Skip to content

Commit e157274

Browse files
ecrupperecrupper
authored
Merge pull request from GHSA-pwx5-6wxg-px5h
* fix(secrets): split env injection based on allow_substitution value * upgrade sdk server and types
1 parent 02a0a98 commit e157274

7 files changed

Lines changed: 61 additions & 19 deletions

File tree

‎executor/linux/build.go‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,12 @@ func (c *client) PlanBuild(ctx context.Context) error {
199199

200200
_log.AppendData(append(sRaw, "\n"...))
201201

202-
// add secret to the map
203-
c.Secrets[secret.Name] = s
202+
// add secret to the appropriate map
203+
if s.GetAllowSubstitution() {
204+
c.Secrets[secret.Name] = s
205+
} else {
206+
c.NoSubSecrets[secret.Name] = s
207+
}
204208
}
205209

206210
// escape newlines in secrets loaded on build_start
@@ -699,6 +703,7 @@ func loadLazySecrets(c *client, _step *pipeline.Container) error {
699703
_log := new(library.Log)
700704

701705
lazySecrets := make(map[string]*library.Secret)
706+
lazyNoSubSecrets := make(map[string]*library.Secret)
702707

703708
// this requires a small preface and brief description on
704709
// how normal secrets make it into a container:
@@ -797,8 +802,12 @@ func loadLazySecrets(c *client, _step *pipeline.Container) error {
797802
return err
798803
}
799804

800-
// add secret to the temp map
801-
lazySecrets[secret.Name] = s
805+
// add secret to the appropriate temp map
806+
if s.GetAllowSubstitution() {
807+
lazySecrets[secret.Name] = s
808+
} else {
809+
lazyNoSubSecrets[secret.Name] = s
810+
}
802811
}
803812
}
804813

@@ -836,6 +845,13 @@ func loadLazySecrets(c *client, _step *pipeline.Container) error {
836845
return err
837846
}
838847

848+
c.Logger.Debug("injecting no-sub lazy loaded secrets")
849+
// inject secrets for container
850+
err = injectSecrets(tmpStep, lazyNoSubSecrets)
851+
if err != nil {
852+
return err
853+
}
854+
839855
c.Logger.Debug("merge lazy loaded secrets into container")
840856
// merge lazy load secrets into original container
841857
err = _step.MergeEnv(tmpStep.Environment)

‎executor/linux/linux.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,13 @@ type (
1919
// client manages communication with the pipeline resources.
2020
client struct {
2121
// https://pkg.go.dev/github.com/sirupsen/logrus#Entry
22-
Logger *logrus.Entry
23-
Vela *vela.Client
24-
Runtime runtime.Engine
25-
Secrets map[string]*library.Secret
26-
Hostname string
27-
Version string
22+
Logger *logrus.Entry
23+
Vela *vela.Client
24+
Runtime runtime.Engine
25+
Secrets map[string]*library.Secret
26+
NoSubSecrets map[string]*library.Secret
27+
Hostname string
28+
Version string
2829

2930
// clients for build actions
3031
secret *secretSvc
@@ -67,6 +68,7 @@ func Equal(a, b *client) bool {
6768
reflect.DeepEqual(a.Vela, b.Vela) &&
6869
reflect.DeepEqual(a.Runtime, b.Runtime) &&
6970
reflect.DeepEqual(a.Secrets, b.Secrets) &&
71+
reflect.DeepEqual(a.NoSubSecrets, b.NoSubSecrets) &&
7072
a.Hostname == b.Hostname &&
7173
a.Version == b.Version &&
7274
reflect.DeepEqual(a.init, b.init) &&
@@ -118,6 +120,9 @@ func New(opts ...Opt) (*client, error) {
118120
// instantiate map for non-plugin secrets
119121
c.Secrets = make(map[string]*library.Secret)
120122

123+
// instantiate map for non-substituted secrets
124+
c.NoSubSecrets = make(map[string]*library.Secret)
125+
121126
// instantiate all client services
122127
c.secret = &secretSvc{client: c}
123128

‎executor/linux/secret.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,13 @@ func (s *secretSvc) create(ctx context.Context, ctn *pipeline.Container) error {
6767
return fmt.Errorf("unable to substitute container configuration")
6868
}
6969

70+
logger.Debug("injecting non-substituted secrets")
71+
// inject no-substitution secrets for container
72+
err = injectSecrets(ctn, s.client.NoSubSecrets)
73+
if err != nil {
74+
return err
75+
}
76+
7077
return nil
7178
}
7279

‎executor/linux/service.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,13 @@ func (c *client) CreateService(ctx context.Context, ctn *pipeline.Container) err
5555
return fmt.Errorf("unable to substitute container configuration")
5656
}
5757

58+
logger.Debug("injecting non-substituted secrets")
59+
// inject no-substitution secrets for container
60+
err = injectSecrets(ctn, c.NoSubSecrets)
61+
if err != nil {
62+
return err
63+
}
64+
5865
return nil
5966
}
6067

‎executor/linux/step.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@ func (c *client) CreateStep(ctx context.Context, ctn *pipeline.Container) error
6565
return fmt.Errorf("unable to substitute container configuration")
6666
}
6767

68+
logger.Debug("injecting non-substituted secrets")
69+
// inject no-substitution secrets for container
70+
err = injectSecrets(ctn, c.NoSubSecrets)
71+
if err != nil {
72+
return err
73+
}
74+
6875
return nil
6976
}
7077

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ require (
88
github.com/docker/docker v24.0.9+incompatible
99
github.com/docker/go-units v0.5.0
1010
github.com/gin-gonic/gin v1.9.1
11-
github.com/go-vela/sdk-go v0.23.1
12-
github.com/go-vela/server v0.23.1
13-
github.com/go-vela/types v0.23.1
11+
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf
12+
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d
13+
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe
1414
github.com/golang-jwt/jwt/v5 v5.2.0
1515
github.com/google/go-cmp v0.6.0
1616
github.com/joho/godotenv v1.5.1

‎go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,12 @@ github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg
9494
github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
9595
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
9696
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
97-
github.com/go-vela/sdk-go v0.23.1 h1:4KxfAF1vR8DvtRraBoWQDIm8f8zxXP806lJR3MmTlC8=
98-
github.com/go-vela/sdk-go v0.23.1/go.mod h1:zDsZIePtBdpCZwmwAWqGWuIch/oGliX1zd51PARTHBk=
99-
github.com/go-vela/server v0.23.1 h1:Y+mGfB79RjIgQ3IEkPjGB6IneB2So3ZXE4XKY+Z02xc=
100-
github.com/go-vela/server v0.23.1/go.mod h1:B+A5lRPOlAVYyXBMGCAJKhPQOlfJuWl3qaRcvhsUqSA=
101-
github.com/go-vela/types v0.23.1 h1:st4BeDcYVyaaFqblU1YroztNvmYLBgmfZpWq0En0Sg0=
102-
github.com/go-vela/types v0.23.1/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
97+
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf h1:8Oka4tMHOdy/DsInyg7c/XPY5wqWWE7Yvzx/u67WBuw=
98+
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf/go.mod h1:XjrVfIDw2SZDFBtJ5vqVse/GFj89MF542N20P8U5a3I=
99+
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d h1:VynpkAIMt3KTh9BaICQdpu6c76/hHU3d4/Ab44bmFew=
100+
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d/go.mod h1:EsDVTqQHQ9snXG2DhUl9uo4+Cf/b9nMiESCkxSjmP90=
101+
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe h1:Fb28yre0nrX1GNeyPN8i8rruTlW8MnPVF3Fo5xTuOkg=
102+
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
103103
github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
104104
github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
105105
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=

0 commit comments

Comments
 (0)
⚡