SNAPSHOT_DIR/encrypted-column-encryption-keying-material" | sed 's:.*;::' > "$GHE_SNAPSHOT_DIR/encrypted-column-current-encryption-key"
8787
fi
8888

89+
backup-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
90+
backup-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
91+
backup-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
92+
backup-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
93+
8994
# Backup argon secrets for multiuser from ghes version 3.8 onwards
9095
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
9196
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"

‎share/github-backup-utils/ghe-restore-secret-scanning-encryption-keys

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-restore-secret-scanning-encryption-keys <host>
3+
#/ Restore the secret scanning encryption keys from a snapshot to the given <host>.
4+
#/ This script will be run automatically by `ghe-restore`
5+
set -e
6+
7+
# Bring in the backup configuration
8+
# shellcheck source=share/github-backup-utils/ghe-backup-config
9+
. "$(dirname "${BASH_SOURCE[0]}")/ghe-backup-config"
10+
11+
# Show usage and bail with no arguments
12+
[ -z "$*" ] && print_usage
13+
14+
bm_start "$(basename $0)"
15+
16+
# Grab host arg
17+
GHE_HOSTNAME="$1"
18+
19+
# Perform a host-check and establish GHE_REMOTE_XXX variables.
20+
ghe_remote_version_required "$GHE_HOSTNAME"
21+
22+
# The snapshot to restore should be set by the ghe-restore command but this lets
23+
# us run this script directly.
24+
: ${GHE_RESTORE_SNAPSHOT:=current}
25+
26+
# Path to snapshot dir we're restoring from
27+
: ${GHE_RESTORE_SNAPSHOT_PATH:="$GHE_DATA_DIR/current"}
28+
29+
# Restore secret scanning encrypted secrets storage keys if present
30+
log_info "Restoring secret scanning encrypted secrets storage keys"
31+
restore-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
32+
restore-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
33+
34+
# Restore secret scanning encrypted secrets transit keys if present
35+
log_info "Restoring secret scanning encrypted secrets transit keys"
36+
restore-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
37+
restore-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
38+
39+
bm_end "$(basename $0)"

‎share/github-backup-utils/ghe-restore-settings

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hm
5353
# Restore kredz.varz HMAC key if present.
5454
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
5555

56+
# Restore encrypted column encryption keying material if present
57+
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
58+
59+
# Restore encrypted column current encryption key if present
60+
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
61+
5662
# Restore SAML keys if present.
5763
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
5864
log_info "Restoring SAML keys ..."

‎test/test-ghe-backup.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -698,6 +698,36 @@ begin_test "ghe-backup takes backup of encrypted column encryption keying materi
698698
)
699699
end_test
700700

701+
begin_test "ghe-backup takes backup of secret scanning encrypted secrets encryption keys"
702+
(
703+
set -e
704+
705+
required_secrets=(
706+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
707+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
708+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
709+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
710+
)
711+
712+
for secret in "${required_secrets[@]}"; do
713+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
714+
done
715+
716+
ghe-backup
717+
718+
required_files=(
719+
"secret-scanning-encrypted-secrets-current-storage-key"
720+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
721+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
722+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
723+
)
724+
725+
for file in "${required_files[@]}"; do
726+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
727+
done
728+
)
729+
end_test
730+
701731
begin_test "ghe-backup takes backup of Actions settings"
702732
(
703733
set -e

‎test/test-ghe-restore.sh

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,71 @@ begin_test "ghe-restore with encrypted column current encryption key for version
389389
)
390390
end_test
391391

392+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions below 3.8.0"
393+
(
394+
set -e
395+
rm -rf "$GHE_REMOTE_ROOT_DIR"
396+
setup_remote_metadata
397+
398+
required_files=(
399+
"secret-scanning-encrypted-secrets-current-storage-key"
400+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
401+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
402+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
403+
)
404+
405+
for file in "${required_files[@]}"; do
406+
echo "foo" >"$GHE_DATA_DIR/current/$file"
407+
done
408+
409+
GHE_REMOTE_VERSION=3.7.0 ghe-restore -v -f localhost
410+
411+
required_secrets=(
412+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
413+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
414+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
415+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
416+
)
417+
418+
for secret in "${required_secrets[@]}"; do
419+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "" ] # expecting these to not be set for versions below 3.8.0
420+
done
421+
)
422+
end_test
423+
424+
425+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions 3.8.0+"
426+
(
427+
set -e
428+
rm -rf "$GHE_REMOTE_ROOT_DIR"
429+
setup_remote_metadata
430+
431+
required_files=(
432+
"secret-scanning-encrypted-secrets-current-storage-key"
433+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
434+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
435+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
436+
)
437+
438+
for file in "${required_files[@]}"; do
439+
echo "foo" >"$GHE_DATA_DIR/current/$file"
440+
done
441+
442+
GHE_REMOTE_VERSION=3.8.0 ghe-restore -v -f localhost
443+
444+
required_secrets=(
445+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
446+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
447+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
448+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
449+
)
450+
451+
for secret in "${required_secrets[@]}"; do
452+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ] # expecting this to have been restored successfully for versions 3.8.0+
453+
done
454+
)
455+
end_test
456+
392457
# Setup Actions data for the subsequent tests
393458
setup_actions_test_data "$GHE_DATA_DIR/1"
394459

0 commit comments

Comments
 (0)