cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.32k stars 128 forks source link

Extend acra-keys export/import subcommand #629

Closed Zhaars closed 1 year ago

Zhaars commented 1 year ago

What has been done in this PR?

Currently, acra-keys export/import command supports keys from V2 keystore only, the idea was to add support for V1 keystore as well under one tool. But we have different utility that has similar functionality for backup keys of V1 keystore - acra-backup. As the result acra-backup functionality was merged under acra-keys export/import

Technically, there were introduced new interfaces keystore.Exporter for export subcommand and keystore.Importer for import subcommand. Corresponded _Backupers were implemented for keystores V1 and V2.

The important thing, is that acra-keys export interface was the following - it could be possible to export all keys from keystore via --all flags or export some special key by specifying exportID in the format like (client/client_test/storage) - which represent a relative path to the key in the keystore. Since all our subcommands inside acra-keys tool operate with a generic key definition (e.g poison-record, client/{some_client}/symmetric, etc) the same functionality was added for acra-keys export too, but specifying key as path was saved for backward compatibility reasons.

Checklist