From 2d115135f7468f344f025fe10343435d3824a837 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Thu, 22 Oct 2020 19:08:08 +0200
Subject: [PATCH] support env vars in config.yml: awsaccesskeyid: {env:
 AWS_KEY}

---
 fdroidserver/common.py | 14 ++++++++++++++
 tests/common.TestCase  | 12 ++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/fdroidserver/common.py b/fdroidserver/common.py
index 48434581..9736edf2 100644
--- a/fdroidserver/common.py
+++ b/fdroidserver/common.py
@@ -388,6 +388,20 @@ def read_config(opts):
         limit = config['git_mirror_size_limit']
         config['git_mirror_size_limit'] = parse_human_readable_size(limit)
 
+    for configname, dictvalue in config.items():
+        if isinstance(dictvalue, dict) \
+           and configname not in ('ndk_paths', 'java_paths', 'char_limits', 'keyaliases'):
+            for k, v in dictvalue.items():
+                if k == 'env':
+                    env = os.getenv(v)
+                    config[configname] = env
+                    if not env:
+                        logging.error(_('Environment variable {var} from {configname} is not set!')
+                                      .format(var=k, configname=configname))
+                else:
+                    logging.error(_('Unknown entry {key} in {configname}')
+                                  .format(key=k, configname=configname))
+
     return config
 
 
diff --git a/tests/common.TestCase b/tests/common.TestCase
index b49ba10e..a12ec6a6 100755
--- a/tests/common.TestCase
+++ b/tests/common.TestCase
@@ -1431,6 +1431,18 @@ class CommonTest(unittest.TestCase):
         config = fdroidserver.common.read_config(fdroidserver.common.options)
         self.assertEqual('yml', config.get('apksigner'))
 
+    def test_with_config_yml_with_env_var(self):
+        """Make sure it is possible to use config.yml alone."""
+        testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)
+        os.chdir(testdir)
+        os.environ['SECRET'] = 'mysecretpassword'
+        with open('config.yml', 'w') as fp:
+            fp.write("""keypass: {'env': 'SECRET'}""")
+        self.assertTrue(os.path.exists('config.yml'))
+        self.assertFalse(os.path.exists('config.py'))
+        config = fdroidserver.common.read_config(fdroidserver.common.options)
+        self.assertEqual(os.getenv('SECRET', 'fail'), config.get('keypass'))
+
     def test_with_config_py(self):
         """Make sure it is still possible to use config.py alone."""
         testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)