Thanks.

One thing I don't like is that the environment variable is unnecessarily concise. That's why I went with FKINIT_OPT in my PR. It makes it clear that the variable is related to the fkinit program.

Oops, I didn't actually even realize that was a PR; I thought it was an issue and missed the patch entirely. I'll review it over there.

Updated with @churchyard 's changes and some documentation added to --help.

... And now also a fix to escape the $ in the help text so it actually prints the string $FKINIT_OTP.

I believe the if should not be here. What happens if the environment variable is set?

I believe the if should not be here. What happens if the environment variable is set?

Huh... I could have sworn I deleted that. You're right, that's superfluous. Fixed.

Now that the actual change is identical to mine, would you consider actually cherry-picking my commit which includes quite an extensive commit message, and amending your help changes on top?

Or I can do that instead in my PR.

Well, there's still a difference in the help message, but yeah; I can split that to a separate commit and pull your original.

OK, I've pulled your original patch and commit message into this set.

Thank you. Looks good to me.

Errm. Isn't passing of secrets via environment variable considered a bad and insecure practice? I mean, it can be read from /proc/PID by any process of the user or superuser. I think in general piping secrets into the destination is a better variant. I mean, openssh-askpass prints password always to stdout.

It seems to me passing the command to run to get the password would be generally better variant.

I mean, OTP pin is not hard secret, but still it is a part of access passphrase, right?

I mean, OTP pin is not hard secret, but still it is a part of access passphrase, right?

I considered that, but the attack surface is miniscule; while a race does exist where someone might be able to use the OTP before it is passed to kinit, it's an extremely small window. I suppose we could add an admonition against using that feature on a multi-user system to the help text, but the convenience of it to be able to extract the TOTP from a wallet or ykman is high enough to risk the race on a single-user system, I think.

If you're concerned about the race, just use the systemd-ask-password interface.