Skip to content

Support literal \n characters for GitHub App RSA Key #1341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
toast-gear opened this issue Oct 26, 2021 · 1 comment · Fixed by #1368
Closed

Support literal \n characters for GitHub App RSA Key #1341

toast-gear opened this issue Oct 26, 2021 · 1 comment · Fixed by #1368

Comments

@toast-gear
Copy link
Contributor

toast-gear commented Oct 26, 2021

Clarity on this section in the README.md:

Note that github_app.key_base64 needs to be the base64-encoded .pem file, i.e., the output of 
base64 app.private-key.pem (not directly the content of app.private-key.pem).

From that description I assume the base64 string once decoded must include new lines? If so I'd like to raise a feature request to support RSA keys with literal \n characters instead.

The reason I am asking is because the GitHub Terraform provider is a provider that you may use with this project to automate the creation of external webhooks with each runner groups API Gateway endpoint as the endpoint for its corresponding webhook. It would be cool if the behaviour of the 2 projects synced up in terms of how the provided credentials are processed. The specific behaviour I'd like see synced up is being introduced in the GitHub provider in this PR integrations/terraform-provider-github#931. I'd like to be able to store my RSA key in a single line with literal \n characters, I'd like this for a few reasons:

  1. It would be nice to mirror how the auth is processed with the GitHub terraform provider as it is likely that this project and that provider will be used in the same terraform apply e.g. create the webhook after deploying the philips-labs module. Keeping how credentials are handled in sync between the 2 projects will make storing and using the same credentials much easier.
  2. GitHub does not handle adding masks (add-mask) to multi-line variables very well. This has been refactored a few times but it still isn't great.
  3. GitHub makes injecting multi-line secrets into the $GITHUB_ENV a faff. It is far easier to inject single line variables into the $GITHUB_ENV and more generally work with compared to multi-line variables in GitHub Actions

EDIT I think the change is quite simple, I think we just need to do a find and replace here https://github.com/philips-labs/terraform-aws-github-runner/blob/develop/modules/runners/lambdas/runners/src/scale-runners/gh-auth.ts#L51 the same that has been done in the linked PR, then add a test case for both formats.

@toast-gear
Copy link
Contributor Author

toast-gear commented Oct 30, 2021

https://github.com/philips-labs/terraform-aws-github-runner/blob/develop/modules/runners/lambdas/runners/src/scale-runners/gh-auth.ts#L51

async function createAuth(installationId: number | undefined, ghesApiUrl: string): Promise<AuthInterface> {
  const appId = parseInt(await getParameterValue(process.env.PARAMETER_GITHUB_APP_ID_NAME));
  let authOptions: StrategyOptions = {
    appId,
    privateKey: Buffer.from(
      await getParameterValue(process.env.PARAMETER_GITHUB_APP_KEY_BASE64_NAME),
      'base64',
    // replace literal \n characters with new lines to allow the key to be stored as a 
    // single line variable. This logic should match how the GitHub Terraform provider 
    // processes private keys to retain compatibility
    ).toString().replace("/[\\n]/g", String.fromCharCode(10),
  };

I think something like this would do it?

I know nothing about writing tests though or I would raise the PR @npalm @gertjanmaas

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant