Passing Bamboo password variable to a script task

[D K]

I'm trying to pass a bamboo variable service.password to a Script Task running docker-compose.

My docker compose takes this as an environment variable but what I get is the mask ****** instead of the password string.

My Docker-compose file

version: '2'

services:

  myapp:

    build:

      context: myapp

      args:

        - SERVICE_USERNAME=${bamboo.service.username}

        - SERVICE_PASSWORD=${bamboo.service.password}

I've also tried write the variables to a properties file .env with another Script task but that also just gets the password mask **** instead of the actual password string

[rsperafico · Accepted solution]

Hello D K,

After reviewing the information provided and running some tests, I was able to replicate the issue in Bamboo v5.14.3.1 (latest till present) and the following was raised in our issue tracker:

• https://jira.atlassian.com/browse/BAM-18142

I would suggest you on voting to the link above as well as adding comments and becoming a watcher.

—

Kind regards,

Rafael P. Sperafico
Atlassian

[eric_giguere_bell]

HI

I cannot vote for the issue, and I really want to!

This is a very serious issue and its broken only for global variables.

So if you have globals, treated as passwords, they don't get replace in in-line scripts or in scripts.

I have found a way that works, with both in-line and scrits, you must use the following syntax: $bamboo_BAMBOO_RW_PASSWORD

Where BAMBOO_RW_PASSWORD is the global variable

Note that the prefix must be in lowercase, and no curlies arount the value.

Thanks

[Przemek Bruski]

How do you know you're getting the password mask? Did you see it in that file or did you see that in the log file?

[D K]

I ran docker-compose config on the docker-compose.yml

[D K]

And also cat .env

[Przemek Bruski]

cat .env from the command line or in the build? Anything that includes your password in the log file will be obfuscated, including cat and echo.

[jvelapol]

Yeah, I'm going to second Przemyslaw's response - anything I write out in a Bamboo task masks anything that has the contents of a variable whose name includes "password" (amusing note - for testing purposes, we use "oracle" as a password in a docker container used for test purposes only - it's amusing to see the number of times we use "oracle" for things like "jdbc-oracle-1.2.4.jar", or in the build output's case "jdbc-*************-1.2.3.jar")

Anyway, I've done things like "env > .env" and then manually logged in to the underlying host (from my desktop:

ssh bamboo-server.env && cat /path/to/bamboo-home/xml-data/build-dir/AAA-BBB-CCC/.env

) and the right values are stored. An alternative way to do that is to set the .env file as an artifact of the build, and you can inspect it manually (though I'd be a bit careful with who can see that artifact, naturally)