[rpms/fedora-packager] epel10.2: fkinit: prompt for password and OTP separately

[rpms/fedora-packager] epel10.2: fkinit: prompt for password and OTP separately

[Stephen Gallagher]

            A new commit has been pushed.

            Repo   : rpms/fedora-packager
            Branch : epel10.2
            Commit : ec95d50e99dbf79211a986f58a24749ed1cb004f
            Author : Stephen Gallagher <sgallagh@redhat.com>
            Date   : 2024-08-09T11:33:56-04:00
            Stats  : +11/-2 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/fedora-packager/c/ec95d50e99dbf79211a986f58a24749ed1cb004f?branch=epel10.2

            Log:
            fkinit: prompt for password and OTP separately

Also runs 'klist' afterwards to confirm success.

This adds an explicit dependency on 'systemd' for the use of the
systemd-ask-password command. As that package was already an indirect
dependency, this doesn't increase the footprint.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

Originally submitted and reviewed in
https://pagure.io/fedora-packager/pull-request/179.

---
diff --git a/fedora-packager.spec b/fedora-packager.spec
index ee24915..24b1fce 100644
--- a/fedora-packager.spec
+++ b/fedora-packager.spec
@@ -29,6 +29,7 @@ Requires:       rpmautospec
 Requires:       mock curl openssh-clients
 Requires:       redhat-rpm-config
 Requires:       fedpkg >= 1.0
+Requires:       systemd
 Obsoletes:      fedora-cert < 0.6.0.3-4
 Obsoletes:      fedora-packager-yubikey < 0.6.0.7-3
 Recommends:     fedora-packager-kerberos

diff --git a/fkinit b/fkinit
index 3e09dbc..4ec0766 100755
--- a/fkinit
+++ b/fkinit
@@ -103,8 +103,16 @@ fi
 
 kinit -n @$domain -c FILE:$armorcache
 
-echo "Enter your password and OTP concatenated. (Ignore that the prompt is for only the token)"
-kinit -T FILE:$armorcache $_arg_user@$domain
+F_PASSWORD=$(systemd-ask-password "FAS password:")
+F_OTP=$(systemd-ask-password "FAS OTP (leave blank if not configured):")
+
+echo -n ${F_PASSWORD}${F_OTP} | kinit -T FILE:$armorcache $_arg_user@$domain >/dev/null
+unset F_PASSWORD
+unset F_OTP
+
+# Display the active credential cache overview
+echo
+klist
 
 
 # ^^^  TERMINATE YOUR CODE BEFORE THE BOTTOM ARGBASH MARKER  ^^^