Merge pull request #599 from matthiasfehr/binary-secret-files

Fix: Remove UTF-8 encoding to prevent mangling of binary secrets
docker · Feb 19, 2025 · ea9281e · ea9281e
2 parents 278be13 + 9692462
commit ea9281e
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/src/buildx/build.ts b/src/buildx/build.ts
@@ -139,16 +139,16 @@ export class Build {
   }
 
   public static resolveSecret(kvp: string, file: boolean): [string, string] {
-    const [key, _value] = Build.parseSecretKvp(kvp);
-    let value = _value;
+    const [key, value] = Build.parseSecretKvp(kvp);
+    const secretFile = Context.tmpName({tmpdir: Context.tmpDir()});
     if (file) {
       if (!fs.existsSync(value)) {
         throw new Error(`secret file ${value} not found`);
       }
-      value = fs.readFileSync(value, {encoding: 'utf-8'});
+      fs.copyFileSync(value, secretFile);
+    } else {
+      fs.writeFileSync(secretFile, value);
     }
-    const secretFile = Context.tmpName({tmpdir: Context.tmpDir()});
-    fs.writeFileSync(secretFile, value);
     return [key, secretFile];
   }