How do I download a jenkins secret file from the credential store?

Question

I can only upload an existing jenkins secret file not download the existing one.

How do I download an existing secret file I uploaded to confirm its contents?

Answer 1

If you have shell access to and sudo/root/Jenkins Unix user permissions on the machine running Jenkins, you can retrieve the secret file by doing the following:

• In some Jenkins job that has permissions to access the secret file, select Configure.
• On the Configuration interface, under Build Environment, select Use secret text(s) or file(s).
• Click Add -> Secret file. This creates a new Secret file binding.
• Select Specific credentials, then from the drop-down menu below it select the secret file you would like to retrieve. Let's assume your secret file is stored under the filename my-secret-file.txt.
• Assign to this secret file a variable e.g. MY_SECRET_FILE_TXT.
• Now, under Pre Steps, click Add pre-build step -> Execute shell.

• In the Command text area, add the following shell script:

  echo "executing user is $(whoami)"
  
  # remove my-secret-file.txt before possibly getting an overwriting error
  rm -f $WORKSPACE/my-secret-file.txt
  
  echo "Jenkins project workspace: $WORKSPACE"
  cp $MY_SECRET_FILE_TXT $WORKSPACE
  

• Click Save to save this configuration.

The next time a build is triggered for this project, the secret file should appear in this project's workspace, i.e. at location $WORKSPACE/my-secret-file.txt. As an example, on my Ubuntu 14.04.5 LTS installation with installed package and daemonjenkins, that location is /var/lib/jenkins/workspace/$JENKINS_PROJECT_NAME/my-secret-file.txt

Answer 2

I usually extract secrets from jenkins by creating a job like this:

Jenkins masks all the keys in the output, so just replace one character when you print it out. If it turns out there is another 0 in your key, it'll appear as ******* and you can try replacing a different character, or splitting it in two and printing the two halfs on different lines, or another similar trick.

You can also just stick it straight into a file like this.

echo $HELLO > slack-key.txt