Signed Pipelines fail to verify when using interpolated environment variables

[fruechel-canva]

Is your feature request related to a problem? Please describe.
Currently, signed pipelines fail to verify if uploading a definition that contains a variable such as ${VAR_NAME} in the command.

Describe the solution you'd like
Variables are supported in pipelines with risks and tradeoffs documented and mitigation options available.

Describe alternatives you've considered
Not using variables at all or only interpolating them from within wrapper scripts is a significant effort that would require rework across a large number of pipelines.

Additional context
There's some complexity in this because simply accepting any variable content could lead to a trivial bypass of the signature while evaluating the variable at signature time might lead to a different result compared to a runtime evaluation. However, the current situation is an edge case the pipeline signature feature has not addressed yet, so some explicit solution would be needed here.

[dabarrell]

Hey @fruechel-canva – I can see that @patrobinson has reached out to investigate your particular case here, so we can see where that support thread leads.

In general, signing of runtime env var interpolation (e.g. escaped env vars with $$ or \$) wouldn't be possible because changing the value of the env var between upload and running could change the behaviour of the step.

However normal env var interpolation (where the agent replaces ${VAR_NAME} before the steps are uploaded) should be signed – this seems to be where the bug would be if that's not working correctly. We'll dig into this further with you directly so we can talk about your example pipeline, then come back to this issue with an update for any readers (cc @bpoland)

[bpoland]

👋 since any script called by the yaml could interpolate env vars, this seems like a bit of an arbitrary limitation. At the very least perhaps the error message could be improved if someone tries this? It took me quite a bit of experimentation to figure out this is what was causing error: invalid signature: signature verification failed -- I thought I had made some mistake generating the keys or something.

[moskyb]

yo! i (mis)informed @dabarrell on his reply above and am here to correct my mistake - you absolutely can (or should be able to!) use $$ and/or \$ interpolation in signed pipelines, as you can see in this screenshot:

the reason this is okay is that the interpolation happens after the signature check, rather than before - the signature verification is basically just checking that the text of the command is echo $PWD in the example above, and isn't smart enough to interpolate that envar.