TL;DR

I'm trying to understand how to setup a Jenkins or Gitlab installation "properly" security-wise.

We'd like jobs to be able to pull from and push to maven repositories and docker registries, but do this in a safe way, so that even malicious Jenkinsfile or .gitlab-ci.yml files can't get direct access to the credentials to either print them on-screen or send them with e.g. curl somewhere.

It seems the straight-forward and documented way to do it for both Jenkins and gitlab is to create "Credentials" in Jenkins and "Variables" in Gitlab CI/CD. These are then made available as environment variables for Jenkinsfile or .gitlab-ci.yml to access and use in their scripts. Which is super-handy!

BUT!

That means that anybody that can create a job in Jenkins/Gitlab or has write access to any repository that has an existing job can get access the raw credentials if they're malicious. Is that really the best one can hope for? That we trust every single person that has login to a Jenkins/Gitlab installation with keys to the kingdom?

Sure we can limit credentials so they're only accessible to certain jobs, but all jobs need access to maven repos and docker registries...

In these post-SolarWinds times, surely we can and must do better than that when securing our build pipeline...

Details

I was hoping for something like the ability for a e.g. a Jenkins file to declare up-front that it wants to use these X docker images and these Y java maven dependencies somewhere before a script runs, so these dependencies are downloaded. So that credentials to pull dependencies are hidden from the scripts. And that after a build, a number of artifacts are declared, so that after the script has concluded, "hidden" credentials are used to pushed the artifacts to e.g. a nexus repository and/or docker registry.

But the Jenkins documentation entry for Using Docker with Pipeline describes how to use a registry with:

docker.withRegistry('https://registry.example.com', 'credentials-id') {
    bla bla bla
}

And that looks all safe and good, but if I put this in the body:

sh 'cat $DOCKER_CONFIG/config.json | base64'

then it is game over. I have direct access to the credentials. (The primitive security of string matching for credentials in script output is easily defeated with base64.)

Gitlab doesn't even try to hide that it is easy in their docs

before_script:
  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

Could be replaced with

before_script:
  - "echo $CI_REGISTRY_USER:$CI_REGISTRY_PASSWORD | base64"

Likewise, game over.

Is there no general to have credentials that are safely protected from the Jenkinsfile or .gitlab-ci.yml scripts?

These two articles describe the situation perfectly:

• Accessing and dumping Jenkins credentials | Codurance "The answers you seek, Jenkins shall leak."
• Storing Secrets In Jenkins - Security Blogs - this last article even describes how to print Jenkins' own encrypted /var/lib/jenkins/credentials.xml and then use Jenkins itself to decrypt them. Saves the hacker the trouble.