bin/setup-circleci-secrets: possibly use generic credentials

If the $SECRET_SCRIPT environment variable is defined in CircleCI, this
can override the GCE credentials.

I now use "base64" instead of "openssl base64" in order to support long
lines in base64 text. It's useful when the text comes from a long
environment variable like $SECRET_SCRIPT defined in CircleCI.

Also, the $PROJECT environment variable can now override the GCE project
name. Before, it needed to be named scope-integration-tests.

This was initially merged in https://github.com/weaveworks/scope/pull/2223
Then, reverted in https://github.com/weaveworks/scope/pull/2229

Since then, it has the following fixes:

 1. fix shell "unbound variable"

Since this shell script uses "set -u", we must not use unset variables
directly.

Symptoms:
> https://circleci.com/gh/weaveworks/scope/6384
> bin/setup-circleci-secrets: line 10: SECRET_SCRIPT: unbound variable

Instead, we should use the parameter expansion "+" to test if the
variable is set. See:
http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_06_02

 2. return value of read

I use the builtin "read" and this returns a non-zero value when reading
until EOF. I use "|| true" to accept that.
This commit is contained in:
Alban Crequy
2017-02-10 11:46:27 +01:00
committed by Alessandro Puccetti
parent d1f5fcaaec
commit e031728b04

View File

@@ -5,9 +5,9 @@ set -eu
# openssl enc -in do-setup-circleci-secrets.orig -out setup-circleci-secrets.orig -e -aes256 -pass stdin
# openssl base64 < setup-circleci-secrets.orig
openssl base64 -d <<EOF | openssl enc \
-out bin/do-setup-circleci-secrets \
-d -aes256 -pass pass:"$1"
if [ -z "${SECRET_SCRIPT+x}" ]; then
# "read" return a non-zero value when reading until EOF, see "help read"
read -r -d '' SECRET_SCRIPT <<EOF || true
U2FsdGVkX193YHZJXNzxU9GqigQaXWrA0AKd+BIjRcx7bmmKn/zSgOv+FfApRRjn
KGBd2ulZw9CwsftX0HWHzVdtpgqbJUW+FEma8eNldau4/f+T+yWTVpCNQXGc3DvB
cWYhmkoTfGWmI2v/0/Bv2TYkw7MAfjCocdluFAv7sSvYnSgIjoYxD4XXkTjLWy1P
@@ -104,5 +104,10 @@ LrFefj0OWhRx4w7pblAnZqUSYunhhhUYimEG40GkM1ZI9b0vDmbgQP/UxMj1M2yB
aVSSW69rmjO7xjVuJnm+wNq2P3H3MFB5MaswXrn2Ah83K4oegpannt7H1nG+mWh/
DJcoVj5UyCTFEyZMdtVWloF4TOVODNNxA+zAE9fUgrI=
EOF
fi
echo "${SECRET_SCRIPT}" | base64 -d | openssl enc \
-out bin/do-setup-circleci-secrets \
-d -aes256 -pass pass:"$1"
exec sh bin/do-setup-circleci-secrets