lib.ec.ssh.AsyncSSH: Actually hide password #87
2026-09-05
lib.ec.ssh.AsyncSSH: Actually hide password
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 4m18s
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 4m20s
CI / Packaging test (pull_request) Successful in 0s
CI / Packaging - Kali Linux (push) Successful in 3m50s
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 4m20s
CI / Packaging test (push) Successful in 0s
_connect_kwargs(hide_secrets = True) is used to log the connection parameters when a connection fails, without leaking the password. The filtered dictionary is built before the password is replaced with '<hidden>', and the replacement is applied to the local kwargs dictionary afterwards, after the filtered copy has already been made. The dictionary that ends up in the log therefore still contains the real password. Hide the password before building the filtered dictionary. Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2 Signed-off-by: Jan Lindemann <jan@janware.com>