jenkinsci / onepassword-secrets-plugin

https://plugins.jenkins.io/onepassword-secrets/
MIT License
5 stars 3 forks source link

Bugfix: Read multiline secrets #13

Closed edif2008 closed 2 months ago

edif2008 commented 2 months ago

This PR reads the entire secret value from 1Password instead of just the first line of it. This ensures that multiline secrets are properly pulled.

Resolves #10

The fix is changing line 129 in src/main/java/com/onepassword/jenkins/plugins/OnePasswordAccessor.java in from:

String secretValue = stdInput.readLine();

which was only reading the firs line of the secret, to:

String secretValue = stdInput.lines().collect(Collectors.joining(System.lineSeparator()));

which reads all the lines of the secret and preserves the newlines in it.

Testing done

Testing has been done by:

For reviewers

  1. Checkout this branch:

    git pull && git checkout bugfix/multiline-secrets
  2. Run the plugin:

    mvn hpi:run
  3. Create a new pipeline with the following script:

    def config = [
           // Configure to use either a Connect server or a service account
    ]
    
    def secrets = [
           [envVar: 'MULTILINE_SECRET', secretRef: '<op://vault/item/multiline-secret>'],
    ]
    
    node {
       sh '''
           CLI_VERSION="v$(curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/N -s | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+')"
           curl -sSfLo op.zip https://cache.agilebits.com/dist/1P/op2/pkg/$CLI_VERSION/op_darwin_arm64_$CLI_VERSION.zip && unzip -o op.zip && rm op.zip
       '''
       withSecrets(config: config, secrets: secrets) {
          sh '''
              if [ "$MULTILINE_SECRET" = "$(cat << EOF
    <your-multiline-secret>
    )" ]; then
                  echo "Strings are equal."
              else
                  echo "Strings are not equal."
              fi
          '''
       }
    }

    For addition details about creating Jenkins pipeline using the plugin and configuring the plugin, check the documentation.

  4. Run the pipeline.

    • [ ] It should succeed.

Submitter checklist

jillianwilson commented 2 months ago

Code Review ✅ Code is a simple 1 line change but looks good

Functional Review ✅ Pulled down code and followed testing instructions. Works as expected.

simonqbz commented 2 months ago

Maybe stupid question, but in Jenkins I only see release 1.0.0 available. When will this fix be released so it can be updated in Jenkins plugin ?

edif2008 commented 2 months ago

We will release it very soon and we will let you know when the release is out.

simonqbz commented 2 months ago

Excellent! Thanks very much.