[JENKINS-28719] Store environment variable values for CoreWrapperStep as Secret

withCredentials stores values encrypted. wrap currrently does not, but it should. (For compatibility, need to readResolve the old map.)

withCredentials also masks secrets accidentally printed to the log. It would perhaps be undesirable for wrap to do so unconditionally, since there may be legitimate reasons to see non-secret variables in build output. Discriminating between the two cases mechanically is unfortunately not possible without an API change to SimpleBuildWrapper, such as making makeSensitiveBuildVariables take Run rather than AbstractBuild, or adding a variant to Context.env.

If both issues are addressed, withCredentials could probably be deprecated (marked isAdvanced), with SecretBuildWrapper made a SimpleBuildWrapper.

---
Originally reported by jglick, imported from: Store environment variable values for CoreWrapperStep as Secret

• assignee: jglick
  
• status: Open
  
• priority: Major
  
• component(s): workflow-basic-steps-plugin
  
• label(s): api, security
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 20251215-220547
  

withCredentials stores values encrypted. wrap currrently does not, but it should. (For compatibility, need to readResolve the old map.)


withCredentials also masks secrets accidentally printed to the log. It would perhaps be undesirable for wrap to do so unconditionally, since there may be legitimate reasons to see non-secret variables in build output. Discriminating between the two cases mechanically is unfortunately not possible without an API change to SimpleBuildWrapper, such as making makeSensitiveBuildVariables take Run rather than AbstractBuild, or adding a variant to Context.env.


If both issues are addressed, withCredentials could probably be deprecated (marked isAdvanced), with SecretBuildWrapper made a SimpleBuildWrapper.

Inizia da CoreWrapperStep.java, confrontando la memorizzazione dei valori dell’ambiente con BindingStep.java e verificando il requisito di compatibilità di leggere la vecchia map tramite readResolve. Esamina quindi SimpleBuildWrapper.makeSensitiveBuildVariables e Context.env per determinare le implicazioni per l’API; il lavoro è completato quando i valori sono memorizzati come Secret senza compromettere i dati esistenti e il comportamento di mascheramento dei secret è stato gestito.

Scritto dal modello di indicizzazione a partire dal testo della issue.