Fix #159 - more secure credential handling #176
Conversation
* Convention: a filename of $(...) is actually a process specification. * The process is executed in the current directory of the containing config file. * The standard output of the process is used as the config file content and parsed. * The process specification is handed to the platform shell for execution.
* This was introduced when we first "defaulted" the `--users` argument (a long time ago). * The fix is to act as if *no* `--users` argument is `--users` by itself, because what the defaulting code really did was to default the argument to `all`.
|
@phil-levy I believe we are now code-complete for the 2.1 release. We need docs, to bump the version number, to update the version history file, and to add some example files showing how to use the new feature. I leave those to you; I've attached a user-sync-config.yml that shows the process config feature; to make this run on windows, change the |
|
The assumption is that the pipe will return data in the platform-specific charset and the YAML parser will accept that. It's really between the YAML parser and the process as to what platform-specific charsets are understood; the use of bytes gets away from Python having to understand which one is in use. The customer may have to adjust what their binary returns if they see inconsistencies. I need to take a look at #167 to see what's happening there, but it shouldn't relate to this. |
Also fixed #175 while I was in there.