Skip to content

Commit fa2f6ff

Browse files
vmaertenvmaerten
committed
remove passphrase
1 parent 8e8eb13 commit fa2f6ff

File tree

12 files changed

+34
-144
lines changed

12 files changed

+34
-144
lines changed

‎completion/fish/task.fish‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -105,10 +105,9 @@ complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled GENTLE_FORCE" -l
105105
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l offline -d 'use only local or cached Taskfiles'
106106
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l timeout -d 'timeout for remote Taskfile downloads'
107107
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l expiry -d 'cache expiry duration'
108-
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cacert -d 'custom CA certificate for TLS' -r
109-
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cert -d 'client certificate for mTLS' -r
110-
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cert-key -d 'client certificate private key' -r
111-
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cert-key-pass -d 'passphrase for private key'
108+
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cacert -d 'custom CA certificate for TLS' -r
109+
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cert -d 'client certificate for mTLS' -r
110+
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l cert-key -d 'client certificate private key' -r
112111

113112
# RemoteTaskfiles experiment - Operations
114113
complete -c $GO_TASK_PROGNAME -n "__task_is_experiment_enabled REMOTE_TASKFILES" -l download -d 'download remote Taskfile'

‎completion/ps/task.ps1‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ Register-ArgumentCompleter -CommandName task -ScriptBlock {
7575
$completions += [CompletionResult]::new('--cacert', '--cacert', [CompletionResultType]::ParameterName, 'custom CA certificate')
7676
$completions += [CompletionResult]::new('--cert', '--cert', [CompletionResultType]::ParameterName, 'client certificate')
7777
$completions += [CompletionResult]::new('--cert-key', '--cert-key', [CompletionResultType]::ParameterName, 'client private key')
78-
$completions += [CompletionResult]::new('--cert-key-pass', '--cert-key-pass', [CompletionResultType]::ParameterName, 'private key passphrase')
7978
# Operations
8079
$completions += [CompletionResult]::new('--download', '--download', [CompletionResultType]::ParameterName, 'download remote Taskfile')
8180
$completions += [CompletionResult]::new('--clear-cache', '--clear-cache', [CompletionResultType]::ParameterName, 'clear cache')

‎completion/zsh/_task‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@ _task() {
8989
'(--cacert)--cacert[custom CA certificate for TLS]:file:_files'
9090
'(--cert)--cert[client certificate for mTLS]:file:_files'
9191
'(--cert-key)--cert-key[client certificate private key]:file:_files'
92-
'(--cert-key-pass)--cert-key-pass[passphrase for private key]: '
9392
)
9493
fi
9594

‎executor.go‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ type (
3939
CACert string
4040
Cert string
4141
CertKey string
42-
CertKeyPass string
4342
Watch bool
4443
Verbose bool
4544
Silent bool
@@ -296,19 +295,6 @@ func (o *certKeyOption) ApplyToExecutor(e *Executor) {
296295
e.CertKey = o.certKey
297296
}
298297

299-
// WithCertKeyPass sets the passphrase for the client certificate key.
300-
func WithCertKeyPass(certKeyPass string) ExecutorOption {
301-
return &certKeyPassOption{certKeyPass: certKeyPass}
302-
}
303-
304-
type certKeyPassOption struct {
305-
certKeyPass string
306-
}
307-
308-
func (o *certKeyPassOption) ApplyToExecutor(e *Executor) {
309-
e.CertKeyPass = o.certKeyPass
310-
}
311-
312298
// WithWatch tells the [Executor] to keep running in the background and watch
313299
// for changes to the fingerprint of the tasks that are run. When changes are
314300
// detected, a new task run is triggered.

‎internal/flags/flags.go‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ var (
7979
CACert string
8080
Cert string
8181
CertKey string
82-
CertKeyPass string
8382
)
8483

8584
func init() {
@@ -162,7 +161,6 @@ func init() {
162161
pflag.StringVar(&CACert, "cacert", getConfig(config, func() *string { return config.Remote.CACert }, ""), "Path to a custom CA certificate for HTTPS connections.")
163162
pflag.StringVar(&Cert, "cert", getConfig(config, func() *string { return config.Remote.Cert }, ""), "Path to a client certificate for HTTPS connections.")
164163
pflag.StringVar(&CertKey, "cert-key", getConfig(config, func() *string { return config.Remote.CertKey }, ""), "Path to a client certificate key for HTTPS connections.")
165-
pflag.StringVar(&CertKeyPass, "cert-key-pass", getConfig(config, func() *string { return config.Remote.CertKeyPass }, ""), "Passphrase for the client certificate key.")
166164
}
167165
pflag.Parse()
168166
}
@@ -213,10 +211,6 @@ func Validate() error {
213211
return errors.New("task: --cert and --cert-key must be provided together")
214212
}
215213

216-
if CertKeyPass != "" && Cert == "" {
217-
return errors.New("task: --cert-key-pass requires --cert and --cert-key")
218-
}
219-
220214
return nil
221215
}
222216

@@ -260,7 +254,6 @@ func (o *flagsOption) ApplyToExecutor(e *task.Executor) {
260254
task.WithCACert(CACert),
261255
task.WithCert(Cert),
262256
task.WithCertKey(CertKey),
263-
task.WithCertKeyPass(CertKeyPass),
264257
task.WithWatch(Watch),
265258
task.WithVerbose(Verbose),
266259
task.WithSilent(Silent),

‎setup.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ func (e *Executor) getRootNode() (taskfile.Node, error) {
6060
taskfile.WithCACert(e.CACert),
6161
taskfile.WithCert(e.Cert),
6262
taskfile.WithCertKey(e.CertKey),
63-
taskfile.WithCertKeyPass(e.CertKeyPass),
6463
)
6564
if os.IsNotExist(err) {
6665
return nil, errors.TaskfileNotFoundError{
@@ -94,7 +93,6 @@ func (e *Executor) readTaskfile(node taskfile.Node) error {
9493
taskfile.WithReaderCACert(e.CACert),
9594
taskfile.WithReaderCert(e.Cert),
9695
taskfile.WithReaderCertKey(e.CertKey),
97-
taskfile.WithReaderCertKeyPass(e.CertKeyPass),
9896
taskfile.WithDebugFunc(debugFunc),
9997
taskfile.WithPromptFunc(promptFunc),
10098
)

‎taskfile/node_base.go‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,12 @@ type (
77
// designed to be embedded in other node types so that this boilerplate code
88
// does not need to be repeated.
99
baseNode struct {
10-
parent Node
11-
dir string
12-
checksum string
13-
caCert string
14-
cert string
15-
certKey string
16-
certKeyPass string
10+
parent Node
11+
dir string
12+
checksum string
13+
caCert string
14+
cert string
15+
certKey string
1716
}
1817
)
1918

@@ -76,9 +75,3 @@ func WithCertKey(certKey string) NodeOption {
7675
node.certKey = certKey
7776
}
7877
}
79-
80-
func WithCertKeyPass(certKeyPass string) NodeOption {
81-
return func(node *baseNode) {
82-
node.certKeyPass = certKeyPass
83-
}
84-
}

‎taskfile/node_http.go‎

Lines changed: 3 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ type HTTPNode struct {
2626

2727
// buildHTTPClient creates an HTTP client with optional TLS configuration.
2828
// If no certificate options are provided, it returns http.DefaultClient.
29-
func buildHTTPClient(insecure bool, caCert, cert, certKey, certKeyPass string) (*http.Client, error) {
29+
func buildHTTPClient(insecure bool, caCert, cert, certKey string) (*http.Client, error) {
3030
// Validate that cert and certKey are provided together
3131
if (cert != "" && certKey == "") || (cert == "" && certKey != "") {
3232
return nil, fmt.Errorf("both --cert and --cert-key must be provided together")
@@ -56,15 +56,7 @@ func buildHTTPClient(insecure bool, caCert, cert, certKey, certKeyPass string) (
5656

5757
// Load client certificate and key if provided
5858
if cert != "" && certKey != "" {
59-
var clientCert tls.Certificate
60-
var err error
61-
62-
if certKeyPass != "" {
63-
// Load encrypted private key
64-
clientCert, err = loadCertWithEncryptedKey(cert, certKey, certKeyPass)
65-
} else {
66-
clientCert, err = tls.LoadX509KeyPair(cert, certKey)
67-
}
59+
clientCert, err := tls.LoadX509KeyPair(cert, certKey)
6860
if err != nil {
6961
return nil, fmt.Errorf("failed to load client certificate: %w", err)
7062
}
@@ -78,46 +70,6 @@ func buildHTTPClient(insecure bool, caCert, cert, certKey, certKeyPass string) (
7870
}, nil
7971
}
8072

81-
// loadCertWithEncryptedKey loads a certificate with an encrypted private key.
82-
func loadCertWithEncryptedKey(certFile, keyFile, passphrase string) (tls.Certificate, error) {
83-
certPEM, err := os.ReadFile(certFile)
84-
if err != nil {
85-
return tls.Certificate{}, fmt.Errorf("failed to read certificate file: %w", err)
86-
}
87-
88-
keyPEM, err := os.ReadFile(keyFile)
89-
if err != nil {
90-
return tls.Certificate{}, fmt.Errorf("failed to read key file: %w", err)
91-
}
92-
93-
// Try to decrypt the private key
94-
decryptedKey, err := decryptPEMKey(keyPEM, passphrase)
95-
if err != nil {
96-
return tls.Certificate{}, fmt.Errorf("failed to decrypt private key: %w", err)
97-
}
98-
99-
return tls.X509KeyPair(certPEM, decryptedKey)
100-
}
101-
102-
// decryptPEMKey attempts to decrypt a PEM-encoded private key.
103-
func decryptPEMKey(keyPEM []byte, passphrase string) ([]byte, error) {
104-
// For PKCS#8 encrypted keys, we need to parse and decrypt them
105-
// The standard library doesn't directly support encrypted PKCS#8,
106-
// so we try to parse it as-is first (in case it's not actually encrypted)
107-
// For now, we support unencrypted keys and return an error for encrypted ones
108-
// that require external libraries to decrypt.
109-
110-
// Try to parse as unencrypted first
111-
_, err := tls.X509KeyPair([]byte("-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----"), keyPEM)
112-
if err == nil {
113-
return keyPEM, nil
114-
}
115-
116-
// TODO: Add support for encrypted PKCS#8 keys using x/crypto/pkcs8
117-
// This would require adding a dependency on golang.org/x/crypto
118-
return nil, fmt.Errorf("encrypted private keys require the key to be decrypted externally, or use an unencrypted key")
119-
}
120-
12173
func NewHTTPNode(
12274
entrypoint string,
12375
dir string,
@@ -134,7 +86,7 @@ func NewHTTPNode(
13486
}
13587

13688
// Build HTTP client with TLS configuration from node options
137-
client, err := buildHTTPClient(insecure, base.caCert, base.cert, base.certKey, base.certKeyPass)
89+
client, err := buildHTTPClient(insecure, base.caCert, base.cert, base.certKey)
13890
if err != nil {
13991
return nil, err
14092
}

‎taskfile/node_http_test.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,15 @@ func TestBuildHTTPClient_Default(t *testing.T) {
6363
t.Parallel()
6464

6565
// When no TLS customization is needed, should return http.DefaultClient
66-
client, err := buildHTTPClient(false, "", "", "", "")
66+
client, err := buildHTTPClient(false, "", "", "")
6767
require.NoError(t, err)
6868
assert.Equal(t, http.DefaultClient, client)
6969
}
7070

7171
func TestBuildHTTPClient_Insecure(t *testing.T) {
7272
t.Parallel()
7373

74-
client, err := buildHTTPClient(true, "", "", "", "")
74+
client, err := buildHTTPClient(true, "", "", "")
7575
require.NoError(t, err)
7676
require.NotNil(t, client)
7777
assert.NotEqual(t, http.DefaultClient, client)
@@ -92,10 +92,10 @@ func TestBuildHTTPClient_CACert(t *testing.T) {
9292

9393
// Generate a valid CA certificate
9494
caCertPEM := generateTestCACert(t)
95-
err := os.WriteFile(caCertPath, caCertPEM, 0600)
95+
err := os.WriteFile(caCertPath, caCertPEM, 0o600)
9696
require.NoError(t, err)
9797

98-
client, err := buildHTTPClient(false, caCertPath, "", "", "")
98+
client, err := buildHTTPClient(false, caCertPath, "", "")
9999
require.NoError(t, err)
100100
require.NotNil(t, client)
101101
assert.NotEqual(t, http.DefaultClient, client)
@@ -110,7 +110,7 @@ func TestBuildHTTPClient_CACert(t *testing.T) {
110110
func TestBuildHTTPClient_CACertNotFound(t *testing.T) {
111111
t.Parallel()
112112

113-
client, err := buildHTTPClient(false, "/nonexistent/ca.crt", "", "", "")
113+
client, err := buildHTTPClient(false, "/nonexistent/ca.crt", "", "")
114114
assert.Error(t, err)
115115
assert.Nil(t, client)
116116
assert.Contains(t, err.Error(), "failed to read CA certificate")
@@ -122,10 +122,10 @@ func TestBuildHTTPClient_CACertInvalid(t *testing.T) {
122122
// Create a temporary file with invalid content
123123
tempDir := t.TempDir()
124124
caCertPath := filepath.Join(tempDir, "invalid.crt")
125-
err := os.WriteFile(caCertPath, []byte("not a valid certificate"), 0600)
125+
err := os.WriteFile(caCertPath, []byte("not a valid certificate"), 0o600)
126126
require.NoError(t, err)
127127

128-
client, err := buildHTTPClient(false, caCertPath, "", "", "")
128+
client, err := buildHTTPClient(false, caCertPath, "", "")
129129
assert.Error(t, err)
130130
assert.Nil(t, client)
131131
assert.Contains(t, err.Error(), "failed to parse CA certificate")
@@ -134,7 +134,7 @@ func TestBuildHTTPClient_CACertInvalid(t *testing.T) {
134134
func TestBuildHTTPClient_CertWithoutKey(t *testing.T) {
135135
t.Parallel()
136136

137-
client, err := buildHTTPClient(false, "", "/path/to/cert.crt", "", "")
137+
client, err := buildHTTPClient(false, "", "/path/to/cert.crt", "")
138138
assert.Error(t, err)
139139
assert.Nil(t, client)
140140
assert.Contains(t, err.Error(), "both --cert and --cert-key must be provided together")
@@ -143,7 +143,7 @@ func TestBuildHTTPClient_CertWithoutKey(t *testing.T) {
143143
func TestBuildHTTPClient_KeyWithoutCert(t *testing.T) {
144144
t.Parallel()
145145

146-
client, err := buildHTTPClient(false, "", "", "/path/to/key.pem", "")
146+
client, err := buildHTTPClient(false, "", "", "/path/to/key.pem")
147147
assert.Error(t, err)
148148
assert.Nil(t, client)
149149
assert.Contains(t, err.Error(), "both --cert and --cert-key must be provided together")
@@ -159,12 +159,12 @@ func TestBuildHTTPClient_CertAndKey(t *testing.T) {
159159

160160
// Generate a self-signed certificate and key for testing
161161
cert, key := generateTestCertAndKey(t)
162-
err := os.WriteFile(certPath, cert, 0600)
162+
err := os.WriteFile(certPath, cert, 0o600)
163163
require.NoError(t, err)
164-
err = os.WriteFile(keyPath, key, 0600)
164+
err = os.WriteFile(keyPath, key, 0o600)
165165
require.NoError(t, err)
166166

167-
client, err := buildHTTPClient(false, "", certPath, keyPath, "")
167+
client, err := buildHTTPClient(false, "", certPath, keyPath)
168168
require.NoError(t, err)
169169
require.NotNil(t, client)
170170
assert.NotEqual(t, http.DefaultClient, client)
@@ -179,7 +179,7 @@ func TestBuildHTTPClient_CertAndKey(t *testing.T) {
179179
func TestBuildHTTPClient_CertNotFound(t *testing.T) {
180180
t.Parallel()
181181

182-
client, err := buildHTTPClient(false, "", "/nonexistent/cert.crt", "/nonexistent/key.pem", "")
182+
client, err := buildHTTPClient(false, "", "/nonexistent/cert.crt", "/nonexistent/key.pem")
183183
assert.Error(t, err)
184184
assert.Nil(t, client)
185185
assert.Contains(t, err.Error(), "failed to load client certificate")
@@ -194,11 +194,11 @@ func TestBuildHTTPClient_InsecureWithCACert(t *testing.T) {
194194

195195
// Generate a valid CA certificate
196196
caCertPEM := generateTestCACert(t)
197-
err := os.WriteFile(caCertPath, caCertPEM, 0600)
197+
err := os.WriteFile(caCertPath, caCertPEM, 0o600)
198198
require.NoError(t, err)
199199

200200
// Both insecure and CA cert can be set together
201-
client, err := buildHTTPClient(true, caCertPath, "", "", "")
201+
client, err := buildHTTPClient(true, caCertPath, "", "")
202202
require.NoError(t, err)
203203
require.NotNil(t, client)
204204

‎taskfile/reader.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ type (
4848
caCert string
4949
cert string
5050
certKey string
51-
certKeyPass string
5251
debugFunc DebugFunc
5352
promptFunc PromptFunc
5453
promptMutex sync.Mutex
@@ -225,19 +224,6 @@ func (o *readerCertKeyOption) ApplyToReader(r *Reader) {
225224
r.certKey = o.certKey
226225
}
227226

228-
// WithReaderCertKeyPass sets the passphrase for the client certificate key.
229-
func WithReaderCertKeyPass(certKeyPass string) ReaderOption {
230-
return &readerCertKeyPassOption{certKeyPass: certKeyPass}
231-
}
232-
233-
type readerCertKeyPassOption struct {
234-
certKeyPass string
235-
}
236-
237-
func (o *readerCertKeyPassOption) ApplyToReader(r *Reader) {
238-
r.certKeyPass = o.certKeyPass
239-
}
240-
241227
// Read will read the Taskfile defined by the [Reader]'s [Node] and recurse
242228
// through any [ast.Includes] it finds, reading each included Taskfile and
243229
// building an [ast.TaskfileGraph] as it goes. If any errors occur, they will be
@@ -328,7 +314,6 @@ func (r *Reader) include(ctx context.Context, node Node) error {
328314
WithCACert(r.caCert),
329315
WithCert(r.cert),
330316
WithCertKey(r.certKey),
331-
WithCertKeyPass(r.certKeyPass),
332317
)
333318
if err != nil {
334319
if include.Optional {

0 commit comments

Comments
 (0)