Replace use of github.com/howeyc/gopass with with x/crypto/ssh/terminal

[jas4711]

Hi! I help maintain this package for Debian. There is a dependency on deprecated and not maintained package https://github.com/howeyc/gopass which suggests to use more standard https://pkg.go.dev/golang.org/x/crypto/ssh/terminal instead -- would you consider this?

It seems to only be used from here: https://github.com/sassoftware/relic/blob/master/lib/passprompt/passprompt.go

/Simon

[semioticrobotic]

Thanks, @jas4711, for checking on this (and for maintaining the Debian package!). Let me tag the @sassoftware/conary team to see what those folks have to say.

[siretart]

the code seems very straight-forward to update. Something like this should do:

diff --git a/lib/passprompt/passprompt.go b/lib/passprompt/passprompt.go
index 8c3af13..7912800 100644
--- a/lib/passprompt/passprompt.go
+++ b/lib/passprompt/passprompt.go
@@ -20,7 +20,7 @@ import (
        "io"
        "os"
 
-       "github.com/howeyc/gopass"
+       "golang.org/x/term"
 )
 
 // Interface for some means of getting a password from the user (or another source)
@@ -34,12 +34,16 @@ type PasswordGetter interface {
 type PasswordPrompt struct{}
 
 func (PasswordPrompt) GetPasswd(prompt string) (string, error) {
-       passwd, err := gopass.GetPasswdPrompt(prompt, true, os.Stdin, os.Stderr)
+       if _, err := io.WriteString(os.Stderr, prompt); err != nil {
+               return "", err
+       }
+
+       passwd, err := term.ReadPassword(int(os.Stdin.Fd()))
+       _, _ = io.WriteString(os.Stderr, "\n")
        if err == io.EOF {
                return "", nil
        } else if err != nil {
                return "", err
-       } else {
-               return string(passwd), nil
        }
+       return string(passwd), nil
 }

(I don't claim copyright on the above, feel free to consider this public domain or Apache 2.0 license).

[jas4711]

The Debian package now uses the patch above, and it seems to work