puppetlabs / puppetlabs/puppetlabs-java_ks
Check, if keytool exists, before trying to execute it
Open
Nobody has claimed this yet.
community
- Dominant language
- Ruby
- Stars
- 34
- Forks
- 97
- Avg merge
- 1h 22m
- Merged PRs (30d)
- 1
Description
Use Case
If keytool does not exist, sensitive Password is not “redacted” in Error-Message:
Error: /Stage[main]/Myprofilemodule/Java_ks[myRootCA]/ensure: change from 'absent' to 'latest' failed:
Execution of 'keytool -importcert -noprompt -alias myrootca -file /etc/pki/tls/certs/myCA_root.pem -keystore /path/to/mykeystore -srcstorepass MyPassword -deststorepass MyPassword' returned 1:
Error: Could not execute posix command: No such file or directory - keytool
Describe the Solution You Would Like
- check, if
keytoolexists, before trying to execute it - prevent Password-Leak in other Error-Situations
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named in the issue. Locate the Ruby code that invokes keytool and handles command failures, then inspect how passwords are included in error messages; done means missing-keytool failures and other execution errors no longer expose passwords, with tests covering those cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, ruby
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100