Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/recover.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Recovering secrets

# Assumption:
# You've created the following GitHub secrets in your repository:
# MY_CLIENT_SECRET - encrypt/decrypt with openssl - useful for public and public repositories
# MY_OPENSSL_PASSWORD - used to protect secrets
# MY_OPENSSL_ITER - Use a number of iterations on the password to derive the encryption key.
# High values increase the time required to brute-force the resulting file.
# This option enables the use of PBKDF2 algorithm to derive the key.

on:
push:
workflow_dispatch:

jobs:
openssl:
name: Recover With OpenSSL
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- env:
MY_CLIENT_SECRET: ${{ secrets.ARTIFACTORY_PASS }}
MY_OPENSSL_PASSWORD: ${{ secrets.MY_OPENSSL_PASSWORD }}
MY_OPENSSL_ITER: ${{ secrets.MY_OPENSSL_ITER }}
run: |
echo "MY_CLIENT_SECRET (***) = ${MY_CLIENT_SECRET}"
echo "MY_CLIENT_SECRET (openssl) = $(echo "${MY_CLIENT_SECRET}" | openssl enc -e -aes-256-cbc -a -pbkdf2 -iter ${MY_OPENSSL_ITER} -k "${MY_OPENSSL_PASSWORD}")"
echo "Copy the above value, and then execute locally:"
echo "echo PASTE_HERE | openssl base64 -d | openssl enc -d -pbkdf2 -iter \$MY_OPENSSL_ITER -aes-256-cbc -k \$MY_OPENSSL_PASSWORD"
Loading