221 adapt to new sw360 release v20

[tngraf]

No description provided.

[gernot-h]

Sorry for not providing more feedback in time here, but I just returned from vacation today. Unfortunately, I didn't really express my concerns about using long-lived secrets in cmdline parameters in #221, but still, I really don't like this.

In a quick search, I found these resources summarizing the issues with passing secrets on the command line:

• https://smallstep.com/blog/command-line-secrets/
• https://www.reddit.com/r/bash/comments/1rttlf0/stop_passing_secrets_as_commandline_arguments/
• https://dev.mysql.com/doc/refman/8.4/en/password-security-user.html

In a nutshell, passing a secret on the cmdline can easily leak in several ways:

• in the process list of the OS ("ps")
• in shell history
• in CI job logs

For all of those, there are workarounds:

• "curl" and "mysql" immediately rewrite their argv upon start to remove the password from the process list, but they still warn you shouldn't do that: https://curl.se/docs/manpage.html#--user
• You can prevent commands from being added to your shell history, e.g. by starting a command with a " " (blank) on most Unix shells.
• Gitlab can filter job output for protected variables.

However, all of those require extra caution by trained users and most don't provide full protection.

Reading the above linked articles also reminds me that environment variables are also not fully protected, so the best solution for me seems to be to read the password from a file.

If I get https://github.com/sw360/capycli/blob/v2.12.0.dev1/capycli/main/options.py#L493 right, it should be possible to just pass client_id and client_secret via the config file and it should be easy to print a warning in this place in case the parameters were given on the cmdline, so we would just need to adapt the documentation and could stay with the current solution.

[gernot-h]

If using the CaPyCli config file doesn't work for some reason, we could also think about allowing a special syntax in the -client_secret argument to ask CaPyCli to read it from a file, e.g. by using something like --client_secret file:filename.txt to avoid creating another new cmdline option.