Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ciecleci/androidのOpenSSLに気をつけよう

yamacraft
October 27, 2017

 ciecleci/androidのOpenSSLに気をつけよう

2017年10月27日(金)に開催されたshibuya.apk #19にて発表した資料になります

yamacraft

October 27, 2017
Tweet

More Decks by yamacraft

Other Decks in Technology

Transcript

  1. circleci/androidͷ
    OpenSSLʹؾΛ͚ͭΑ͏
    @yamacraft

    View Slide

  2. profile
    • @yamacraft (Wataru Yamada)
    • Mobile Application Engineer
    • LeadingMark, inc
    • team Y.G.E.(private)
    • Ұ෦دߘ → → →

    View Slide

  3. αϯϓϧϓϩδΣΫτ
    https://github.com/yamacraft/android.RequestPermissions

    View Slide

  4. લஔ͖
    • ઌ΄ͲͷϓϩδΣΫτ͸Circle CI 1.0ͰϏϧυ͢Δ࢓૊ΈΛೖ
    Ε͍ͯͨ
    • Circle CI 2.0ͩͱϏϧυ΋ૣ͘ͳΔͱฉ͍ͨͷͰɺࢼ͠ʹରԠ
    ͯ͠ΈΑ͏ͱࢥͬͨ
    • ͪͳΈʹൿಗ৘ใ͸OpenSSLͰ҉߸Խͨ͠ϑΝΠϧʹೖΕͯ
    ͍Δʢ1.0࣌୅ʹެ͕ࣜҊ಺ͯͨ͠ํ๏Λ࠾༻ʣ
    • https://github.com/circleci/encrypted-files

    View Slide

  5. Circle CI2.0Ͱઃఆͨ͠಺༰
    • image͸ެࣜͷcircleci/androidΛ࢖༻
    • OpenSSLͰ҉߸Խͨ͠ϑΝΠϧΛ෮ݩ͠ɺγ
    εςϜͷ؀ڥม਺ʹ૊ΈࠐΉ
    • ͋ͱ͸./gradlew build͢Δ͚ͩ

    View Slide

  6. decryptͰ͖ͳ͍…

    View Slide

  7. Ͳ͏ͯ͠…
    • circleci/android(apt)ͷOpenSSL͸ 1.1.0f
    • mac OS(homebrew)ͷOpenSSL͸1.0.2l
    • 1.1.0͔Βޓ׵ੑʹͪΐͬͱ໰୊ʢ࢓༷มߋʣ
    ͕͋ΔΒ͍͠…

    View Slide

  8. ৄࡉ
    • OpenSSL1.1.0ͱҎલͷόʔδϣϯͱͷޓ׵ੑ
    • https://http2.try-and-test.net/openssl1_1_0_tips.html

    View Slide

  9. ͰɺͲ͏ͨ͠ͷʁ
    • ҉߸ԽϑΝΠϧΛ࡞Δ࣌ʹɺҰํ޲ؔ਺Λ
    sha256ࢦఆ͢ΔΦϓγϣϯΛࢦఆͯ͠ੜ੒͢
    Δͱ෮߸ԽͰ͖ΔΑ͏ʹͳΔ
    • openssl aes-256-cbc -md sha256 -e -in
    secret-env-plain -out secret-env-cipher -k
    $KEY

    View Slide

  10. ϏϧυͰ͖ͨʂ

    View Slide

  11. ·ͱΊ
    OpenSSLͷόʔδϣϯҧ͍ʹ͸ؾΛ͚ͭΑ͏ʂ

    View Slide

  12. ͓͠·͍

    View Slide