Log public signing key thumbprint and signed step payload #2853
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…g step payloads before signing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
To aid debugging signing verification failures this PR introduces a new flag⚠️ Using
--debug-signingwhich will log to both agent and job logs the step payload as it is signed and verified. This will allow asserting the payloads match when tracking down the verification failures. This is intended for development debugging purposes.--debug-signingwill log the step payloads in full to the job logs when uploading steps, this could leak secrets to those with access to the build and thus the job logs.Context
Updates
go-pipelineto v0.10.0Changes
--debugthe thumbprint of a public key will be logged when signing or verifying stepsbuildkite-agent start--debug-signingEnable debug logging for pipeline signing. This can potentially leak secrets to the logs as it prints each step in full before signing. Requires debug logging to be enabled [$BUILDKITE_AGENT_DEBUG_SIGNING]buildkite-agent pipeline upload--debug-signingEnable debug logging for pipeline signing. This can potentially leak secrets to the logs as it prints each step in full before signing. Requires debug logging to be enabled [$BUILDKITE_AGENT_DEBUG_SIGNING]buildkite-agent tool sign--debug-signingEnable debug logging for pipeline signing. This can potentially leak secrets to the logs as it prints each step in full before signing. Requires debug logging to be enabled [$BUILDKITE_AGENT_DEBUG_SIGNING]Testing
go test ./...). Buildkite employees may check this if the pipeline has run automatically.go fmt ./...)