Split out of the 2026-08-21 repository review (M24), deferred from #112 because there is no drop-in fix.
xmsconan/ci_tools/wheel_deploy.py builds devpi login <user> --password <pass> as an argv list, and every credential source converges on it — --password, $AQUAPI_PASSWORD, and the [aquapi] section of ~/.xmsconan.toml.
Why it matters. docs/USAGE.md §16.8 has the user run xmsconan_wheel_deploy --wheel-dir wheelhouse by hand on the same managed VS2019 Windows box whose Event 4688 / Sysmon capture is the stated threat in ci_tools/conan_setup.py::_login_environment — immediately after vs2019_build.py went to --password-file lengths to keep the Conan password off argv. Process-creation auditing copies the full argv into the event log and ships it to the SIEM in cleartext.
Why it was not fixed in #112. devpi-client reads no password environment variable, and its getpass fallback reads the console rather than a pipe on Windows, so neither of the two mechanisms used elsewhere in this package applies.
Two candidate routes:
- The
devpiclient_get_password plugin hook — register a small plugin that returns the password from the environment or ~/.xmsconan.toml, so devpi login never needs the flag.
- Write the auth entry into
~/.devpi/client directly and skip devpi login altogether.
Both need checking against the devpi-client version the CI images carry.
Until then, wheel_deploy.py's module docstring and --help name the safer sources and say plainly that --password lands in the process command line (#112, last commit).
Split out of the 2026-08-21 repository review (M24), deferred from #112 because there is no drop-in fix.
xmsconan/ci_tools/wheel_deploy.pybuildsdevpi login <user> --password <pass>as an argv list, and every credential source converges on it —--password,$AQUAPI_PASSWORD, and the[aquapi]section of~/.xmsconan.toml.Why it matters.
docs/USAGE.md§16.8 has the user runxmsconan_wheel_deploy --wheel-dir wheelhouseby hand on the same managed VS2019 Windows box whose Event 4688 / Sysmon capture is the stated threat inci_tools/conan_setup.py::_login_environment— immediately aftervs2019_build.pywent to--password-filelengths to keep the Conan password off argv. Process-creation auditing copies the full argv into the event log and ships it to the SIEM in cleartext.Why it was not fixed in #112. devpi-client reads no password environment variable, and its
getpassfallback reads the console rather than a pipe on Windows, so neither of the two mechanisms used elsewhere in this package applies.Two candidate routes:
devpiclient_get_passwordplugin hook — register a small plugin that returns the password from the environment or~/.xmsconan.toml, sodevpi loginnever needs the flag.~/.devpi/clientdirectly and skipdevpi loginaltogether.Both need checking against the devpi-client version the CI images carry.
Until then,
wheel_deploy.py's module docstring and--helpname the safer sources and say plainly that--passwordlands in the process command line (#112, last commit).