在这篇博文中,我将分享如何从 CI/CD 服务(例如 GitHub Actions)中恢复机密。

如果您在这里,那么您已经知道秘密在 CI/CD 日志中隐藏了***,例如:

jobs:
  openssl:
    name: Recover With OpenSSL
    runs-on: ubuntu-20.04
    steps:
      - env:
          MY_CLIENT_SECRET: ${{ secrets.MY_CLIENT_SECRET }}
        run: |
          echo "MY_CLIENT_SECRET (***)     = ${MY_CLIENT_SECRET}"

进入全屏模式 退出全屏模式

# Output
MY_CLIENT_SECRET (***)     = ***

进入全屏模式 退出全屏模式

上述内容不是很有帮助,因为这可能是您现在所处的情况。

又快又脏(危险)

对于私有存储库,可以使用base64对秘密进行编码,然后再将其打印到 CI/CD 服务日志;这样,GitHub Actions 就不会隐藏***的秘密。然后,复制 encoded 值并在本地 decode 它。

name: Recovering secrets

# Assumption:
# You've created the following GitHub secrets in your repository:
# MY_CLIENT_ID - encode/decode with base64 - useful for private repositories

on:
  push:
  workflow_dispatch:

jobs:
  base64:
    name: Recover With Base64
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
      - env:
          MY_CLIENT_ID: ${{ secrets.MY_CLIENT_ID }}
        run: |
          echo "MY_CLIENT_ID (***)    = ${MY_CLIENT_ID}"
          echo "MY_CLIENT_ID (base64) = $(echo ${MY_CLIENT_ID} | base64)"
          echo "Copy the above value, and then execute locally:"
          echo "echo PASTE_HERE | base64 -D"

进入全屏模式 退出全屏模式

[](https://res.cloudinary.com/practicaldev/image/fetch/s--MtpBRVA7--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https:// /dev-to-uploads.s3.amazonaws.com/uploads/articles/e2hjlmn74z6qg9j085g6.png)

上述方法是危险的,因为任何人都可以解码这个秘密,所以对于公共存储库,这是不行的。假设打印的 encoded 值为c29tZS1jbGllbnQtaWQtdmFsdWUK...

echo c29tZS1jbGllbnQtaWQtdmFsdWUK | base64 -D
# some-client-id-value

进入全屏模式 退出全屏模式

我刚刚将MY_CLIENT_ID暴露给全世界......我很害怕。

如何从 CICD 服务中恢复秘密

从 CICD 系统恢复机密而不将其暴露给外界的最佳方法是在将机密打印到 CI/CD 日志之前对其进行加密。

name: Recovering secrets

# Assumption:
# You've created the following GitHub secrets in your repository:
# MY_CLIENT_SECRET - encrypt/decrypt with openssl - useful for public and private repositories
# MY_OPENSSL_PASSWORD - used to protect secrets
# MY_OPENSSL_ITER - Use a number of iterations on the password to derive the encryption key.
#                   High values increase the time required to brute-force the resulting file.
#                   This option enables the use of PBKDF2 algorithm to derive the key.

on:
  push:
  workflow_dispatch:

jobs:
  openssl:
    name: Recover With OpenSSL
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
      - env:
          MY_CLIENT_SECRET: ${{ secrets.MY_CLIENT_SECRET }}
          MY_OPENSSL_PASSWORD: ${{ secrets.MY_OPENSSL_PASSWORD }}
          MY_OPENSSL_ITER: ${{ secrets.MY_OPENSSL_ITER }}
        run: |
          echo "MY_CLIENT_SECRET (***)     = ${MY_CLIENT_SECRET}"
          echo "MY_CLIENT_SECRET (openssl) = $(echo "${MY_CLIENT_SECRET}" | openssl enc -e -aes-256-cbc -a -pbkdf2 -iter ${MY_OPENSSL_ITER} -k "${MY_OPENSSL_PASSWORD}")"
          echo "Copy the above value, and then execute locally:"
          echo "echo PASTE_HERE | openssl base64 -d | openssl enc -d -pbkdf2 -iter \$MY_OPENSSL_ITER -aes-256-cbc -k \$MY_OPENSSL_PASSWORD"

进入全屏模式 退出全屏模式

[](https://res.cloudinary.com/practicaldev/image/fetch/s--eMH5HVKS--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https:// /dev-to-uploads.s3.amazonaws.com/uploads/articles/xvdjfmb0ensf5tji5hkr.png)

解密上述字符串U2FsdGVkX1+6/+7bvNG/Ga7siAI994FkMUn5Njzn4zyNwvf8qM3MY0MMmd9sCFvz的唯一方法是使用正确的数字iter和password,否则你将不得不使用暴力攻击,祝你好运:)

这是我在本地机器上解密上述值的方法:

echo U2FsdGVkX1+CeN0/ScQLZGU8f0ix86fh1oLJg/1M+o2lbCM+pBA8BIUCbkHMCjRZ \
| openssl base64 -d \
| openssl enc -d -pbkdf2 -iter $MY_OPENSSL_ITER -aes-256-cbc -k $MY_OPENSSL_PASSWORD

进入全屏模式 退出全屏模式

最后的话

我建议创建一个单独的工作流来恢复 CI/CD (GitHub) 机密,例如.github/workflows/recover-github-secrets.yml,然后运行工作流,然后在完成机密恢复后删除其日志。

[](https://res.cloudinary.com/practicaldev/image/fetch/s--xkCzX0_2--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https ://dev-to-uploads.s3.amazonaws.com/uploads/articles/uh0d5qb8bqagjwx6acws.png)

参考文献

• 在 GitHub Actions 中如何执行上述 YAML 文件的示例

• GitHub Actions 使用base64和openssl恢复 GitHub 机密的完整 YAML 示例