Base64 decode GitLab API secret

before using it.

1 files changed, 21 insertions, 1 deletions

diff --git a/main.go b/main.go
index aed0cc27..c4a6a4e2 100644
--- a/main.go
+++ b/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
@@ -121,6 +122,22 @@ func setArtifactsServer(artifactsServer string, artifactsServerTimeout int, conf
 	config.ArtifactsServer = artifactsServer
 }
 
+func setGitLabAPISecretKey(secretFile string, config *appConfig) {
+	encoded := readFile(secretFile)
+
+	decoded := make([]byte, base64.StdEncoding.DecodedLen(len(encoded)))
+	secretLength, err := base64.StdEncoding.Decode(decoded, encoded)
+	if err != nil {
+		log.WithError(err).Fatal("Failed to decode GitLab API secret")
+	}
+
+	if secretLength != 32 {
+		log.WithError(fmt.Errorf("Expected 32 bytes GitLab API secret but got %d bytes", secretLength)).Fatal("Failed to decode GitLab API secret")
+	}
+
+	config.GitLabAPISecretKey = decoded
+}
+
 func configFromFlags() appConfig {
 	var config appConfig
 
@@ -144,13 +161,16 @@ func configFromFlags() appConfig {
 	}{
 		{&config.RootCertificate, *pagesRootCert},
 		{&config.RootKey, *pagesRootKey},
-		{&config.GitLabAPISecretKey, *gitLabAPISecretKey},
 	} {
 		if file.path != "" {
 			*file.contents = readFile(file.path)
 		}
 	}
 
+	if *gitLabAPISecretKey != "" {
+		setGitLabAPISecretKey(*gitLabAPISecretKey, &config)
+	}
+
 	if *artifactsServer != "" {
 		setArtifactsServer(*artifactsServer, *artifactsServerTimeout, &config)
 	}