From ab2bf3fe5829c9befd98206a549ec037eb05150b Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 14:53:34 +0300 Subject: [PATCH 01/12] doc: write about integrity check in tcm --- doc/tooling/tcm/index.rst | 1 + doc/tooling/tcm/tcm_integrity_check.rst | 114 ++++++++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 doc/tooling/tcm/tcm_integrity_check.rst diff --git a/doc/tooling/tcm/index.rst b/doc/tooling/tcm/index.rst index 1251bf6bf..2c22f851b 100644 --- a/doc/tooling/tcm/index.rst +++ b/doc/tooling/tcm/index.rst @@ -46,4 +46,5 @@ to read data. LDAP authorization is supported as well. tcm_backend_store tcm_dev_mode tcm_configuration_reference + tcm_integrity_check Releases diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst new file mode 100644 index 000000000..4e183b460 --- /dev/null +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -0,0 +1,114 @@ +.. _tcm_integrity_check: + +Integrity check +================ + +.. include:: index.rst + :start-after: ee_note_tcm_start + :end-before: ee_note_tcm_end + +TCM supports the integrity check mechanism. +This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. + +The integrity check mechanism is used to: + +* Ensure the environment and application files haven’t been modified. +* Prevent launching or running TCM in a compromised state. +* Detect unauthorized changes in centralized configuration. + +This feature is available for any application managed by tt, including TCM. + + +.. _tcm_integrity_check_enable: + +Enabling integrity check +------------------------ + +To enable integrity checks, you must sign the application and configuration: + +#. Package the application with integrity checks: + + .. code-block:: console + + tt pack --with-integrity-check + +#. Publish configuration with integrity metadata: + + .. code-block:: console + + tt cluster publish --with-integrity-check + +.. _tcm_integrity_check_configure: + +Configure integrity check +------------------------- + +Configuration parameters +======================== + +.. list-table:: + :header-rows: 1 + :widths: 35 45 10 10 + + * - Parameter + - Description + - Type + - Default + * - ``security.integrity-check`` + - Enables signature validation + - ``bool`` + - ``false`` + * - ``security.signature-private-key-file`` + - Path to the private key for signing configuration + - ``string`` + - ``""`` + +Environment variables +===================== + +.. list-table:: + :header-rows: 1 + :widths: 40 60 + + * - Variable + - Description + * - ``TCM_SECURITY_INTEGRITY_CHECK`` + - Enables integrity check via environment variable + * - ``TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE`` + - Path to the private key for signing configuration + + +Example configuration +===================== + +Integrity check in TCM can be enabled and customized using several methods. +You can configure it directly in the TCM configuration file or through environment variables when starting the application. + +* In configuration file: + + .. code-block:: yaml + + # tcm.yaml + security: + integrity-check: true + signature-private-key-file: /etc/tcm/private_key.pem + + +* Environment variables: + + .. code-block:: console + + export TCM_SECURITY_INTEGRITY_CHECK=true + export TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE=/etc/tcm/private_key.pem + + tt --integrity-check /etc/tcm/public_key.pem start tcm + + + + + + + + + + From b2ae6fbc11c48a5e306332747cd9eab5e6b30426 Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 15:13:48 +0300 Subject: [PATCH 02/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 4e183b460..b2d01b578 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -7,7 +7,7 @@ Integrity check :start-after: ee_note_tcm_start :end-before: ee_note_tcm_end -TCM supports the integrity check mechanism. +|tcm| supports the integrity check mechanism. This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. The integrity check mechanism is used to: @@ -16,9 +16,6 @@ The integrity check mechanism is used to: * Prevent launching or running TCM in a compromised state. * Detect unauthorized changes in centralized configuration. -This feature is available for any application managed by tt, including TCM. - - .. _tcm_integrity_check_enable: Enabling integrity check @@ -54,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - ``security.integrity-check`` + * - :ref:```security.integrity-check`` Date: Thu, 9 Oct 2025 15:17:59 +0300 Subject: [PATCH 03/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index b2d01b578..86c462c6e 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -41,7 +41,7 @@ Configure integrity check ------------------------- Configuration parameters -======================== +~~~~~~~~~~~~~~~~~~~~~~~~ .. list-table:: :header-rows: 1 @@ -61,7 +61,7 @@ Configuration parameters - ``""`` Environment variables -===================== +~~~~~~~~~~~~~~~~~~~~~ .. list-table:: :header-rows: 1 @@ -76,7 +76,7 @@ Environment variables Example configuration -===================== +~~~~~~~~~~~~~~~~~~~~~ Integrity check in |tcm| can be enabled and customized using several methods. You can configure it directly in the |tcm| configuration file or through environment variables when starting the application. From 597c9091b5f276e405203c4ba11a22434dd44ce5 Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 16:01:52 +0300 Subject: [PATCH 04/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 86c462c6e..b6ee346c0 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:```security.integrity-check`` Date: Thu, 9 Oct 2025 16:12:14 +0300 Subject: [PATCH 05/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index b6ee346c0..cf3ef385a 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:`security.integrity-check Date: Thu, 9 Oct 2025 16:19:05 +0300 Subject: [PATCH 06/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index cf3ef385a..34b062acd 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:`security.integrity-check ` - Enables signature validation - ``bool`` - ``false`` - * - :ref:`security.signature-private-key-file` ` - Path to the private key for signing configuration - ``string`` - ``""`` From c656a364650c1e3577c6e5610a5f0f3878d4f10f Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 17:03:15 +0300 Subject: [PATCH 07/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 34b062acd..ace317532 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -8,12 +8,12 @@ Integrity check :end-before: ee_note_tcm_end |tcm| supports the integrity check mechanism. -This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. +The integrity check mechanism in TCM verifies the digital signature of centralized configuration files. +It ensures that TCM only applies configurations that are signed with a trusted private key. -The integrity check mechanism is used to: +This mechanism allows TCM to: -* Ensure the environment and application files haven’t been modified. -* Prevent launching or running TCM in a compromised state. +* Allows updating the configuration with integrity check support. * Detect unauthorized changes in centralized configuration. .. _tcm_integrity_check_enable: From ad643bcb09a67a987ad407e039f78c2a6f6b22da Mon Sep 17 00:00:00 2001 From: mar Date: Mon, 13 Oct 2025 14:44:38 +0300 Subject: [PATCH 08/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 43 ++++--------------------- 1 file changed, 6 insertions(+), 37 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index ace317532..34b72b068 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -16,25 +16,6 @@ This mechanism allows TCM to: * Allows updating the configuration with integrity check support. * Detect unauthorized changes in centralized configuration. -.. _tcm_integrity_check_enable: - -Enabling integrity check ------------------------- - -To enable integrity checks, you must sign the application and configuration: - -#. Package the application with integrity checks: - - .. code-block:: console - - tt pack --with-integrity-check - -#. Publish configuration with integrity metadata: - - .. code-block:: console - - tt cluster publish --with-integrity-check - .. _tcm_integrity_check_configure: Configure integrity check @@ -79,23 +60,11 @@ Example configuration ~~~~~~~~~~~~~~~~~~~~~ Integrity check in |tcm| can be enabled and customized using several methods. -You can configure it directly in the |tcm| configuration file or through environment variables when starting the application. - -* In configuration file: - - .. code-block:: yaml - - # tcm.yaml - security: - integrity-check: true - signature-private-key-file: /etc/tcm/private_key.pem - - -* Environment variables: - - .. code-block:: console +You can configure it directly in the |tcm| configuration file: - export TCM_SECURITY_INTEGRITY_CHECK=true - export TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE=/etc/tcm/private_key.pem +.. code-block:: yaml - tt --integrity-check /etc/tcm/public_key.pem start tcm + # tcm.yaml + security: + integrity-check: true + signature-private-key-file: /etc/tcm/private_key.pem From 08e7d095efa426daf14b6f51c6ca9e4df0a7c551 Mon Sep 17 00:00:00 2001 From: mar Date: Mon, 13 Oct 2025 14:44:54 +0300 Subject: [PATCH 09/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 34b72b068..9ef1b2595 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -41,20 +41,6 @@ Configuration parameters - ``string`` - ``""`` -Environment variables -~~~~~~~~~~~~~~~~~~~~~ - -.. list-table:: - :header-rows: 1 - :widths: 40 60 - - * - Variable - - Description - * - ``TCM_SECURITY_INTEGRITY_CHECK`` - - Enables integrity check via environment variable - * - ``TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE`` - - Path to the private key for signing configuration - Example configuration ~~~~~~~~~~~~~~~~~~~~~ From 42ef23159f033d94fe1afbcf6edb14cefeff2299 Mon Sep 17 00:00:00 2001 From: mar Date: Wed, 15 Oct 2025 11:28:52 +0300 Subject: [PATCH 10/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 9ef1b2595..ab46b68e1 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -45,8 +45,7 @@ Configuration parameters Example configuration ~~~~~~~~~~~~~~~~~~~~~ -Integrity check in |tcm| can be enabled and customized using several methods. -You can configure it directly in the |tcm| configuration file: +Integrity check in |tcm| can be enabled directly in the |tcm| configuration file: .. code-block:: yaml From 514ed105137e45a17c9254ac73d3d641af14f739 Mon Sep 17 00:00:00 2001 From: mar Date: Wed, 15 Oct 2025 12:23:52 +0300 Subject: [PATCH 11/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index ab46b68e1..701f8481e 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -45,7 +45,7 @@ Configuration parameters Example configuration ~~~~~~~~~~~~~~~~~~~~~ -Integrity check in |tcm| can be enabled directly in the |tcm| configuration file: +Integrity check can be enabled directly in the |tcm| configuration file: .. code-block:: yaml From f0373caa2aaf7516ff0d578b477945a69b03324f Mon Sep 17 00:00:00 2001 From: mar Date: Wed, 15 Oct 2025 13:01:27 +0300 Subject: [PATCH 12/12] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 701f8481e..3974a1cd4 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -13,7 +13,7 @@ It ensures that TCM only applies configurations that are signed with a trusted p This mechanism allows TCM to: -* Allows updating the configuration with integrity check support. +* Update the configuration with integrity check support. * Detect unauthorized changes in centralized configuration. .. _tcm_integrity_check_configure: