From e772c4b6d52627c463e70b4284e3794aa0bd0634 Mon Sep 17 00:00:00 2001 From: Ryan Lue Date: Thu, 30 Jun 2022 23:04:35 -0700 Subject: calcurse-caldav: Support PasswordCommand option This commit adds a new `Auth/PasswordCommand` option to support security best practices re: handling secrets in CLI program configuration. Prior to this commit, the two available options for specifying a password were: 1. via the `Auth/Password` config parameter, or 2. via a `$CALCURSE_CALDAV_PASSWORD` environment variable. The former is unsafe for obvious reasons; the latter is unsafe because as long as the script is running, its environment can be accessed via $ cat /proc//environ and is thus visible to anyone with access to the system. This commit preserves preexisting behavior (for backward compatibility) but removes all mention of option 2 from the README. Since the README example for option 2 used a password command anyway, there is little reason to continue its use, and this commit recommends it be deprecated. Signed-off-by: Lukas Fleischer --- contrib/caldav/README.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'contrib/caldav/README.md') diff --git a/contrib/caldav/README.md b/contrib/caldav/README.md index a842081..b464dc9 100644 --- a/contrib/caldav/README.md +++ b/contrib/caldav/README.md @@ -34,13 +34,12 @@ argument. You can choose between the following initialization modes: For subsequent calcurse-caldav invocations, you don't need to specify any additional parameters. -You can specify a username and password for basic authentication in the -config file. Alternatively, the password can be passed securely from another -program (such as *pass*) via the `CALCURSE_CALDAV_PASSWORD` environment variable like -so: -``` -CALCURSE_CALDAV_PASSWORD=$(pass show calcurse) calcurse-caldav -``` +Specify your HTTP Basic authentication credentials under the config file's +`Auth` section. The most secure approach is to save your password in a CLI +encrypted password store (_e.g.,_ [pass](https://www.passwordstore.org/)), and +then set `PasswordCommand` to the shell command used to retrieve it. +If security is not a priority, you may store your password in plain text +instead. Hooks ----- -- cgit v1.2.3-54-g00ecf