我怎样才能解密安全的env变量？

Question

我有.travis.yml一些安全(加密)的env变量.现在我需要解密这些变量以在不同的项目中使用它们.

有没有简单的方法(除了触发提交并在控制台输出中打印它们)？

Answer 1

您不能从我理解的本地解密,但您可以恢复键/值.本质上,它们必须被解密才能在构建过程中使用.

1. 转到当前项目的上一个版本.
2. 选择"Debug Build"
3. 使用提供的用户和主机SSH进入实例 ***********@to2.tmate.io
4. 进入远程shell后,运行env.

这将打印所有环境变量,因此您将不得不为您的安全变量挖掘一些,但它们将在那里.

Answer 2

我认为你不能解密它.公钥用于加密数据,只能用travis不提供的私钥解密.

Answer 3

Daniel's answer here would probably work, but it relies on the Debug Mode of Travis CI, which is disabled for public repositories by default, due to security concerns.

There is actually another way to do it. It is inspired by, and simplified from this blog post "RECOVER LOST TRAVISCI VARIABLES – TWO WAYS".

Some explanation first:

• Why is it possible? Because Travis-CI would have to decrypt it into plain text and set it as an environment variable, for it to work on their machine. That is your chance to recover it.
• Yet echo $SECRET would NOT reveal it from console log, because Travis-CI scans all the stdout and filter that particular value. (Duh.) That's not a bad thing at all, because you won't want your recovered secret shown in the console log available to the world anyway. The solution is to encrypt it with another KNOWN_SECRET, with the help of a command line tool ccrypt which you would need to install.
• Lastly, you need another tool to encode the encrypted secret, for it to be show as normal characters in console log. Command line tool base64 comes in handy, as it is already available on Travis CI's build machines, and in your local git bash (if you are using git on Windows) or in your shell (if you are using Linux).

TL;DR: As easy as 1-2-3!

1. Add or modify your .travis.yml to contain the following content.

sudo: required
install:
  - sudo apt-get install -y ccrypt
  - echo $UNKNOWN_SECRET > info.txt
  - ccencrypt info.txt -K $KNOWN_SECRET
  - cat info.txt.cpt | base64

2. Commit the above change to an experimental branch, and trigger a Travis CI run. Browser the console log, to find that line of output, say, A1B2C3D4....

3. On your local machine, run this:

echo `A1B2C3D4...` | base64 -d > info.txt.cpt
sudo apt-get install -y ccrypt  # If you haven't already
ccrypt –d info.txt.cpt
# When prompt, type in the KNOWN_SECRET, and then you will have info.txt in plain text