Remove username and password in remote url for cache directory name

[bond-os]

Currently, module remote url has some characters replaced to with - so it can be used as cache directory name on disk. However, when Puppetfile has module urls with authentication data in format of protocol://username:password@host, password will be leaked in cache directory name.

I've added replace action for username or username and password parts for the cache directory to avoid leaking credentials on filesystem. Using regex as some popular urls from eg. gitlab are not parsable with URI.parse.

- (JIRA ticket) Remove username and password from remote url for cache directory name. [Issue or PR #](link to issue or PR)

[CLAassistant]

All committers have signed the CLA.

[mwaggett]

hey @bond-os thanks for this contribution!

Would you mind updating the CHANGELOG to include this change?

Also, have you done any manual testing of this?

[mwaggett]

Also, would you mind updating your commit message to include the details you included in the PR description? thanks!

[bond-os]

@mwaggett yes, tested locally with simple puppetfile and private repo:

mod 'test',
    :git => 'https://'+ENV['git_username']+':'+ENV['git_password']+'@github.com/bond-os/r10k-test.git',
    :branch => 'main'

git_username=bond-os git_password="ghp_xxx" bundle exec r10k puppetfile install -v -t
INFO	 -> Using Puppetfile '/Users/bernard/Documents/GitHub/r10k/Puppetfile'
INFO	 -> Deploying module to /Users/bernard/Documents/GitHub/r10k/modules/test

and cache dir on fs is:

-> % ll ~/.r10k/git/
total 0
drwxr-xr-x  10 bernard  staff  320 Jul 14 18:32 https---github.com-bond-os-r10k-test.git

[mwaggett]

Looks good!