Are you in the loop? Keep up with the latest by making sure you're subscribed to Community Announcements. Just click Watch and select Articles.

Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Best practice for secret files

Is there really no straight-forward way to inject secret files into a build with Bitbucket pipelines? Coming from Jenkins, this feels like a massive oversight.

I have seen people say "save it as an env variable", however I tried this with some TLS certificates and the indentation got messed up and the certificate became invalid.

I thought this was such an obvious use case that it would have direct support. I don't really want to have to go around creating sFTP servers to go with each repo just to copy in some secret certificates here and there.

Was this discussed at some point and the community decided on "will not fix"? If Jenkins can manage it easily enough then why can't Bitbucket?

1 answer

2 votes
Patrik S
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Jul 21, 2022 • edited Oct 12, 2023

Hello @Steven Gillies ,

Thank you for reaching out to Atlassian Support.

Secret environment variables are indeed the way to go if you want to inject secret contents into your build. The reason why the indentation got messed up in your attempt is because pipelines do not currently support line breaks in environment variables, so you will need to base-64 encode the content of the file before saving it to the environment variable:

  • Linux :
$ base64 -w 0 < my_file.txt
  • MacOS :

$ base64 < my_file.txt

Save the base64 encoded value (which will be just plain text) returned by the command above as the value of the environment variable (it can be a workspace,repository or deployment variable).

Then, within your pipeline script, you can decode the variable value and save it to a file :



    - step:


           - (umask  077 ; echo $MY_SECRET_VAR | base64 --decode > ~/my_file.txt)

 Would you please try the suggestion above and let us know how it goes ? 

Thank you, @Steven Gillies .

Kind regards,

Patrik S

Hey @Patrik S 

Thanks for the suggestion.

I tried using the same way in the pipeline but I got the error "Command not found"

After that, I tried using variables directly 

(umask  077 ; $MY_SECRET_VAR | base64 --decode > ~/my_file.txt)

But no luck. Would you please suggest some other way. 

Patrik S
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Oct 10, 2023

Hey @Amit Sharma and welcome to the Community!

There are multiple causes that can lead pipelines to return a Command not found error, and they are described in detail in the article Bitbucket Pipelines - Command not found error.

I suspect the issue is that the image you are using in the build might not have the base64 command. In order to confirm if that is the case, could you share with us the full log output when you execute the below command in your pipeline? 

(umask  077 ; echo $MY_SECRET_VAR | base64 --decode > ~/my_file.txt)

We would expect the "command not found error" to specify which command is missing.

Thank you, @Amit Sharma !

Patrik S

Hey @Patrik S  

Thanks for the quick update.

I verified that base64 is available.

Actually, I am saving encoded keys in the variable and trying to access the variable in my script.

(umask 077 ; echo $MY_KEYS | base64 --decode > ~/my_keys)

I am getting the below error on this

base64: Invalid Input.

I tried to print the value of the variable using echo and expr but no luck.


Thanks for all the support.

Hey @Patrik S I am able to solve this by creating a Plain repository variable for the key where I need to echo the value.

While other secure variables are working fine If we use the command. For ex.



@Patrik S thanks again for helping me out here.

Like Patrik S likes this

Suggest an answer

Log in or Sign up to answer
Site Admin
AUG Leaders

Atlassian Community Events