Add secrets module: Spring Cloud Vault, AWS Secrets Manager, Kubernetes configtree and Jasypt on Spring Boot 4.1.2, with real transcripts

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6tTs7ivgTNq4ZrurU
2026-11-08 18:24:42 +00:00
parent 6a36e84858
commit 1497fba911
38 changed files with 1263 additions and 1 deletions
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Shows what a packaged Spring Boot app exposes about its secrets to anyone who can look at the
+# process or the jar. Writes output/10-exposure.txt. Linux only (/proc).
+#
+#   ./scripts/exposure.sh
+set -euo pipefail
+cd "$(dirname "$0")/.."
+mkdir -p output
+OUT=output/10-exposure.txt
+: > "$OUT"
+say() { echo "$@" | tee -a "$OUT"; }
+
+mvn -B -q -DskipTests package 2>&1 | grep -v '^Picked up\|^WARNING' || true
+JAR=target/secrets-1.0.0.jar
+
+say "1. the jar: src/main/resources/application-leaky.yml (a deliberately committed secret) as packaged"
+say "   \$ unzip -p $JAR BOOT-INF/classes/application-leaky.yml | grep password"
+unzip -p "$JAR" BOOT-INF/classes/application-leaky.yml | grep 'password' | sed 's/^/   /' | tee -a "$OUT"
+
+DB_PASSWORD_FROM_ENV=env-secret-123 SIGNING_KEY=env-signing-key-456 \
+  java -jar "$JAR" --spring.profiles.active=hold --spring.main.web-application-type=none \
+    --spring.cloud.vault.enabled=false --spring.cloud.aws.secretsmanager.enabled=false \
+    --db.password=arg-secret-789 > /tmp/secrets-exposure.log 2>&1 &
+PID=$!
+trap 'kill $PID 2>/dev/null || true' EXIT
+for _ in $(seq 1 60); do grep -q 'Started SecretsApplication' /tmp/secrets-exposure.log && break; sleep 0.5; done
+
+say "2. command-line argument, as any user on the host sees it"
+say "   \$ ps -o args= -p <pid> | tr ' ' '\\n' | grep db.password"
+ps -o args= -p "$PID" | tr ' ' '\n' | grep 'db.password' | sed 's/^/   /' | tee -a "$OUT"
+
+say "3. environment variables, readable by the same user"
+say "   \$ tr '\\0' '\\n' < /proc/<pid>/environ | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY'"
+tr '\0' '\n' < "/proc/$PID/environ" | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY' | sed 's/^/   /' | tee -a "$OUT"
+
+say "4. /proc/<pid>/cmdline, what the kernel keeps of the arguments"
+tr '\0' '\n' < "/proc/$PID/cmdline" | grep 'db.password' | sed 's/^/   /' | tee -a "$OUT"
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Regenerates every file under output/.
+#
+#   ./scripts/run-all.sh
+#
+# Needs a JDK 25, Maven 3.9 and a running Docker daemon (the tests start hashicorp/vault and
+# motoserver/moto containers through Testcontainers). Transcripts 01-09 come out of the test suite,
+# so each line in them is something the build checked; 10 is a real jar and /proc.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+mkdir -p output
+
+echo "== test suite (transcripts 01-09)"
+mvn -B test | tee /tmp/secrets-mvn.log | grep -E '^\[(INFO|WARNING|ERROR)\] Tests run:' | sed 's/^\[[A-Z]*\] //' > output/00-test-summary.txt
+
+echo "== packaged jar and /proc (transcript 10)"
+./scripts/exposure.sh >/dev/null
+
+echo
+echo "output:"
+ls -1 output