printenv prints the secrets in plaintext

[ptagr]

Drone version : 0.7.3
Reproduce: Run printenv in a drone step
Actual: global secrets are printed with their values in plaintext
Expected: global secrets are printed with the values concealed (*)

[clayrisser]

How else do you expect services to read the secrets???

[donny-dont]

In 0.5 there was a conceal option for secrets. This was expensive to do and didn't handle multi line secrets.

[tboerger]

Please follow the issue template, the tracker should be used for confirmed issues, not just for something you just expect.

If you are using global secrets instead of secrets scoped to specific plugins it's up to you to keep the secrets hidden, in that case you can enable gating and just decline a pull request that tries to print the secrets.

[tonglil]

Can I suggest a FR that could help with certain cases of this issue? Just read docs again and realized this is already implemented on the per-repo level.

Extend secrets with an optional field to specify exactly which plugin(s) can access the secret, otherwise it will not even populate that container with that env var. Plugins would still have to "request" the secret with secrets: [ docker_username, docker_password ], and any secret they request that they don't have access to would be empty string.

So for example, if you are publishing an image to Docker, the only place you need that secret is in plugins/docker and no where else. So when adding the secret, you add a list of plugins that will can get the secret: -image plugins/docker -image plugins/gcr:0.5 (if it needs it as well).

Then the build steps will not even have these secrets injected into the environment, providing a bit more granularity in controlling the secrets.

Secrets set per repo

At the small scale, this allows pipeline/repo admins to add appropriate secrets knowing that only the appropriate plugins can use them and changes to .drone.yml won't explose "these" secrets (it can still explose .netrc for example).

Secrets set by global secrets

On the org-scale level, global secrets could be injected by Drone operators (who may not be repo owners) for users to use with certain plugins (and versions), and rotate them out if need be all at once, while being able to "not trust" individual .drone.yml pipeline changes. For example, this could be a secret for publishing to a shared GCR bucket, or a Slack token for a pre-configured org Slack integration to send build notifications (so team's don't have to create their own Slack integration + more tokens).

Let me know if any part of that doesn't make sense, happy to clarify.

[tonglil]

UI could look something like this:

[tonglil]

After looking at the docs' CLI section, I see this is already implemented 😆

[tonglil]

I guess if Global Secrets' yml config got updated, this could be considered done?

- name: docker_username
  value: octocat
  image:
    - plugins/docker
- name: docker_password
  value: correct-horse-batter-staple
  image:
    - plugins/docker

[bradrydzewski]

@tonglil this is already possible from the command line and the global secrets file :)

Example when configuring a secret from the command line:

drone secret add \
  -repository octocat/hello-world \
+ -image plugins/docker \
  -name docker_username \
  -value <value>

This is also supported in the global secrets file, although not currently documented:

- name: docker_password
  value: correct-horse-battery-staple
  repos: [ octocat/hello-world, github/* ]
+ images: [ plugins/docker ]

[tonglil]

Awesome, looks like I am making a PR to the docs this week! Tony Li

…

On Aug 1, 2017, at 1:38 PM, Brad Rydzewski ***@***.***> wrote: @tonglil this is already possible from the command line and the global secrets file :) Example when configuring a secret from the command line: drone secret add \ -repository octocat/hello-world \ + -image plugins/docker \ -name docker_username \ -value <value> This is also supported in the global secrets file, although not currently documented: - name: docker_password value: correct-horse-battery-staple repos: [ octocat/hello-world, github/* ] + images: [ plugins/docker ] — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[bradrydzewski]

the ability to conceal secrets was re-implemented to work with the new drone-runtime package, and will be re-introduced in 0.9