Display secret to user in inspect

[rhatdan]

It is pretty complicated to display the secret on the host, but is not really secured. This patch makes it easier to examine the secret.

Partial fix for #18667

Does this PR introduce a user-facing change?

podman secret inspect has a new options --showsecret which will output the actual secret.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

@ashley-cui PTAL

[ashley-cui]

Again, this is nitpicky on naming, but I feel like there could be a better name - perhaps --show-data or --display-data? I don't think --display is descriptive enough as a flag for something as revealing as dumping the actual contents of the secret, and doesn't make sense for API calls

Otherwise, implementation and code LGTM

[rhatdan]

Not a big fan of options with "-" embeded.

How about

--expose
--reveal
--decrypt
--decode

[rhatdan]

@umohnani8 @vrothberg @Luap99 @wdyt?

[kriansa]

--reveal is a clearer option IMHO.

[vrothberg]

Code LGTM but I have absolutely no feeling for the naming.

I think that @TomSweeneyRedHat and @edsantiago have good nose for such things.

[edsantiago]

I've been lurking here, mulling it over in the background, and my medium preference is for --expose.

Reason: that is (to me) the scariest-sounding name. It triggers a strong visceral response, my fingers don't even want to type it. Before I type such a command I would spend time reading the man page and help output. Or I might decide not to do it at all. And I think that, for a risky option like this one, that is a desirable reaction.

[Luap99]

--expose is already used by podman run and means something completely different, it exposes ports. I don't like having options with the same name but different meaning for commands.

I would prefer something that I can understand without reading the man page, i.e. --show-data as suggest by @ashley-cui

[rhatdan]

We seem to be painting a shed....
I don't see how --show-data (My lack of liking options with "-" in them.) is better then the ones I suggested (--reveal or --decrypt) would be ones I like.

Since the secret is actually just base64 encoded running with --decode might be the best logically.

[kriansa]

Since the secret is actually just base64 encoded running with --decode might be the best logically.

That's a detail of implementation for the built-in file driver. In the future when we have other and possibly remote secret drivers, that would not be so logical.

[vrothberg]

I agree. A --decrypt may be more accurate for others.

I think it's good practice to highlight the "don't try this at home" aspect of the flag. It's not a secret anymore once it's out :^)

[Luap99]

But doesn't --decrypt imply that secrets are encrypted? In reality they are not (at least today).

[rhatdan]

Went with --showsecret

[ashley-cui]

LGTM

[TomSweeneyRedHat]

LGTM, and I like showsecret too.

[vrothberg]

Another reminder to stick to the 2 LGTM rule (and not merging our own PRs). Rushing new features in is risky, especially so close to a new release.