3 ms·
I recently had to copy a secret which was available in a CI-job to a new repository, but the system was smart enough to filter it if echoed literally. So "echo
by stevekemp 2y ago
I recently had to copy a secret which was available in a CI-job to a new repository, but the system was smart enough to filter it if echoed literally.
So "echo $API_TOKEN" failed, but getting the output of the complete environment was as easy as "env | base64".
- TeMPOraL 2y agoOne has to question the premise of such "smartness" in the system in the first place.
- pxc 2y agoI think of it as a form of politeness, basically. It's only a security feature in the sense that it's a tool you can use to make good logging hygiene a little easier for your CI system, not in the sense of helping form any kind of security boundary. I assume (hope?) that's the intention, that nobody is advertising this as a way to prevent exfiltration of secrets.