Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Print stderr when token decryption fails. #2008

Merged
merged 1 commit into from
Jul 23, 2024
+32 −25
Merged

Print stderr when token decryption fails. #2008

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 32 additions & 25 deletions buildkite/bazelci.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -911,31 +911,38 @@ def wait_build_to_finish(self, build_number, interval_time=30, logger=None):


def decrypt_token(encrypted_token, kms_key, project="bazel-untrusted"):
return (
subprocess.check_output(
[
gcloud_command(),
"kms",
"decrypt",
"--project",
project,
"--location",
"global",
"--keyring",
"buildkite",
"--key",
kms_key,
"--ciphertext-file",
"-",
"--plaintext-file",
"-",
],
input=base64.b64decode(encrypted_token),
env=os.environ,
try:
return (
subprocess.run(
[
gcloud_command(),
"kms",
"decrypt",
"--project",
project,
"--location",
"global",
"--keyring",
"buildkite",
"--key",
kms_key,
"--ciphertext-file",
"-",
"--plaintext-file",
"-",
],
input=base64.b64decode(encrypted_token),
env=os.environ,
check=True,
stdout=subprocess.PIPE, # We cannot use capture_output since some workers run Python <3.7
stderr=subprocess.PIPE, # We cannot use capture_output since some workers run Python <3.7
)
.decode("utf-8")
.strip()
)
.decode("utf-8")
.strip()
)
except subprocess.CalledProcessError as ex:
cause = ex.stderr.decode("utf-8")
raise BuildkiteException(f"Failed to decrypt token:\n{cause}")


def eprint(*args, **kwargs):
Expand Down Expand Up @@ -1449,7 +1456,7 @@ def PrepareRepoInCwd(print_cmd_groups, initial_setup=False):
test_bep_file = os.path.join(tmpdir, _TEST_BEP_FILE)
# Create an empty test_bep_file so that the bazelci-agent can start to follow the file right away. Otherwise,
# there is a race between when bazelci-agent starts to read the file and when Bazel creates the file.
open(test_bep_file, 'w').close()
open(test_bep_file, "w").close()
with concurrent.futures.ThreadPoolExecutor() as executor:
future = executor.submit(
upload_test_logs_from_bep, test_bep_file, tmpdir, monitor_flaky_tests
Expand Down