29 lines
2.0 KiB
Markdown
29 lines
2.0 KiB
Markdown
|
# 0038. CLI password sources and explicit plaintext storage
|
||
|
|
|
||
|
|
- **Status:** Accepted
|
||
|
|
- **Area:** Distribution
|
||
|
|
- **Recorded:** 2026-11-03
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
The CLI read the wallet password only from `--password`, where it is stored in the shell history and visible to other local users in the process list (ADR 0024 already noted it). Worse, when `--password` was missing in `create`/`restore*` the CLI printed a warning and stored the **seed in plaintext**: a forgotten flag silently produced an unencrypted wallet.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
- Password sources, one at most per command: `--password-env NAME`, `--password-stdin` (first line), or `--password P` (kept for compatibility, prints a warning on stderr). With none, a no-echo prompt on the terminal (`Console.ReadKey(intercept: true)`), with a confirmation when creating a wallet. With no terminal the command fails with a clear message and never hangs.
|
||
|
|
- A new wallet (`create`, `restore`, `restore-xpub`, `restore-address`) is stored unencrypted **only** with `--no-encryption`, which prints a warning and cannot be combined with a password option. An empty password is refused.
|
||
|
|
- Opening: a plaintext wallet needs no password; an encrypted one needs a source. The password used to open is reused to save the wallet back (`sync`).
|
||
|
|
- Implemented in `src/Cli/CliPassword.cs`; the command logic in `Program.cs` only asks it for the password.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
- A forgotten flag can no longer produce a plaintext wallet; scripts that relied on that must add `--no-encryption` (recorded as a behaviour change in the changelog).
|
||
|
|
- `--password` is not removed, so existing scripts with a password keep working; removing it is left to a major version.
|
||
|
|
- The environment variable route still exposes the password to processes that can read the environment of the CLI; it is safer than an argument but not a hardened interface (the CLI remains a developer tool).
|
||
|
|
|
||
|
|
## References
|
||
|
|
|
||
|
|
- `src/Cli/CliPassword.cs`
|
||
|
|
- `src/Cli/Program.cs`
|
||
|
|
- `tests/PalladiumWallet.Tests/App/CliTests.cs`
|
||
|
|
- Related: 0024
|