Sensitive files during deployment
Manage sensitive files during deployment
Some deployments need a file, not a string: a signing certificate, a provisioning profile, a keystore, an SSH key.
Secure files
The Azure Pipelines secure files library stores such files encrypted, outside the repository. A pipeline downloads one at run time with the Download Secure File task, and the file lands on the agent for that run only.
Two properties make it the right answer:
- A secure file is a protected resource. Its owner can attach approvals, checks and pipeline permissions — so a signing certificate can be restricted to the release pipeline that is entitled to sign.
- Nothing is committed. A certificate in the repository is in git history permanently, and rotating it does not remove the old one.
Cleaning up
The downloaded file exists on the agent's filesystem. On a Microsoft-hosted agent the machine is discarded, so this is self-limiting. On a self-hosted agent it persists unless removed — the same persistence that makes self-hosted agents fast makes them a place where a signing key can be left behind.
The alternative
Where the sensitive material is a value rather than a file, prefer a Key Vault-linked variable group. Secure files are for genuine file artifacts.
Primary sources