Better built-in secure field support

[samrocketman]

Right now a lot of the work for secure field support is offloaded to the user. I want this to be made even easier by offloading most of this work into the library. See also #22.

[samrocketman]

Here's how it can be supported. Based on using securityIO and repository-secrets proof of concept using openssl commands to encrypt strings.

jenkins:
  secrets_id: "<Jenkins RSA key identifier>"
  secrets:
    - key: MY_ENVIRONMENT_VAR
      secret: <rsa encrypted string>
    - key: ANOTHER_ENVIRON_VAR
      secret: <rsa encypted string>

Job DSL to obtain the private key from Jenkins.

import jenkins.model.Jenkins

public String getFolderRSAKeyCredentials(String folder, String credentials_id) {
    def credentials
    def properties = Jenkins.getInstance().getJob(folder).getProperties()
    for(int i=0; i < properties.size(); i++) {
        if(properties.get(i).getClass().getSimpleName() == 'FolderCredentialsProperty') {
            credentials = properties.get(i)
        }
    }
    String found_credentials = ''
    if(credentials != null ) {
        credentials.getDomainCredentials().each { domain ->
            domain.getCredentials().each { credential ->
                if(credential != null && credential.getClass().getSimpleName() == 'BasicSSHUserPrivateKey') {
                    if(credential.getId() == credentials_id) {
                        found_credentials = credential.getPrivateKey()
                    }
                }
            }
        }
    }
    return found_credentials
}

println getFolderRSAKeyCredentials('folder', 'cred-id')

[samrocketman]

Created a test repo. https://github.com/samrocketman/jervis-secrets-test

[samrocketman]

https://wiki.jenkins-ci.org/display/JENKINS/Mask+Passwords+Plugin can be used to set the secret vars.

[samrocketman]

securityIO class should be handled carefully because it uses files. If temp files are to be used it should be used like this:

File priv_key = File.createTempFile('temp', '.txt')
//delete file if JVM is shut down
priv_key.deleteOnExit()
try {
    priv_key.write(getFolderRSAKeyCredentials('folder', 'cred-id'))
    //do some stuff with secrets
    //use the absolute path when referencing
    //priv_key.getAbsolutePath()
}
catch(Throwable t) {
    //clean up temp file
    priv_key.delete()
    //rethrow caught exception
    throw t
}

[samrocketman]

https://issues.jenkins-ci.org/browse/JENKINS-31674 for Job DSL implementation.

[samrocketman]

Support added in:

• 00ec1be secure property support in lifecycleGenerator
• 8c0eac5 encrypted property support in firstjob DSL