RTDEV-101449 - Samples-key-not-on-argv

.github/workflows/anchore-sbom-evidence-example.yml

@@ -45,12 +45,24 @@ jobs:
 
       # Attaching the evidence to associated package
       - name: Attach evidence using jfrog cli
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf evd create \
               --package-name $IMAGE_NAME \
               --package-version $VERSION \
               --package-repo-name $REPO_NAME \
-              --key "${{ secrets.PRIVATE_KEY }}" \
+              --key "$evidence_signing_key_file" \
               --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
               --predicate ./anchore-sbom.json \
               --predicate-type http://anchore.com/syft/sbom/v1 \

.github/workflows/anchore-scan-evidence-example.yml

@@ -47,12 +47,24 @@ jobs:
 
       # Attaching the evidence to associated package
       - name: Attach evidence using jfrog cli
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf evd create \
             --package-name $IMAGE_NAME \
             --package-version $VERSION \
             --package-repo-name $REPO_NAME \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
             --predicate ./anchore-scan-results.sarif \
             --predicate-type http://anchore.com/grype/vulnerabilities/v1 \

.github/workflows/blazemeter-evidence-example.yml

@@ -83,12 +83,24 @@ jobs:
 
       - name: Attach evidence to the package
         working-directory: examples/blazemeter
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf evd create \
           --package-name $IMAGE_NAME \
           --package-version $TAG_NAME \
           --package-repo-name $REPO_NAME \
-          --key "${{ secrets.PRIVATE_KEY }}" \
+          --key "$evidence_signing_key_file" \
           --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \
           --predicate "blazemeter-predicate.json" \
           --predicate-type "http://blazemeter.com/performance-results/v1" \

.github/workflows/build-and-deploy.yml

@@ -45,18 +45,42 @@ jobs:
           jf rt build-docker-create example-project-docker-dev --image-file build-metadata --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }}
 
       - name: Evidence on docker
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json
           jf evd create --package-name example-project-app --package-version ${{ github.run_number }} --package-repo-name example-project-docker-dev-local \
-            --key "${{ secrets.PRIVATE_KEY }}"  --key-alias KEY-ALIAS \
+            --key "$evidence_signing_key_file"  --key-alias KEY-ALIAS \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 
           echo '🔎 Evidence attached: `signature` 🔏 ' 
 
       - name: Upload readme file
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf rt upload ./README.md example-project-generic-dev/readme/${{ github.run_number }}/ --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }}
           jf evd create --subject-repo-path example-project-generic-dev/readme/${{ github.run_number }}/README.md \
-            --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS  \
+            --key "$evidence_signing_key_file" --key-alias KEY-ALIAS  \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1
 
       - name: Collecting Information from Git
@@ -69,11 +93,23 @@ jobs:
         run: jfrog rt build-publish ${{ vars.BUILD_NAME }} ${{ github.run_number }}
 
       - name: Sign build evidence
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json
           jf evd create --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/build-signature/v1 \
-            --key "${{ secrets.PRIVATE_KEY }}"  --key-alias KEY-ALIAS
+            --key "$evidence_signing_key_file"  --key-alias KEY-ALIAS
           echo '🔎 Evidence attached: `build-signature` 🔏 ' >> $GITHUB_STEP_SUMMARY
 
       - name: Create release bundle
@@ -102,13 +138,25 @@ jobs:
           echo "🚀 Succesfully promote to \`QA\` environemnt" >> $GITHUB_STEP_SUMMARY
 
       - name: Evidence on release-bundle
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'", "test": "CI test", "result": "success" }' > test_evidence.json
           JF_LINK=${{ vars.ARTIFACTORY_URL }}'/ui/artifactory/lifecycle/?bundleName='${{ vars.BUNDLE_NAME }}'&bundleToFlash='${{ vars.BUNDLE_NAME }}'&releaseBundleVersion='${{ github.run_number }}'&repositoryKey=release-bundles-v2&activeVersionTab=Version%20Timeline&activeKanbanTab=promotion'
           echo 'Test on Release bundle ['${{ vars.BUNDLE_NAME }}':'${{ github.run_number }}']('${JF_LINK}') success' >> $GITHUB_STEP_SUMMARY
           jf evd create --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \
             --predicate ./test_evidence.json --predicate-type https://jfrog.com/evidence/testing-results/v1 \
-            --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS
+            --key "$evidence_signing_key_file" --key-alias KEY-ALIAS
           echo '🔎 Evidence attached: integration-test 🧪 ' >> $GITHUB_STEP_SUMMARY
 
 
@@ -145,9 +193,21 @@ jobs:
           echo "RESULT=$result" >> $GITHUB_ENV
 
       - name: Promote to Production
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           if [ "${{ env.RESULT }}" == "true" ]; then
-            jf evd create --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS \
+            jf evd create --key "$evidence_signing_key_file" --key-alias KEY-ALIAS \
               --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \
               --predicate ./policy.json --predicate-type https://jfrog.com/evidence/approval/v1
             jf release-bundle-promote ${{ vars.BUNDLE_NAME }} ${{ github.run_number }} PROD --signing-key PGP-RSA-2048  --sync=true

.github/workflows/build.yml

@@ -46,29 +46,65 @@ jobs:
           jfrog rt build-docker-create example-project-docker-dev --image-file build-metadata --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }}
 
       - name: Evidence on docker
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json
           jf evd create --package-name example-project-app --package-version 65 --package-repo-name example-project-docker-dev-local \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 
           echo '🔎 Evidence attached: `signature` 🔏 ' 
 
       - name: Upload readme file
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf rt upload ./README.md example-project-generic-dev/readme/${{ github.run_number }}/ --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }}
           jf evd create --subject-repo-path example-project-generic-dev/readme/${{ github.run_number }}/README.md \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1
 
       - name: Publish build info
         run: jfrog rt build-publish ${{ vars.BUILD_NAME }} ${{ github.run_number }}
 
       - name: Sign build evidence
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json
           jf evd create --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} \
             --predicate ./sign.json --predicate-type https://jfrog.com/evidence/build-signature/v1 \
-            --key "${{ secrets.PRIVATE_KEY }}"
+            --key "$evidence_signing_key_file"
           echo '🔎 Evidence attached: `build-signature` 🔏 ' >> $GITHUB_STEP_SUMMARY
 
       - name: Create release bundle
@@ -80,11 +116,23 @@ jobs:
           echo '📦 Release bundle ['${{ vars.BUNDLE_NAME }}']('${NAME_LINK}'):['${{ github.run_number }}']('${VER_LINK}') created' >> $GITHUB_STEP_SUMMARY
 
       - name: Evidence on release-bundle v2
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > rbv2_evidence.json
           JF_LINK=${{ vars.ARTIFACTORY_URL }}'/ui/artifactory/lifecycle/?bundleName='${{ vars.BUNDLE_NAME }}'&bundleToFlash='${{ vars.BUNDLE_NAME }}'&releaseBundleVersion='${{ github.run_number }}'&repositoryKey=release-bundles-v2&activeVersionTab=Version%20Timeline&activeKanbanTab=promotion'
           echo 'Test on Release bundle ['${{ vars.BUNDLE_NAME }}':'${{ github.run_number }}']('${JF_LINK}') success' >> $GITHUB_STEP_SUMMARY
           jf evd create --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \
             --predicate ./rbv2_evidence.json --predicate-type https://jfrog.com/evidence/testing-results/v1 \
-            --key "${{ secrets.PRIVATE_KEY }}"
+            --key "$evidence_signing_key_file"
           echo '🔎 Evidence attached: integration-test 🧪 ' >> $GITHUB_STEP_SUMMARY

.github/workflows/codeql-evidence-example.yml

@@ -82,14 +82,26 @@ jobs:
 
       # Attaching the evidence to associated package
       - name: Attach Evidence using JFrog CLI
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           if [ ${{ matrix.language_details.name }} == 'go' ]; then
             PACKAGE_VERSION="v0.0.${{ github.run_number }}"
             jf evd create \
             --package-name "jfrog.com/mygobuild" \
             --package-version $PACKAGE_VERSION \
             --package-repo-name go-local \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
             --predicate "results-go/go.sarif" \
             --predicate-type "http://github.com/CodeQL/static-analysis" \
@@ -100,7 +112,7 @@ jobs:
             --package-name my-javascript-build \
             --package-version $PACKAGE_VERSION \
             --package-repo-name javascript-local \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
             --predicate "results-javascript/javascript.sarif" \
             --predicate-type "http://github.com/CodeQL/static-analysis" \

.github/workflows/cypress-evidence-example.yml

@@ -65,12 +65,24 @@ jobs:
       #Steps to attach evidence to the package
       - name: Attach evidence to the package
         working-directory: examples/cypress
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf evd create \
           --package-name $IMAGE_NAME \
           --package-version $TAG_NAME \
           --package-repo-name $REPO_NAME \
-          --key "${{ secrets.PRIVATE_KEY }}" \
+          --key "$evidence_signing_key_file" \
           --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \
           --predicate "reports/overall-report.json" \
           --predicate-type "http://cypress.io/test-results/v1" \

.github/workflows/dependabot-evidence-example.yml

@@ -74,12 +74,24 @@ jobs:
 
       # Attaching the evidence to associated package
       - name: Attach Evidence using JFrog CLI
+        env:
+          EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }}
         run: |
+          umask 077
+          if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then
+            echo "Evidence signing key is empty" >&2
+            exit 1
+          fi
+          evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key"
+          printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file"
+          chmod 600 "$evidence_signing_key_file"
+          unset EVIDENCE_SIGNING_KEY
+          trap 'rm -f "$evidence_signing_key_file"' EXIT
           jf evd create \
             --package-name $IMAGE_NAME \
             --package-version $VERSION \
             --package-repo-name $REPO_NAME \
-            --key "${{ secrets.PRIVATE_KEY }}" \
+            --key "$evidence_signing_key_file" \
             --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
             --predicate ./dependabot.json \
             --predicate-type http://Github.com/Dependabot/static-analysis \