owncloud
Run acceptance tests with masterkey and HSM
Owncloud talks to the hsmdaemon (golang daemon) via rest api which in turn talks to softhsm which is a HSM emulation. The "softhsm" package is available for every major distro. Concept and Setup documentation can be found here: https://doc.owncloud.com/server/admin_manual/configuration/server/security/hsmdaemon/
Note that if you follow the instructions above ownCloud will default to userkey encryption. So additionally the steps described here should be executed: https://doc.owncloud.com/server/admin_manual/configuration/files/encryption/master-key-encryption.html#enable-and-configure-master-key-based-encryption.
The tests don't need to run for each PR, it should be enough to trigger them on each release.
As the hsmdaemon is closed-source we could either provide the compiled binary to the CI pipeline or compile it during the run. This would require a golang environment.
The HSM docs implicit use user-key and then mention the change to master-key.
If you want to use a single master key run
occ encryption:select-encryption-type masterkey
If I remeber correctly, we want to "force" admins to use right from the start master-key encryption and we have a Deprecation Note for User-key Storage Encryption in the release notes of 10.7
Why not doing this from the beginning by promoting master-key and drop user-key description in HSM? Is there a particular issue behind that we do as we do now or could/should that be changed (from the docs pov)?
@jnweiger fyi
@IljaN @jnweiger do we want to try and do this?
If so, the first blocker that we have come to is the hsmdaemon - the docs say "After you have obtained the hsmdaemon from ownCloud, you need to..." - how can we get the hsmdaemon software?
@IljaN @jnweiger do we want to try and do this?
If so, the first blocker that we have come to is the
hsmdaemon- the docs say "After you have obtained the hsmdaemon from ownCloud, you need to..." - how can we get thehsmdaemonsoftware?
Blocked until we get the reply of this ^
We can probably use https://github.com/psmiraglia/docker-softhsm as a template. IIRC it is possible to automate the interactive token generation step from the ReadMe.
