ciecleci/androidのOpenSSLに気をつけよう

2017年10月27日（金）に開催されたshibuya.apk #19にて発表した資料になります

Transcript

1. circleci/androidͷ
   OpenSSLʹؾΛ͚ͭΑ͏
   @yamacraft
   

   View Slide

2. profile
   • @yamacraft (Wataru Yamada)
   • Mobile Application Engineer
   • LeadingMark, inc
   • team Y.G.E.(private)
   • Ұ෦دߘ → → →
   

   View Slide

3. αϯϓϧϓϩδΣΫτ
   https://github.com/yamacraft/android.RequestPermissions
   

   View Slide

4. લஔ͖
   • ઌ΄ͲͷϓϩδΣΫτ͸Circle CI 1.0ͰϏϧυ͢Δ࢓૊ΈΛೖ
   Ε͍ͯͨ
   • Circle CI 2.0ͩͱϏϧυ΋ૣ͘ͳΔͱฉ͍ͨͷͰɺࢼ͠ʹରԠ
   ͯ͠ΈΑ͏ͱࢥͬͨ
   • ͪͳΈʹൿಗ৘ใ͸OpenSSLͰ҉߸Խͨ͠ϑΝΠϧʹೖΕͯ
   ͍Δʢ1.0࣌୅ʹެ͕ࣜҊ಺ͯͨ͠ํ๏Λ࠾༻ʣ
   • https://github.com/circleci/encrypted-files
   

   View Slide

5. Circle CI2.0Ͱઃఆͨ͠಺༰
   • image͸ެࣜͷcircleci/androidΛ࢖༻
   • OpenSSLͰ҉߸Խͨ͠ϑΝΠϧΛ෮ݩ͠ɺγ
   εςϜͷ؀ڥม਺ʹ૊ΈࠐΉ
   • ͋ͱ͸./gradlew build͢Δ͚ͩ
   

   View Slide

6. decryptͰ͖ͳ͍…
   

   View Slide

7. Ͳ͏ͯ͠…
   • circleci/android(apt)ͷOpenSSL͸ 1.1.0f
   • mac OS(homebrew)ͷOpenSSL͸1.0.2l
   • 1.1.0͔Βޓ׵ੑʹͪΐͬͱ໰୊ʢ࢓༷มߋʣ
   ͕͋ΔΒ͍͠…
   

   View Slide

8. ৄࡉ
   • OpenSSL1.1.0ͱҎલͷόʔδϣϯͱͷޓ׵ੑ
   • https://http2.try-and-test.net/openssl1_1_0_tips.html
   

   View Slide

9. ͰɺͲ͏ͨ͠ͷʁ
   • ҉߸ԽϑΝΠϧΛ࡞Δ࣌ʹɺҰํ޲ؔ਺Λ
   sha256ࢦఆ͢ΔΦϓγϣϯΛࢦఆͯ͠ੜ੒͢
   Δͱ෮߸ԽͰ͖ΔΑ͏ʹͳΔ
   • openssl aes-256-cbc -md sha256 -e -in
   secret-env-plain -out secret-env-cipher -k
   $KEY
   

   View Slide

10. ϏϧυͰ͖ͨʂ
    

    View Slide

11. ·ͱΊ
    OpenSSLͷόʔδϣϯҧ͍ʹ͸ؾΛ͚ͭΑ͏ʂ
    

    View Slide

12. ͓͠·͍
    

    View Slide