Skip to content

Commit a7d68bd

Browse files
KyFaStKyFaSt
authored
Merge pull request #349 from github/kyfast-always-restore-column-encryption-keys
Always restore column encryption keys
2 parents 5a94701 + 7f962bd commit a7d68bd

File tree

6 files changed

+178
-12
lines changed

6 files changed

+178
-12
lines changed

‎bin/ghe-restore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -437,6 +437,12 @@ if $RESTORE_SETTINGS; then
437437
ghe-restore-settings "$GHE_HOSTNAME"
438438
fi
439439

440+
# Always restore column encryption keys
441+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
442+
log_info "Always restore encrypted column encryption keys on GHES verions 3.7.0+"
443+
fi
444+
ghe-restore-column-encryption-keys "$GHE_HOSTNAME"
445+
440446
# Make sure mysql and elasticsearch are prep'd and running before restoring.
441447
# These services will not have been started on appliances that have not been
442448
# configured yet.

‎share/github-backup-utils/ghe-backup-settings

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,16 @@ backup-secret "management console password" "manage-password" "secrets.manage"
7878
backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
7979
backup-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
8080
backup-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
81-
backup-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
82-
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
81+
82+
# backup encryption keying material for GHES 3.7.0 onwards
83+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
84+
backup-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
85+
fi
86+
87+
# backup current encryption key for GHES 3.8.0 onwards
88+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
89+
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
90+
fi
8391

8492
# Backup argon secrets for multiuser from ghes version 3.8 onwards
8593
if [[ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" && "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.2)" ]]; then

‎share/github-backup-utils/ghe-restore-column-encryption-keys

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-restore-column-encryption-keys <host>
3+
#/ Restore the column encryption keys from a snapshot to the given <host>.
4+
#/ This script will be run automatically by `ghe-restore
5+
set -e
6+
7+
# Bring in the backup configuration
8+
# shellcheck source=share/github-backup-utils/ghe-backup-config
9+
. "$( dirname "${BASH_SOURCE[0]}" )/ghe-backup-config"
10+
11+
# Show usage and bail with no arguments
12+
[ -z "$*" ] && print_usage
13+
14+
bm_start "$(basename $0)"
15+
16+
# Grab host arg
17+
GHE_HOSTNAME="$1"
18+
19+
# Perform a host-check and establish GHE_REMOTE_XXX variables.
20+
ghe_remote_version_required "$GHE_HOSTNAME"
21+
22+
# The snapshot to restore should be set by the ghe-restore command but this lets
23+
# us run this script directly.
24+
: ${GHE_RESTORE_SNAPSHOT:=current}
25+
26+
# Path to snapshot dir we're restoring from
27+
: ${GHE_RESTORE_SNAPSHOT_PATH:="$GHE_DATA_DIR/current"}
28+
29+
# Restore encrypted column encryption keying material for GHES 3.7.0 onward
30+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
31+
log_info "Restoring encrypted column encryption keying material"
32+
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
33+
fi
34+
35+
# Restore encrypted column current encryption key for GHES 3.8.0 onwards
36+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
37+
log_info "Restoring encrypted column current encryption key"
38+
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
39+
fi
40+
41+
42+
bm_end "$(basename $0)"

‎share/github-backup-utils/ghe-restore-settings

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,6 @@ restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hm
5656
# Restore kredz.varz HMAC key if present.
5757
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
5858

59-
# Restore encrypted column encryption keying material if present
60-
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
61-
62-
# Restore encrypted column current encryption key if present
63-
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
64-
6559
# Restore SAML keys if present.
6660
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
6761
log_info "Restoring SAML keys ..."

‎test/test-ghe-backup.sh

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,18 @@ begin_test "ghe-backup takes backup of kredz-varz settings"
555555
)
556556
end_test
557557

558-
begin_test "ghe-backup takes backup of encrypted column encryption keying material"
558+
begin_test "ghe-backup does not take backup of encrypted column encryption keying material for versions below 3.7.0"
559+
(
560+
GHE_REMOTE_VERSION=2.1.10 ghe-backup -v | grep -q "encrypted column encryption keying material not set" && exit 1
561+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-keying-material" ]
562+
563+
GHE_REMOTE_VERSION=3.6.1 ghe-backup -v | grep -q "encrypted column encryption keying material not set" && exit 1
564+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-keying-material" ]
565+
566+
)
567+
end_test
568+
569+
begin_test "ghe-backup takes backup of encrypted column encryption keying material for versions 3.7.0+"
559570
(
560571
set -e
561572

@@ -567,6 +578,24 @@ begin_test "ghe-backup takes backup of encrypted column encryption keying materi
567578
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
568579
done
569580

581+
# GHES version 3.7.0
582+
GHE_REMOTE_VERSION=3.7.0
583+
export GHE_REMOTE_VERSION
584+
585+
ghe-backup
586+
587+
required_files=(
588+
"encrypted-column-encryption-keying-material"
589+
)
590+
591+
for file in "${required_files[@]}"; do
592+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
593+
done
594+
595+
# GHES version 3.8.0
596+
GHE_REMOTE_VERSION=3.8.0
597+
export GHE_REMOTE_VERSION
598+
570599
ghe-backup
571600

572601
required_files=(
@@ -580,7 +609,18 @@ begin_test "ghe-backup takes backup of encrypted column encryption keying materi
580609
)
581610
end_test
582611

583-
begin_test "ghe-backup takes backup of encrypted column current encryption key"
612+
begin_test "ghe-backup does not take backup of encrypted column current encryption key for versions below 3.8.0"
613+
(
614+
GHE_REMOTE_VERSION=2.1.10 ghe-backup -v | grep -q "encrypted column current encryption key not set" && exit 1
615+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-current-encryption-key" ]
616+
617+
GHE_REMOTE_VERSION=3.7.0 ghe-backup -v | grep -q "encrypted column current encryption key not set" && exit 1
618+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-current-encryption-key" ]
619+
620+
)
621+
end_test
622+
623+
begin_test "ghe-backup takes backup of encrypted column current encryption key for versions 3.8.0+"
584624
(
585625
set -e
586626

@@ -592,6 +632,24 @@ begin_test "ghe-backup takes backup of encrypted column current encryption key"
592632
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
593633
done
594634

635+
# GHES version 3.8.0
636+
GHE_REMOTE_VERSION=3.8.0
637+
export GHE_REMOTE_VERSION
638+
639+
ghe-backup
640+
641+
required_files=(
642+
"encrypted-column-current-encryption-key"
643+
)
644+
645+
for file in "${required_files[@]}"; do
646+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
647+
done
648+
649+
# GHES version 3.9.0
650+
GHE_REMOTE_VERSION=3.9.0
651+
export GHE_REMOTE_VERSION
652+
595653
ghe-backup
596654

597655
required_files=(

‎test/test-ghe-restore.sh

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,18 @@ begin_test "ghe-restore with no pages backup"
281281
)
282282
end_test
283283

284-
begin_test "ghe-restore with encrypted column encryption keying material"
284+
begin_test "ghe-restore does not restore encrypted column encryption keying material for versions below 3.7.0"
285+
(
286+
GHE_REMOTE_VERSION=2.1.10 ghe-restore -v -f localhost | grep -q "encrypted column encryption keying material not set" && exit 1
287+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-keying-material" ]
288+
289+
GHE_REMOTE_VERSION=3.6.1 ghe-restore -v -f localhost | grep -q "encrypted column encryption keying material not set" && exit 1
290+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-keying-material" ]
291+
292+
)
293+
end_test
294+
295+
begin_test "ghe-restore with encrypted column encryption keying material for versions 3.7.0+"
285296
(
286297
set -e
287298
rm -rf "$GHE_REMOTE_ROOT_DIR"
@@ -295,6 +306,23 @@ begin_test "ghe-restore with encrypted column encryption keying material"
295306
echo "foo" > "$GHE_DATA_DIR/current/$file"
296307
done
297308

309+
# GHES version 3.7.0
310+
GHE_REMOTE_VERSION=3.7.0
311+
export GHE_REMOTE_VERSION
312+
313+
ghe-restore -v -f localhost
314+
required_secrets=(
315+
"secrets.github.encrypted-column-keying-material"
316+
)
317+
318+
for secret in "${required_secrets[@]}"; do
319+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
320+
done
321+
322+
# GHES version 3.8.0
323+
GHE_REMOTE_VERSION=3.8.0
324+
export GHE_REMOTE_VERSION
325+
298326
ghe-restore -v -f localhost
299327
required_secrets=(
300328
"secrets.github.encrypted-column-keying-material"
@@ -306,7 +334,19 @@ begin_test "ghe-restore with encrypted column encryption keying material"
306334
)
307335
end_test
308336

309-
begin_test "ghe-restore with encrypted column current encryption key"
337+
338+
begin_test "ghe-restore does not encrypted column current encryption key for versions below 3.8.0"
339+
(
340+
GHE_REMOTE_VERSION=2.1.10 restore -v -f | grep -q "encrypted column current encryption key not set" && exit 1
341+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-current-encryption-key" ]
342+
343+
GHE_REMOTE_VERSION=3.7.0 restore -v -f | grep -q "encrypted column current encryption key not set" && exit 1
344+
[ ! -f "$GHE_DATA_DIR/current/encrypted-column-current-encryption-key" ]
345+
346+
)
347+
end_test
348+
349+
begin_test "ghe-restore with encrypted column current encryption key for versions 3.8.0+"
310350
(
311351
set -e
312352
rm -rf "$GHE_REMOTE_ROOT_DIR"
@@ -320,6 +360,24 @@ begin_test "ghe-restore with encrypted column current encryption key"
320360
echo "foo" > "$GHE_DATA_DIR/current/$file"
321361
done
322362

363+
# GHES version 3.8.0
364+
GHE_REMOTE_VERSION=3.8.0
365+
export GHE_REMOTE_VERSION
366+
367+
ghe-restore -v -f localhost
368+
required_secrets=(
369+
"secrets.github.encrypted-column-current-encryption-key"
370+
)
371+
372+
for secret in "${required_secrets[@]}"; do
373+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
374+
done
375+
376+
377+
# GHES version 3.9.0
378+
GHE_REMOTE_VERSION=3.9.0
379+
export GHE_REMOTE_VERSION
380+
323381
ghe-restore -v -f localhost
324382
required_secrets=(
325383
"secrets.github.encrypted-column-current-encryption-key"

0 commit comments

Comments
 (0)