You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "hemanthumashankar0511 (via GitHub)" <gi...@apache.org> on 2026/08/20 08:59:05 UTC

[I] [Archery] Redact sensitive arguments in command debug logs [arrow]

hemanthumashankar0511 opened a new issue, #50922:
URL: https://github.com/apache/arrow/issues/50922

   ### Describe the bug, including details regarding any error messages, version, and platform.
   
   ### Describe the bug, including details regarding any error messages, version, and platform.
   In `dev/archery/archery/utils/command.py`, `Command.run()` logs the full subprocess invocation at the `DEBUG` level:
   `logger.debug(f"Executing `{invocation}`")`
   If Archery is run with `--debug`, any sensitive values passed as CLI arguments (like `--token`, `--password`, or Docker `-e AWS_SECRET_ACCESS_KEY=...`) are printed in plain text to the logs. 
   
   **Proposed Fix:**
   Add a lightweight redaction filter to the `logger.debug()` statement to mask common secret patterns before logging, while leaving the actual `subprocess.run()` execution unchanged. 
   
   ### Component(s)
   
   Archery


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Archery] Redact sensitive arguments in command debug logs [arrow]

Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on issue #50922:
URL: https://github.com/apache/arrow/issues/50922#issuecomment-5361649073

   I think that we don't need this. Do you have any real problems by the current behavior?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Archery] Redact sensitive arguments in command debug logs [arrow]

Posted by "kou (via GitHub)" <gi...@apache.org>.
kou closed issue #50922: [Archery] Redact sensitive arguments in command debug logs
URL: https://github.com/apache/arrow/issues/50922


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Archery] Redact sensitive arguments in command debug logs [arrow]

Posted by "hemanthumashankar0511 (via GitHub)" <gi...@apache.org>.
hemanthumashankar0511 commented on issue #50922:
URL: https://github.com/apache/arrow/issues/50922#issuecomment-5369433289

   Thanks @kou, this came from an internal Fortify scan on our downstream branch, but I haven't seen any real problems in practice.
   so I agree this isn't a practical concern.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Archery] Redact sensitive arguments in command debug logs [arrow]

Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on issue #50922:
URL: https://github.com/apache/arrow/issues/50922#issuecomment-5376025243

   OK. I close this for now.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Archery] Redact sensitive arguments in command debug logs [arrow]

Posted by "hemanthumashankar0511 (via GitHub)" <gi...@apache.org>.
hemanthumashankar0511 commented on issue #50922:
URL: https://github.com/apache/arrow/issues/50922#issuecomment-5354085414

   Hi everyone! I'm new to contributing to Apache Arrow and would love to pick this up as my first issue. 
   Before I open a PR, could someone confirm if this is a genuine issue you'd like to be addressed?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org