Skip to content

v0.7 (bêta)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@gnocent gnocent released this 10 Oct 12:04
· 35 commits to main since this release
v0.7
5dc5531

TermDevTools v0.7 (beta)

Version française : CHANGELOG_fr.md

In one sentence: TermDevTools reaches a cluster through a proxy, takes API keys the way Kibana gives them as well as Bearer tokens, and no longer writes anything next to its binary.

Why "beta": like 0.6, this version has only been used by its author so far. Going through a proxy was checked with test proxies, not with a real corporate proxy. Feedback is welcome.

What's new

  • HTTP and SOCKS5 proxies: a cluster is reached through the proxy the HTTPS_PROXY / HTTP_PROXY environment variables designate, unless NO_PROXY excludes it. For one cluster in particular, proxy: on its entry in config.yaml takes precedence: a proxy URL (http://…, or socks5://… — what ssh -D opens), or none for a direct connection. F9 writes it into the curl command when config.yaml sets it.
  • API key in its encoded form: the key as Kibana shows it when created is pasted straight into the secret field, with no identifier. The identifier is taken from the key and saved. Entering the identifier and the secret works as before.
  • Bearer token: a new authentication type, for a service account token, an access token or a JWT. Like any secret, it is asked again on every connection and never saved.
  • Exports go to your configuration directory: Ctrl+S on the result writes to ~/.config/termdevtools/exports/, no longer next to the binary. Exporting therefore also works in a shared or read-only installation, and each user has their own. The status bar still shows the path of the file written.
  • The crash report (crash-<date>.log) is written to the same place: the program no longer writes anything to its binary's directory.
  • Messages of the connection screen on three lines: a long error is no longer cut after the first.

Security

  • A proxy is never used without being shown: while connecting, at the head of the message if the connection fails, and in the status bar once connected. Its credentials, for their part, are never displayed nor copied, and are sent to it alone.
  • A proxy reached over TLS (https://proxy…) is refused: the cluster's TLS settings — its client certificate, a verification turned off — would apply to the proxy as well.
  • Nothing secret in config.yaml, as before: credentials in proxy: are refused, and a Bearer token is never saved.
  • An API key secret with no identifier is refused before anything is sent, with a message saying what to enter.
  • Binaries built with Go 1.27.2. That version of Go fixes flaws of its standard library published since 0.6, two of which concern a client like this one: the desynchronization of an HTTP/1 connection after a proxy rejects a CONNECT tunnel (GO-2026-6605) and the bypass of a memory limit when parsing headers (GO-2026-6608). go.mod now asks for that version.

Before upgrading from 0.6

  • Proxy: 0.6 ignored HTTPS_PROXY and HTTP_PROXY. If either is set on your machine, a cluster reached directly so far will go through that proxy. If it must not, add it to NO_PROXY, or set proxy: none on its entry in config.yaml. On failure, the message starts with the proxy gone through and recalls both remedies.
  • Exports: an exports/ directory left next to the binary is neither moved nor deleted; take your files from it if you need them.
  • API keys: nothing to do. Existing entries keep their identifier; only the label of the secret field changes.

Checks

  • Password, API key (in both forms) and Bearer token: checked against a real Elasticsearch 9.5.4 with security on — accepted with the right secret, turned down with a wrong one.
  • Proxy: checked with a test HTTP proxy and a test SOCKS5 server — a tunnel to a cluster in https with its certificate verified end to end, each side's credentials kept to itself.
  • govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.2. With Go 1.27.1, it reported eight in the standard library.
  • The reference data (recipes, endpoints, _cat columns) has not changed since 0.6: its checks against eleven real clusters are those of 0.6 and were not run again.
  • No independent external audit was carried out.

Known limits

  • OpenSearch managed by AWS with IAM authentication (SigV4) is not supported.
  • Proxy: its credentials are only given through the environment variable, with Basic authentication; NTLM, Kerberos, PAC files and Windows' proxy settings are not supported. No real corporate proxy was tried.
  • Bearer token: only an Elasticsearch service account token was tried; Elasticsearch and OpenSearch JWTs were not. The program doesn't renew an expired token.
  • The demo animation of the README was recorded with 0.5: it shows neither the recipe catalog nor these additions.

Binaries

One self-sufficient file per platform — no archive and no companion file:

  • termdevtools-linux-amd64 — Linux x86-64 (static binary)
  • termdevtools-windows-amd64.exe — Windows 10/11 x64
  • termdevtools-darwin-arm64 — macOS Apple Silicon
  • SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français).

Assets 6
Loading