Encrypt balenaOS artifacts at rest in GitHub

[ab77]

Applies symmetric encryption (PBKDF2 hardened) to balenaOS build assets prior to uploading them to GitHub for temporary storage between builds. Decrypts assets after downloading.

Requires: https://github.com/balena-os/.github/pull/83
Depends-on: balena-os/balena-generic#525

https://balena.fibery.io/Work/Improvement/Encrypt-artifacts-used-between-jobs-2070

[klutchell]

How can we make this conditional? Ideally we would only encrypt artifacts if certain conditions are met, like if the repository is public and sign image is enabled, for example.

Also please include a link to the Fibery improvement in the body of the PR.

[rcooke-warwick]

This is tested and working with both encrypt and decrypt here: https://github.com/balena-os/balena-raspberrypi/actions/runs/11126932142/job/30919311161?pr=1180

[klutchell]

@rcooke-warwick I asked Anton to remove this so we had one fewer place where conditions were used to decide between encryption and decryption. Like if we changed the conditions for encryption and forgot to update the decryption conditions, it might take a while to notice we broke it.

Was it not correctly detecting the lack of *.enc files?

[rcooke-warwick]

Thats right,

Run for artifact in *.enc **/*.enc; do
+ for artifact in *.enc **/*.enc
+ openssl enc -v -d -aes-256-cbc -k *** -pbkdf2 -iter 310000 -md sha256 -salt -in '*.enc' -out '*'
bufsize=8192
Can't open "*.enc" for reading, No such file or directory
40D756EFD17F0000:error:80000002:system library:BIO_new_file:No such file or directory:../crypto/bio/bss_file.c:67:calling fopen(*.enc, rb)
40D756EFD17F0000:error:10000080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:75:

[rcooke-warwick]

If we're too lenient about the logic in this step passing, we risk scenarios like:

• we break the encryption step
• we break the decryption step
• we change the logic to .enc files get written to a different place, or are called something else

And then trying to flash the DUT with whatever, or getting as far as the tests, which will then fail - but its harder to ID where the failure happened if it gets that far. Just to keep in mind

[klutchell]

Ack, sounds good