Just today while reporting a bug I've discovered very unpleasant issue: I access public network via auth-required proxy server. For correct operability of portage I've redefined in /etc/make.conf FETCHCOMMAND and RESUMECOMMAND to: FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp --proxy-user="myuser" --proxy-password="mypassword" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp --proxy-user="myuser" --proxy-password="mypassword" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" Normally required for troubleshooting emerge --info output in my case contain not only FETCHCOMMAND and RESUMECOMMAND, but the values of wget private options: --proxy-user and --proxy-password. Also SESSION_MANAGER variable contains private (but much less important) data: the domain name. Reproducible: Always Steps to Reproduce: 1. Redefine FETCH/RESUMECOMMAND adding some private data (for example --proxy-user/password options); 2. Type emerge --info. Actual Results: See your private data in emerge --info output in cleartext. Expected Results: The values of private options of FETCH/RESUMECOMMAND MUST be masked (for example into 'xxxxxx'). emerge --info Portage 2.1.10.3 (default/linux/x86/10.0, gcc-4.4.5, glibc-2.12.2-r0, 2.6.39-gentoo-r3 i686) ================================================================= System uname: Linux-2.6.39-gentoo-r3-i686-Intel-R-_Pentium-R-_4_CPU_3.00GHz-with-gentoo-2.0.3 Timestamp of tree: Mon, 15 Aug 2011 00:45:01 +0000 app-shells/bash: 4.1_p9 dev-java/java-config: 2.1.11-r3 dev-lang/python: 2.7.1-r1, 3.1.3-r1 dev-util/cmake: 2.8.4-r1 dev-util/pkgconfig: 0.26 sys-apps/baselayout: 2.0.3 sys-apps/openrc: 0.8.3-r1 sys-apps/sandbox: 2.4 sys-devel/autoconf: 2.13, 2.68 sys-devel/automake: 1.10.3, 1.11.1 sys-devel/binutils: 2.20.1-r1 sys-devel/gcc: 4.4.5 sys-devel/gcc-config: 1.4.1-r1 sys-devel/libtool: 2.4-r1 sys-devel/make: 3.82 sys-kernel/linux-headers: 2.6.36.1 (virtual/os-headers) sys-libs/glibc: 2.12.2 Repositories: gentoo location: /usr/portage sync: rsync://mirror.yandex.ru/gentoo-portage/ priority: -1000 rion location: /var/lib/layman/rion masters: gentoo priority: 0 local-portage-tree location: /usr/local/portage-ftn masters: gentoo priority: 1 ACCEPT_KEYWORDS="x86" ACCEPT_LICENSE="* -@EULA" ACCEPT_PROPERTIES="*" ALSA_CARDS="intel8x0" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ARCH="x86" AUTOCLEAN="yes" CALLIGRA_FEATURES="braindump flow karbon kexi kpresenter krita tables words" CAMERAS="ptp2" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=native -pipe" CHOST="i686-pc-linux-gnu" CLEAN_DELAY="5" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" COLLISION_IGNORE="/lib/modules" COLORTERM="Terminal" CONFIG_PROTECT="/etc /etc/env.d/50glib2 /usr/share/gnupg/qualified.txt /var/bind" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.2/ext-active/ /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.2/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.2/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -march=native -pipe" C_INCLUDE_PATH="/usr/lib/oracle/10.2.0.3/client/include" DBUS_SESSION_BUS_ADDRESS="unix:abstract=/tmp/dbus-q326fEBxOu,guid=ae371fdb5867f89a4508ea6600000089" DESKTOP_SESSION="xfce" DISPLAY=":0.0" DISTDIR="/var/distfiles" EDITOR="/usr/bin/vim" ELIBC="glibc" EMERGE_DEFAULT_OPTS="--ask --verbose --autounmask=n" EMERGE_WARNING_DELAY="10" EPREFIX="" EROOT="/" FCFLAGS="" FEATURES="assume-digests binpkg-logs buildsyspkg collision-protect distlocks ebuild-locks fixlafiles fixpackages news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch" FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp --proxy-user=user --proxy-password=password -O "${DISTDIR}/${FILE}" "${URI}"" FETCHCOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}"" FETCHCOMMAND_SFTP="bash -c "x=\${2#sftp://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec sftp -P \${port} \"\${host}:/\${x#*/}\" \"\$1\"" sftp "${DISTDIR}/${FILE}" "${URI}"" FETCHCOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec rsync --rsh=\"ssh -p\${port}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}"" FFLAGS="" GCC_SPECS="" GDK_USE_XFT="1" GENTOO_MIRRORS="http://mirror.yandex.ru/gentoo-distfiles/ ftp://mirror.yandex.ru/gentoo-distfiles/ http://ftp.chg.ru/pub/Linux/distributions/gentoo/ ftp://ftp.chg.ru/pub/Linux/distributions/gentoo/ http://ftp.corbina.net/pub/Linux/gentoo/ ftp://ftp.corbina.net/pub/Linux/gentoo/" GLADE_CATALOG_PATH=":" GLADE_MODULE_PATH=":" GLADE_PIXMAP_PATH=":" GPG_AGENT_INFO="/tmp/gpg-cKW1Ag/S.gpg-agent:1643:1" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" GRUB_PLATFORMS="" GSETTINGS_BACKEND="gconf" GTK_PATH=":/usr/lib/gtk-2.0" G_BROKEN_FILENAMES="1" G_FILENAME_ENCODING="KOI8-R" HG="/usr/bin/hg" HOME="/home/ftn" HUSHLOGIN="FALSE" INFOPATH="/usr/share/info:/usr/share/binutils-data/i686-pc-linux-gnu/2.20.1/info:/usr/share/gcc-data/i686-pc-linux-gnu/4.4.5/info" INPUT_DEVICES="keyboard mouse" JAVAC="/etc/java-config-2/current-system-vm/bin/javac" JAVA_HOME="/etc/java-config-2/current-system-vm" JDK_HOME="/etc/java-config-2/current-system-vm" KERNEL="linux" LANG="ru_RU.KOI8-R" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LC_ALL="" LC_NUMERIC="C" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LESS="-R -M --shift 5" LESSOPEN="|lesspipe.sh %s" LIBGLADE_MODULE_PATH=":/usr/lib/libglade/2.0" LINGUAS="ru en" LOGNAME="ftn" LS_COLORS="rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.pdf=00;32:*.ps=00;32:*.txt=00;32:*.patch=00;32:*.diff=00;32:*.log=00;32:*.tex=00;32:*.doc=00;32:*.aac=00;36:*.au=00;36:*.flac=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.axa=00;36:*.oga=00;36:*.spx=00;36:*.xspf=00;36:" MAIL="/var/mail/ftn" MAKEOPTS="-j2" MANPATH="/etc/java-config-2/current-system-vm/man:/usr/local/share/man:/usr/share/man:/usr/share/binutils-data/i686-pc-linux-gnu/2.20.1/man:/usr/share/gcc-data/i686-pc-linux-gnu/4.4.5/man:/etc/java-config/system-vm/man/:/usr/lib/php5.2/man/:/usr/lib/php5.3/man/" NETBEANS="apisupport cnd groovy gsf harness ide identity j2ee java mobility nb php profiler soa visualweb webcommon websvccommon xml" NLS_LANG="russian_cis.cl8iso8859p5" OPENGL_PROFILE="xorg-x11" ORACLE_HOME="/usr/lib/oracle/10.2.0.3/client" PAGER="/usr/bin/less" PATH="/usr/local/bin:/usr/bin:/bin:/opt/bin:/usr/i686-pc-linux-gnu/gcc-bin/4.1.1:/usr/i686-pc-linux-gnu/gcc-bin/4.4.5:~/bin:~/bin" PHP_TARGETS="php5-3" PKGDIR="/usr/portage/packages" PORTAGE_ARCHLIST="ppc sparc64-freebsd ppc-openbsd x86-openbsd ppc64 x86-winnt x86-fbsd ppc-aix alpha arm x86-freebsd s390 amd64 arm-linux x86-macos x64-openbsd ia64-hpux hppa x86-netbsd x86-cygwin amd64-linux ia64-linux x86 sparc-solaris x64-freebsd sparc64-solaris x86-linux x64-macos sparc m68k-mint ia64 mips ppc-macos x86-interix hppa-hpux amd64-fbsd x64-solaris mips-irix m68k sh x86-solaris sparc-fbsd" PORTAGE_BINHOST_CHUNKSIZE="3000" PORTAGE_BIN_PATH="/usr/lib/portage/bin" PORTAGE_COMPRESS_EXCLUDE_SUFFIXES="css gif htm[l]? jp[e]?g js pdf png" PORTAGE_CONFIGROOT="/" PORTAGE_DEBUG="0" PORTAGE_DEPCACHEDIR="/var/cache/edb/dep" PORTAGE_ELOG_CLASSES="log warn error" PORTAGE_ELOG_MAILFROM="portage@localhost" PORTAGE_ELOG_MAILSUBJECT="[portage] ebuild log for ${PACKAGE} on ${HOST}" PORTAGE_ELOG_MAILURI="root" PORTAGE_ELOG_SYSTEM="save_summary echo" PORTAGE_FETCH_CHECKSUM_TRY_MIRRORS="5" PORTAGE_FETCH_RESUME_MIN_SIZE="350K" PORTAGE_GID="250" PORTAGE_GPG_SIGNING_COMMAND="gpg --sign --clearsign --yes --default-key "${PORTAGE_GPG_KEY}" --homedir "${PORTAGE_GPG_DIR}" "${FILE}"" PORTAGE_INST_GID="0" PORTAGE_INST_UID="0" PORTAGE_NICENESS="13" PORTAGE_PYM_PATH="/usr/lib/portage/pym" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_RSYNC_RETRIES="-1" PORTAGE_SANDBOX_COMPAT_LEVEL="16" PORTAGE_SYNC_STALE="30" PORTAGE_TMPDIR="/var/tmp" PORTAGE_VERBOSE="1" PORTAGE_WORKDIR_MODE="0700" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/rion /usr/local/portage-ftn" PRELINK_PATH_MASK="/usr/lib/libfreebl3.so:/usr/lib/libnssdbm3.so:/usr/lib/libsoftokn3.so" PROFILE_ONLY_VARIABLES="ARCH ELIBC KERNEL USERLAND" PWD="/home/ftn" PYTHONDONTWRITEBYTECODE="1" RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp --proxy-user=user --proxy-password=password -O "${DISTDIR}/${FILE}" "${URI}"" RESUMECOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}"" RESUMECOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec rsync --rsh=\"ssh -p\${port}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}"" ROOT="/" ROOTPATH="/opt/bin:/usr/i686-pc-linux-gnu/gcc-bin/4.1.1:/usr/i686-pc-linux-gnu/gcc-bin/4.4.5" RPMDIR="/usr/portage/rpm" RUBY_TARGETS="ruby18" SHELL="/bin/bash" SHLVL="5" SSH_AGENT_PID="1643" SSH_AUTH_SOCK="/tmp/gpg-5CuzYq/S.gpg-agent.ssh" SUPPORT_ALSA="1" SYNC="rsync://mirror.yandex.ru/gentoo-portage/" TERM="xterm" TNS_ADMIN="/etc/oracle/" USE="X a52 ac3 acl alsa avi berkdb bold bzip2 cdr cli cracklib crypt cups cxx dbus djvu dri dvd flac fortran gdbm gif gtk iconv jpeg jpeg2k modules mp3 mudflap ncurses nls nptl nptlonly ogg openmp pam pcre pdf perl png pppd python qt3support readline session ssl sysfs tcpd tiff unicode utf8 vorbis x86 xcb xorg xulrunner zlib" ALSA_CARDS="intel8x0" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="braindump flow karbon kexi kpresenter krita tables words" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="ru en" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="sis" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" USER="ftn" USERLAND="GNU" USE_EXPAND="ALSA_CARDS ALSA_PCM_PLUGINS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CROSSCOMPILE_OPTS DRACUT_MODULES DVB_CARDS ELIBC FCDSL_CARDS FOO2ZJS_DEVICES FRITZCAPI_CARDS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL LCD_DEVICES LINGUAS LIRC_DEVICES MISDN_CARDS NETBEANS_MODULES NGINX_MODULES_HTTP NGINX_MODULES_MAIL OFED_DRIVERS PHP_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS RUBY_TARGETS SANE_BACKENDS USERLAND VIDEO_CARDS XFCE_PLUGINS XTABLES_ADDONS" USE_EXPAND_HIDDEN="CROSSCOMPILE_OPTS ELIBC KERNEL USERLAND" USE_ORDER="env:pkg:conf:defaults:pkginternal:env.d" VIDEO_CARDS="sis" WINDOWID="56629280" WINDOWPATH="7" WWW_HOME="www.ya.ru" XAUTHORITY="/home/ftn/.Xauthority" XDG_CONFIG_DIRS="/etc/xdg:/etc/xdg" XDG_DATA_DIRS="/usr/local/share:/usr/share:/usr/share" XDG_MENU_PREFIX="xfce-" XSESSION="Xfce4" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" _="/usr/bin/emerge"
I'd say this bug is invalid. a) You shouldn't store passwords as plain text, but you some authentication mechanism. b) FETCH_COMMAND is necessary information to debug fetch issues and should consequently be part of emerge --info.
(In reply to comment #1) > I'd say this bug is invalid. > > a) You shouldn't store passwords as plain text, but you some authentication > mechanism. > > b) FETCH_COMMAND is necessary information to debug fetch issues and should > consequently be part of emerge --info. Even so, I think it would be reasonable to process variables with a regular expression, like the fetch() function does: http://git.overlays.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=6d4cf62440f60b2e41a9e8e824b876093f6517c3
(In reply to comment #0) > Just today while reporting a bug I've discovered very unpleasant issue: > > I access public network via auth-required proxy server. > For correct operability of portage I've redefined in /etc/make.conf > FETCHCOMMAND and RESUMECOMMAND to: > FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp --proxy-user="myuser" > --proxy-password="mypassword" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" > RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp --proxy-user="myuser" > --proxy-password="mypassword" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" I'd suggest that you put command in a shell script with appropriate permissions, and have FETCHCOMMAND/RESUMECOMMAND call the shell script. If the pattern was a URI pattern, then I'd go ahead and filter it. However, recognizing the --proxy-user and --proxy-password options that are unique to wget it a little too much to ask.
(In reply to comment #3) > I'd suggest that you put command in a shell script with appropriate > permissions, and have FETCHCOMMAND/RESUMECOMMAND call the shell script. > Thank you. May be the issue could be solved by adding some user-side filter, by default disabled (and empty)? Now I'm thinking about writing some bash-script for filtering emerge --info output (and start to use emerge-info.sh, solving my issue, instead of emerge-info). For some paranoids domain (and perhaps IP) data also should (wanted to) be filtered.
We could add a variable called something like PORTAGE_INFO_VAR_FILTER where you would have a regular expression that would be used like grep -v to filter matched lines out of the variable output.
May be it is better to use not grep -v but sed-like filter (with variable field-mask list). For example: PORTAGE_INFO_VAR_FILTER is set (contains private data, value doesn't included). FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp --proxy-user="myuser" --proxy-password="mypassword" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" is not excluded from emerge --info output, but modified to something like: FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp --proxy-user="gentoo" --proxy-password="secret" -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
As was shown in bug #398615 for proxy credentials it's more correct to use system-wide fetch utility configuration (if used default net-misc/wget --- /etc/wgetrc). But other private data (user names and IPs) normally should be filtered.
It seems to be mostly my mistake. I also prefer to use by default for most cases '--verbose' option (issue described in bug #376989), which extends verbosity much above necessary. Currently using alias: alias einfo="emerge --ignore-default-opts --info" almost completely solves issue (the only private data present in output is internal address of local rsync mirror). So, adding to the end of 'emerge --verbose --info' command warning about private data will completely solve this issue.
Just attention. And don't use --verbose option for bugzilla's system desc. For rather long ago Bugzilla's quotas reminds to do so.
