fix(installer): stop leaking the client password on curl's argv (CWE-214)

[LukasWodka]

Summary

verify_credentials() passed the machine-credential password as a curl argv element (--data-urlencode "password=${client_password}"). For the request's lifetime (up to the -m 60 timeout, and up to 5× on the interactive retry loop) it was world-readable via ps aux / /proc/<pid>/cmdline to any unprivileged local user — and tracebloc deploys on shared institutional/on-prem compute (HPC, universities, hospitals) where a co-tenant could scrape it and impersonate the client against the backend. CWE-214. Fires on every install path (minted #838 credential, env-supplied creds, interactive entry).

(Found by an adversarial bug-hunt of the installer + CLI.)

Fix

Feed the password via stdin: --data-urlencode "password@-" reads the value from stdin and URL-encodes it, so it never appears in the process table. printf '%s' is a bash builtin (no fork → no argv exposure) and emits no trailing newline (a here-string <<< would append one and corrupt the password). The username (client_id, a UUID) isn't secret and stays inline.

Verification

• Byte-identical POST body vs the old argv form — captured both with nc using a tricky password (p@ss w/ +&=é); both send username=uid-123&password=p%40ss+w%2F+%2B%26%3D%C3%A9. Auth behavior unchanged.
• shellcheck clean.
• The password reaches helm via the values file (only the non-secret clientId is --set on argv), so verify_credentials was the sole argv leak.
• Behavior-level bats tests (mock curl → http code) are unaffected.

Type

Security fix (CWE-214) · installer · HIGH.

---

Note

Low Risk
Small, localized security fix to the install script with the same POST semantics; manifest hash update only.

Overview
verify_credentials() no longer passes the client password as a curl command-line argument. The secret is piped from a printf '%s' builtin into --data-urlencode password@-, so it stays out of /proc/ps while the auth check runs (including retries). Client ID remains inline on the argv; HTTP status handling is unchanged.

scripts/manifest.sha256 is updated for the modified installer script.

^{Reviewed by Cursor Bugbot for commit 3627b3d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

Clean, well-scoped fix 👍 Verified the stdin form produces a byte-identical POST body, the || code=000 still catches curl failures, and the manifest is in sync (gen-manifest.sh --check passes). Confirmed verify_credentials was the only argv leak — Windows Test-Credentials already passes the password via Invoke-WebRequest -Body, so CWE-214 is closed on both paths.