Obfuscate password in credentials debug messages #12944

jtfmumm · 2025-04-17T13:18:03Z

I noticed in the trace output that we weren't obfuscating the Credentials password in a trace message. This PR creates a Password newtype with a custom Debug implementation.

zanieb · 2025-04-17T13:47:22Z

See also #1714

jtfmumm · 2025-04-17T14:09:04Z

See also #1714

Thanks, I'll address that here as well.

jtfmumm · 2025-04-17T14:54:36Z

See also #1714

I've addressed the first example in your linked issue (Updating ...) but I think it's worth a more thorough audit of how we're handling URLs. I suggest we merge this PR first because it's critical and then I can do the audit separately.

crates/uv-auth/src/credentials.rs

This reverts commit 19c0b04.

zanieb

As noted in #12969 (comment), we'll probably want a UV_LOG_SHOW_SECRETS variable or something to toggle this back on for people that are debugging if their secrets are correct. I don't know if that needs to block this change.

jtfmumm · 2025-04-18T17:37:02Z

As noted in #12969 (comment), we'll probably want a UV_LOG_SHOW_SECRETS variable or something to toggle this back on for people that are debugging if their secrets are correct. I don't know if that needs to block this change.

I'd argue we shouldn't provide the option to log secrets, though admittedly that's pretty strict. That could be part of a bigger conversation. Since this PR doesn't mask usernames (avoiding the other question you raise in your linked comment), I'd say we merge it as is.

zanieb · 2025-04-18T19:48:56Z

I'd argue we shouldn't provide the option to log secrets, though admittedly that's pretty strict.

Why? It's very helpful for debugging and it seems quite reasonable to allow people to opt-in to?

jtfmumm · 2025-04-18T19:57:34Z

I'd argue we shouldn't provide the option to log secrets, though admittedly that's pretty strict.

Why? It's very helpful for debugging and it seems quite reasonable to allow people to opt-in to?

Yeah I agree it’s helpful. But it’s the kind of option that can be accidentally left on. Do other tools in the space provide flags to log secrets?

For debugging purposes we could consider opt in logging of the salted hash of the secret.

zanieb · 2025-04-18T21:01:47Z

I'm not sure about other tools in the space. I looked around a little, but didn't find clear answers. However, I don't really feel concerned about the situation where someone explicitly enables showing secrets in order to debug something then leaves it on by accident? It feels fairly contrived. We could even call it UV_UNSAFE_SHOW_SECRETS or whatever, but authentication is a complicated part of uv and we have spent a great deal of time debugging it — I'm very hesitant about losing the ability to get any insight into what credentials are used. I think a salted hash sounds pretty overkill for something like this, I worry it'd just be more confusing.

jtfmumm · 2025-04-18T21:42:06Z

A simpler way to put it is that this option allows careless developers to log secrets in production when debugging a problem. I can write something up separately. Is this blocking the PR or should I merge in the meantime?

zanieb · 2025-04-18T21:46:27Z

No I don't think it needs to block this change.

If careless developers want to log secrets in production, they'll do so regardless of uv's security posture. We usually design to be secure by default, but trust users to make insecure choices if they need to, e.g., --insecure-host and --index-strategy.

topher96 · 2025-04-19T11:31:38Z

Regarding password logging - what about a password masking option instead? Logs are nearly impossible get rid of at a big company due to centralized logging with long retention policies and shared widely to aid multiple levels of support. I suggest instead of an option to log passwords at any log level (outside of some extreme trace level) you add an option to only log the first N characters and the total length. You could add some logic to reduce N further when the length is short. Also add something grep-able in the string so centralized loggers could mask it out. The benefit is companies could just leave the option on in at least a quality environment. For example if my secret was PASSWORD123 it could show {SEC:11}'PA' - that's enough to be useful for debugging in a broad set of cases.

zanieb · 2025-04-20T16:01:13Z

I've been down that route before :) PrefectHQ/prefect#6707 (comment)

But it's a nice middle-ground for opt-in.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.6.11` -> `0.6.16` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.6.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0616) [Compare Source](astral-sh/uv@0.6.15...0.6.16) ##### Bug fixes - Revert "Properly handle authentication for 302 redirect URLs" ([#13041](astral-sh/uv#13041)) ### [`v0.6.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0615) [Compare Source](astral-sh/uv@0.6.14...0.6.15) This release includes preliminary support for the `pylock.toml` file format, as standardized in [PEP 751](https://peps.python.org/pep-0751/). `pylock.toml` is an alternative resolution output format intended to replace `requirements.txt` (e.g., in the context of `uv pip compile`, whereby a "locked" `requirements.txt` file is generated from a set of input requirements). `pylock.toml` is standardized and tool-agnostic, such that in the future, `pylock.toml` files generated by uv could be installed by other tools, and vice versa. As of this release, `pylock.toml` is supported in the following commands: - To export a `uv.lock` to the `pylock.toml` format, run: `uv export -o pylock.toml` - To generate a `pylock.toml` file from a set of requirements, run: `uv pip compile -o pylock.toml -r requirements.in` - To install from a `pylock.toml` file, run: `uv pip sync pylock.toml` or `uv pip install -r pylock.toml` ##### Enhancements - Add PEP 751 support to `uv pip compile` ([#13019](astral-sh/uv#13019)) - Add `uv export` support for PEP 751 ([#12955](astral-sh/uv#12955)) - Accept `requirements.txt` (verbatim) as a format on the CLI ([#12957](astral-sh/uv#12957)) - Add `UV_NO_EDITABLE` environment variable to set `--no-editable` on all invocations ([#12773](astral-sh/uv#12773)) - Add `pylock.toml` to `uv pip install` and `uv pip sync` ([#12992](astral-sh/uv#12992)) - Add a brief sleep before sending `SIGINT` to child processes ([#13018](astral-sh/uv#13018)) - Add upload time to `uv.lock` ([#12968](astral-sh/uv#12968)) - Allow updating Git sources by name ([#12897](astral-sh/uv#12897)) - Cache `which git` in `uv init` ([#12893](astral-sh/uv#12893)) - Enable `--dry-run` with `--locked` / `--frozen` for `uv sync` ([#12778](astral-sh/uv#12778)) - Infer output type in `uv export` ([#12958](astral-sh/uv#12958)) - Make `uv init` resilient against broken git ([#12895](astral-sh/uv#12895)) - Respect build constraints for `uv run --with` dependencies ([#12882](astral-sh/uv#12882)) - Split UV_INDEX on all whitespace ([#12820](astral-sh/uv#12820)) - Support build constraints in `uv tool` and PEP723 scripts. ([#12842](astral-sh/uv#12842)) - Use suffix from `uvx` binary when searching for uv binary ([#12923](astral-sh/uv#12923)) - Update version formatting to use cyan color ([#12943](astral-sh/uv#12943)) - Add debug logs for version file search ([#12951](astral-sh/uv#12951)) - Fix `SourceNotAllowed` error message during Python discovery ([#13012](astral-sh/uv#13012)) - Obfuscate password in credentials debug messages ([#12944](astral-sh/uv#12944)) - Obfuscate possible tokens in URL logs ([#12969](astral-sh/uv#12969)) - Validate that PEP 751 entries don't include multiple sources ([#12993](astral-sh/uv#12993)) ##### Preview features - Build backend: Add reference docs and schema ([#12803](astral-sh/uv#12803)) ##### Bug fixes - Align supported `config-settings` with example in docs ([#12947](astral-sh/uv#12947)) - Ensure virtual environment is compatible with interpreter on sync ([#12884](astral-sh/uv#12884)) - Fix `PythonDownloadRequest` parsing for partial keys ([#12925](astral-sh/uv#12925)) - Fix pre-release exclusive comparison operator in `uv-pep440` ([#12836](astral-sh/uv#12836)) - Forward additional signals to the child process in `uv run` ([#13017](astral-sh/uv#13017)) - Omit PEP 751 version for source trees ([#13030](astral-sh/uv#13030)) - Patch `CC` and `CCX` entries in sysconfig for cross-compiled `aarch64` Python distributions ([#12239](astral-sh/uv#12239)) - Properly handle authentication for HTTP 302 redirect URLs ([#12920](astral-sh/uv#12920)) - Set 4MB stack size for all threads, introduce `UV_STACK_SIZE` ([#12839](astral-sh/uv#12839)) - Show PyPy downloads during `uv python list` ([#12915](astral-sh/uv#12915)) - Add `subdirectory` to Direct URL for local directories ([#12971](astral-sh/uv#12971)) - Prefer stable releases over pre-releases in `uv python install` ([#12194](astral-sh/uv#12194)) - Write requested Python variant to pin file in `uv init` ([#12870](astral-sh/uv#12870)) ##### Documentation - Fix CLI reference with code block ([#12807](astral-sh/uv#12807)) - Fix lockfile note ([#12793](astral-sh/uv#12793)) - Fix typo in a reference ([#12858](astral-sh/uv#12858)) - Improve docs for `uv python list --only-downloads` and `--only-installed` ([#12916](astral-sh/uv#12916)) - Update note on lack of musl distributions to ARM-only ([#12825](astral-sh/uv#12825)) - Add section on shebangs for scripts ([#11553](astral-sh/uv#11553)) - Display aliases for long and short args in the CLI reference ([#12824](astral-sh/uv#12824)) - Fix highlight line in explicit index documentation ([#12887](astral-sh/uv#12887)) - Add explicit source (matching PyTorch guide) ([#12844](astral-sh/uv#12844)) - Fix link to issue ([#12823](astral-sh/uv#12823)) - Fix grammatical error in FastAPI guide ([#12908](astral-sh/uv#12908)) - Add `--locked` to `uv sync` in GitHub Actions guide ([#12819](astral-sh/uv#12819)) - Improve formatting for `"all"` `default-groups` setting documentation ([#12963](astral-sh/uv#12963)) - Replace `--frozen` with `--locked` in Docker integration guide ([#12818](astral-sh/uv#12818)) ### [`v0.6.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0614) [Compare Source](astral-sh/uv@0.6.13...0.6.14) ##### Python versions The following Python versions have been added: - CPython 3.13.3 - CPython 3.12.10 - CPython 3.11.12 - CPython 3.10.17 - CPython 3.9.22 See the [`python-build-standalone` release notes](https://github.com/astral-sh/python-build-standalone/releases/tag/20250409) for more details. ##### Enhancements - Add `uv-build` and `uv_build` aliases to `uv init --build-backend` ([#12776](astral-sh/uv#12776)) - Emit dedicated error message for Conda `environment.yml` files ([#12669](astral-sh/uv#12669)) ##### Preview features - Build backend: Check module dir exists for sdist build ([#12779](astral-sh/uv#12779)) - Build backend: Fix sdist with long directories ([#12764](astral-sh/uv#12764)) ##### Performance - Avoid querying GitHub on repeated install invocations ([#12767](astral-sh/uv#12767)) ##### Bug fixes - Error when `tool.uv.sources` is set in system-level configuration file ([#12757](astral-sh/uv#12757)) - Split workspace members onto their own lines in `uv init` ([#12756](astral-sh/uv#12756)) ##### Documentation - Add lockfile note about PEP 751 ([#12732](astral-sh/uv#12732)) - Extend the reference documentation for `uv pip sync` ([#12683](astral-sh/uv#12683)) - Fix mismatched pip interface header / nav titles ([#12640](astral-sh/uv#12640)) ### [`v0.6.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0613) [Compare Source](astral-sh/uv@0.6.12...0.6.13) ##### Enhancements - Add `--show-version` to `uv python find` ([#12376](astral-sh/uv#12376)) - Remove `--no-config` warning from `uv pip compile` and `uv pip sync` ([#12642](astral-sh/uv#12642)) - Skip repeated directories in `PATH` when searching for Python interpreters ([#12367](astral-sh/uv#12367)) - Unset `SCRIPT_PATH` in relocatable activation script ([#12672](astral-sh/uv#12672)) - Add `UV_PYTHON_DOWNLOADS_JSON_URL` to set custom managed python sources ([#10939](astral-sh/uv#10939)) - Reject `pyproject.toml` files in `uv pip compile -o` ([#12673](astral-sh/uv#12673)) - Respect the `--offline` flag for Git operations ([#12619](astral-sh/uv#12619)) ##### Bug fixes - Warn instead of error if CRC appears to be missing ([#12722](astral-sh/uv#12722)) - Avoid infinite loop in `uv export` with conflicts ([#12726](astral-sh/uv#12726)) ##### Rust API - Update MSRV to 1.84 ([#12670](astral-sh/uv#12670)) ### [`v0.6.12`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0612) [Compare Source](astral-sh/uv@0.6.11...0.6.12) ##### Enhancements - Report the queried executable path in `uv python list` ([#12628](astral-sh/uv#12628)) - Improve archive unpack error messages ([#12627](astral-sh/uv#12627)) ##### Bug fixes - Respect `authenticate` when using `explicit = true` ([#12631](astral-sh/uv#12631)) - Normalize extra and group names in `uv add` and `uv remove` ([#12586](astral-sh/uv#12586)) - Enforce CRC-32 checks when unpacking archives ([#12623](astral-sh/uv#12623)) - Fix parsing of `python-platform` in settings files ([#12592](astral-sh/uv#12592)) ##### Documentation - Add note about `uv build` to `package = false` ([#12608](astral-sh/uv#12608)) - Add index fallback note to `authenticate = always` documentation ([#12498](astral-sh/uv#12498)) - Fix invalid 'kind' reference in flat index docs ([#12583](astral-sh/uv#12583)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

## 0.6.17 ### Preview features - Add PyTorch v2.7.0 to GPU backend ([#13072](astral-sh/uv#13072)) ### Bug fixes - Avoid panic for invalid Python versions ([#13077](astral-sh/uv#13077)) - Block scripts from overwriting `python` ([#13051](astral-sh/uv#13051)) - Check distribution names to handle invalid redirects ([#12917](astral-sh/uv#12917)) - Check for mismatched package and distribution names on resolver thread ([#13088](astral-sh/uv#13088)) - Fix panic with invalid last character in PEP 508 name ([#13105](astral-sh/uv#13105)) - Reject `requires-python` even if not listed on the index page ([#13086](astral-sh/uv#13086)) ## 0.6.16 ### Bug fixes - Revert "Properly handle authentication for 302 redirect URLs" ([#13041](astral-sh/uv#13041)) ## 0.6.15 This release includes preliminary support for the `pylock.toml` file format, as standardized in [PEP 751](https://peps.python.org/pep-0751/). `pylock.toml` is an alternative resolution output format intended to replace `requirements.txt` (e.g., in the context of `uv pip compile`, whereby a "locked" `requirements.txt` file is generated from a set of input requirements). `pylock.toml` is standardized and tool-agnostic, such that in the future, `pylock.toml` files generated by uv could be installed by other tools, and vice versa. As of this release, `pylock.toml` is supported in the following commands: - To export a `uv.lock` to the `pylock.toml` format, run: `uv export -o pylock.toml` - To generate a `pylock.toml` file from a set of requirements, run: `uv pip compile -o pylock.toml -r requirements.in` - To install from a `pylock.toml` file, run: `uv pip sync pylock.toml` or `uv pip install -r pylock.toml` ### Enhancements - Add PEP 751 support to `uv pip compile` ([#13019](astral-sh/uv#13019)) - Add `uv export` support for PEP 751 ([#12955](astral-sh/uv#12955)) - Accept `requirements.txt` (verbatim) as a format on the CLI ([#12957](astral-sh/uv#12957)) - Add `UV_NO_EDITABLE` environment variable to set `--no-editable` on all invocations ([#12773](astral-sh/uv#12773)) - Add `pylock.toml` to `uv pip install` and `uv pip sync` ([#12992](astral-sh/uv#12992)) - Add a brief sleep before sending `SIGINT` to child processes ([#13018](astral-sh/uv#13018)) - Add upload time to `uv.lock` ([#12968](astral-sh/uv#12968)) - Allow updating Git sources by name ([#12897](astral-sh/uv#12897)) - Cache `which git` in `uv init` ([#12893](astral-sh/uv#12893)) - Enable `--dry-run` with `--locked` / `--frozen` for `uv sync` ([#12778](astral-sh/uv#12778)) - Infer output type in `uv export` ([#12958](astral-sh/uv#12958)) - Make `uv init` resilient against broken git ([#12895](astral-sh/uv#12895)) - Respect build constraints for `uv run --with` dependencies ([#12882](astral-sh/uv#12882)) - Split UV_INDEX on all whitespace ([#12820](astral-sh/uv#12820)) - Support build constraints in `uv tool` and PEP723 scripts. ([#12842](astral-sh/uv#12842)) - Use suffix from `uvx` binary when searching for uv binary ([#12923](astral-sh/uv#12923)) - Update version formatting to use cyan color ([#12943](astral-sh/uv#12943)) - Add debug logs for version file search ([#12951](astral-sh/uv#12951)) - Fix `SourceNotAllowed` error message during Python discovery ([#13012](astral-sh/uv#13012)) - Obfuscate password in credentials debug messages ([#12944](astral-sh/uv#12944)) - Obfuscate possible tokens in URL logs ([#12969](astral-sh/uv#12969)) - Validate that PEP 751 entries don't include multiple sources ([#12993](astral-sh/uv#12993)) ### Preview features - Build backend: Add reference docs and schema ([#12803](astral-sh/uv#12803)) ### Bug fixes - Align supported `config-settings` with example in docs ([#12947](astral-sh/uv#12947)) - Ensure virtual environment is compatible with interpreter on sync ([#12884](astral-sh/uv#12884)) - Fix `PythonDownloadRequest` parsing for partial keys ([#12925](astral-sh/uv#12925)) - Fix pre-release exclusive comparison operator in `uv-pep440` ([#12836](astral-sh/uv#12836)) - Forward additional signals to the child process in `uv run` ([#13017](astral-sh/uv#13017)) - Omit PEP 751 version for source trees ([#13030](astral-sh/uv#13030)) - Patch `CC` and `CCX` entries in sysconfig for cross-compiled `aarch64` Python distributions ([#12239](astral-sh/uv#12239)) - Properly handle authentication for HTTP 302 redirect URLs ([#12920](astral-sh/uv#12920)) - Set 4MB stack size for all threads, introduce `UV_STACK_SIZE` ([#12839](astral-sh/uv#12839)) - Show PyPy downloads during `uv python list` ([#12915](astral-sh/uv#12915)) - Add `subdirectory` to Direct URL for local directories ([#12971](astral-sh/uv#12971)) - Prefer stable releases over pre-releases in `uv python install` ([#12194](astral-sh/uv#12194)) - Write requested Python variant to pin file in `uv init` ([#12870](astral-sh/uv#12870)) ### Documentation - Fix CLI reference with code block ([#12807](astral-sh/uv#12807)) - Fix lockfile note ([#12793](astral-sh/uv#12793)) - Fix typo in a reference ([#12858](astral-sh/uv#12858)) - Improve docs for `uv python list --only-downloads` and `--only-installed` ([#12916](astral-sh/uv#12916)) - Update note on lack of musl distributions to ARM-only ([#12825](astral-sh/uv#12825)) - Add section on shebangs for scripts ([#11553](astral-sh/uv#11553)) - Display aliases for long and short args in the CLI reference ([#12824](astral-sh/uv#12824)) - Fix highlight line in explicit index documentation ([#12887](astral-sh/uv#12887)) - Add explicit source (matching PyTorch guide) ([#12844](astral-sh/uv#12844)) - Fix link to issue ([#12823](astral-sh/uv#12823)) - Fix grammatical error in FastAPI guide ([#12908](astral-sh/uv#12908)) - Add `--locked` to `uv sync` in GitHub Actions guide ([#12819](astral-sh/uv#12819)) - Improve formatting for `"all"` `default-groups` setting documentation ([#12963](astral-sh/uv#12963)) - Replace `--frozen` with `--locked` in Docker integration guide ([#12818](astral-sh/uv#12818))

Obfuscate password in credentials

e4cf236

jtfmumm added the security label Apr 17, 2025

jtfmumm changed the title ~~Obfuscate password in credentials~~ Obfuscate password in credentials debug messages Apr 17, 2025

jtfmumm added 2 commits April 17, 2025 15:20

..

f7a6d03

..

eb5f83e

zanieb reviewed Apr 17, 2025

View reviewed changes

crates/uv-auth/src/credentials.rs Outdated Show resolved Hide resolved

jtfmumm added 2 commits April 17, 2025 19:36

..

19c0b04

Revert ".."

035133e

This reverts commit 19c0b04.

jtfmumm force-pushed the jtfm/obfuscate-password branch from a9c6654 to 035133e Compare April 17, 2025 17:37

jtfmumm closed this Apr 17, 2025

jtfmumm reopened this Apr 17, 2025

zanieb approved these changes Apr 18, 2025

View reviewed changes

jtfmumm merged commit ea16fe2 into main Apr 18, 2025
77 checks passed

jtfmumm deleted the jtfm/obfuscate-password branch April 18, 2025 22:01

BrewTestBot mentioned this pull request Apr 22, 2025

uv 0.6.15 Homebrew/homebrew-core#220927

Merged

Obfuscate password in credentials debug messages #12944

Obfuscate password in credentials debug messages #12944

Uh oh!

Conversation

jtfmumm commented Apr 17, 2025

Uh oh!

zanieb commented Apr 17, 2025

Uh oh!

jtfmumm commented Apr 17, 2025

Uh oh!

jtfmumm commented Apr 17, 2025

Uh oh!

Uh oh!

zanieb left a comment

Choose a reason for hiding this comment

Uh oh!

jtfmumm commented Apr 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanieb commented Apr 18, 2025

Uh oh!

jtfmumm commented Apr 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanieb commented Apr 18, 2025

Uh oh!

jtfmumm commented Apr 18, 2025

Uh oh!

zanieb commented Apr 18, 2025

Uh oh!

Uh oh!

topher96 commented Apr 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanieb commented Apr 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jtfmumm commented Apr 18, 2025 •

edited

Loading

jtfmumm commented Apr 18, 2025 •

edited

Loading

topher96 commented Apr 19, 2025 •

edited

Loading