From e24c93add4b16eb742551d617c33c3846928c50b Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Sat, 17 Oct 2026 13:55:24 +0200 Subject: [PATCH 1/2] Keep the values of environment variables out of --help Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- crates/hodeishield-cli/src/cli.rs | 2 ++ crates/hodeishield-cli/tests/cli.rs | 21 +++++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/crates/hodeishield-cli/src/cli.rs b/crates/hodeishield-cli/src/cli.rs index ec228d4..0505f85 100644 --- a/crates/hodeishield-cli/src/cli.rs +++ b/crates/hodeishield-cli/src/cli.rs @@ -43,6 +43,7 @@ pub struct Cli { global = true, help_heading = "Global options", env = "HODEISHIELD_PROFILE", + hide_env_values = true, value_name = "NAME" )] pub profile: Option, @@ -53,6 +54,7 @@ pub struct Cli { global = true, help_heading = "Global options", env = "HODEISHIELD_API_URL", + hide_env_values = true, value_name = "URL" )] pub api_url: Option, diff --git a/crates/hodeishield-cli/tests/cli.rs b/crates/hodeishield-cli/tests/cli.rs index 4fb7f15..15bc171 100644 --- a/crates/hodeishield-cli/tests/cli.rs +++ b/crates/hodeishield-cli/tests/cli.rs @@ -108,6 +108,27 @@ fn assert_no_key(output: &std::process::Output) { ); } +/// `--help` names the variables but never prints their values, which end up in terminals and CI logs. +#[test] +fn help_does_not_print_the_values_of_the_environment() { + let env = Env::new(); + let output = env + .cmd() + .env("HODEISHIELD_API_URL", "https://api-from-env.example.test") + .env("HODEISHIELD_PROFILE", "profile-from-env") + .env("HODEISHIELD_API_KEY", KEY) + .arg("--help") + .output() + .expect("run"); + let text = String::from_utf8_lossy(&output.stdout); + assert!(text.contains("[env: HODEISHIELD_API_URL]"), "{text}"); + assert!( + !text.contains("api-from-env") && !text.contains("profile-from-env"), + "{text}" + ); + assert_no_key(&output); +} + #[test] fn vendors_list_prints_a_table_and_the_next_page() { let env = Env::new(); From 35edc3b4ec1b3e424fd42ed64655840eefab9442 Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Sat, 17 Oct 2026 13:58:27 +0200 Subject: [PATCH 2/2] Remove the settings before the binary on uninstall, and name the MSI check and the Applications screen everywhere Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- README.md | 9 ++++++--- docs/user-information.md | 6 +++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 675d28c..39ea8ad 100644 --- a/README.md +++ b/README.md @@ -130,13 +130,15 @@ binary in `/usr/local/bin` or `~/.local/bin` (or the `--dir` you gave) and the m ```sh hodeishield logout # revokes the sign-in and removes the stored token +rm -f "$(hodeishield config path)" # optional: the settings rm "$(command -v hodeishield)" # the binary rm -f /usr/local/share/man/man1/hodeishield*.1 # man pages (~/.local/share/man/man1 for ~/.local/bin) -rm -f "$(hodeishield config path)" # optional: the settings ``` -Run `hodeishield logout` first; with the binary gone it can no longer do it. Remove the completion -files too if you copied them. +Run `hodeishield logout` and `config path` first; with the binary gone neither can run. If you +installed completions from `hodeishield completions`, remove the file where you saved it, usually +`~/.local/share/bash-completion/completions/hodeishield` (bash), `_hodeishield` in a directory of +your `fpath` (zsh) or `~/.config/fish/completions/hodeishield.fish` (fish). On Windows, `hodeishield logout` first removes the sign-in from Credential Manager, then: @@ -285,6 +287,7 @@ fail with a missing-source error), and the same `verify-blob` command works with ```powershell (Get-FileHash .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() Select-String hodeishield-0.5.0-x86_64-pc-windows-msvc.zip SHA256SUMS # the two hashes must match +# the same two lines with .msi for the MSI cosign verify-blob .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip ` --bundle .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip.sigstore.json ` --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 ` diff --git a/docs/user-information.md b/docs/user-information.md index 3f91895..51bcb56 100644 --- a/docs/user-information.md +++ b/docs/user-information.md @@ -89,7 +89,7 @@ logged, HTTPS only, no redirects followed, signed releases) is in has no option to skip certificate verification: install your organisation's CA in that store ([Networking](../README.md#networking-proxies-and-tls-inspection)). - **Cut access you no longer need**: `hodeishield logout`, or revoke the CLI's access in the app - under **Account → Application access**; revoke an API key in the app as soon as it is not needed + under **Account → Applications**; revoke an API key in the app as soon as it is not needed or may have been exposed. Known limitations: @@ -141,7 +141,7 @@ To stop using `hodeishield` on a machine and leave nothing behind: 1. **Sign out of every profile you signed in to**: `hodeishield logout`, and `hodeishield logout --profile ` for each other profile. This revokes the token at the app and removes it from the system keychain. If the CLI warns that the app did not confirm the - revocation, revoke the CLI's access in the app under **Account → Application access**. + revocation, revoke the CLI's access in the app under **Account → Applications**. 2. **Revoke the tenant API keys** the machine used, in the app, and remove them from the environment and secret stores that held them. 3. **Delete the configuration file and the update-check record.** `hodeishield config path` prints @@ -169,7 +169,7 @@ To stop using `hodeishield` on a machine and leave nothing behind: | `cargo install` | `cargo uninstall hodeishield-cli` | If the CLI is already gone and a sign-in was left in the keychain, revoke the access in the app -(**Account → Application access**), then delete the entry, one per profile, whose service is +(**Account → Applications**), then delete the entry, one per profile, whose service is `hodeishield-cli` and whose account is the profile name: on macOS with Keychain Access or `security delete-generic-password -s hodeishield-cli -a `, on Windows in Credential Manager (*Windows Credentials*, named `.hodeishield-cli`), and on Linux with