Hi everyone, I'm working on integrating sensitive ...

# multiplatform

[Abduelrahman Elemam]

Hi everyone,
I'm working on integrating sensitive variables into my KMP Gradle file for a project. I've tried using both local.properties and .env files with System.getenv("Var Name"), but unfortunately, these attempts always return null.
Currently, the only reliable approach seems to be storing sensitive variables directly in the gradle.properties file. However, this means the secrets would be uploaded to Git, which I'd like to avoid for security reasons.

Does anyone have any alternative solutions that would allow me to securely store sensitive variables outside of gradle.properties and access them within my KMP Gradle file?

[Michael Krussel]

I've seen teams put the properties in their user home gradle.properties to avoid having it get uploaded to Git.

For local.properties you need to manually load the properties file it doesn't get auto loaded like gradle.properties.

[Abduelrahman Elemam]

i have tried also to create gradle-secrets-plugin.properties and added these vars there and it also the same.

is this requires to manually load the file also ??

[Abduelrahman Elemam]

what do u mean by in their user home ? in the root project ?

[Azim Ansari]

local.properties should work for you without nulls, if you are loading it correctly.
Use below code

val localProperties = Properties()
val localPropertiesFile = rootProject.file("local.properties")

if (localPropertiesFile.exists()) {
    localPropertiesFile.inputStream().use { stream ->
        localProperties.load(stream)
    }
}

[Abduelrahman Elemam]

@Azim Ansari yes, this will work, thanks.
i was wondering why the approach i asked about is not anymore. i used to use it before.

[Michael Krussel]

On MacOS any property you put in ~/.gradle/gradle.properties is visible to all projects.

https://docs.gradle.org/current/userguide/build_environment.html#priority_for_configurations

[ephemient]

you could create a https://docs.gradle.org/current/javadoc/org/gradle/api/provider/ValueSource.html, for example something like

private abstract class PropertiesFileValueSource : ValueSource<Properties, PropertiesFileValueSource.Parameters> {
    interface Parameters : ValueSourceParameters {
        val propertiesFile: RegularFileProperty
    }

    override fun obtain(): Properties = Properties().apply {
        parameters.propertiesFile.get().asFile.inputStream().use { load(it) }
    }
}

val localProperties = providers.of(PropertiesFileValueSource::class) {
    parameters.propertiesFile = rootProject.file("local.properties")
}

which would then be lazily loaded and tracked by Gradle

[Abduelrahman Elemam]

@Michael Krussel that what i need, thank u 😍

[Abduelrahman Elemam]

@ephemient thanks for your answer, @Michael Krussel provided a solution for whole projects using the same secret gradle file.