Open ssl decryption gives 'Extra Arguments given' when trying to run a build pipeline for sfdx using circle ci

Question

i have this issue with openssl when i try to run a pipeline in circle ci. Decrypting the encrypted server key in my sfdx project fails.

this is the command i use to decrypt

 - run:
      name: Decrypt server key
      command:
        openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 -K $DECRYPT_KEY -iv $DECRYPT_IV
 

but i get this error

#!/bin/bash -eo pipefail
 openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 -K 
 $DECRYPT_KEY -iv $DECRYPT_IV
 Extra arguments given. 
 enc: Use -help for summary.

Exited with code exit status 1 
CircleCI received exit code 1

Answer 1

The first problem appears to be that you haven't quoted your environment variables and they contain whitespace or special characters:

openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 \
-K '$DECRYPT_KEY' -iv '$DECRYPT_IV'

After fixing this, you've mentioned that you're receiving an error

hex string is too long , hex value is invalid.

It's not immediately obvious to me why this is the case since I cannot see (and you should on no account show me!) your keyfile and encryption passphrase. I would suggest beginning by reviewing all of your secrets for correctness and ensuring that you can decrypt the keyfile locally.

Then, I'd go through the Salesforce DX Developer Guide's section on Continuous Integration using CircleCI, which it looks like you're probably following but might have missed a step on.

If you're observing different results locally and on CircleCI, validate that you have the same versions of OpenSSL installed - at least once in the past a version difference has also come with a difference in the default hash algorithm, which can result in divergent results. You may want to try redoing your setup and explicitly specifying a hash algorithm, such as -md sha512, to ensure you're using the same one everywhere.