{"id":20111376,"url":"https://github.com/openstack/charm-barbican","last_synced_at":"2025-07-26T01:13:09.061Z","repository":{"id":46748361,"uuid":"64736358","full_name":"openstack/charm-barbican","owner":"openstack","description":"Juju Charm - Barbican. Mirror of code maintained at opendev.org.","archived":false,"fork":false,"pushed_at":"2024-11-20T09:25:49.000Z","size":2905,"stargazers_count":10,"open_issues_count":0,"forks_count":3,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-09T11:52:43.450Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://opendev.org/openstack/charm-barbican","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-02T07:52:11.000Z","updated_at":"2024-11-20T09:25:53.000Z","dependencies_parsed_at":"2023-02-10T13:46:37.263Z","dependency_job_id":"64c29eaf-20d8-409d-98b0-9f127d0257a9","html_url":"https://github.com/openstack/charm-barbican","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-barbican","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-barbican/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-barbican/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-barbican/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openstack","download_url":"https://codeload.github.com/openstack/charm-barbican/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252666307,"owners_count":21785239,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T18:15:52.027Z","updated_at":"2025-05-06T10:33:12.633Z","avatar_url":"https://github.com/openstack.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Barbican Source Charm\n\nTHIS CHARM IS FOR EXPERIMENTAL USE AT PRESENT.\n\nThis repository is for the reactive, layered,\n[Barbican](https://wiki.openstack.org/wiki/Barbican) _source_ charm. From the\n[wiki](https://wiki.openstack.org/wiki/Barbican) 'Barbican is a REST API\ndesigned for the secure storage, provisioning and management of secrets such as\npasswords, encryption keys and X.509 Certificates. It is aimed at being useful\nfor all environments, including large ephemeral Clouds.'\n\nBarbican can be used without an HSM for test purposes.\n\n# Plugins\n\nThe Barbican charm currently supports the following plugins:\n\n - charm-barbican-softhsm\n\nHowever, due to an odd quirk of interelating software issues, barbican +\nSoftHSM2 + OpenSSL \u003c 1.0.2h is not functionaly due to a missing feature in\nOpenSSL (EVP_aes_128_wrap_pad specifically).\n\nThus the plugin interface is _currently_ provided to show how to interface an\nHSM to the barbican charm.\n\n# Creating the primary MKEK and primary HMAC\n\nBarbican (can use|uses) a Master Key Encryption Key (MKEK) scheme to wrap other\nkeys so that in the course of issuing new encryption keys, it does not exhaust\nthe storage capacity of an HSM.\n\nSee [KMIP MKEK Model\nPlugin](https://specs.openstack.org/openstack/barbican-specs/specs/kilo/barbican-mkek-model.html)\nfor more details.\n\nBarbican itself can generate the MKEK and HMAC keys and store them in the\nassociated HSM through the use of two actions 'generate-mkek' and\n'generate-hmac'.\n\nThe names of the keys are stored in the configuration for the service as\n'mkek-label' and 'hmac-label'.  These default to 'primarymkek' and\n'primaryhmac' respectively.\n\nNote that these keys are not recoverable _from_ the HSM.  If the HSM has\nalready been configured with these keys then these actions would overwrite the\nexisting key. So only use them for the initial implementation or to change the\nMKEK and HMAC keys in the HSM.\n\n## Use of actions\n\nFor juju 1.x:\n```bash\njuju action do generate-mkek\n```\n\nFor juju 2.x:\n\n```bash\njuju run-action generate-mkek\n```\n\nNote that, depending on the HSM, it may only be possible to do this ONCE as the\nHSM may reject setting up the keys more than once.\n\n# Developer Notes\n\nThe Barbican charm has to be able to set `[crypto]` and `[xxx_plugin]` sections\nin the `barbican-api.conf` file. This data comes via the `barbican-hsm`\ninterface from a charm (probably a subordinate) that provides the interface.\n\nOn the `barbican-hsm` interface the data is provided in the `plugin_data()`\nmethod of the interface (or if it is adapted) in the `plugin_data` property.\n\nThe theory of operation for the crypto plugin is that a local library that\nsupports the PKCS#11 interface that Barbican can talk to locally.\n\nNote(AJK): it is not clear yet how a clustered Barbican can be created with\na single HSM backend.  It's likely to be a separate piece of hardward with\na local library that talks to it.\n\nIn order for Barbican to be configured for the example softhsm2 library, the\nconfiguration file needs to include the entries:\n\n```ini\n[crypto]\nenabled_crypto_plugins = p11_crypto\n\n[p11_crypto_plugin]\nlibrary_path = '/usr/lib/libCryptoki2_64.so'\nlogin = 'catt'\nmkek_label = 'primarymkek'\nmkek_length = 32\nhmac_label = 'primaryhmac' slot_id = \u003cslot_id\u003e\n```\n\nNote that the /var/lib/softhsm/tokens directory HAS to exist as otherwise the\nsofthsm2-util command won't work.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-barbican","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenstack%2Fcharm-barbican","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-barbican/lists"}