From 4e7fccb1af2cf637169a53771fee4694c316469c Mon Sep 17 00:00:00 2001 From: Alf-Rune Siqveland Date: Wed, 29 Apr 2026 13:19:58 +0200 Subject: [PATCH 1/4] chore: replaced github.com/howeyc/gopass with golang.org/x/term Co-Authored-By: Simon Josefsson Signed-off-by: Alf-Rune Siqveland --- cmd/login.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmd/login.go b/cmd/login.go index a46a0715..898464ff 100644 --- a/cmd/login.go +++ b/cmd/login.go @@ -20,10 +20,10 @@ import ( "path/filepath" "strings" - "github.com/howeyc/gopass" "github.com/pkg/errors" "github.com/spf13/cobra" "github.com/spf13/viper" + "golang.org/x/term" "github.com/mendersoftware/mender-cli/client/useradm" "github.com/mendersoftware/mender-cli/log" @@ -146,7 +146,7 @@ func (c *LoginCmd) maybeGetPassword() error { if c.password == "" { fmt.Printf("Password: ") - p, err := gopass.GetPasswdMasked() + p, err := term.ReadPassword(int(os.Stdin.Fd())) if err != nil { return err } From bf958383e5b0c9ba289f69aa7062dacac0ea67ce Mon Sep 17 00:00:00 2001 From: Alf-Rune Siqveland Date: Wed, 29 Apr 2026 10:38:46 +0200 Subject: [PATCH 2/4] chore: tidy `howeyc/gopass` from go.mod Signed-off-by: Alf-Rune Siqveland --- go.mod | 2 -- go.sum | 17 ++--------------- 2 files changed, 2 insertions(+), 17 deletions(-) diff --git a/go.mod b/go.mod index 948a6a71..b722397a 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,6 @@ require ( github.com/cheggaaa/pb/v3 v3.1.7 github.com/google/uuid v1.6.0 github.com/gorilla/websocket v1.5.3 - github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef github.com/mendersoftware/go-lib-micro v0.0.0-20260507072508-a0998f726f15 github.com/mendersoftware/mender-artifact v0.0.0-20250529094801-7264a90f1074 github.com/pkg/errors v0.9.1 @@ -44,7 +43,6 @@ require ( github.com/subosito/gotenv v1.6.0 // indirect github.com/ulikunitz/xz v0.5.14 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.35.0 // indirect golang.org/x/text v0.28.0 // indirect google.golang.org/appengine v1.6.8 // indirect google.golang.org/protobuf v1.36.6 // indirect diff --git a/go.sum b/go.sum index 860a9aee..06f86872 100644 --- a/go.sum +++ b/go.sum @@ -3,9 +3,8 @@ github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAU github.com/cheggaaa/pb/v3 v3.1.7 h1:2FsIW307kt7A/rz/ZI2lvPO+v3wKazzE4K/0LtTWsOI= github.com/cheggaaa/pb/v3 v3.1.7/go.mod h1:/Ji89zfVPeC/u5j8ukD0MBPHt2bzTYp74lQ7KlgFWTQ= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= @@ -25,14 +24,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= -github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM= -github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= -github.com/klauspost/cpuid/v2 v2.2.3 h1:sxCkb+qR91z4vsqw4vGGZlDgPz3G7gjaLyK3V8y70BU= -github.com/klauspost/cpuid/v2 v2.2.3/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY= github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM= github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws= github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU= @@ -50,10 +45,6 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= -github.com/mendersoftware/go-lib-micro v0.0.0-20221025103319-e1f941fb3145 h1:ALhDv8wnoQJ4sgUm1mTcPuJd7uj589rg8mqX0SMEwTA= -github.com/mendersoftware/go-lib-micro v0.0.0-20221025103319-e1f941fb3145/go.mod h1:E/DE4gIsSGq6iybd4IBq+4O/CkAwL/5xeU6zwlgWmW8= -github.com/mendersoftware/go-lib-micro v0.0.0-20250620123909-c9fc306420c6 h1:QzRVsEJBKcDVPgAqxnr+zDfLbGXaKg2VLfcSU/ZgoTs= -github.com/mendersoftware/go-lib-micro v0.0.0-20250620123909-c9fc306420c6/go.mod h1:CzlSoiOQvmyxmGnSmT7uaIYTT1SQXYD0jjX+nl/X6Ms= github.com/mendersoftware/go-lib-micro v0.0.0-20260507072508-a0998f726f15 h1:flR5o632Ub13HeiOeQ4SlHmnW60VQFAmThj9T14vYq0= github.com/mendersoftware/go-lib-micro v0.0.0-20260507072508-a0998f726f15/go.mod h1:CzlSoiOQvmyxmGnSmT7uaIYTT1SQXYD0jjX+nl/X6Ms= github.com/mendersoftware/mender-artifact v0.0.0-20250529094801-7264a90f1074 h1:uWBcuef1n5O4wACH7Vcpl4YkuQL65g4lHvr6AXxo6ps= @@ -68,9 +59,8 @@ github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= @@ -105,8 +95,6 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= -golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= @@ -117,7 +105,6 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= From 0578d799b4cb6257f2fe3923423a5a5213563eac Mon Sep 17 00:00:00 2001 From: Alf-Rune Siqveland Date: Wed, 29 Apr 2026 13:25:34 +0200 Subject: [PATCH 3/4] chore: update third-party licenses Signed-off-by: Alf-Rune Siqveland --- licenses.csv | 2 -- 1 file changed, 2 deletions(-) diff --git a/licenses.csv b/licenses.csv index c190f853..cb6d0d95 100644 --- a/licenses.csv +++ b/licenses.csv @@ -5,7 +5,6 @@ github.com/fsnotify/fsnotify,BSD-3-Clause github.com/go-viper/mapstructure/v2,MIT github.com/google/uuid,BSD-3-Clause github.com/gorilla/websocket,BSD-2-Clause -github.com/howeyc/gopass,ISC github.com/klauspost/compress,Apache-2.0 github.com/klauspost/compress/internal/snapref,BSD-3-Clause github.com/klauspost/compress/zstd/internal/xxhash,MIT @@ -29,7 +28,6 @@ github.com/subosito/gotenv,MIT github.com/ulikunitz/xz,BSD-3-Clause github.com/vmihailenco/msgpack,BSD-2-Clause go.yaml.in/yaml/v3,MIT -golang.org/x/crypto/ssh/terminal,BSD-3-Clause golang.org/x/sys/unix,BSD-3-Clause golang.org/x/term,BSD-3-Clause golang.org/x/text,BSD-3-Clause From b499cdf5f758a3123db98b32a89ba975d960fc3e Mon Sep 17 00:00:00 2001 From: Alf-Rune Siqveland Date: Wed, 29 Apr 2026 13:42:11 +0200 Subject: [PATCH 4/4] test: update acceptance test for reading password to use shell Signed-off-by: Alf-Rune Siqveland --- tests/acceptance/tests/cli.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/acceptance/tests/cli.py b/tests/acceptance/tests/cli.py index 0598a27e..69c72ea1 100644 --- a/tests/acceptance/tests/cli.py +++ b/tests/acceptance/tests/cli.py @@ -31,7 +31,11 @@ def run_and_enter_password(self, *argv, password=""): """Returns a CompletedProcess wrapped in CliResult""" args = [self.path] + list(argv) p = subprocess.Popen( - args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE + args, + shell=True, + stdin=subprocess.PIPE, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, ) stdout, stderr = p.communicate(input=password.encode() + b"\n") return CliResult(p, stdout=stdout, stderr=stderr)