Hide secrets in all log_call invocations

[b10n1k]

My first idea was to encrypt the text and then decrypt it when it is needed for the call.

However the concern was about the logs and i found that the only thing that it needs to be done
is to update the log_call, because this is what is called from all the backends. in this way nothing
else seems to need to change in testapi or anywhere else.

Signed-off-by: ybonatakis ybonatakis@suse.com

http://aquarius.suse.cz/tests/9012/logfile?filename=autoinst-log.txt

[codecov]

Codecov Report

Merging #2002 (13181d7) into master (d909b2d) will increase coverage by 0.01%.
The diff coverage is 100.00%.

❗ Current head 13181d7 differs from pull request most recent head d08282e. Consider uploading reports for the commit d08282e to get more accurate results

@@            Coverage Diff             @@
##           master    #2002      +/-   ##
==========================================
+ Coverage   77.50%   77.52%   +0.01%     
==========================================
  Files          70       70              
  Lines        7261     7262       +1     
==========================================
+ Hits         5628     5630       +2     
+ Misses       1633     1632       -1     

Impacted Files	Coverage Δ
bmwqemu.pm	100.00% <100.00%> (ø)
testapi.pm	64.07% <100.00%> (+0.04%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d909b2d...d08282e. Read the comment docs.

[github-actions]

Great PR! Please pay attention to the following items before merging:

Files matching testapi.pm:

• Consider bumping the version number in OpenQA/Isotovideo/Interface.pm for changes in behaviour

This is an automatically generated QA checklist based on modified files

[Martchus]

Maybe "hide" would be a better word than "stash" here?

[asmorodskyi]

LGTM , also I am closing my version which was trying to achieve the same . Nice work Yannis !

[b10n1k]

LGTM , also I am closing my version which was trying to achieve the same . Nice work Yannis !

I removed the log_call from testapi::type_string and i have the feeling that there are more of those around which could be removed and cleanup the os-autoinst.txt. just keep this in mind.

[okurz]

Better rephrase the "Hide" commit message as "Hide secrets in all log_call invocations"
and please wrap your git commit messages consistently at 80 characters per line.

[b10n1k]

@okurz @Martchus @asmorodskyi changes are made. But i cant comment on the conversations anymore, for some reason. I guess also that the recommendation from the bot is not needed, right?

[okurz]

I am not sure what your intention with the tests is but it should be obvious that we won't merge your PR as long as you have disabled a big chunk of tests with comments :)

[okurz]

I guess also that the recommendation from the bot is not needed, right?

Well, if the only real change is that the string output in log messages changes then the API version does not need to be bumped.

[okurz]

@b10n1k please only push updates if you actually address the review comments. I was getting notified multiple times but have seen the changes not implemented.

[Martchus]

Suggested change

	sub log_call_test_secret {
	bmwqemu::log_call(text => "passwd\n", secret => 1);
	}
	stderr_like(\&log_call_test_secret, qr{\Q<<< main::log_call_test_secret(text="[masked]", secret=1)}, 'log_call hides sensitive info');
	sub log_call_test_secret {
	bmwqemu::log_call(text => "passwd\n", secret => 1);
	}
	stderr_like { bmwqemu::log_call(text => "passwd\n", secret => 1) } qr{\Q<<< main::log_call_test_secret(text="[masked]", secret=1)}, 'log_call hides sensitive info';

[jlausuch]

This breaks the use of type_password.

With this change, type_password() in testapi.pm passes the argument secret to type_string (see below code), but now type_string() is ALWAYS printing $string to the log, whatever value it is (if it's secret or not). So, all the strings commands made with type_password are logged in autoinst-log.txt

Maybe we should recover my $log = $args{secret} ? 'SECRET STRING' : $string;

I created this ticket https://progress.opensuse.org/issues/111010

sub type_password {
    my ($string, %args) = @_;
    $string //= $password;
    type_string $string, secret => 1, max_interval => ($args{max_interval} // 100), %args;
}