certmate-cli 0.1.0__tar.gz → 0.1.2__tar.gz

{certmate_cli-0.1.0 → certmate_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certmate-cli
-Version: 0.1.0
+Version: 0.1.2
 Summary: CertMate command-line interface — the SSL certificate lifecycle from your terminal
 Project-URL: Homepage, https://github.com/fabriziosalmi/certmate
 Project-URL: Source, https://github.com/fabriziosalmi/certmate/tree/main/clients/certmate-cli
@@ -23,7 +23,7 @@ Classifier: Topic :: Security
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
-Requires-Dist: certmate-sdk>=0.1.0
+Requires-Dist: certmate-sdk>=0.1.2
 Requires-Dist: rich>=13
 Requires-Dist: typer>=0.9
 Description-Content-Type: text/markdown
@@ -47,3 +47,5 @@ certmate audit verify
 ```
 
 Connection comes from `--url`/`--token` or `CERTMATE_URL`/`CERTMATE_TOKEN`.
+Prefer the `CERTMATE_TOKEN` environment variable over `--token`: command-line
+arguments are visible to other local processes (`ps`) and shell history.

{certmate_cli-0.1.0 → certmate_cli-0.1.2}/README.md

@@ -17,3 +17,5 @@ certmate audit verify
 ```
 
 Connection comes from `--url`/`--token` or `CERTMATE_URL`/`CERTMATE_TOKEN`.
+Prefer the `CERTMATE_TOKEN` environment variable over `--token`: command-line
+arguments are visible to other local processes (`ps`) and shell history.

{certmate_cli-0.1.0 → certmate_cli-0.1.2}/certmate_cli/__init__.py

@@ -1,2 +1,2 @@
 """certmate-cli — the CertMate SSL lifecycle from your terminal (built on certmate-sdk)."""
-__version__ = "0.1.0"
+__version__ = "0.1.2"

{certmate_cli-0.1.0 → certmate_cli-0.1.2}/certmate_cli/main.py

@@ -10,6 +10,7 @@ Connection comes from --url/--token or CERTMATE_URL/CERTMATE_TOKEN.
 from __future__ import annotations
 
 import re
+import sys
 from typing import List, Optional
 
 import typer
@@ -41,14 +42,38 @@ _DOMAIN_RE = re.compile(
     r"^(\*\.)?([a-zA-Z0-9_](-*[a-zA-Z0-9_])*\.)+[a-zA-Z]{2,}$")
 
 
+def _token_on_argv() -> bool:
+    """True when the token was passed as a command-line flag (as opposed to
+    the CERTMATE_TOKEN environment variable). argv is what leaks to `ps`
+    output and shell history, so it is exactly the thing to check."""
+    return any(a == "--token" or a.startswith("--token=") for a in sys.argv)
+
+
+def _stderr_isatty() -> bool:
+    # Indirection so tests can stub interactivity; CliRunner's captured
+    # stderr never reports a TTY.
+    try:
+        return sys.stderr.isatty()
+    except Exception:
+        return False
+
+
 @app.callback()
 def _main(
     ctx: typer.Context,
     url: Optional[str] = typer.Option(None, "--url", envvar="CERTMATE_URL",
                                       help="CertMate base URL (default http://localhost:8000)."),
     token: Optional[str] = typer.Option(None, "--token", envvar="CERTMATE_TOKEN",
-                                        help="API bearer token."),
+                                        help="API bearer token. Prefer the CERTMATE_TOKEN "
+                                             "environment variable: --token is visible to other "
+                                             "local processes (ps) and shell history."),
 ):
+    # Kept for compatibility, but discourage --token interactively: argv is
+    # world-readable via ps and lands in shell history. Warn only on a TTY so
+    # scripts and pipelines stay quiet.
+    if token and _token_on_argv() and _stderr_isatty():
+        err.print("[yellow]warning[/]: --token is visible in ps output and shell history; "
+                  "prefer the CERTMATE_TOKEN environment variable.")
     ctx.obj = {"url": url, "token": token}
 
 
@@ -156,7 +181,9 @@ def cert_create(
                                  help="Validate inputs and preflight the DNS provider WITHOUT issuing."),
 ):
     """Issue a certificate (async; waits for completion by default)."""
-    sans: List[str] = [s.strip() for s in san.split(",")] if san else []
+    # Drop empties so a trailing comma ("a.com,b.com,") never produces a
+    # bogus "" SAN entry — mirrors cert_reissue.
+    sans: List[str] = [s.strip() for s in san.split(",") if s.strip()] if san else []
     client = _client(ctx)
 
     if dry_run:
@@ -213,10 +240,18 @@ def cert_renew(ctx: typer.Context, domain: str,
                force: bool = typer.Option(False, "--force", help="Force renewal even if not due.")):
     """Renew a certificate."""
     res = _run(lambda: _client(ctx).renew_certificate(domain, force=force))
-    if res.get("renewed") is False:
-        out.print(f"[yellow]not due[/] — {domain} was not yet due for renewal.")
-    else:
+    renewed = res.get("renewed")
+    # Only servers v2.21.1+ report the outcome (`renewed: true/false`). Green
+    # requires an explicit true — an absent key means the server did not say,
+    # and claiming success would be a lie.
+    if renewed is True:
         out.print(f"[green]renewed[/] {domain}.")
+    elif renewed is False:
+        msg = res.get("message") or f"{domain} was not yet due for renewal."
+        out.print(f"[yellow]not due[/] — {msg}")
+    else:
+        out.print(f"renew requested for [bold]{domain}[/] — server did not report "
+                  "the outcome (server v2.21.1+ reports it).")
 
 
 @cert_app.command("rm")
@@ -280,13 +315,22 @@ def audit_verify(ctx: typer.Context):
     ok = bool(res.get("ok"))
     reason = res.get("reason") or ""
     cp = res.get("checkpoint_verified")
-    # "chain file does not exist" / "empty chain" is a fresh instance that has
-    # not audited anything yet — benign, not a tamper alarm. Show it neutrally.
-    if not ok and any(k in reason.lower() for k in ("does not exist", "empty")):
-        out.print(f"audit chain: [dim]none yet[/] — {reason}")
+    # Benign ONLY when the server says state='absent' (200: fresh instance,
+    # nothing audited yet). The reason wording is NOT a signal: a chain file
+    # DELETED after signed checkpoints attested it existed comes back as a 409
+    # with the very same "chain file does not exist" text — that is tampering
+    # and must exit non-zero, like every other not-ok result.
+    if not ok and res.get("state") == "absent":
+        out.print(f"audit chain: [dim]none yet[/] — {reason or 'nothing audited yet'}")
         return
-    out.print(f"audit chain: {'[green]intact[/]' if ok else '[red]BROKEN[/]'}"
-              f"{(' — ' + reason) if reason else ''}")
+    detail = (
+        f" — {reason}"
+        if reason and not (ok and reason.lower() == "intact")
+        else ""
+    )
+    out.print(
+        f"audit chain: {'[green]intact[/]' if ok else '[red]BROKEN[/]'}{detail}"
+    )
     if cp is not None:
         out.print(f"  signed checkpoint: {'[green]verified[/]' if cp else '[dim]not cross-checked[/]'}"
                   f"{(' @ seq ' + str(res.get('checkpoint_seq'))) if res.get('checkpoint_seq') is not None else ''}")

{certmate_cli-0.1.0 → certmate_cli-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "certmate-cli"
-version = "0.1.0"
+version = "0.1.2"
 description = "CertMate command-line interface — the SSL certificate lifecycle from your terminal"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -30,8 +30,10 @@ classifiers = [
 ]
 # Built ON the SDK (never the reverse). typer for the command surface, rich
 # for tables/spinners. Still light — no server deps.
+# The SDK floor tracks the CLI release: 0.1.2 needs TransportError and the
+# renew/audit semantics introduced in certmate-sdk 0.1.2.
 dependencies = [
-    "certmate-sdk>=0.1.0",
+    "certmate-sdk>=0.1.2",
     "typer>=0.9",
     "rich>=13",
 ]