From 03894158ecf07b0399f190169331746d128b21a9 Mon Sep 17 00:00:00 2001 From: Quantum Explorer Date: Mon, 20 Jul 2026 20:52:55 +0800 Subject: [PATCH 1/2] fix(build): prevent secret tracing in dependency stages --- Dockerfile | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6e68c5e1a48..4cee7c25322 100644 --- a/Dockerfile +++ b/Dockerfile @@ -450,7 +450,7 @@ ARG SDK_TEST_DATA ARG SHIELDED_TEST_DATA ARG ADDITIONAL_FEATURES="" -SHELL ["/bin/bash", "-o", "pipefail","-e", "-x", "-c"] +SHELL ["/bin/bash", "-o", "pipefail", "-e", "-c"] WORKDIR /platform @@ -462,8 +462,8 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --mount=type=cache,sharing=locked,id=cargo_git,target=${CARGO_HOME}/git/db \ --mount=type=secret,id=AWS \ --mount=type=secret,id=GITHUB_TOKEN \ - set -ex; \ - if [ -f /run/secrets/GITHUB_TOKEN ]; then \ + trap 'rm -f "${HOME}/.gitconfig"' EXIT; \ + if [ -s /run/secrets/GITHUB_TOKEN ]; then \ git config --global url."https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ fi && \ source /root/env && \ @@ -491,8 +491,7 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --package drive-abci \ ${FEATURES_FLAG} \ --locked && \ - if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi && \ - rm -f ~/.gitconfig || true + if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi COPY --parents \ Cargo.lock \ @@ -873,7 +872,7 @@ USER node # FROM deps AS build-rs-dapi -SHELL ["/bin/bash", "-o", "pipefail","-e", "-x", "-c"] +SHELL ["/bin/bash", "-o", "pipefail", "-e", "-c"] WORKDIR /platform @@ -885,8 +884,8 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --mount=type=cache,sharing=locked,id=cargo_git,target=${CARGO_HOME}/git/db \ --mount=type=secret,id=AWS \ --mount=type=secret,id=GITHUB_TOKEN \ - set -ex; \ - if [ -f /run/secrets/GITHUB_TOKEN ]; then \ + trap 'rm -f "${HOME}/.gitconfig"' EXIT; \ + if [ -s /run/secrets/GITHUB_TOKEN ]; then \ git config --global url."https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ fi && \ source /root/env && \ @@ -898,8 +897,7 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --profile "$CARGO_BUILD_PROFILE" \ --package rs-dapi \ --locked && \ - if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi && \ - rm -f ~/.gitconfig || true + if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi COPY --parents \ Cargo.lock \ From 475f09f4db267c80e218023eb6ba1f4903039dbe Mon Sep 17 00:00:00 2001 From: Quantum Explorer Date: Wed, 22 Jul 2026 14:53:53 +0800 Subject: [PATCH 2/2] fix(build): keep github token out of git error output git redacts URL passwords but not URL usernames in its error output, so embedding the token as the username in the insteadOf rewrite leaked it on any fetch/auth failure even with xtrace disabled. Use the x-access-token:TOKEN form at all three sites so the token sits in the password slot git knows to redact. Also bring the build-js stage up to the same standard as the other two secret-mounting stages: -s guard instead of -f (an empty secret file previously configured a broken rewrite) and EXIT-trap cleanup instead of success-only rm. Co-Authored-By: Claude Fable 5 --- Dockerfile | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4cee7c25322..199773305e4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -464,7 +464,7 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --mount=type=secret,id=GITHUB_TOKEN \ trap 'rm -f "${HOME}/.gitconfig"' EXIT; \ if [ -s /run/secrets/GITHUB_TOKEN ]; then \ - git config --global url."https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ + git config --global url."https://x-access-token:$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ fi && \ source /root/env && \ export FEATURES_FLAG=""; \ @@ -641,8 +641,9 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --mount=type=cache,sharing=locked,id=cargo_git,target=${CARGO_HOME}/git/db \ --mount=type=secret,id=AWS \ --mount=type=secret,id=GITHUB_TOKEN \ - if [ -f /run/secrets/GITHUB_TOKEN ]; then \ - git config --global url."https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ + trap 'rm -f "${HOME}/.gitconfig"' EXIT; \ + if [ -s /run/secrets/GITHUB_TOKEN ]; then \ + git config --global url."https://x-access-token:$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ fi && \ source /root/env && \ unset CFLAGS CXXFLAGS && \ @@ -652,8 +653,7 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --package wasm-dpp \ --target wasm32-unknown-unknown \ --locked && \ - if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi && \ - rm -f ~/.gitconfig || true + if [[ -x /usr/bin/sccache ]]; then sccache --show-stats; fi # Rust deps @@ -886,7 +886,7 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM --mount=type=secret,id=GITHUB_TOKEN \ trap 'rm -f "${HOME}/.gitconfig"' EXIT; \ if [ -s /run/secrets/GITHUB_TOKEN ]; then \ - git config --global url."https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ + git config --global url."https://x-access-token:$(cat /run/secrets/GITHUB_TOKEN)@github.com/".insteadOf "https://github.com/"; \ fi && \ source /root/env && \ if [[ "${CARGO_BUILD_PROFILE}" == "release" ]] ; then \