Skip to content

Commit a679144

Browse files
RobertBolenderRobertBolender
authored
Merge pull request #351 from github/backup-restore-secret-scanning-encryption-keys
Backup and restore secret scanning encrypted secrets encryption keys
2 parents 623b505 + a7077ef commit a679144

File tree

6 files changed

+151
-0
lines changed

6 files changed

+151
-0
lines changed

‎bin/ghe-restore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,12 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
443443
fi
444444
ghe-restore-column-encryption-keys "$GHE_HOSTNAME"
445445

446+
# Always restore secret scanning encryption keys
447+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
448+
log_info "Always restore secret scanning encryption keys on GHES verions 3.8.0+"
449+
ghe-restore-secret-scanning-encryption-keys "$GHE_HOSTNAME"
450+
fi
451+
446452
# Make sure mysql and elasticsearch are prep'd and running before restoring.
447453
# These services will not have been started on appliances that have not been
448454
# configured yet.

‎share/github-backup-utils/ghe-backup-settings

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
8989
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
9090
fi
9191

92+
backup-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
93+
backup-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
94+
backup-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
95+
backup-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
96+
9297
# Backup argon secrets for multiuser from ghes version 3.8 onwards
9398
if [[ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" && "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.2)" ]]; then
9499
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"

‎share/github-backup-utils/ghe-restore-secret-scanning-encryption-keys

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-restore-secret-scanning-encryption-keys <host>
3+
#/ Restore the secret scanning encryption keys from a snapshot to the given <host>.
4+
#/ This script will be run automatically by `ghe-restore`
5+
set -e
6+
7+
# Bring in the backup configuration
8+
# shellcheck source=share/github-backup-utils/ghe-backup-config
9+
. "$(dirname "${BASH_SOURCE[0]}")/ghe-backup-config"
10+
11+
# Show usage and bail with no arguments
12+
[ -z "$*" ] && print_usage
13+
14+
bm_start "$(basename $0)"
15+
16+
# Grab host arg
17+
GHE_HOSTNAME="$1"
18+
19+
# Perform a host-check and establish GHE_REMOTE_XXX variables.
20+
ghe_remote_version_required "$GHE_HOSTNAME"
21+
22+
# The snapshot to restore should be set by the ghe-restore command but this lets
23+
# us run this script directly.
24+
: ${GHE_RESTORE_SNAPSHOT:=current}
25+
26+
# Path to snapshot dir we're restoring from
27+
: ${GHE_RESTORE_SNAPSHOT_PATH:="$GHE_DATA_DIR/current"}
28+
29+
# Restore secret scanning encrypted secrets storage keys if present
30+
log_info "Restoring secret scanning encrypted secrets storage keys"
31+
restore-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
32+
restore-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
33+
34+
# Restore secret scanning encrypted secrets transit keys if present
35+
log_info "Restoring secret scanning encrypted secrets transit keys"
36+
restore-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
37+
restore-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
38+
39+
bm_end "$(basename $0)"

‎share/github-backup-utils/ghe-restore-settings

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hm
5656
# Restore kredz.varz HMAC key if present.
5757
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
5858

59+
# Restore encrypted column encryption keying material if present
60+
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
61+
62+
# Restore encrypted column current encryption key if present
63+
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
64+
5965
# Restore SAML keys if present.
6066
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
6167
log_info "Restoring SAML keys ..."

‎test/test-ghe-backup.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -663,6 +663,36 @@ begin_test "ghe-backup takes backup of encrypted column current encryption key f
663663
)
664664
end_test
665665

666+
begin_test "ghe-backup takes backup of secret scanning encrypted secrets encryption keys"
667+
(
668+
set -e
669+
670+
required_secrets=(
671+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
672+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
673+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
674+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
675+
)
676+
677+
for secret in "${required_secrets[@]}"; do
678+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
679+
done
680+
681+
ghe-backup
682+
683+
required_files=(
684+
"secret-scanning-encrypted-secrets-current-storage-key"
685+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
686+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
687+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
688+
)
689+
690+
for file in "${required_files[@]}"; do
691+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
692+
done
693+
)
694+
end_test
695+
666696
begin_test "ghe-backup takes backup of Actions settings"
667697
(
668698
set -e

‎test/test-ghe-restore.sh

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,71 @@ begin_test "ghe-restore with encrypted column current encryption key for version
389389
)
390390
end_test
391391

392+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions below 3.8.0"
393+
(
394+
set -e
395+
rm -rf "$GHE_REMOTE_ROOT_DIR"
396+
setup_remote_metadata
397+
398+
required_files=(
399+
"secret-scanning-encrypted-secrets-current-storage-key"
400+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
401+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
402+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
403+
)
404+
405+
for file in "${required_files[@]}"; do
406+
echo "foo" >"$GHE_DATA_DIR/current/$file"
407+
done
408+
409+
GHE_REMOTE_VERSION=3.7.0 ghe-restore -v -f localhost
410+
411+
required_secrets=(
412+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
413+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
414+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
415+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
416+
)
417+
418+
for secret in "${required_secrets[@]}"; do
419+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "" ] # expecting these to not be set for versions below 3.8.0
420+
done
421+
)
422+
end_test
423+
424+
425+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions 3.8.0+"
426+
(
427+
set -e
428+
rm -rf "$GHE_REMOTE_ROOT_DIR"
429+
setup_remote_metadata
430+
431+
required_files=(
432+
"secret-scanning-encrypted-secrets-current-storage-key"
433+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
434+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
435+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
436+
)
437+
438+
for file in "${required_files[@]}"; do
439+
echo "foo" >"$GHE_DATA_DIR/current/$file"
440+
done
441+
442+
GHE_REMOTE_VERSION=3.8.0 ghe-restore -v -f localhost
443+
444+
required_secrets=(
445+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
446+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
447+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
448+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
449+
)
450+
451+
for secret in "${required_secrets[@]}"; do
452+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ] # expecting this to have been restored successfully for versions 3.8.0+
453+
done
454+
)
455+
end_test
456+
392457
# Setup Actions data for the subsequent tests
393458
setup_actions_test_data "$GHE_DATA_DIR/1"
394459

0 commit comments

Comments
 (0)