From ab2bf3fe5829c9befd98206a549ec037eb05150b Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 14:53:34 +0300 Subject: [PATCH 1/7] doc: write about integrity check in tcm --- doc/tooling/tcm/index.rst | 1 + doc/tooling/tcm/tcm_integrity_check.rst | 114 ++++++++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 doc/tooling/tcm/tcm_integrity_check.rst diff --git a/doc/tooling/tcm/index.rst b/doc/tooling/tcm/index.rst index 1251bf6bf..2c22f851b 100644 --- a/doc/tooling/tcm/index.rst +++ b/doc/tooling/tcm/index.rst @@ -46,4 +46,5 @@ to read data. LDAP authorization is supported as well. tcm_backend_store tcm_dev_mode tcm_configuration_reference + tcm_integrity_check Releases diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst new file mode 100644 index 000000000..4e183b460 --- /dev/null +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -0,0 +1,114 @@ +.. _tcm_integrity_check: + +Integrity check +================ + +.. include:: index.rst + :start-after: ee_note_tcm_start + :end-before: ee_note_tcm_end + +TCM supports the integrity check mechanism. +This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. + +The integrity check mechanism is used to: + +* Ensure the environment and application files haven’t been modified. +* Prevent launching or running TCM in a compromised state. +* Detect unauthorized changes in centralized configuration. + +This feature is available for any application managed by tt, including TCM. + + +.. _tcm_integrity_check_enable: + +Enabling integrity check +------------------------ + +To enable integrity checks, you must sign the application and configuration: + +#. Package the application with integrity checks: + + .. code-block:: console + + tt pack --with-integrity-check + +#. Publish configuration with integrity metadata: + + .. code-block:: console + + tt cluster publish --with-integrity-check + +.. _tcm_integrity_check_configure: + +Configure integrity check +------------------------- + +Configuration parameters +======================== + +.. list-table:: + :header-rows: 1 + :widths: 35 45 10 10 + + * - Parameter + - Description + - Type + - Default + * - ``security.integrity-check`` + - Enables signature validation + - ``bool`` + - ``false`` + * - ``security.signature-private-key-file`` + - Path to the private key for signing configuration + - ``string`` + - ``""`` + +Environment variables +===================== + +.. list-table:: + :header-rows: 1 + :widths: 40 60 + + * - Variable + - Description + * - ``TCM_SECURITY_INTEGRITY_CHECK`` + - Enables integrity check via environment variable + * - ``TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE`` + - Path to the private key for signing configuration + + +Example configuration +===================== + +Integrity check in TCM can be enabled and customized using several methods. +You can configure it directly in the TCM configuration file or through environment variables when starting the application. + +* In configuration file: + + .. code-block:: yaml + + # tcm.yaml + security: + integrity-check: true + signature-private-key-file: /etc/tcm/private_key.pem + + +* Environment variables: + + .. code-block:: console + + export TCM_SECURITY_INTEGRITY_CHECK=true + export TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE=/etc/tcm/private_key.pem + + tt --integrity-check /etc/tcm/public_key.pem start tcm + + + + + + + + + + From b2ae6fbc11c48a5e306332747cd9eab5e6b30426 Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 15:13:48 +0300 Subject: [PATCH 2/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 4e183b460..b2d01b578 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -7,7 +7,7 @@ Integrity check :start-after: ee_note_tcm_start :end-before: ee_note_tcm_end -TCM supports the integrity check mechanism. +|tcm| supports the integrity check mechanism. This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. The integrity check mechanism is used to: @@ -16,9 +16,6 @@ The integrity check mechanism is used to: * Prevent launching or running TCM in a compromised state. * Detect unauthorized changes in centralized configuration. -This feature is available for any application managed by tt, including TCM. - - .. _tcm_integrity_check_enable: Enabling integrity check @@ -54,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - ``security.integrity-check`` + * - :ref:```security.integrity-check`` Date: Thu, 9 Oct 2025 15:17:59 +0300 Subject: [PATCH 3/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index b2d01b578..86c462c6e 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -41,7 +41,7 @@ Configure integrity check ------------------------- Configuration parameters -======================== +~~~~~~~~~~~~~~~~~~~~~~~~ .. list-table:: :header-rows: 1 @@ -61,7 +61,7 @@ Configuration parameters - ``""`` Environment variables -===================== +~~~~~~~~~~~~~~~~~~~~~ .. list-table:: :header-rows: 1 @@ -76,7 +76,7 @@ Environment variables Example configuration -===================== +~~~~~~~~~~~~~~~~~~~~~ Integrity check in |tcm| can be enabled and customized using several methods. You can configure it directly in the |tcm| configuration file or through environment variables when starting the application. From 597c9091b5f276e405203c4ba11a22434dd44ce5 Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 16:01:52 +0300 Subject: [PATCH 4/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 86c462c6e..b6ee346c0 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:```security.integrity-check`` Date: Thu, 9 Oct 2025 16:12:14 +0300 Subject: [PATCH 5/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index b6ee346c0..cf3ef385a 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:`security.integrity-check Date: Thu, 9 Oct 2025 16:19:05 +0300 Subject: [PATCH 6/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index cf3ef385a..34b062acd 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -51,11 +51,11 @@ Configuration parameters - Description - Type - Default - * - :ref:`security.integrity-check ` - Enables signature validation - ``bool`` - ``false`` - * - :ref:`security.signature-private-key-file` ` - Path to the private key for signing configuration - ``string`` - ``""`` From c656a364650c1e3577c6e5610a5f0f3878d4f10f Mon Sep 17 00:00:00 2001 From: mar Date: Thu, 9 Oct 2025 17:03:15 +0300 Subject: [PATCH 7/7] doc: write about integrity check in tcm --- doc/tooling/tcm/tcm_integrity_check.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/tooling/tcm/tcm_integrity_check.rst b/doc/tooling/tcm/tcm_integrity_check.rst index 34b062acd..ace317532 100644 --- a/doc/tooling/tcm/tcm_integrity_check.rst +++ b/doc/tooling/tcm/tcm_integrity_check.rst @@ -8,12 +8,12 @@ Integrity check :end-before: ee_note_tcm_end |tcm| supports the integrity check mechanism. -This feature ensures that the environment, application files, and centralized configuration have not been tampered with after packaging and publishing. +The integrity check mechanism in TCM verifies the digital signature of centralized configuration files. +It ensures that TCM only applies configurations that are signed with a trusted private key. -The integrity check mechanism is used to: +This mechanism allows TCM to: -* Ensure the environment and application files haven’t been modified. -* Prevent launching or running TCM in a compromised state. +* Allows updating the configuration with integrity check support. * Detect unauthorized changes in centralized configuration. .. _tcm_integrity_check_enable: