Use openssl in a github action

I want to release the artifact of a github action to a specific update repo, so that my software can use it to update itself. To verify the update in the local update process I want to sign this artifact. I chose to store the update itself and signature in separate files for now.

My github action would take the zipped artifact and should sign it with the given RSA4096 Private Key and should use SHA512 as a digest.

My github action for that looks as follows:

- name: Sign release
  run: |
    echo $PRIVATE_KEY > privatekey.pem
    openssl dgst -sha512 -sign privatekey.pem -out latest.sig latest.zip
    env:
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

This github action should take my private key from the repository's secrets, put it in an environment variable, and then put it in a local file so the following openssl command can take this private key to sign it. I went this way to hinder the private key itself being echo'ed to the log.

The private key value is as follows: (This is of course not the actual private key but one I created solely for testing purposes until this github action works properly. This private key is only 1024 bits instead of the above mentiond 4096 bits. I will not use this private key afterwards anymore.)

The problem is the following log output of the github action when executing this step:

unable to load key file
6196:error:0909006C:PEM routines:get_name:no start line:crypto\pem\pem_lib.c:745:Expecting: ANY PRIVATE KEY

Which means that whatever was echoed to the privatekey.pem is not the actual private key secret value, but something else. I couldn't get the content of the file printed in subsequent tests. Not with a necho or cat command or anything similar, so I have actually no knowledge of what is written to the file, which makes it impossible for me to get any deeper into my analysis.

Is anyone here able to deduce some helpful tips or a solution to this problem?

Solution

It's likely that part of your problem is the lack of quoting. When you don't quote a variable in shell, it is split on whitespace (space, tab, and newline), so what you're passing to echo is several different arguments which, instead of being separated by newlines, are separated by spaces via echo.

You'd probably want to write this (note the quotation marks around $PRIVATE_KEY:

- name: Sign release
  run: |
    echo "$PRIVATE_KEY" > privatekey.pem
    openssl dgst -sha512 -sign privatekey.pem -out latest.sig latest.zip
    env:
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

In general, it's a good practice to place all variables in double quotes when using them unless you're certain that you want the shell to expand them.

Of course, all of this applies only if you're using a POSIX shell, which means that you need to be using Unix or bash on Windows, since the syntax you're using is POSIX shell syntax.

GitHub Actions, like most CI systems, tries to sanitize its output to prevent disclosing secrets that are accidentally printed to logs, which is why you were unable to print the value.