How to decrypt a GPG encrypted file inside a Jenkins job using keychain and gpg-agent? [closed]
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
Recently, I encountered a use case where I needed to decryt GPG encrypted files within a Jenkins job on our Jenkins master (Centos 7.X).
I'm familiar with keychain which I use on a regular basis to managed protected SSH keys in Bash scripts, cron jobs and avoid any user interaction to provide passphrase for private key decryption. As Keychain is a wrapper for SSH & GPG agents, I tried to configure it to automatically provide passphrase to my GPG private key in order to decryt GPG encrypted file inside a Jenkins job.
So far, I haven't find a solution to use Keychain GPG agent and came with a workaround using Jenkins credential feature. In above code, $GPG_PASS is a Jenkins "Secret text" variable Binding which take advantage of Jenkins credentials builtin feature (eg. my GPG secret key passphrase being stored in a jenkins global credential).
gpg --batch --yes --passphrase "$GPG_PASS" -r "$key_id"
--output "$outfile" -d "$encryptedfile.gpg"
My requirements are that encrypted files are decrypted locally on Jenkins master inside a job without any priviledge escalation.
Note that Jenkins user shell point to "/bin/false"...
linux gpg gpg-agent jenkins keychain
asked Sep 25 at 8:09
donmelchior
1
closed as too broad by Goro, Romeo Ninov, countermode, RalfFriedl, X Tian Sep 27 at 8:55
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
add a comment |Â
up vote
0
down vote
favorite
Recently, I encountered a use case where I needed to decryt GPG encrypted files within a Jenkins job on our Jenkins master (Centos 7.X).
I'm familiar with keychain which I use on a regular basis to managed protected SSH keys in Bash scripts, cron jobs and avoid any user interaction to provide passphrase for private key decryption. As Keychain is a wrapper for SSH & GPG agents, I tried to configure it to automatically provide passphrase to my GPG private key in order to decryt GPG encrypted file inside a Jenkins job.
So far, I haven't find a solution to use Keychain GPG agent and came with a workaround using Jenkins credential feature. In above code, $GPG_PASS is a Jenkins "Secret text" variable Binding which take advantage of Jenkins credentials builtin feature (eg. my GPG secret key passphrase being stored in a jenkins global credential).
gpg --batch --yes --passphrase "$GPG_PASS" -r "$key_id"
--output "$outfile" -d "$encryptedfile.gpg"
My requirements are that encrypted files are decrypted locally on Jenkins master inside a job without any priviledge escalation.
Note that Jenkins user shell point to "/bin/false"...
linux gpg gpg-agent jenkins keychain
asked Sep 25 at 8:09
donmelchior
1
closed as too broad by Goro, Romeo Ninov, countermode, RalfFriedl, X Tian Sep 27 at 8:55
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
It's not really clear what your question is. Does yourgpgcommand not work from within your Jenkins job or something like that?
– jayhendren
Sep 26 at 15:57
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Recently, I encountered a use case where I needed to decryt GPG encrypted files within a Jenkins job on our Jenkins master (Centos 7.X).
I'm familiar with keychain which I use on a regular basis to managed protected SSH keys in Bash scripts, cron jobs and avoid any user interaction to provide passphrase for private key decryption. As Keychain is a wrapper for SSH & GPG agents, I tried to configure it to automatically provide passphrase to my GPG private key in order to decryt GPG encrypted file inside a Jenkins job.
So far, I haven't find a solution to use Keychain GPG agent and came with a workaround using Jenkins credential feature. In above code, $GPG_PASS is a Jenkins "Secret text" variable Binding which take advantage of Jenkins credentials builtin feature (eg. my GPG secret key passphrase being stored in a jenkins global credential).
gpg --batch --yes --passphrase "$GPG_PASS" -r "$key_id"
--output "$outfile" -d "$encryptedfile.gpg"
My requirements are that encrypted files are decrypted locally on Jenkins master inside a job without any priviledge escalation.
Note that Jenkins user shell point to "/bin/false"...
linux gpg gpg-agent jenkins keychain
asked Sep 25 at 8:09
donmelchior
1
Recently, I encountered a use case where I needed to decryt GPG encrypted files within a Jenkins job on our Jenkins master (Centos 7.X).
I'm familiar with keychain which I use on a regular basis to managed protected SSH keys in Bash scripts, cron jobs and avoid any user interaction to provide passphrase for private key decryption. As Keychain is a wrapper for SSH & GPG agents, I tried to configure it to automatically provide passphrase to my GPG private key in order to decryt GPG encrypted file inside a Jenkins job.
So far, I haven't find a solution to use Keychain GPG agent and came with a workaround using Jenkins credential feature. In above code, $GPG_PASS is a Jenkins "Secret text" variable Binding which take advantage of Jenkins credentials builtin feature (eg. my GPG secret key passphrase being stored in a jenkins global credential).
gpg --batch --yes --passphrase "$GPG_PASS" -r "$key_id"
--output "$outfile" -d "$encryptedfile.gpg"
My requirements are that encrypted files are decrypted locally on Jenkins master inside a job without any priviledge escalation.
Note that Jenkins user shell point to "/bin/false"...
linux gpg gpg-agent jenkins keychain
linux gpg gpg-agent jenkins keychain
asked Sep 25 at 8:09
donmelchior
1
asked Sep 25 at 8:09
donmelchior
1
asked Sep 25 at 8:09
donmelchior
1
asked Sep 25 at 8:09
donmelchior
1
asked Sep 25 at 8:09
donmelchior
1
1
closed as too broad by Goro, Romeo Ninov, countermode, RalfFriedl, X Tian Sep 27 at 8:55
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
closed as too broad by Goro, Romeo Ninov, countermode, RalfFriedl, X Tian Sep 27 at 8:55
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
It's not really clear what your question is. Does yourgpgcommand not work from within your Jenkins job or something like that?
– jayhendren
Sep 26 at 15:57
add a comment |Â
It's not really clear what your question is. Does yourgpgcommand not work from within your Jenkins job or something like that?
– jayhendren
Sep 26 at 15:57
It's not really clear what your question is. Does your
gpg command not work from within your Jenkins job or something like that?– jayhendren
Sep 26 at 15:57
It's not really clear what your question is. Does your
gpg command not work from within your Jenkins job or something like that?– jayhendren
Sep 26 at 15:57
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's not really clear what your question is. Does your
gpgcommand not work from within your Jenkins job or something like that?– jayhendren
Sep 26 at 15:57