[SOLR-14158] package manager to read keys from packagestore and not ZK

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 8.4
• Fix Version/s: 8.4.1
• Component/s: packages
• Labels: packagemanager
• Assignee: Noble Paul
• Reporter: Noble Paul
• Created: 02/Jan/20 18:59
• Updated: 22/Jan/20 06:08
• Resolved: 21/Jan/20 16:02

Description

The security of the package system relies on securing ZK. It's much easier for users to secure the file system than securing ZK.

We provide an option to read public keys from file store. 

This will

• Have a special directory called trusted . Direct writes are forbidden to that directory over http
• The CLI directly writes to the keys to <SOLR_HOME>/filestore/trusted/keys/ directory. Other nodes are asked to fetch the public key files from that node
• Package artifacts will continue to be uploaded over http

Issue Links

• links to: GitHub Pull Request #1153