Skip to content

Commit f532b2e

Browse files
dooleydevindooleydevin
authored
Merge pull request #416 from github/enterprise-3.7-backport-331-add-encrypted-column-keys
Backport 331 for 3.7: Add encrypted column encryption keys to backup utils
2 parents 1eecca5 + f3fa5ad commit f532b2e

File tree

5 files changed

+227
-0
lines changed

5 files changed

+227
-0
lines changed

‎share/github-backup-utils/ghe-backup-settings

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,15 @@ backup-secret() {
7676

7777
backup-secret "management console password" "manage-password" "secrets.manage"
7878
backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
79+
backup-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
80+
backup-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
81+
backup-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
82+
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
83+
84+
# Backup argon secrets for multiuser from ghes version 3.8 onwards
85+
if [[ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" && "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.2)" ]]; then
86+
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
87+
fi
7988

8089
# Backup external MySQL password if running external MySQL DB.
8190
if is_service_external 'mysql'; then

‎share/github-backup-utils/ghe-restore-settings

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,21 @@ ghe-restore-packages "$GHE_HOSTNAME" 1>&3
4444
# Restore management console password hash if present.
4545
restore-secret "management console password" "manage-password" "secrets.manage"
4646

47+
# Restore management console argon2 secret if present.
48+
restore-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
49+
50+
# Restore kredz.credz HMAC key if present.
51+
restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
52+
53+
# Restore kredz.varz HMAC key if present.
54+
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
55+
56+
# Restore encrypted column encryption keying material if present
57+
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
58+
59+
# Restore encrypted column current encryption key if present
60+
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
61+
4762
# Restore SAML keys if present.
4863
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
4964
echo "Restoring SAML keys ..."

‎test/test-ghe-backup.sh

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,106 @@ begin_test "ghe-backup upgrades transaction backup to full if LSN chain break"
470470
)
471471
end_test
472472

473+
begin_test "ghe-backup takes backup of Kredz settings"
474+
(
475+
set -e
476+
477+
required_secrets=(
478+
"secrets.kredz.credz-hmac-secret"
479+
)
480+
481+
for secret in "${required_secrets[@]}"; do
482+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
483+
done
484+
485+
ghe-backup
486+
487+
required_files=(
488+
"kredz-credz-hmac"
489+
)
490+
491+
for file in "${required_files[@]}"; do
492+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
493+
done
494+
495+
)
496+
end_test
497+
498+
begin_test "ghe-backup takes backup of kredz-varz settings"
499+
(
500+
set -e
501+
502+
required_secrets=(
503+
"secrets.kredz.varz-hmac-secret"
504+
)
505+
506+
for secret in "${required_secrets[@]}"; do
507+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
508+
done
509+
510+
ghe-backup
511+
512+
required_files=(
513+
"kredz-varz-hmac"
514+
)
515+
516+
for file in "${required_files[@]}"; do
517+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
518+
done
519+
520+
)
521+
end_test
522+
523+
begin_test "ghe-backup takes backup of encrypted column encryption keying material"
524+
(
525+
set -e
526+
527+
required_secrets=(
528+
"secrets.github.encrypted-column-keying-material"
529+
)
530+
531+
for secret in "${required_secrets[@]}"; do
532+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
533+
done
534+
535+
ghe-backup
536+
537+
required_files=(
538+
"encrypted-column-encryption-keying-material"
539+
)
540+
541+
for file in "${required_files[@]}"; do
542+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
543+
done
544+
545+
)
546+
end_test
547+
548+
begin_test "ghe-backup takes backup of encrypted column current encryption key"
549+
(
550+
set -e
551+
552+
required_secrets=(
553+
"secrets.github.encrypted-column-current-encryption-key"
554+
)
555+
556+
for secret in "${required_secrets[@]}"; do
557+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
558+
done
559+
560+
ghe-backup
561+
562+
required_files=(
563+
"encrypted-column-current-encryption-key"
564+
)
565+
566+
for file in "${required_files[@]}"; do
567+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
568+
done
569+
570+
)
571+
end_test
572+
473573
begin_test "ghe-backup takes backup of Actions settings"
474574
(
475575
set -e

‎test/test-ghe-restore.sh

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,56 @@ begin_test "ghe-restore with no pages backup"
281281
)
282282
end_test
283283

284+
begin_test "ghe-restore with encrypted column encryption keying material"
285+
(
286+
set -e
287+
rm -rf "$GHE_REMOTE_ROOT_DIR"
288+
setup_remote_metadata
289+
290+
required_files=(
291+
"encrypted-column-encryption-keying-material"
292+
)
293+
294+
for file in "${required_files[@]}"; do
295+
echo "foo" > "$GHE_DATA_DIR/current/$file"
296+
done
297+
298+
ghe-restore -v -f localhost
299+
required_secrets=(
300+
"secrets.github.encrypted-column-keying-material"
301+
)
302+
303+
for secret in "${required_secrets[@]}"; do
304+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
305+
done
306+
)
307+
end_test
308+
309+
begin_test "ghe-restore with encrypted column current encryption key"
310+
(
311+
set -e
312+
rm -rf "$GHE_REMOTE_ROOT_DIR"
313+
setup_remote_metadata
314+
315+
required_files=(
316+
"encrypted-column-current-encryption-key"
317+
)
318+
319+
for file in "${required_files[@]}"; do
320+
echo "foo" > "$GHE_DATA_DIR/current/$file"
321+
done
322+
323+
ghe-restore -v -f localhost
324+
required_secrets=(
325+
"secrets.github.encrypted-column-current-encryption-key"
326+
)
327+
328+
for secret in "${required_secrets[@]}"; do
329+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
330+
done
331+
)
332+
end_test
333+
284334
# Setup Actions data for the subsequent tests
285335
setup_actions_test_data "$GHE_DATA_DIR/1"
286336

@@ -310,6 +360,58 @@ begin_test "ghe-restore invokes ghe-import-mssql"
310360
)
311361
end_test
312362

363+
begin_test "ghe-restore with Kredz settings"
364+
(
365+
set -e
366+
rm -rf "$GHE_REMOTE_ROOT_DIR"
367+
setup_remote_metadata
368+
enable_actions
369+
370+
required_files=(
371+
"kredz-credz-hmac"
372+
)
373+
374+
for file in "${required_files[@]}"; do
375+
echo "foo" > "$GHE_DATA_DIR/current/$file"
376+
done
377+
378+
ghe-restore -v -f localhost
379+
required_secrets=(
380+
"secrets.kredz.credz-hmac-secret"
381+
)
382+
383+
for secret in "${required_secrets[@]}"; do
384+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
385+
done
386+
)
387+
end_test
388+
389+
begin_test "ghe-restore with kredz-varz settings"
390+
(
391+
set -e
392+
rm -rf "$GHE_REMOTE_ROOT_DIR"
393+
setup_remote_metadata
394+
enable_actions
395+
396+
required_files=(
397+
"kredz-varz-hmac"
398+
)
399+
400+
for file in "${required_files[@]}"; do
401+
echo "foo" > "$GHE_DATA_DIR/current/$file"
402+
done
403+
404+
ghe-restore -v -f localhost
405+
required_secrets=(
406+
"secrets.kredz.varz-hmac-secret"
407+
)
408+
409+
for secret in "${required_secrets[@]}"; do
410+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
411+
done
412+
)
413+
end_test
414+
313415
begin_test "ghe-restore with Actions settings"
314416
(
315417
set -e

‎test/testlib.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#
2020
# Copyright (c) 2011-14 by Ryan Tomayko <http://tomayko.com>
2121
# License: MIT
22+
# shellcheck disable=SC2319
2223
set -e
2324

2425
# Setting basic paths

0 commit comments

Comments
 (0)