Skip to content

Commit fe608ac

Browse files
RobertBolenderhubot
RobertBolender
authored and
hubot
committed
Merge pull request #351 from github/backup-restore-secret-scanning-encryption-keys
Backup and restore secret scanning encrypted secrets encryption keys
1 parent c216f2f commit fe608ac

File tree

6 files changed

+151
-0
lines changed

6 files changed

+151
-0
lines changed

‎bin/ghe-restore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,12 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
386386
fi
387387
ghe-restore-column-encryption-keys "$GHE_HOSTNAME"
388388

389+
# Always restore secret scanning encryption keys
390+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
391+
log_info "Always restore secret scanning encryption keys on GHES verions 3.8.0+"
392+
ghe-restore-secret-scanning-encryption-keys "$GHE_HOSTNAME"
393+
fi
394+
389395
# Make sure mysql and elasticsearch are prep'd and running before restoring.
390396
# These services will not have been started on appliances that have not been
391397
# configured yet.

‎share/github-backup-utils/ghe-backup-settings

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@ if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
8989
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
9090
fi
9191

92+
backup-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
93+
backup-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
94+
backup-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
95+
backup-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
96+
9297
# Backup argon secrets for multiuser from ghes version 3.8 onwards
9398
if ! [ "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.0)" ]; then
9499
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"

‎share/github-backup-utils/ghe-restore-secret-scanning-encryption-keys

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-restore-secret-scanning-encryption-keys <host>
3+
#/ Restore the secret scanning encryption keys from a snapshot to the given <host>.
4+
#/ This script will be run automatically by `ghe-restore`
5+
set -e
6+
7+
# Bring in the backup configuration
8+
# shellcheck source=share/github-backup-utils/ghe-backup-config
9+
. "$(dirname "${BASH_SOURCE[0]}")/ghe-backup-config"
10+
11+
# Show usage and bail with no arguments
12+
[ -z "$*" ] && print_usage
13+
14+
bm_start "$(basename $0)"
15+
16+
# Grab host arg
17+
GHE_HOSTNAME="$1"
18+
19+
# Perform a host-check and establish GHE_REMOTE_XXX variables.
20+
ghe_remote_version_required "$GHE_HOSTNAME"
21+
22+
# The snapshot to restore should be set by the ghe-restore command but this lets
23+
# us run this script directly.
24+
: ${GHE_RESTORE_SNAPSHOT:=current}
25+
26+
# Path to snapshot dir we're restoring from
27+
: ${GHE_RESTORE_SNAPSHOT_PATH:="$GHE_DATA_DIR/current"}
28+
29+
# Restore secret scanning encrypted secrets storage keys if present
30+
log_info "Restoring secret scanning encrypted secrets storage keys"
31+
restore-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
32+
restore-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
33+
34+
# Restore secret scanning encrypted secrets transit keys if present
35+
log_info "Restoring secret scanning encrypted secrets transit keys"
36+
restore-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
37+
restore-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
38+
39+
bm_end "$(basename $0)"

‎share/github-backup-utils/ghe-restore-settings

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hm
5353
# Restore kredz.varz HMAC key if present.
5454
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
5555

56+
# Restore encrypted column encryption keying material if present
57+
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
58+
59+
# Restore encrypted column current encryption key if present
60+
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
61+
5662
# Restore SAML keys if present.
5763
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
5864
log_info "Restoring SAML keys ..."

‎test/test-ghe-backup.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -651,6 +651,36 @@ begin_test "ghe-backup takes backup of encrypted column current encryption key f
651651
)
652652
end_test
653653

654+
begin_test "ghe-backup takes backup of secret scanning encrypted secrets encryption keys"
655+
(
656+
set -e
657+
658+
required_secrets=(
659+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
660+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
661+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
662+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
663+
)
664+
665+
for secret in "${required_secrets[@]}"; do
666+
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
667+
done
668+
669+
ghe-backup
670+
671+
required_files=(
672+
"secret-scanning-encrypted-secrets-current-storage-key"
673+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
674+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
675+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
676+
)
677+
678+
for file in "${required_files[@]}"; do
679+
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
680+
done
681+
)
682+
end_test
683+
654684
begin_test "ghe-backup takes backup of Actions settings"
655685
(
656686
set -e

‎test/test-ghe-restore.sh

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,71 @@ begin_test "ghe-restore with encrypted column current encryption key for version
389389
)
390390
end_test
391391

392+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions below 3.8.0"
393+
(
394+
set -e
395+
rm -rf "$GHE_REMOTE_ROOT_DIR"
396+
setup_remote_metadata
397+
398+
required_files=(
399+
"secret-scanning-encrypted-secrets-current-storage-key"
400+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
401+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
402+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
403+
)
404+
405+
for file in "${required_files[@]}"; do
406+
echo "foo" >"$GHE_DATA_DIR/current/$file"
407+
done
408+
409+
GHE_REMOTE_VERSION=3.7.0 ghe-restore -v -f localhost
410+
411+
required_secrets=(
412+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
413+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
414+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
415+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
416+
)
417+
418+
for secret in "${required_secrets[@]}"; do
419+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "" ] # expecting these to not be set for versions below 3.8.0
420+
done
421+
)
422+
end_test
423+
424+
425+
begin_test "ghe-restore with secret scanning encrypted secrets encryption keys for versions 3.8.0+"
426+
(
427+
set -e
428+
rm -rf "$GHE_REMOTE_ROOT_DIR"
429+
setup_remote_metadata
430+
431+
required_files=(
432+
"secret-scanning-encrypted-secrets-current-storage-key"
433+
"secret-scanning-encrypted-secrets-delimited-storage-keys"
434+
"secret-scanning-encrypted-secrets-current-shared-transit-key"
435+
"secret-scanning-encrypted-secrets-delimited-shared-transit-keys"
436+
)
437+
438+
for file in "${required_files[@]}"; do
439+
echo "foo" >"$GHE_DATA_DIR/current/$file"
440+
done
441+
442+
GHE_REMOTE_VERSION=3.8.0 ghe-restore -v -f localhost
443+
444+
required_secrets=(
445+
"secrets.secret-scanning.encrypted-secrets-current-storage-key"
446+
"secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
447+
"secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
448+
"secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
449+
)
450+
451+
for secret in "${required_secrets[@]}"; do
452+
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ] # expecting this to have been restored successfully for versions 3.8.0+
453+
done
454+
)
455+
end_test
456+
392457
# Setup Actions data for the subsequent tests
393458
setup_actions_test_data "$GHE_DATA_DIR/1"
394459

0 commit comments

Comments
 (0)