Keep secrets out of argv and scope the explicit-creds skip to artifactapi

Makefile

@@ -7,3 +7,4 @@ build:
 
 test: build
 	docker run --rm -v $(CURDIR):/src:ro,z --entrypoint sh $(IMAGE) /src/test/login_test.sh
+	test "$$(docker run --rm -v $(CURDIR)/test/stub-entrypoint.sh:/usr/local/bin/dockerd-entrypoint.sh:ro,z $(IMAGE) a 'b c')" = "plugin-docker-buildx|a|b c"

artifactapi-login.sh

@@ -8,7 +8,7 @@ warn() { echo "artifactapi-login: $*, pushing unauthenticated" >&2; }
 artifactapi_login() {
   [ "${PLUGIN_DRY_RUN:-false}" != true ] || return 0
   case "${PLUGIN_REGISTRY:-} ${PLUGIN_REPO:-}" in *"$ARTIFACTAPI_HOST"*) ;; *) return 0 ;; esac
-  [ -z "${PLUGIN_USERNAME:-}${PLUGIN_PASSWORD:-}" ] || return 0
+  case "${PLUGIN_REGISTRY:-}" in *"$ARTIFACTAPI_HOST"*) [ -z "${PLUGIN_USERNAME:-}${PLUGIN_PASSWORD:-}" ] || return 0 ;; esac
   case "${PLUGIN_LOGINS:-}" in *"$ARTIFACTAPI_HOST"*) return 0 ;; esac
 
   sa=${SA_TOKEN_FILE:-/var/run/secrets/kubernetes.io/serviceaccount/token}
@@ -17,14 +17,15 @@ artifactapi_login() {
   role=${PLUGIN_VAULT_ROLE:-woodpecker_artifactapi_writer}
   oidc_role=${PLUGIN_VAULT_OIDC_ROLE:-artifactapi-writer}
 
-  client_token=$(jq -nc --arg role "$role" --arg jwt "$(cat "$sa")" '{role:$role,jwt:$jwt}' |
+  client_token=$(SA_JWT=$(cat "$sa") jq -nc --arg role "$role" '{role:$role,jwt:env.SA_JWT}' |
     curl -sfS --max-time 30 -X POST --data @- "$vault/v1/auth/k8s/au/syd1/login" |
     jq -er .auth.client_token) || { warn "vault login as $role failed"; return 0; }
-  token=$(curl -sfS --max-time 30 -H "X-Vault-Token: $client_token" "$vault/v1/identity/oidc/token/$oidc_role" |
+  token=$(printf 'X-Vault-Token: %s\n' "$client_token" |
+    curl -sfS --max-time 30 -H @- "$vault/v1/identity/oidc/token/$oidc_role" |
     jq -er .data.token) || { warn "reading identity/oidc/token/$oidc_role failed"; return 0; }
 
   PLUGIN_LOGINS=$(printf '%s' "${PLUGIN_LOGINS:-[]}" |
-    jq -c --arg r "$ARTIFACTAPI_HOST" --arg p "$token" '. + [{registry:$r,username:"woodpecker",password:$p}]') ||
+    OIDC_JWT=$token jq -c --arg r "$ARTIFACTAPI_HOST" '. + [{registry:$r,username:"woodpecker",password:env.OIDC_JWT}]') ||
     { warn "PLUGIN_LOGINS is not valid JSON"; return 0; }
   export PLUGIN_LOGINS
   echo "artifactapi-login: logged in to $ARTIFACTAPI_HOST via vault role $role" >&2

test/login_test.sh

@@ -8,11 +8,15 @@ REG=artifactapi.k8s.syd1.au.unkin.net
 OK_LOGIN='{"registry":"'$REG'","username":"woodpecker","password":"oidc-jwt"}'
 VAULT_FAIL=
 
+no_secret_argv() { case "$*" in *sa-jwt*|*s.client*|*oidc-jwt*) echo "secret in argv: $*" >&2; return 99 ;; esac; }
+jq() { no_secret_argv "$@" && command jq "$@"; }
+
 curl() {
   [ -z "$VAULT_FAIL" ] || return 22
+  no_secret_argv "$@" || return
   case "$*" in
     *auth/k8s/au/syd1/login*) grep -q '"role":"woodpecker_artifactapi_writer","jwt":"sa-jwt"' && echo '{"auth":{"client_token":"s.client"}}' ;;
-    *"X-Vault-Token: s.client"*identity/oidc/token/artifactapi-writer) echo '{"data":{"token":"oidc-jwt"}}' ;;
+    *"-H @-"*identity/oidc/token/artifactapi-writer) grep -qx 'X-Vault-Token: s.client' && echo '{"data":{"token":"oidc-jwt"}}' ;;
     *) return 22 ;;
   esac
 }
@@ -32,6 +36,7 @@ check "existing logins kept" '[{"registry":"r","username":"u","password":"p"},'"
 check "other registry skipped" "" PLUGIN_REPO=git.unkin.net/unkin/x
 check "dry run skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_DRY_RUN=true
 check "explicit creds skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
+check "creds for another registry still log in" "[$OK_LOGIN]" PLUGIN_REGISTRY=git.unkin.net PLUGIN_REPO=$REG/docker-internal/x PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
 check "explicit login skipped" '[{"registry":"'$REG'"}]' PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"'$REG'"}]'
 check "missing sa token is anonymous" "" PLUGIN_REGISTRY=$REG SA_TOKEN_FILE=/nonexistent
 check "vault failure is anonymous" "" PLUGIN_REGISTRY=$REG VAULT_FAIL=1

test/stub-entrypoint.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+IFS="|"; echo "$*"