android build release apk on jenkins, without storing my password in plain text

Question

I need to be able to build the release version of my apk, using a Jenkins job.

From reading the following SO question

How to create a release signed apk file using Gradle?

I understand I can do it in one of two ways. Either get the user to enter the password at cmd prompt, or store my password details in a plain text file that doesn't get committed to git, and lives on my local machine.

Neither of these will work when running the build job on jenkins though. 1) I can't gain user input because this may be running in the middle of the night (I don't even know how to get user input from the cmd line even if the user was at their machine) 2) Anyone who can gain access to that build box, would be able to cat the contents of that file either via the cmd line or from another build.gradle job running on that jenkins server.

Does anyone know of anyway I can keep my password hidden but so that the Jenkins job can access it?

Thanks

Answer 1

You can use Mask Password Plugin, which does just that. Or the same functionality is included in EnvInject plugin, and sooner or later all Jenkins projects get a need for EnvInject plugin (that does many other things), so might as well start using it now.

To securely use a password from within a build/post-build step

• Install EnvInject plugin.
• Under Jenkins Global Configuration, find Global Passwords section.
• Add a name (this will be the environment variable name) and password (will be starred **** ).
• Under Job Configuration, find Build Environment section.
• Checkmark Inject passwords to the build as environment variables.
• Then checkmark Global passwords.

In any build step, you can now use $name (as defined earlier) to refer to a password as you would if you were typing it in plain text.

• The password variable is injected only at job execution time (typing $name on command line of the server by itself will not produce anything, and like all Jenkins variables, it is not persistent).
• The job console log will show **** instead of password, if it appears.
• You could configure passwords per job, rather than globally, so that other jobs can't use it.

The only security concern is that if someone has administrative permissions to configure your job, they can write echo $name > secretpassword.txt into a build step, and then review the file in the workspace. But you should be careful who you assign administrative rights to.

Answer 2

You should take a look for this plugin

https://wiki.jenkins-ci.org/display/JENKINS/Mask+Passwords+Plugin