Skip to content

Commit 7d28a44

Browse files
committed
Encrypt the private SSH key as a Travis secure environment variable
This is to demonstrate that this doesn't actually work. See #349 (comment). The private key is too large to be encrypted with the Travis public key. Instead we have to do what we are currently doing. Create a symmetric encryption key to encrypt the actual SSH key, and then encrypt that symmetric key into the secure environment variable (and save the encrypted SSH private key to a file).
1 parent 6b30470 commit 7d28a44

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

doctr/__main__.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -506,14 +506,16 @@ def configure(args, parser):
506506
private_ssh_key, public_ssh_key = generate_ssh_key()
507507
if args.dkenv:
508508
key = None # don't need it on disk
509-
encrypted_variable = None # not applicable
510-
private_ssh_key = private_ssh_key.decode('ASCII') # Will print this later!
509+
encrypted_variable = encrypt_variable(env_name.encode('utf-8') + b"=" +
510+
private_ssh_key.replace(b'\n', br'\n').replace(b' ', br'\ '),
511+
build_repo=build_repo, tld=tld,
512+
travis_token=travis_token, **login_kwargs)
511513
else:
512514
key = encrypt_to_file(private_ssh_key, keypath + '.enc')
513515
encrypted_variable = encrypt_variable(env_name.encode('utf-8') + b"=" + key,
514516
build_repo=build_repo, tld=tld,
515517
travis_token=travis_token, **login_kwargs)
516-
private_ssh_key = None # Prevent accidental use below
518+
private_ssh_key = None # Prevent accidental use below
517519
public_ssh_key = public_ssh_key.decode('ASCII')
518520

519521
deploy_keys_url = 'https://github.com/{deploy_repo}/settings/keys'.format(deploy_repo=deploy_key_repo)
@@ -565,7 +567,6 @@ def configure(args, parser):
565567
repository settings as environment variable {env_name}:{RESET}
566568
""".format(N=N, BOLD_MAGENTA=BOLD_MAGENTA, RESET=RESET,
567569
env_name=args.dkenv, private_ssh_key=private_ssh_key)))
568-
print(private_ssh_key)
569570

570571
print(dedent("""\
571572
{N}. {BOLD_MAGENTA}Add these lines to your `.travis.yml` file:{RESET}

0 commit comments

Comments
 (0)