Adopt "password-store" #53

[phillxnet]

Align with rockstor-core changes regarding 'pass' adoption for secrets storage. Install via OS provided 'password-store'. See partner draft PR: https://github.com/rockstor/rockstor-core/pull/2756/files

Includes

• Additional minimal setup of GNUPG & pass to enable %check scriptlet function as we need a running Django instance for our tests.
• BuildRequires 'password-store' OS package for 'pass': required for %check scriptlet.
• Requires 'password-store' OS package on all OS targets.
• Minor README.md typos.

Fixes #53

[phillxnet]

Testing

BuildRequires

error: Failed build dependencies:
	password-store is needed by rockstor-5.0.5-2756.x86_64

and once fulfilled we have:

%check scriptlet:

Executing(%check): /bin/sh -e /var/tmp/rpm-tmp.rqGtyu
+ umask 022
+ cd /home/buildbot/worker/Poetry-Build-on-Leap15-5/rpmbuild
+ cd rockstor-core-5.0.5-2756
+ export LANG=C.UTF-8
+ LANG=C.UTF-8
+ export PYTHONIOENCODING=utf8
+ PYTHONIOENCODING=utf8
+ /usr/local/bin/poetry install --no-interaction --no-ansi
+ /usr/bin/gpg --quick-generate-key --batch --passphrase '' rockstor@localhost
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key BEF5B29317E2F7A4 marked as ultimately trusted
gpg: directory '/root/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/root/.gnupg/openpgp-revocs.d/4B5AEAB87DA836A1D7273367BEF5B29317E2F7A4.rev'
+ /usr/bin/pass init rockstor@localhost
mkdir: created directory '/root/.password-store/'
Password store initialized for rockstor@localhost
+ /usr/bin/pass generate --no-symbols --force python-keyring/rockstor/SECRET_KEY 100
mkdir: created directory '/root/.password-store/python-keyring'
mkdir: created directory '/root/.password-store/python-keyring/rockstor'
The generated password for python-keyring/rockstor/SECRET_KEY is:
sE99gjqPh9Ft0Kgx8jaWHoAc1B7UXk3qyY05LfQRS4sCjoj2EAdPFiOxmZeokRyFOObKHqDjyOKS........
+ export DJANGO_SETTINGS_MODULE=settings
+ DJANGO_SETTINGS_MODULE=settings
+ /usr/local/bin/poetry run django-admin collectstatic --no-input --verbosity 1
Error: python-keyring/rockstor/SECRET_KEY_FALLBACK is not in the password store.
Error: python-keyring/rockstor/CLIENT_SECRET is not in the password store.
No SECRET_KEY_FALLBACK - rotated on reboot / rockstor services restart.
515 static files copied to '/home/buildbot/worker/Poetry-Build-on-Leap15-5/rpmbuild/rockstor-core-5.0.5-2756/static', 517 post-processed.
+ cd src/rockstor/
+ /usr/local/bin/poetry run django-admin test
Error: python-keyring/rockstor/SECRET_KEY_FALLBACK is not in the password store.
Error: python-keyring/rockstor/CLIENT_SECRET is not in the password store.
Creating test database for alias 'default'...
No SECRET_KEY_FALLBACK - rotated on reboot / rockstor services restart.
Found 278 test(s).
Creating test database for alias 'smart_manager'...
System check identified no issues (0 silenced).
......................................................................................................................................................................................................................................................................................
----------------------------------------------------------------------
Ran 278 tests in 31.606s
OK
Destroying test database for alias 'default'...
Destroying test database for alias 'smart_manager'...
+ exit 0

• Where we have the expected missing SECRET_KEY_FALLBACK and CLIENT_SECRET as we don't setup them up. But this is not a blocker for our collectstatic, where-as SECRET_KEY is not allowed to be none so we have to set that..
• We do have an exposed in rpmbuild log SECRET_KEY but in two reboots it will be replaced anyway and this in only on an rpmbuild host.

%posttrans scriptlet

Executed after install and where we run build.sh for initial setup:

Running post-transaction scripts [..
%posttrans(rockstor-5.0.5-2756.x86_64) script output:
...
gpg: A key for "rockstor@localhost" already exists
Password store initialized for rockstor@localhost
The generated password for python-keyring/rockstor/SECRET_KEY is:
h9iXrX7WJRPhrX4bQ47nj1wxgCiM3i3Ktpn5eRZSAtrLzcQ1KdwPFVZvyzhn7gtO.........
Error: python-keyring/rockstor/SECRET_KEY_FALLBACK is not in the password store.
Error: python-keyring/rockstor/CLIENT_SECRET is not in the password store.
No SECRET_KEY_FALLBACK - rotated on reboot / rockstor services restart.
...
515 static files copied to '/opt/rockstor/static', 517 post-processed.

ROCKSTOR BUILD SCRIPT COMPLETED
...
If installing from source, from scratch, for development; i.e. NOT via RPM:
Note GnuPG & password-store ExecStartPre steps in /opt/rockstor/conf/rockstor-pre.service
1. Run 'cd /opt/rockstor'.
2. Run 'systemctl start postgresql'.
3. Run 'export DJANGO_SETTINGS_MODULE=settings'.
4. Run 'export PASSWORD_STORE_DIR=/root/.password-store'.
5. Run 'poetry run initrock' as root (equivalent to rockstor-pre.service ExecStart).
6. Run 'systemctl enable --now rockstor-bootstrap'.
No config-backups-rpmsave directory found.
..done]

• We have build.sh reinstating unconditionally the required SECRET_KEY, just in case. %check had already done this but we are installing on the build host.
• We have a successful collectstatic.
• And our new somewhat redundant but good for developer awareness extended instructions re pass and ExecStartPre directives.

Successful install of test rpm on rpmbuild host.

[phillxnet]

Pass status

On first rpm install, with no prior rockstor install, we have the following 'pass' state for the root user:

rleap15-5:~ # pass
Password Store
└── python-keyring
    └── rockstor
        ├── CLIENT_SECRET
        ├── SECRET_KEY_FALLBACK
        └── SECRET_KEY

• SECRET_KEY: initially set by %check for collect static and test; & then again during %posttrans's invoking build.sh after initial rpm install.
• SECRET_KEY_FALLBACK: set by rockstor-pre.service via rename of last (build.sh) SECRET_KEY instance.
• SECRET_KEY: is then re-instantiated a-fresh by rockstor-pre.service ExecStartPre by way of a rotation.
• CLIENT_SECRET: set by initrock invoked by ExecStart in rockstor-pre.service: but only if we are a fresh install - or it didn't already exist. This way it remains constant (unless wiped) per install/reinstall.

[phillxnet]

The custom testing rpm instance also rebooted successfully on the rpmbuild host.

[phillxnet]

For a 5.0.5-0 to 5.0.5-2758 rpm update test, via Web-UI, see the following comment in the partner rockstor-core issue:
rockstor/rockstor-core#2758 (comment)