Is there way to include some sensitive credentials in builds?
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hello,
I am packaging one nice GUI application (newsflash) that is working
with API of some services like feedly. Those require some API key, but
I think it is against their rules to have it included in the plain-text
format in git. I am curious if there is a way how to get those passed
during the build. The key can be passed as an environment variable on
the user's system, but there is no way everybody will be getting their
own keys and I think this is non-trivial process.
I think shim does that by building unsigned copy, then signing it
outside of Fedora infrastructure and making signed build with prebuilt,
signed binaries. This would not help in my case.
Any ideas?
- --
Igor Raits <ignatenkobrain(a)fedoraproject.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEcwgJ58gsbV5f5dMcEV1auJxcHh4FAl7k5lUACgkQEV1auJxc
Hh4DJhAAr8lkzSGSZipWQA70K57+bLCQDv7M7igmQYo9vUVz3QH004aShKOZ7tmy
XWvkx/T/lNQ7V0ND1jvs74/NwskYYojPgTHNNTUtYOK1krmBtTGjcZcaR66CJXay
YZpUiYGouvFmHn15X9VDGO0uoMM4kAPWhdkZ1/Ruw5cSfwSZMW7j48WPaeu6iYNj
zujO3hyIfkv5TY323Wx1x8MfPyH5IgwOmZ/OiCyW6mmJaXBj+P+qgMuWZnmkrxea
prfK6/Amb8HOm8AbbSN6Cg+jszcRGSAdkSNEPG7ryGbOtWI1SnuzbIqMv3ffE2Rm
5eO9Ycgo9HGDFNLuEMOCT8CkNdl4kf/wYvd3TjktfFQxyqJIJXFlnAWuZJa4i+6Z
fq5XIAsmu9aPftKjmF7kYusN0UZQ3Z7Fq0wphdOgPd9wXnGjdeqy/7tkopHSgTJ6
9mxYkXUPmD8kI9LyCVCZOltGsArB1X0GmRaiGnTsfd2H33JQY38+kv2OO1kP6pkG
F+osagb3E3rW8cAxWuKWLgx5ElCbLTbe1gdPwNi2gvYEtExxkMqdJAnujkkGXoQk
zkKi/KsQrcEj69M83t19GxaaxMc4Ns8ccin9vYe09ffCJKsUUTgvxvCFBtmpSim6
NHx7y8h2VezuF2D4hmR6Q0Vw3Y/EXRPU/7euBl6/Gc6z3+5OzmM=
=9tek
-----END PGP SIGNATURE-----
On 13.06.2020 16:44, Igor Raits wrote:
I am packaging one nice GUI application (newsflash) that is working
with API of some services like feedly. Those require some API key, but
I think it is against their rules to have it included in the plain-text
format in git.
All API keys must be present in dist-git (check Telegram Desktop package
for example). Anyone can download SRPM and should be able to rebuild it.
--
Sincerely,
Vitaly Zaitsev (vitaly(a)easycoding.org)
Igor Raits wrote:
I am packaging one nice GUI application (newsflash) that is working
with API of some services like feedly. Those require some API key, but
I think it is against their rules to have it included in the plain-text
format in git. I am curious if there is a way how to get those passed
during the build. The key can be passed as an environment variable on
the user's system, but there is no way everybody will be getting their
own keys and I think this is non-trivial process.
Unfortunately, this whole API key concept is inherently incompatible with
the concept of Free Software.
The only thing that you can do is to get an API key for Fedora, ship it in
dist-git no matter what the service's TOS say, and hope they won't ban the
key. (Most services actually don't, because they know that their rules are
not realistically enforcible to the letter for Free Software.) If they do
ban the key, there is not much we can do unfortunately.
Kevin Kofler
1434
days inactive
1437
days old
2 comments
3 participants
tags (0)
participants (3)
-
Igor Raits -
Kevin Kofler -
Vitaly Zaitsev