Is there a secure ssh step for bitbucket pipelines

[Stephan Eicher]

I saw that the `ssh-run` bitbucket pipeline still relies on `alpine:3.9` container image.

https://bitbucket.org/atlassian/ssh-run/src/798568418ced843e20e6465092a74b1a04a8dd66/Dockerfile#lines-1

As far as i could find the security updates for that release were stopped on 01 Jan 2021

I suspect that this old release includes many security issues which were fixed in newer versions of alpine linux.

This should definitely be fixed as this container has access to private keys used to deploy software to production systems.

[Igor Stoyanov · Accepted solution]

@Stephan Eicher hi. The alpine image updated in following pipes:

• rsync-deploy
• sftp-deploy
• ssh-run

Regards, Igor

[Igor Stoyanov]

@Stephan Eicher hi. Thanks for your investigation.
We will update the ssh-run pipe docker image  and notify you.

Regards, Igor

[Stephan Eicher]

The following pipelines are also affected:

• https://bitbucket.org/atlassian/rsync-deploy/src/f8dd0734642683d2e9a1b2d616ccd94fb227be2b/Dockerfile#lines-1
• https://bitbucket.org/atlassian/sftp-deploy/src/5564629cc640da1b026c79318a5472f8a6442661/Dockerfile#lines-1
• https://bitbucket.org/atlassian/scp-deploy/src/940c6675ccb117a211f87003bba7275b9db3ec92/Dockerfile#lines-1 (python 3.10 EOL)
• https://bitbucket.org/atlassian/vault-secrets/src/0363522414531c0fac9d762ba7976e23cc5c4394/Dockerfile#lines-1 (python 3.10 EOL)
  
  It looks like a general issue some pipelines are not really maintained.

[Igor Stoyanov]

@Stephan Eicher hi. According to this page:

python 3.10 EOL will be 2026-10, so no changes needed.

But we will update alpine image in your listed in the comments pipes.

We have more than 50 pipes to maintain, so, unfortunately, our strategy usually when no new features to be implemented is to wait for users feature request.
You could always ask us in the community to bump a pipe version or even create a pull-request by yourself since it is open-sourced.

Also keep in mind that pipes are not the same as pipelines.

Pipes provide a simple way to configure a pipeline. They are especially powerful when you want to work with third-party tools. More details here.

Regards, Igor