fastlane 2.240.0 → 2.241.0

data/fastlane/swift/MatchfileProtocol.swift

@@ -56,10 +56,10 @@ public protocol MatchfileProtocol: AnyObject {
     /// Clone just the branch specified, instead of the whole repo. This requires that the branch already exists. Otherwise the command will fail
     var cloneBranchDirectly: Bool { get }
 
-    /// Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64
+    /// Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64. Needs git 2.31 or later
     var gitBasicAuthorization: String? { get }
 
-    /// Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64
+    /// Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64. Needs git 2.31 or later
     var gitBearerAuthorization: String? { get }
 
     /// Use a private key to access the git repo (e.g.: access to GitHub repository via Deploy keys), usually a id_rsa named file or the contents hereof
@@ -173,6 +173,9 @@ public protocol MatchfileProtocol: AnyObject {
     /// Force encryption to use legacy cbc algorithm for backwards compatibility with older match versions
     var forceLegacyEncryption: Bool { get }
 
+    /// Enable profile with 'Offline Support' (7 day validity). Requires Apple ID login, not supported with App Store Connect API key authentication
+    var offlineProfile: Bool { get }
+
     /// Print out extra information and all commands
     var verbose: Bool { get }
 }
@@ -406,6 +409,10 @@ public extension MatchfileProtocol {
         return false
     }
 
+    var offlineProfile: Bool {
+        return false
+    }
+
     var verbose: Bool {
         return false
     }
@@ -413,4 +420,4 @@ public extension MatchfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.151]
+// FastlaneRunnerAPIVersion [0.9.153]

data/fastlane/swift/Precheckfile.swift

@@ -17,4 +17,4 @@ public class Precheckfile: PrecheckfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.240.0
+// Generated with fastlane 2.241.0

data/fastlane/swift/PrecheckfileProtocol.swift

@@ -84,4 +84,4 @@ public extension PrecheckfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.150]
+// FastlaneRunnerAPIVersion [0.9.152]

data/fastlane/swift/Scanfile.swift

@@ -17,4 +17,4 @@ public class Scanfile: ScanfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.240.0
+// Generated with fastlane 2.241.0

data/fastlane/swift/ScanfileProtocol.swift

@@ -77,6 +77,9 @@ public protocol ScanfileProtocol: AnyObject {
     /// Should the thread sanitizer be turned on?
     var threadSanitizer: Bool? { get }
 
+    /// Whether verbose and long-running diagnostics (like sysdiagnoses or log archives) are collected when testing. Valid values are: on-failure or never. If not specified, the value in the test plan is used. Equivalent to -collect-test-diagnostics (Xcode 14 and up)
+    var collectTestDiagnostics: String? { get }
+
     /// Should the HTML report be opened when tests are completed?
     var openReport: Bool { get }
 
@@ -353,6 +356,10 @@ public extension ScanfileProtocol {
         return nil
     }
 
+    var collectTestDiagnostics: String? {
+        return nil
+    }
+
     var openReport: Bool {
         return false
     }
@@ -588,4 +595,4 @@ public extension ScanfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.162]
+// FastlaneRunnerAPIVersion [0.9.164]

data/fastlane/swift/Screengrabfile.swift

@@ -17,4 +17,4 @@ public class Screengrabfile: ScreengrabfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.240.0
+// Generated with fastlane 2.241.0

data/fastlane/swift/ScreengrabfileProtocol.swift

@@ -161,4 +161,4 @@ public extension ScreengrabfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.152]
+// FastlaneRunnerAPIVersion [0.9.154]

data/fastlane/swift/Snapshotfile.swift

@@ -17,4 +17,4 @@ public class Snapshotfile: SnapshotfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.240.0
+// Generated with fastlane 2.241.0

data/fastlane/swift/SnapshotfileProtocol.swift

@@ -385,4 +385,4 @@ public extension SnapshotfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.146]
+// FastlaneRunnerAPIVersion [0.9.148]

data/fastlane/swift/formatting/Rakefile

@@ -14,5 +14,6 @@ end
 task(:lint) do
   Dir.chdir('..') do
     sh("swiftformat . --config formatting/.swiftformat --verbose --selfrequired waitWithPolling --exclude Fastfile.swift --swiftversion 4.0")
+    sh("swiftformat ../spec/swift --config formatting/.swiftformat --verbose --swiftversion 4.0")
   end
 end

data/fastlane/swift/main.swift

@@ -11,6 +11,9 @@
 import Foundation
 
 let argumentProcessor = ArgumentProcessor(args: CommandLine.arguments)
+/// fastlane reads this from the built runner, to tell whether it is outdated. Increase it when the runner changes how it talks to fastlane.
+let runnerProtocolVersion = "FastlaneRunnerProtocolVersion [1]"
+verbose(message: runnerProtocolVersion)
 let timeout = argumentProcessor.commandTimeout
 
 class MainProcess {
@@ -44,4 +47,4 @@ while !process.doneRunningLane, RunLoop.current.run(mode: RunLoopMode.defaultRun
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.2]
+// FastlaneRunnerAPIVersion [0.9.3]

data/fastlane_core/README.md

@@ -72,7 +72,7 @@ UI.deprecated("The '--key' parameter is deprecated")
 ```
 
 # Code of Conduct
-Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/CODE_OF_CONDUCT.md).
+Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/docs/CODE_OF_CONDUCT.md).
 
 # License
 This project is licensed under the terms of the MIT license. See the LICENSE file.

data/fastlane_core/lib/fastlane_core/analytics/analytics_event_builder.rb

@@ -21,7 +21,7 @@ module FastlaneCore
         params: {
           fastlane_client_language: @fastlane_client_language,
           fastlane_version: Fastlane::VERSION,
-          install_method: install_method,
+          install_method: Helper.install_method,
           ruby_version: RUBY_VERSION,
           operating_system: Helper.operating_system,
           build_tool_version: @build_tool_version,
@@ -29,21 +29,5 @@ module FastlaneCore
         }.reject { |_, value| value.nil? }
       }
     end
-
-    private
-
-    def install_method
-      if Helper.bundler?
-        'bundler'
-      elsif Helper.contained_fastlane?
-        'standalone'
-      elsif Helper.homebrew?
-        'homebrew'
-      elsif Helper.mac_app?
-        'mac_app'
-      else
-        'gem'
-      end
-    end
   end
 end

data/fastlane_core/lib/fastlane_core/configuration/configuration.rb

@@ -1,5 +1,6 @@
 require_relative '../helper'
 require_relative '../globals'
+require_relative '../secrets'
 require_relative 'config_item'
 require_relative 'commander_generator'
 require_relative 'configuration_file'
@@ -53,16 +54,17 @@ module FastlaneCore
       # used for pushing and popping values to provide nesting configuration contexts
       @values_stack = []
 
-      # if we are in captured output mode - keep a array of sensitive option values
-      # those will be later - replaced by ####
-      if FastlaneCore::Globals.capture_output?
-        available_options.each do |element|
-          next unless element.sensitive
-          self.class.sensitive_strings << values[element.key]
-        end
+      verify_input_types
+
+      @available_options.each do |element|
+        next unless element.sensitive
+
+        Secrets.register(@values[element.key], name: element.key)
+        # if we are in captured output mode - keep a array of sensitive option values
+        # those will be later - replaced by ####
+        self.class.sensitive_strings << @values[element.key] if FastlaneCore::Globals.capture_output?
       end
 
-      verify_input_types
       verify_value_exists
       verify_no_duplicates
       verify_conflicts
@@ -229,6 +231,7 @@ module FastlaneCore
 
       value = option.auto_convert_value(value)
       value = nil if value.nil? && !option.string? # by default boolean flags are false
+      Secrets.register(value, name: option.key) if option.sensitive
       return value unless value.nil? && (!option.optional || force_ask) && ask
 
       # fallback to asking
@@ -267,6 +270,18 @@ module FastlaneCore
     end
     # rubocop:enable Metrics/PerceivedComplexity
 
+    # Returns true if the value for a certain key comes from one of the sources `fetch` checks
+    # before falling back to the default value: passed in, an environment variable or the config file
+    def specified?(key)
+      UI.crash!("Key '#{key}' must be a symbol. Example :#{key}") unless key.kind_of?(Symbol)
+
+      option = verify_options_key!(key)
+
+      !@values[key].nil? ||
+        !option.fetch_env_value.nil? ||
+        self.config_file_options.key?(key)
+    end
+
     # Overwrites or sets a new value for a given key
     # @param key [Symbol] Must be a symbol
     def set(key, value)

data/fastlane_core/lib/fastlane_core/device_manager.rb

@@ -243,7 +243,7 @@ module FastlaneCore
         plist_buddy_cmd = "-c \"Add :KeyboardContinuousPathEnabled bool false\""
         plist_path = File.expand_path("~/Library/Developer/CoreSimulator/Devices/#{self.udid}/data/Library/Preferences/com.apple.keyboard.ContinuousPath.plist")
 
-        Helper.backticks("#{plist_buddy} #{plist_buddy_cmd} #{plist_path} >/dev/null 2>&1")
+        Helper.backticks("#{plist_buddy} #{plist_buddy_cmd} #{plist_path.shellescape} >/dev/null 2>&1")
       end
     end
   end
@@ -300,7 +300,7 @@ module FastlaneCore
 
         UI.verbose("Launching #{simulator_path} for device: #{device.name} (#{device.udid})")
 
-        Helper.backticks("open -a #{simulator_path} --args -CurrentDeviceUDID #{device.udid}", print: FastlaneCore::Globals.verbose?)
+        Helper.backticks("open -a #{simulator_path.shellescape} --args -CurrentDeviceUDID #{device.udid}", print: FastlaneCore::Globals.verbose?)
       end
 
       def copy_logs(device, log_identity, logs_destination_dir, log_collection_start_time)

data/fastlane_core/lib/fastlane_core/helper.rb

@@ -57,6 +57,21 @@ module FastlaneCore
       !self.bundler? && !self.contained_fastlane? && !self.homebrew? && !self.mac_app?
     end
 
+    # How this fastlane was installed, as reported to analytics and printed at startup
+    def self.install_method
+      if self.bundler?
+        'bundler'
+      elsif self.contained_fastlane?
+        'standalone'
+      elsif self.homebrew?
+        'homebrew'
+      elsif self.mac_app?
+        'mac_app'
+      else
+        'gem'
+      end
+    end
+
     # environment
     #
 
@@ -332,18 +347,18 @@ module FastlaneCore
     # Zips directory
     def self.zip_directory(path, output_path, contents_only: false, overwrite: false, print: true)
       if overwrite
-        overwrite_command = " && rm -f '#{output_path}'"
+        overwrite_command = " && rm -f #{output_path.shellescape}"
       else
         overwrite_command = ""
       end
 
       if contents_only
-        command = "cd '#{path}'#{overwrite_command} && zip -r '#{output_path}' *"
+        command = "cd #{path.shellescape}#{overwrite_command} && zip -r #{output_path.shellescape} *"
       else
         containing_path = File.expand_path("..", path)
         contents_path = File.basename(path)
 
-        command = "cd '#{containing_path}'#{overwrite_command} && zip -r '#{output_path}' '#{contents_path}'"
+        command = "cd #{containing_path.shellescape}#{overwrite_command} && zip -r #{output_path.shellescape} #{contents_path.shellescape}"
       end
 
       UI.command(command) unless print
@@ -381,6 +396,8 @@ module FastlaneCore
         # we set the default here, instead of at the parameters
         # as we don't want to `UI.message` a rocket that's just there for the loading indicator
         text ||= "🚀"
+        # A spinner left running by a show without a hide could never be stopped once replaced
+        @require_fastlane_spinner.stop if @require_fastlane_spinner && !@require_fastlane_spinner.done?
         @require_fastlane_spinner = TTY::Spinner.new("[:spinner] #{text} ", format: :dots)
         @require_fastlane_spinner.auto_spin
       else
@@ -388,12 +405,24 @@ module FastlaneCore
       end
     end
 
-    def self.hide_loading_indicator
+    def self.hide_loading_indicator(success: true)
       if self.should_show_loading_indicator? && @require_fastlane_spinner
-        @require_fastlane_spinner.success
+        success ? @require_fastlane_spinner.success : @require_fastlane_spinner.error
       end
     end
 
+    # Shows the loading indicator while the block runs, and hides it even when the block raises
+    def self.with_loading_indicator(text = nil)
+      failed = false
+      show_loading_indicator(text)
+      yield
+    rescue Exception # rubocop:disable Lint/RescueException
+      failed = true
+      raise
+    ensure
+      hide_loading_indicator(success: !failed)
+    end
+
     # files
     #
 

data/fastlane_core/lib/fastlane_core/itunes_transporter.rb

@@ -9,14 +9,6 @@ require_relative 'helper'
 require_relative 'fastlane_pty'
 
 module FastlaneCore
-  # The TransporterInputError occurs when you passed wrong inputs to the {Deliver::ItunesTransporter}
-  class TransporterInputError < StandardError
-  end
-  # The TransporterTransferError occurs when some error happens
-  # while uploading or downloading something from/to iTC
-  class TransporterTransferError < StandardError
-  end
-
   # Used internally
   class TransporterRequiresApplicationSpecificPasswordError < StandardError
   end
@@ -791,8 +783,6 @@ module FastlaneCore
     # @param app_id [Integer] The unique App ID
     # @param dir [String] the path in which the package file should be stored
     # @return (Bool) True if everything worked fine
-    # @raise [Deliver::TransporterTransferError] when something went wrong
-    #   when transferring
     def download(app_id, dir = nil)
       # Dir.tmpdir, not a literal "/tmp": the transporter chdirs into this
       # directory, and "/tmp" is not one on Windows. See fastlane#30184.
@@ -832,8 +822,6 @@ module FastlaneCore
     # @param package_path [String] the path to the package file (used instead of app_id and dir)
     # @param asset_path [String] the path to the ipa/dmg/pkg file (used instead of package_path if running on macOS)
     # @return (Bool) True if everything worked fine
-    # @raise [Deliver::TransporterTransferError] when something went wrong
-    #   when transferring
     def upload(app_id = nil, dir = nil, package_path: nil, asset_path: nil, platform: nil)
       raise "app_id and dir are required or package_path or asset_path is required" if (app_id.nil? || dir.nil?) && package_path.nil? && asset_path.nil?
 
@@ -901,8 +889,6 @@ module FastlaneCore
     # @param dir [String] the path in which the package file is located
     # @param package_path [String] the path to the package file (used instead of app_id and dir)
     # @return (Bool) True if everything worked fine
-    # @raise [Deliver::TransporterTransferError] when something went wrong
-    #   when transferring
     def verify(app_id = nil, dir = nil, package_path: nil, asset_path: nil, platform: nil)
       raise "app_id and dir are required or package_path or asset_path is required" if (app_id.nil? || dir.nil?) && package_path.nil? && asset_path.nil?
 

data/fastlane_core/lib/fastlane_core/keychain_importer.rb

@@ -54,37 +54,34 @@ module FastlaneCore
         command << " 1> /dev/null" # always disable stdout. This can be very verbose, and leak potentially sensitive info
 
         # Showing loading indicator as this can take some time if a lot of keys installed
-        Helper.show_loading_indicator("Setting key partition list... (this can take a minute if there are a lot of keys installed)")
-
-        # Strip keychain password from command output
-        sensitive_command = command.gsub(password_part, " -k ********")
-        UI.command(sensitive_command) if output
-        Open3.popen3(command) do |stdin, stdout, stderr, thrd|
-          unless thrd.value.success?
-            err = stderr.read.to_s.strip
-
-            # Inform user when no/wrong password was used as its needed to prevent UI permission popup from Xcode when signing
-            if err.include?("SecKeychainItemSetAccessWithPassword")
-              keychain_name = File.basename(keychain_path, ".*")
-              Security::InternetPassword.delete(server: server_name(keychain_name))
-
-              UI.important("")
-              UI.important("Could not configure imported keychain item (certificate) to prevent UI permission popup when code signing\n" \
-                       "Check if you supplied the correct `keychain_password` for keychain: `#{keychain_path}`\n" \
-                       "#{err}")
-              UI.important("")
-              UI.important("Please look at the following docs to see how to set a keychain password:")
-              UI.important(" - https://docs.fastlane.tools/actions/sync_code_signing")
-              UI.important(" - https://docs.fastlane.tools/actions/get_certificates")
-            else
-              UI.error(err)
+        Helper.with_loading_indicator("Setting key partition list... (this can take a minute if there are a lot of keys installed)") do
+          # Strip keychain password from command output
+          sensitive_command = command.gsub(password_part, " -k ********")
+          UI.command(sensitive_command) if output
+          Open3.popen3(command) do |stdin, stdout, stderr, thrd|
+            unless thrd.value.success?
+              err = stderr.read.to_s.strip
+
+              # Inform user when no/wrong password was used as its needed to prevent UI permission popup from Xcode when signing
+              if err.include?("SecKeychainItemSetAccessWithPassword")
+                keychain_name = File.basename(keychain_path, ".*")
+                Security::InternetPassword.delete(server: server_name(keychain_name))
+
+                UI.important("")
+                UI.important("Could not configure imported keychain item (certificate) to prevent UI permission popup when code signing\n" \
+                         "Check if you supplied the correct `keychain_password` for keychain: `#{keychain_path}`\n" \
+                         "#{err}")
+                UI.important("")
+                UI.important("Please look at the following docs to see how to set a keychain password:")
+                UI.important(" - https://docs.fastlane.tools/actions/sync_code_signing")
+                UI.important(" - https://docs.fastlane.tools/actions/get_certificates")
+              else
+                UI.error(err)
+              end
             end
           end
         end
 
-        # Hiding after Open3 finishes
-        Helper.hide_loading_indicator
-
       end
     end
 
@@ -98,7 +95,13 @@ module FastlaneCore
       server = server_name(keychain_name)
 
       # Attempt to find password in keychain for keychain
-      item = Security::InternetPassword.find(server: server)
+      begin
+        item = Security::InternetPassword.find(server: server)
+      rescue Security::Error => ex
+        UI.important("Could not read the keychain item #{server}: #{ex.message}")
+        item = nil
+      end
+
       if item
         keychain_password = item.password
         UI.important("Using keychain password from keychain item #{server} in #{keychain_path}")

data/fastlane_core/lib/fastlane_core/languages.rb

@@ -8,7 +8,6 @@ module FastlaneCore
     # The new format used from September 2015 on
     # This was generated from `Spaceship::Tunes.client.available_languages.sort`
     # Updates should also be made to:
-    # - produce/lib/produce/available_default_languages.rb
     # - spaceship/lib/assets/languageMapping.json
     # See pull request for example: https://github.com/fastlane/fastlane/pull/14110
     ALL_LANGUAGES = %w[ar-SA bn-BD ca cs da de-DE el en-AU en-CA en-GB en-US es-ES es-MX fi fr-CA fr-FR gu-IN he hi hr hu id it ja kn-IN ko ml-IN mr-IN ms nl-NL no or-IN pa-IN pl pt-BR pt-PT ro ru sk sl-SI sv ta-IN te-IN th tr uk ur-PK vi zh-Hans zh-Hant]

data/fastlane_core/lib/fastlane_core/print_table.rb

@@ -1,5 +1,6 @@
 require_relative 'configuration/configuration'
 require_relative 'helper'
+require_relative 'secrets'
 
 module FastlaneCore
   class PrintTable
@@ -87,6 +88,8 @@ module FastlaneCore
       end
 
       def transform_output(rows, transform: :newline)
+        # Masked before wrapping, which would split a secret across lines
+        rows = rows.map { |row| row.map { |column| column.kind_of?(String) ? Secrets.mask(column) : column } }
         return rows unless should_transform?
 
         require 'fastlane_core/string_filters'
@@ -110,7 +113,7 @@ module FastlaneCore
         return return_array
       end
 
-      def collect_rows(options: nil, hide_keys: [], mask_keys: [], prefix: '', mask: '********')
+      def collect_rows(options: nil, hide_keys: [], mask_keys: [], prefix: '', mask: nil)
         rows = []
 
         options.each do |key, value|
@@ -118,7 +121,7 @@ module FastlaneCore
           next if value.nil?
           next if value.to_s == ""
           next if hide_keys.include?(prefixed_key)
-          value = mask if mask_keys.include?(prefixed_key)
+          value = mask || Secrets.label(key) if mask_keys.include?(prefixed_key)
 
           if value.respond_to?(:key)
             rows.concat(self.collect_rows(options: value, hide_keys: hide_keys, mask_keys: mask_keys, prefix: "#{prefix}#{key}.", mask: mask))

data/fastlane_core/lib/fastlane_core/provisioning_profile.rb

@@ -106,26 +106,17 @@ module FastlaneCore
 
       private
 
+      # keychain_path is ignored: unlike `security cms -D`, this imports no certificate into a keychain. See #30186.
       def decode(path, keychain_path = nil)
-        require 'tmpdir'
-        Dir.mktmpdir('fastlane') do |dir|
-          err = "#{dir}/cms.err"
-          # we want to prevent the error output to mix up with the standard output because of
-          # /dev/null: https://github.com/fastlane/fastlane/issues/6387
-          if Helper.mac?
-            if keychain_path.nil?
-              decoded = `security cms -D -i "#{path}" 2> #{err}`
-            else
-              decoded = `security cms -D -i "#{path}" -k "#{keychain_path.shellescape}" 2> #{err}`
-            end
-          else
-            # `security` only works on Mac, fallback to `openssl`
-            # via https://stackoverflow.com/a/14379814/252627
-            decoded = `openssl smime -inform der -verify -noverify -in #{path.shellescape} 2> #{err}`
-          end
-          UI.error("Failure to decode #{path}. Exit: #{$?.exitstatus}: #{File.read(err)}") if $?.exitstatus != 0
-          decoded
-        end
+        require 'openssl'
+        profile = OpenSSL::PKCS7.new(File.binread(path))
+        # NOVERIFY skips the certificate chain, which `security cms -D` does not enforce either, but still checks the signature.
+        # A mismatch is decoded anyway, as `security cms -D` did: match/spec/fixtures/test.provisionprofile has one.
+        UI.important("The signature of #{path} does not match its content: it was changed after it was signed") unless profile.verify([], OpenSSL::X509::Store.new, nil, OpenSSL::PKCS7::NOVERIFY)
+        profile.data.to_s
+      rescue ArgumentError, OpenSSL::PKCS7::PKCS7Error, SystemCallError => e
+        UI.error("Failure to decode #{path}: #{e.message}")
+        ""
       end
     end
   end

data/fastlane_core/lib/fastlane_core/secrets.rb

@@ -0,0 +1,77 @@
+require_relative 'core_ext/shellwords'
+require_relative 'env'
+
+module FastlaneCore
+  # Values hidden from everything fastlane prints. Only output is masked: commands still receive the real value.
+  # FASTLANE_DISABLE_SECRET_MASKING turns it off, for debugging.
+  module Secrets
+    MASK = '********'.freeze
+    # Shorter values would mask unrelated text.
+    MIN_LENGTH = 4
+
+    # Masks what is written to an IO, so `puts`, `print`, `abort` and Logger output are covered.
+    module OutputFilter
+      def write(*args)
+        super(*args.map { |arg| Secrets.mask(arg.to_s) })
+      end
+    end
+
+    class << self
+      # Registers a secret, or every String inside a Hash or Array, together with the escaped forms `sh` prints.
+      # A name, such as the option's key, replaces it with `<NAME>_REDACTED` rather than MASK.
+      def register(value, name: nil)
+        case value
+        when Hash then value.each_value { |v| register(v, name: name) }
+        when Array then value.each { |v| register(v, name: name) }
+        when String
+          return if value.length < MIN_LENGTH
+
+          replacement = name ? label(name) : MASK
+          [value, Shellwords.escape(value), value.shellescape].each do |form|
+            labels[form.b] = replacement if [nil, MASK].include?(labels[form.b])
+          end
+          @pattern = nil
+          install_output_filter unless disabled?
+        end
+      end
+
+      def mask(text)
+        return text if labels.empty? || !text.kind_of?(String) || disabled?
+
+        # One pass: a name put in place of a secret is not masked again by a shorter secret it contains
+        text.b.gsub(pattern) { |match| labels[match] }.force_encoding(text.encoding)
+      end
+
+      # What a secret registered under this name is replaced with, e.g. API_TOKEN_REDACTED
+      def label(name)
+        "#{name.to_s.upcase}_REDACTED"
+      end
+
+      def labels
+        @labels ||= {}
+      end
+
+      def clear
+        @labels = {}
+        @pattern = nil
+      end
+
+      def disabled?
+        FastlaneCore::Env.truthy?('FASTLANE_DISABLE_SECRET_MASKING')
+      end
+
+      private
+
+      # Longest first, so a secret wins over a shorter one it contains
+      def pattern
+        @pattern ||= Regexp.union(labels.keys.sort_by { |v| -v.length })
+      end
+
+      def install_output_filter
+        [$stdout, $stderr].each do |io|
+          io.singleton_class.prepend(OutputFilter) unless io.singleton_class.include?(OutputFilter)
+        end
+      end
+    end
+  end
+end

data/fastlane_core/lib/fastlane_core/ui/fastlane_runner.rb

@@ -265,11 +265,11 @@ module Commander
       ui.error("- If you use system Ruby:")
       ui.error("  - Run `brew update && brew install ruby`")
       ui.error("- If you use rbenv with ruby-build:")
-      ui.error("  - Run `brew update && brew upgrade ruby-build && rbenv install 2.3.1`")
-      ui.error("  - Run `rbenv global 2.3.1` to make it the new global default Ruby version")
+      ui.error("  - Run `brew update && brew upgrade ruby-build && rbenv install #{Fastlane::SUGGESTED_MINIMUM_RUBY}`")
+      ui.error("  - Run `rbenv global #{Fastlane::SUGGESTED_MINIMUM_RUBY}` to make it the new global default Ruby version")
       ui.error("- If you use rvm:")
       ui.error("  - First run `rvm osx-ssl-certs update all`")
-      ui.error("  - Then run `rvm reinstall ruby-2.3.1 --with-openssl-dir=/usr/local`")
+      ui.error("  - Then run `rvm reinstall ruby-#{Fastlane::SUGGESTED_MINIMUM_RUBY}`")
       ui.error("")
       ui.error("If that doesn't fix your issue, please google for the following error message:")
       ui.error("  '#{e}'")

data/fastlane_core/lib/fastlane_core/ui/github_issue_inspector_reporter.rb

@@ -20,7 +20,7 @@ module Fastlane
       report.issues[0..(NUMBER_OF_ISSUES_INLINE - 1)].each { |issue| print_issue_full(issue) }
 
       if report.issues.count > NUMBER_OF_ISSUES_INLINE
-        report.url.sub!('\'', '%27')
+        report.url.gsub!('\'', '%27')
         puts("and #{report.total_results - NUMBER_OF_ISSUES_INLINE} more at: #{report.url}")
         puts("")
       end