Release KSM CLI v1.5.0#1065
Open
stas-schaller wants to merge 27 commits into
Open
Conversation
…SM-975) When keyring is unavailable, the fallback warning now distinguishes between binary and pip installs: - Binary install (sys.frozen=True): directs user to download the '-keyring' version of the binary from the GitHub releases page. Previously, binary users were incorrectly told to run 'pip install', which is not applicable. - Pip install: corrects the suggested command to use single-quoted brackets so it works on zsh (macOS default shell since Catalina). Unquoted [] is a glob pattern in zsh and causes 'zsh: no matches found'. Adds two unit tests covering both code paths.
…ning fix(cli): context-aware keyring warning for binary vs pip installs (KSM-975)
When sys.frozen is True (PyInstaller binary), get_default_ini_file() now uses $HOME instead of os.getcwd(), matching the launched_from_app=True path. Pip installs are unaffected.
Switch query() from get_secrets() to get_secrets_with_options() with request_links=True so the server actually returns link data. Add record.links to _record_to_dict() output and a Links section to _format_record() text output. Without request_links=True the server never sends link data regardless of what the record contains.
…SM-1003) Frozen (PyInstaller) binaries wrote ksm_cache.bin to the current working directory when caching was enabled, the same pollution KSM-980 fixed for keeper.ini. The CLI now resolves a cache directory with the same policy as Config.get_default_ini_file (KSM_INI_DIR, else HOME/USERPROFILE when frozen) and sets KSM_CACHE_DIR before importing the SDK core, since KSMCache.kms_cache_file_name is evaluated at import time. Pip/source installs keep the CWD default; an explicit KSM_CACHE_DIR is always honored.
…startup (KSM-1005) update-checker 1.0.0 (PyPI 2026-06-08) made UpdateChecker.check() keyword-only: check(self, *, package_name, package_version). The unpinned dependency in setup.py meant every fresh install resolved 1.0.0, and the positional call at __main__.py:200 crashed 'ksm shell' on launch with a TypeError. Call check() with keyword arguments (package_name/package_version) — compatible with both 0.18.0 and 1.0.0, so no version pin is needed. Also wrap the shell startup update check in try/except, matching version_command and base_command_help, so a failed update check can never block the shell.
fix(cli): ksm shell crash from update-checker 1.0.0 keyword-only check() (KSM-1005)
…binary (KSM-1014)
…t output The KSM-981 links output rendered one bare-UID row per link: settings self-links (meta/ai_settings/jit_settings, recordUid == the record's own UID) were indistinguishable from real linked records, and link data was never decoded - JSON output carried opaque base64/ciphertext blobs. A pamUser with no linked records still showed a links table containing its own UID. - JSON: each link entry keeps the raw recordUid/data/path fields untouched and gains a "decoded" object via the core 17.3.0 typed accessor KeeperRecordLink.get_link_data(record_key) - plain link payloads are parsed and ai_settings/jit_settings are decrypted with the record key - Text: the Links table now has three columns (Linked Record UID with a "(self)" label, Path, decoded Link Data) so PAM meta settings and AI/JIT configuration are distinguishable from links to other records - keeper-secrets-manager-core pin bumped >=17.2.0 -> >=17.3.0 (KeeperRecordLink/get_links only exist from 17.3.0) - Link tests upgraded to live-shape fixtures (meta self-link, credential link with flags, data-less reference) asserting decoded JSON output and the labeled text table Verified live against a QA PAM app: all 24 links across 14 records render with decoded data, including decrypted ai/jit settings.
fix(cli): KSM-1015 decode link data and label self-links in secret get output
Ticket IDs in test docstrings/comments rot when the tracker changes and distract readers into looking something up the comment should just explain inline; the substance (why each test exists) is kept, only the KSM-#### / REL-#### / URL references are removed.
_get_instance_region() constructed IMDSFetcher with botocore's default timeout/retries, so 'ksm profile setup -t aws' stalled on every one of the four region-lookup calls against an unreachable 169.254.169.254 before eventually surfacing a raw botocore NoRegionError. IMDSFetcher now uses a 1s/1-attempt timeout, and _get_client() raises a message naming the non-EC2 cause and the --fallback option instead. read_config() also logs AWS errors it previously swallowed silently.
…profiles KeyringUtilityStorage.__load_config() caught every exception, including keyring.errors.KeyringLocked, behind a blanket except-and-log-at-debug, so a locked keyring (e.g. gnome-keyring running but locked in an SSH session with no display server) was indistinguishable from no profile ever being configured. Reproduced empirically against the actual published keeper-secrets-manager-cli==1.3.0 package in a Docker container with a real dbus-daemon + gnome-keyring-daemon, locking a collection with a stored secret and confirming the silent None return. __load_config() now catches KeyringLocked specifically and raises the new KsmCliKeyringLockedException with an actionable message; existing KsmCliException handling in profile.py surfaces it without further changes. Keyring-less installs are unaffected (the guarded keyring import falls back to a tuple that matches nothing on ImportError).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The IMDS timeout fix and _get_client() error handling belong in the storage package (keeper-secrets-manager-storage), not the CLI release. These changes will land in storage v1.2.0 via KSM-977-aws-load-config-raise.
APPDIR is a Linux AppImage variable, not a standard Windows env var. Replace with APPDATA joined with "Keeper" so %APPDATA%\Keeper\keeper.ini is correctly included in the config path search, consistent with the existing PROGRAMDATA\Keeper and PROGRAMFILES\Keeper entries. KSM-1113
Relative ["etc"] entries in find_ksm_path resolved against CWD, not /etc. os.path.join produces /etc/keeper.ini only when the first component is an absolute path. No behavior change on Windows where /etc does not exist. KSM-1113
KSM-1114 dropped colorama, which left check_config_mode()'s Windows icacls permission warning uncolored (that function, in the Core SDK, duck-types its color_mod arg against colorama's Fore/Style shape). A small click.style()-backed shim gives it the same shape without reintroducing colorama as a dependency. KSM-1114
…ng entries Removes the KSM-859 entry (fix was reverted from this branch via 29c5997; CLI v1.5.0 ships without it, tracked as KSM-1115 for a future release). Adds KSM-1113, KSM-1107, and the installer-level KSM-1018/1105/1106 fixes, which were merged on this branch or the same release but missing from the changelog.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release branch for v1.5.0: three CLI bug fixes and a dependency cleanup, plus four installer-level fixes shipped from the cli-binaries repo that affect the same release.
Changes
Bug Fixes
--ini-file/KSM_CONFIGas a fallback.%APPDIR%\Keeper(a Linux AppImage variable, not a Windows one) instead of%APPDATA%\Keeper; on Linux, the/etcsearch entry resolved against the current working directory instead of/etc. Both are now resolved correctly.ksm secret add cloneexited 0 even when the source UID did not exist, masking the failure from scripts. Now exits non-zero with an error message.Dependency
coloramapackage withclick.style(), already available via the existingclick-help-colorsdependency. Includes a shim so the Windows-only config-permission warning (which duck-types its color argument against colorama'sFore/Styleshape) keeps its coloring.Maintenance
Deferred
Installer fixes (cli-binaries repo — not in this diff, but user-facing for this release and included in the CHANGELOG)
libssl.3.dylibpredated OpenSSL 3.2.0, whichcryptographynow requires, causingImportError: Symbol not found: _SSL_get0_group_nameon everyksminvocation. Both x64 and arm64 macOS builds now bundle an up-to-date libssl.%TEMP%was unsigned, causing EDR/AV to block the post-install launch ofksm.exe. Fixed so the launch no longer trips endpoint security.ArchitecturesAllowedandArchitecturesInstallIn64BitModedirectives, so the 64-bit binary was placed inC:\Program Files (x86)on 64-bit systems. The installer now correctly targetsC:\Program Files.Breaking Changes
None.
Related Issues