Hiding credentials in Pip class does not hide the credentials in the gradle process.exec() logs

[insi-eb]

While the default log cleaning removes the credentials from the log of the python command line, the gradle process.exec() log in the line after the cleaned log shows the credentials without any hiding.

[python] python3 -m pip list --format=columns --user --extra-index-url https://insi-eb:*****@...
Starting process 'command 'python3''. Working directory: /workspaces/platform Command: python3 -m pip list --format=columns --user --extra-index-url https://insi-eb:<myToken>@...

I guess the only way to really hide credentials also there would be to set a filtering OutputStream on the GradleEnvironment::exec() call.

[xvik]

First of all, this log appears only when gradle --info logs enabled, which is not the case by default (it only used for local debugging).

Also, this is a pure log, not a process output:

    @Override
    public ExecHandle start() {
        LOGGER.info("Starting process '{}'. Working directory: {} Command: {} {}",
                displayName, directory, command, ARGUMENT_JOINER.join(arguments));

And it would be hard to filter it.

Gradle team position: info logs for process exec should show actual command arguments ... if you use passwords openly it's your problem.

So I doubt I can fix it directly.

But I found a workaround: pip supports PIP_EXTRA_INDEX_URL environment variable, so we can declare extra url as:

python {
        environment('PIP_EXTRA_INDEX_URL', 'http://user:pass@extra-url.com')
}

(multiple urls could be declared with a space 'url1 url2')

Please try, it should help.