adding conditional check to save argon secrets only for ghes version >3.7.0

Author: Tony Truong

share/github-backup-utils/ghe-backup-settings

@@ -75,11 +75,15 @@ backup-secret() {
 }
 
 backup-secret "management console password" "manage-password" "secrets.manage"
-backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
 backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
 backup-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
 backup-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
 
+# Backup argon secrets for multiuser from ghes version 3.8 onwards
+if [ "$(version $GHE_REMOTE_VERSION)" -gt "$(version 3.7.0)" ]; then
+  backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
+fi
+
 # Backup external MySQL password if running external MySQL DB.
 if is_service_external 'mysql'; then
   backup-secret "external MySQL password" "external-mysql-password" "secrets.external.mysql"

test/test-ghe-backup.sh

@@ -132,17 +132,29 @@ begin_test "ghe-backup without password pepper"
 )
 end_test
 
-begin_test "ghe-backup without management console argon2 secret"
+begin_test "ghe-backup without management console argon2 secret for ghes lower than 3.8"
 (
   set -e
 
-  git config -f "$GHE_REMOTE_DATA_USER_DIR/common/secrets.conf" secrets.manage-auth.argon-secret ""
-  ghe-backup
+  git config -f "$GHE_REMOTE_DATA_USER_DIR/common/secrets.conf" secrets.manage-auth.argon-secret "fake pw"
+  GHE_REMOTE_VERSION=3.7.0 ghe-backup
 
   [ ! -f "$GHE_DATA_DIR/current/manage-argon-secret" ]
 )
 end_test
 
+# multiuser auth introduced in ghes version 3.8
+begin_test "ghe-backup management console argon2 secret"
+(
+  set -e
+
+  git config -f "$GHE_REMOTE_DATA_USER_DIR/common/secrets.conf" secrets.manage-auth.argon-secret "fake pw"
+  GHE_REMOTE_VERSION=3.8.0 ghe-backup
+
+  [ "$(cat "$GHE_DATA_DIR/current/manage-argon-secret")" = "fake pw" ]
+)
+end_test
+
 begin_test "ghe-backup empty git-hooks directory"
 (
   set -e

test/testlib.sh

@@ -448,7 +448,9 @@ verify_all_backedup_data() {
   [ "$(cat "$GHE_DATA_DIR/current/manage-password")" = "fake password hash data" ]
 
   # verify manage-argon-secret file was backed up
-  [ "$(cat "$GHE_DATA_DIR/current/manage-argon-secret")" = "fake argon2 secret" ]
+  if [ "$(version $GHE_REMOTE_VERSION)" -gt "$(version 3.7.0)" ]; then
+    [ "$(cat "$GHE_DATA_DIR/current/manage-argon-secret")" = "fake argon2 secret" ]
+  fi
 
   # verify password pepper file was backed up
   [ "$(cat "$GHE_DATA_DIR/current/password-pepper")" = "fake password pepper data" ]