deploy.sh can reveal Github access token on git errors

[leeper]

I configured a Github access token with the wrong permissions, leading to a failure to fetch my drat repo. The failure resulted in an error that published the access token (see very bottom of build here). Is it possible to modify the deploy.sh (from the Travis vignette) so that it can't do that?

[eddelbuettel]

@csgillespie : Thoughts on this?

[csgillespie]

This sounds bad. I'm away until next Monday and I'll look at it then.

On 12:21, Sat, 25 Jul 2015 Dirk Eddelbuettel notifications@github.com wrote:

@csgillespie https://github.com/csgillespie : Thoughts on this?

— Reply to this email directly or view it on GitHub https://github.com/eddelbuettel/drat/issues/31#issuecomment-124835705.

[eddelbuettel]

@csgillespie Any chance you can look at this sooner rather than later? I have the rest of drat ready for a release. So the question is: should I wait for you for a possible fix or change, or should we just keep these two issues separate?

[leeper]

I think the easiest thing is probably just to redirect stderr to a file, like:

git fetch upstream 2>err.txt

I have no idea if this will create other problems, but it will solve this one.

[csgillespie]

@eddelbuettel Just about to respond before your ping.

I have been thinking about the problem and the solution that @leeper suggests is the one I came up with. We could pipe all errors from bash deploy.sh but I think that's overkill. So I would just propose we change the git fetch step to

git fetch upstream 2>err.txt

[eddelbuettel]

Seems straightforward enough. Thank you both!

[leeper]

Perfect. On Aug 4, 2015 4:17 PM, "Dirk Eddelbuettel" notifications@github.com wrote:

Closed #31 https://github.com/eddelbuettel/drat/issues/31 via 7dc6a8e https://github.com/eddelbuettel/drat/commit/7dc6a8e82cf4fdf4ce58bc5ed9d4785fe6b28689 .

— Reply to this email directly or view it on GitHub https://github.com/eddelbuettel/drat/issues/31#event-373103443.

[jangorecki]

It looks like it prints my unencrypted token on success in this build. It looks to be also the case for @leeper project, see latest build of cloudyr/aws.signature, line 882. Did I miss something?

[csgillespie]

I'll investigate

[csgillespie]

@eddelbuettel Rather than potentially stuffing other issues with a PR, would you change

git push

to

 git push 2>err.txt

in the vignette.

[eddelbuettel]

Done, though I erroneously referred to #37 when I meant #31 here.