Merge pull request #415 from github/enterprise-3.6-backport-331-add-encrypted-column-keys
Backport 331 for 3.6: Add encrypted column encryption keys to backup utils
This commit is contained in:
Devin Dooley
GitHub
Коммит
5824660688
|
|
@ -76,6 +76,15 @@ backup-secret() {
|
|||
|
||||
backup-secret "management console password" "manage-password" "secrets.manage"
|
||||
backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
|
||||
backup-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
|
||||
backup-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
|
||||
backup-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
|
||||
backup-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
|
||||
|
||||
# Backup argon secrets for multiuser from ghes version 3.8 onwards
|
||||
if [[ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" && "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.2)" ]]; then
|
||||
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
|
||||
fi
|
||||
|
||||
# Backup external MySQL password if running external MySQL DB.
|
||||
if is_service_external 'mysql'; then
|
||||
|
|
|
|||
|
|
@ -44,6 +44,21 @@ ghe-restore-packages "$GHE_HOSTNAME" 1>&3
|
|||
# Restore management console password hash if present.
|
||||
restore-secret "management console password" "manage-password" "secrets.manage"
|
||||
|
||||
# Restore management console argon2 secret if present.
|
||||
restore-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
|
||||
|
||||
# Restore kredz.credz HMAC key if present.
|
||||
restore-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
|
||||
|
||||
# Restore kredz.varz HMAC key if present.
|
||||
restore-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
|
||||
|
||||
# Restore encrypted column encryption keying material if present
|
||||
restore-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
|
||||
|
||||
# Restore encrypted column current encryption key if present
|
||||
restore-secret "encrypted column current encryption key" "encrypted-column-current-encryption-key" "secrets.github.encrypted-column-current-encryption-key"
|
||||
|
||||
# Restore SAML keys if present.
|
||||
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then
|
||||
echo "Restoring SAML keys ..."
|
||||
|
|
|
|||
|
|
@ -470,6 +470,106 @@ begin_test "ghe-backup upgrades transaction backup to full if LSN chain break"
|
|||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-backup takes backup of Kredz settings"
|
||||
(
|
||||
set -e
|
||||
|
||||
required_secrets=(
|
||||
"secrets.kredz.credz-hmac-secret"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
|
||||
done
|
||||
|
||||
ghe-backup
|
||||
|
||||
required_files=(
|
||||
"kredz-credz-hmac"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
|
||||
done
|
||||
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-backup takes backup of kredz-varz settings"
|
||||
(
|
||||
set -e
|
||||
|
||||
required_secrets=(
|
||||
"secrets.kredz.varz-hmac-secret"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
|
||||
done
|
||||
|
||||
ghe-backup
|
||||
|
||||
required_files=(
|
||||
"kredz-varz-hmac"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
|
||||
done
|
||||
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-backup takes backup of encrypted column encryption keying material"
|
||||
(
|
||||
set -e
|
||||
|
||||
required_secrets=(
|
||||
"secrets.github.encrypted-column-keying-material"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
|
||||
done
|
||||
|
||||
ghe-backup
|
||||
|
||||
required_files=(
|
||||
"encrypted-column-encryption-keying-material"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
|
||||
done
|
||||
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-backup takes backup of encrypted column current encryption key"
|
||||
(
|
||||
set -e
|
||||
|
||||
required_secrets=(
|
||||
"secrets.github.encrypted-column-current-encryption-key"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
|
||||
done
|
||||
|
||||
ghe-backup
|
||||
|
||||
required_files=(
|
||||
"encrypted-column-current-encryption-key"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
[ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
|
||||
done
|
||||
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-backup takes backup of Actions settings"
|
||||
(
|
||||
set -e
|
||||
|
|
|
|||
|
|
@ -55,7 +55,17 @@ begin_test "ghe-host-check detects unsupported GitHub Enterprise Server versions
|
|||
# shellcheck disable=SC2046 # Word splitting is required to populate the variables
|
||||
read -r bu_version_major bu_version_minor _ <<<$(ghe_parse_version $BACKUP_UTILS_VERSION)
|
||||
bu_major_minor="$bu_version_major.$bu_version_minor"
|
||||
releases=$(/usr/bin/curl -s https://github-enterprise.s3.amazonaws.com/release/latest.json)
|
||||
#releases=$(/usr/bin/curl -s https://github-enterprise.s3.amazonaws.com/release/latest.json)
|
||||
releases=$(cat <<EOF
|
||||
{
|
||||
"3.8": "3.8.3",
|
||||
"3.7": "3.7.10",
|
||||
"3.6": "3.6.13",
|
||||
"3.5": "3.5.17",
|
||||
"3.4": "3.4.3"
|
||||
}
|
||||
EOF
|
||||
)
|
||||
supported=$(echo $releases | jq -r 'select(."'${bu_major_minor}'")')
|
||||
# shellcheck disable=SC2207 # Command required as alternatives fail
|
||||
keys=($(echo $releases | jq -r 'keys[]'))
|
||||
|
|
|
|||
|
|
@ -281,6 +281,56 @@ begin_test "ghe-restore with no pages backup"
|
|||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-restore with encrypted column encryption keying material"
|
||||
(
|
||||
set -e
|
||||
rm -rf "$GHE_REMOTE_ROOT_DIR"
|
||||
setup_remote_metadata
|
||||
|
||||
required_files=(
|
||||
"encrypted-column-encryption-keying-material"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
echo "foo" > "$GHE_DATA_DIR/current/$file"
|
||||
done
|
||||
|
||||
ghe-restore -v -f localhost
|
||||
required_secrets=(
|
||||
"secrets.github.encrypted-column-keying-material"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
|
||||
done
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-restore with encrypted column current encryption key"
|
||||
(
|
||||
set -e
|
||||
rm -rf "$GHE_REMOTE_ROOT_DIR"
|
||||
setup_remote_metadata
|
||||
|
||||
required_files=(
|
||||
"encrypted-column-current-encryption-key"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
echo "foo" > "$GHE_DATA_DIR/current/$file"
|
||||
done
|
||||
|
||||
ghe-restore -v -f localhost
|
||||
required_secrets=(
|
||||
"secrets.github.encrypted-column-current-encryption-key"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
|
||||
done
|
||||
)
|
||||
end_test
|
||||
|
||||
# Setup Actions data for the subsequent tests
|
||||
setup_actions_test_data "$GHE_DATA_DIR/1"
|
||||
|
||||
|
|
@ -310,6 +360,58 @@ begin_test "ghe-restore invokes ghe-import-mssql"
|
|||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-restore with Kredz settings"
|
||||
(
|
||||
set -e
|
||||
rm -rf "$GHE_REMOTE_ROOT_DIR"
|
||||
setup_remote_metadata
|
||||
enable_actions
|
||||
|
||||
required_files=(
|
||||
"kredz-credz-hmac"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
echo "foo" > "$GHE_DATA_DIR/current/$file"
|
||||
done
|
||||
|
||||
ghe-restore -v -f localhost
|
||||
required_secrets=(
|
||||
"secrets.kredz.credz-hmac-secret"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
|
||||
done
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-restore with kredz-varz settings"
|
||||
(
|
||||
set -e
|
||||
rm -rf "$GHE_REMOTE_ROOT_DIR"
|
||||
setup_remote_metadata
|
||||
enable_actions
|
||||
|
||||
required_files=(
|
||||
"kredz-varz-hmac"
|
||||
)
|
||||
|
||||
for file in "${required_files[@]}"; do
|
||||
echo "foo" > "$GHE_DATA_DIR/current/$file"
|
||||
done
|
||||
|
||||
ghe-restore -v -f localhost
|
||||
required_secrets=(
|
||||
"secrets.kredz.varz-hmac-secret"
|
||||
)
|
||||
|
||||
for secret in "${required_secrets[@]}"; do
|
||||
[ "$(ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret")" = "foo" ]
|
||||
done
|
||||
)
|
||||
end_test
|
||||
|
||||
begin_test "ghe-restore with Actions settings"
|
||||
(
|
||||
set -e
|
||||
|
|
|
|||
|
|
@ -19,6 +19,7 @@
|
|||
#
|
||||
# Copyright (c) 2011-14 by Ryan Tomayko <http://tomayko.com>
|
||||
# License: MIT
|
||||
# shellcheck disable=SC2319
|
||||
set -e
|
||||
|
||||
# Setting basic paths
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче