From f4bcd240ec01f3fc21ea2b8bdee8a81ad22d31e3 Mon Sep 17 00:00:00 2001
From: Marc Barussaud <marc.barussaud@orange.com>
Date: Wed, 17 Jan 2024 12:55:46 +0000
Subject: [PATCH] fix: support secret evaluation for vault usage
---
templates/gitlab-ci-sonar.yml | 72 +++++++++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
diff --git a/templates/gitlab-ci-sonar.yml b/templates/gitlab-ci-sonar.yml
index 699cdae..2be1e91 100644
--- a/templates/gitlab-ci-sonar.yml
+++ b/templates/gitlab-ci-sonar.yml
@@ -238,6 +238,77 @@ stages:
log_info "... done"
}
+ # evaluate and export a secret
+ # - $1: secret variable name
+ function eval_secret() {
+ name=$1
+ value=$(eval echo "\$${name}")
+ case "$value" in
+ @b64@*)
+ decoded=$(mktemp)
+ errors=$(mktemp)
+ if echo "$value" | cut -c6- | base64 -d > "${decoded}" 2> "${errors}"
+ then
+ # shellcheck disable=SC2086
+ export ${name}="$(cat ${decoded})"
+ log_info "Successfully decoded base64 secret \\e[33;1m${name}\\e[0m"
+ else
+ fail "Failed decoding base64 secret \\e[33;1m${name}\\e[0m:\\n$(sed 's/^/... /g' "${errors}")"
+ fi
+ ;;
+ @hex@*)
+ decoded=$(mktemp)
+ errors=$(mktemp)
+ if echo "$value" | cut -c6- | sed 's/\([0-9A-F]\{2\}\)/\\\\x\1/gI' | xargs printf > "${decoded}" 2> "${errors}"
+ then
+ # shellcheck disable=SC2086
+ export ${name}="$(cat ${decoded})"
+ log_info "Successfully decoded hexadecimal secret \\e[33;1m${name}\\e[0m"
+ else
+ fail "Failed decoding hexadecimal secret \\e[33;1m${name}\\e[0m:\\n$(sed 's/^/... /g' "${errors}")"
+ fi
+ ;;
+ @url@*)
+ url=$(echo "$value" | cut -c6-)
+ if command -v curl > /dev/null
+ then
+ decoded=$(mktemp)
+ errors=$(mktemp)
+ if curl -s -S -f --connect-timeout 5 -o "${decoded}" "$url" 2> "${errors}"
+ then
+ # shellcheck disable=SC2086
+ export ${name}="$(cat ${decoded})"
+ log_info "Successfully curl'd secret \\e[33;1m${name}\\e[0m"
+ else
+ log_warn "Failed getting secret \\e[33;1m${name}\\e[0m:\\n$(sed 's/^/... /g' "${errors}")"
+ fi
+ elif command -v wget > /dev/null
+ then
+ decoded=$(mktemp)
+ errors=$(mktemp)
+ if wget -T 5 -O "${decoded}" "$url" 2> "${errors}"
+ then
+ # shellcheck disable=SC2086
+ export ${name}="$(cat ${decoded})"
+ log_info "Successfully wget'd secret \\e[33;1m${name}\\e[0m"
+ else
+ log_warn "Failed getting secret \\e[33;1m${name}\\e[0m:\\n$(sed 's/^/... /g' "${errors}")"
+ fi
+ else
+ log_warn "Couldn't get secret \\e[33;1m${name}\\e[0m: no http client found"
+ fi
+ ;;
+ esac
+ }
+
+ function eval_all_secrets() {
+ encoded_vars=$(env | grep -Ev '(^|.*_ENV_)scoped__' | awk -F '=' '/^[a-zA-Z0-9_]*=@(b64|hex|url)@/ {print $1}')
+ for var in $encoded_vars
+ do
+ eval_secret "$var"
+ done
+ }
+
# builds the Java proxy options from Linux env (http_proxy, https_proxy, ftp_proxy and no_proxy)
function eval_java_proxy_args() {
# transform no_proxy into Java stype nonProxyHosts
@@ -273,6 +344,7 @@ stages:
}
unscope_variables
+ eval_all_secrets
# ENDSCRIPT
--
GitLab