bitrise-steplib / steps-xcode-archive

Xcode Archive for iOS step
MIT License
68 stars 56 forks source link

Do not log sensitive command params when Apple ID authentication fails #332

Closed lpusok closed 11 months ago

lpusok commented 11 months ago

Checklist

Version

Requires a PATCH version update

Context

Pulls in updated https://github.com/bitrise-io/go-xcode/pull/221.

We logged potential secrets due to using the v2/command package: https://github.com/bitrise-io/go-utils/blob/921272de13f5811b3a22dcd883459ea472c7f461/command/command.go#L172.

Apple ID authentication failed: The input stream is exhausted., error: command failed with exit status 1 (bundle "exec" "ruby" "main.rb" "--subcommand" "list_dev_certs" "--username" "myemail@gmail.com" "--password" "my-readable-password" "--session"

Fixed this by omitting the error returned by v2/command.

Changes

Investigation details

Decisions