Release KSM CLI v1.5.0 - #1065
Open
stas-schaller wants to merge 18 commits into
Open
Conversation
Ticket IDs in test docstrings/comments rot when the tracker changes and distract readers into looking something up the comment should just explain inline; the substance (why each test exists) is kept, only the KSM-#### / REL-#### / URL references are removed.
_get_instance_region() constructed IMDSFetcher with botocore's default timeout/retries, so 'ksm profile setup -t aws' stalled on every one of the four region-lookup calls against an unreachable 169.254.169.254 before eventually surfacing a raw botocore NoRegionError. IMDSFetcher now uses a 1s/1-attempt timeout, and _get_client() raises a message naming the non-EC2 cause and the --fallback option instead. read_config() also logs AWS errors it previously swallowed silently.
…profiles KeyringUtilityStorage.__load_config() caught every exception, including keyring.errors.KeyringLocked, behind a blanket except-and-log-at-debug, so a locked keyring (e.g. gnome-keyring running but locked in an SSH session with no display server) was indistinguishable from no profile ever being configured. Reproduced empirically against the actual published keeper-secrets-manager-cli==1.3.0 package in a Docker container with a real dbus-daemon + gnome-keyring-daemon, locking a collection with a stored secret and confirming the silent None return. __load_config() now catches KeyringLocked specifically and raises the new KsmCliKeyringLockedException with an actionable message; existing KsmCliException handling in profile.py surfaces it without further changes. Keyring-less installs are unaffected (the guarded keyring import falls back to a tuple that matches nothing on ImportError).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The IMDS timeout fix and _get_client() error handling belong in the storage package (keeper-secrets-manager-storage), not the CLI release. These changes will land in storage v1.2.0 via KSM-977-aws-load-config-raise.
APPDIR is a Linux AppImage variable, not a standard Windows env var. Replace with APPDATA joined with "Keeper" so %APPDATA%\Keeper\keeper.ini is correctly included in the config path search, consistent with the existing PROGRAMDATA\Keeper and PROGRAMFILES\Keeper entries. KSM-1113
Relative ["etc"] entries in find_ksm_path resolved against CWD, not /etc. os.path.join produces /etc/keeper.ini only when the first component is an absolute path. No behavior change on Windows where /etc does not exist. KSM-1113
KSM-1114 dropped colorama, which left check_config_mode()'s Windows icacls permission warning uncolored (that function, in the Core SDK, duck-types its color_mod arg against colorama's Fore/Style shape). A small click.style()-backed shim gives it the same shape without reintroducing colorama as a dependency. KSM-1114
…ng entries Removes the KSM-859 entry (fix was reverted from this branch via 29c5997; CLI v1.5.0 ships without it, tracked as KSM-1115 for a future release). Adds KSM-1113, KSM-1107, and the installer-level KSM-1018/1105/1106 fixes, which were merged on this branch or the same release but missing from the changelog.
FieldType.__init__ in keeper-secrets-manager-helper crashes with IndexError when a complex field (name, address, host, etc.) has value: [] — the server's normal representation of an unpopulated field. Strip fields with empty value lists from the source record before passing to RecordV3.create_from_data so the helper never receives value: [] for a dict-typed field. Empty fields on the source are absent from the clone payload; the server still creates them as empty on the cloned record. A proper fix for the root cause in the helper is tracked in KSM-1119.
helper FieldType.__init__ crashes with IndexError when a dict-typed field (address, name, host, passkey, etc.) has value: [] -- the server's normal representation of an unpopulated complex field. The add-file path called Record.create_from_file with no filter, so any record script containing an unpopulated complex field crashed with an opaque "list index out of range" error naming neither the field nor the cause. add editor shares the same loader and is fixed by the same change. Fix: load the file via load_file, strip fields where value is empty before calling RecordV3.create_from_data, matching the pattern introduced for add clone in KSM-1118 (commit b0d660e). Also adds cleanup comments at both workaround sites (add file and add clone) so they can be removed once the helper ships the "if self.value:" guard in FieldType.__init__ (KSM-1119). Pre-existing since 1.4.0; not a 1.5.0 regression.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release branch for v1.5.0: five CLI bug fixes and a dependency cleanup, plus four installer-level fixes shipped from the cli-binaries repo that affect the same release.
Changes
Bug Fixes
--ini-file/KSM_CONFIGas a fallback.%APPDIR%\Keeper(a Linux AppImage variable, not a Windows one) instead of%APPDATA%\Keeper; on Linux, the/etcsearch entry resolved against the current working directory instead of/etc. Both are now resolved correctly.ksm secret add cloneexited 0 even when the source UID did not exist, masking the failure from scripts. Now exits non-zero with an error message.ksm secret add clonecrashed with "list index out of range" when the source record contained any unpopulated complex field (name, address, host, etc.) — fields the server legitimately returns asvalue: []. Empty-value fields are now skipped before the create payload is assembled. Root cause in the helper library is tracked separately as KSM-1119.ksm secret add fileandksm secret add editorcrashed with the same "list index out of range" error as KSM-1118 when the record script contained an unpopulated complex field withvalue: []. The file/editor load path had no filter; empty-value fields are now stripped before the create payload is assembled, matching the behavior introduced foradd clonein KSM-1118. Root cause in the helper library is tracked as KSM-1119.Dependency
coloramapackage withclick.style(), already available via the existingclick-help-colorsdependency. Includes a shim so the Windows-only config-permission warning (which duck-types its color argument against colorama'sFore/Styleshape) keeps its coloring.Maintenance
Deferred
Installer fixes (cli-binaries repo — not in this diff, but user-facing for this release and included in the CHANGELOG)
libssl.3.dylibpredated OpenSSL 3.2.0, whichcryptographynow requires, causingImportError: Symbol not found: _SSL_get0_group_nameon everyksminvocation. Both x64 and arm64 macOS builds now bundle an up-to-date libssl.%TEMP%was unsigned, causing EDR/AV to block the post-install launch ofksm.exe. Fixed so the launch no longer trips endpoint security.ArchitecturesAllowedandArchitecturesInstallIn64BitModedirectives, so the 64-bit binary was placed inC:\Program Files (x86)on 64-bit systems. The installer now correctly targetsC:\Program Files.Breaking Changes
None.
Related Issues