Ant SecureInputHandler: prints password in clear text when used with tee - ant

We use Ant's secure handler to enter passwords:
<input message="Please enter TFS password: " addproperty="tfs.password">
<handler type="secure"/>
</input>
That, of course, does work: input is not printed.
When though (to save the build log) we run the build as
ant | tee build.log
the input is printed in clear text. Oops.
I wonder where is the issue (ant? tee?) and how to fix that.
P.S. OS:
Linux devosb1 3.0.0-12-generic #20-Ubuntu
SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
P.P.S. OK, so it is not tee -- a shell script with read/echo instead of tee triggers the same behaviour.

Looks like a shell issue. Have you considered using the ANT record task?
<project name="demo" default="build">
<target name="build">
<record name="build.log" loglevel="verbose"/>
<input message="Please enter TFS password: " addproperty="tfs.password">
<handler type="secure"/>
</input>
</target>
</project>

Related

Why do I get BUILD SUCCESSFUL while I had an error?

I am experimenting with Jenkins and Ant. I would like to simply run my Makefile that does everything, the build and the tests.
I figured out that the best way is to use Ant because I become flexible with my build process similarly to travis.yml.
Unfortunately the compiler I am using only exists on Windows so I installed Jenkins on Windows. I wrote this build.xml
<?xml version="1.0"?>
<project name="Hello World Project" default="info">
<target name="info">
<echo>Hello World - Welcome to Apache Ant!</echo>
<exec executable="make"/>
</target>
</project>
And the output I get so far is this one:
C:\Program Files (x86)\Jenkins\workspace\test>exit 0
[test] $ cmd.exe /C "ant.bat info && exit %%ERRORLEVEL%%"
Unable to locate tools.jar. Expected to find it in C:\Program Files\Java\jre1.8.0_131\lib\tools.jar
Buildfile: C:\Program Files (x86)\Jenkins\workspace\test\build.xml
info:
[echo] Hello World - Welcome to Apache Ant!
[exec] rm -f test_*.s
[exec] arm-none-eabi-gcc.exe -O2 -Wall -S -c test.c -o test_gcc.s
[exec] make: arm-none-eabi-gcc.exe: Command not found
[exec] make: *** [Makefile:9: test_gcc.s] Error 127
[exec] Result: 2
BUILD SUCCESSFUL
Total time: 0 seconds
Finished: SUCCESS
Why do I get a BUILD SUCCESSFUL status while I got an Error?
N.B. I know I have to configure my PATH to include the toolchain. I would like to first understand this inconsistency.
By default, Ant's exec task does not fail the build when an error code is returned. However, this can simply be switched on with the failonerror attribute:
<exec executable="make" failonerror="true" />

Sign a launch4j executable in ant with sign4j and jsign

I have an application in a Jar and I wrap it in a exe with launch4j so is easy for the user to launch it (in windows). I have a certificate, so I sign the jar (I don't know if this is really necessary because it will be wrapped inside the exe) and I want to sign the exe but it corrupt the executable.
I use ant to make all the process and look like:
<signjar jar="${jar.location}" alias="${key.alias}" storetype="pkcs12" keystore="${key.file}" storepass="${key.password}" tsaurl="https://timestamp.geotrust.com/tsa" />
<launch4j configFile="launch4j_configuration.xml" fileversion="${version}.0" txtfileversion="${build}" productversion="${version}.0" txtproductversion="${build}" outfile="${exe.location}" jar="${jar.location}" />
<signexe file="${exe.location}" alias="${key.alias}" storetype="pkcs12" keystore="${key.file}" storepass="${key.password}" tsaurl="http://timestamp.verisign.com/scripts/timstamp.dll" />
I have found that is because when you sign the exe it broke the jar structure or something like this. But what I have also seen is that inside the launch4j folder is a sign4j folder that contains what I think is a program that solve this problem.
My problem now is how is used this program? And how can I integrate it in the ant script to sign the exe?
The README.txt file in the folder doesn't helped to me. Sorry if this so obvious but isn't clear for me. Also note that I'm using Ubuntu.
What I have found is that you must execute the sign4j command with the signing command as its argument. Something like:
sign4j jsign -s keyfile.p12 -a "(codesign_1091_es_sw_kpsc)" --storepass AVERYGOODPASSWORD --storetype pkcs12 -n MyProgram -u https://www.example.com MyProgram.exe
So, to integrate it into ant, you need to create an exec task. For example, something like:
<exec executable="sign4j">
<arg line="java -jar jsign-1.2.jar -s ${key.file} -a ${key.alias} --storepass ${key.password} --storetype pkcs12 ${exe.location}"/>
</exec>
It works also with other signing tools like for example authenticode from Microsoft, too ...
<exec executable="launch4j/sign4j/sign4j.exe">
<arg line="signtool.exe sign /fd SHA256 /f mycert.pfx /p foobar /t http://timestamp.verisign.com/scripts/timstamp.dll dist\myapp.exe"/>
</exec>
I use ant target as below to sign exe generated out of a jar file
<target name="signexe" depends="createExe" description="Signing Exe">
<exec executable="C:\Tools\Launch4j\sign4j\sign4j.exe">
<arg line="java -jar C:\3rdParty\jsign\jsign-3.1.jar
--keystore ${keystore.location} --alias ${key.alias} --storepass ${store.password}
--name 'Application Name'
--tsaurl http://timestamp.verisign.com/scripts/timstamp.dll
AppLauncher.exe"/>
</exec>
</target>

How to execute Ant without buildfile

I'm working on a project to develop a custom Ant task.
As part of automated acceptance testing, I'd like to execute Ant from JUnit (the opposite of the usual desire) and pass it a string containing certain build XML to be tested via a command line param or stdin or pipe or something like that, rather than referring it to a buildfile on disk.
Is there any feasible way to do this?
Ant expects a file as input. You can however use the -f parameter to specify a tempfile as input:
$ cat <<EOF > tmp1.xml
<project name="demo" default="hello">
<target name="hello">
<echo>hello world</echo>
</target>
</project>
EOF
$ ant -f tmp1.xml
Obviously from Junit you're more likely the write the XML from Java :-)

How to execute an interactive application from Ant build script?

From http://ant.apache.org/manual/Tasks/exec.html :
Note that you cannot interact with the
forked program, the only way to send
input to it is via the input and
inputstring attributes. Also note that
since Ant 1.6, any attempt to read
input in the forked program will
receive an EOF (-1). This is a change
from Ant 1.5, where such an attempt
would block.
How do I launch and interact with interactive console program from ant?
What I want to do is similar to drush sqlc functionality, that is launch the mysql client interpreter using the proper database credentials, but not limited to this use case.
Here's a sample use case:
<project name="mysql">
<target name="mysql">
<exec executable="mysql">
<arg line="-uroot -p"/>
</exec>
</target>
</project>
When run using ant :
$ ant -f mysql.xml mysql
Buildfile: /home/ceefour/tmp/mysql.xml
mysql:
Enter password:
BUILD SUCCESSFUL
Total time: 2 seconds
After inputting password, it immediately exits.
Compare this with what happens when executing directly on the shell (expected behavior):
$ mysql -uroot -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 1122
Server version: 5.1.58-1ubuntu1 (Ubuntu)
Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL v2 license
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
You can launch your command via a shell, redirecting standard input/output/error from/to/to /dev/tty, which corresponds to the controlling terminal of the process.
<target name="dbshell" description="Open a shell for interactive tasks">
<exec executable="/bin/sh">
<arg value="-c"/>
<arg value="mysql -u root -p < /dev/tty > /dev/tty 2> /dev/tty"/>
</exec>
</target>
I have tried running on cosnole and if you do not fork it works.
As mentioned in the doc too.
Beside with eclipse there are additional ways to configure inputhandler.
As is acknowledged here.
http://www.coderanch.com/t/419646/tools/java-program-accept-user-input
A clean way to get this work
http://www.myeclipseide.com/PNphpBB2-viewtopic-t-25337.html

How can I ensure all output from Ant's exec task goes to stdout?

The Ant exec task has an output property which can be used to tell Ant where the output goes. I've used it to redirect the output to a file. The thing is, if I don't do something with the output, the stuff that Ant prints isn't that much of a help - it's not complete.
Is there someway of setting the output property to System.out?
When executing a batch file with ant's apply or exec tasks on Windows, I found there are special cases where some of the stdout and stderr is not captured by ant. (For example: if you call a batch file that in turn calls other commands (like node.exe), then the stdout and stderror from the child node.exe process is lost.)
I spent a long time trying to debug this! It seems that the batch file's stdout and stderr is captured, however commands called by the batch file are somehow not seen by ant. (perhaps because they are separate child processes). Using the output and error attributes as suggested above doesn't help because only some of the stdout and/or stderr is captured.
The solution I came up with (a hack) is to add these arguments at the end of the command:
<!--Next arg: forces node's stderror and stdout to a temporary file-->
<arg line=" > _tempfile.out 2<&1"/>
<!--Next arg: If command exits with an error, then output the temporary file to stdout, -->
<!--delete the temporary file and finally exit with error level 1 so that -->
<!--the apply task can catch the error if #failonerror="true" -->
<arg line=" || (type _tempfile.out & del _tempfile.out & exit /b 1)"/>
<!--Next arg: Otherwise, just type the temporary file and delete it-->
<arg line=" & type _tempfile.out & del _tempfile.out &"/>
Because this hack only applies to windows, remember to add #osfamily="windows" to the apply or exec task. And create similar task(s) for `#osfamily="unix", etc but without these extra arguments.
The output of exec does go to standard out unless you specify the output attribute.
If you want to output to System.out, then simply do not specify the "output" attribute. If you would like to redirect to a file AND print it to System.out, you can use the tee command, which will redirect output to a given file and also echo it to standard out... I do not know if Windows supports "tee" or an equivalent.
Maybe you want to look at the error, logError, and errorproperty attributes of the exec task too. These deal with the handling of the standard error stream from the exec'd process. There may be useful information there that is going awol for some reason - which might account for the incompleteness you see.
But, if the exec'd process decides to close stdout or stderr and send them elsewhere - there's little you can do.
I have faced similar problem: the output of command execution was suppressed. Perhaps that is the side effect when running cmd under WinXP (I an using maven-antrun-plugin). Anyway setting output="con" worked out perfectly:
<configuration>
<target>
<exec executable="cmd" output="con">
<arg value="/c" />
<arg value="..." />
</exec>
</target>
</configuration>
Working with Ant and Gruntjs:
For anyone trying to get this to work using Gruntjs. I was able to get it working by doing the following (in combination with darcyparker's answer).
In my Ant Build File:
<target description="run grunt js tasks" name="grunt">
<exec dir="/path/to/grunt" executable="cmd" failonerror="true">
<arg value="/c"/>
<arg value="jshint.bat"/> // I broke each task into it's own exec
<arg line=" > jshint.log 2<&1"/>
<arg line=" || (type jshint.log & del jshint.log & exit /b 1)"/>
<arg line=" & type jshint.log & del jshint.log &"/>
</exec>
<exec dir="/path/to/grunt" executable="cmd" failonerror="true">
// another grunt task (IE: uglify, cssmin, ect..)
</exec>
</target>
jshint.bat
#echo off
pushd "C:\path\to\grunt\"
#ECHO _____________________________________________
#ECHO GRUNT JSHINT
#ECHO _____________________________________________
grunt jshint --stack >>jshint.log
NOTE: Path to grunt would be where your Gruntfile.js is located. Also note, I had to initially create the log file (to get it to work with darcyparker's answer) which would output the stack trace from that particular task. This would then give me the grunt task stack output from wherever I call my ant target.
Finally note that pushd "C:\path\to\grunt\" won't be necissary if your bat files are in the same directory as your Gruntfile.js.
I was experiencing this same kind of issue trying to get the build process to fail in Ant after Karma tests intentionally failed, and executing them with "grunt test".
Just added /c before "grunt test", and it worked like a charm
<target name="unittest">
<echo>*** KARMA UNIT TESTING ***</echo>
<exec dir="api_ui" executable="cmd" osfamily="windows" logError="yes" failonerror="true">
<arg value="/c grunt test"/>
</exec>
</target>

Resources