From 7d07872b00b811dfb36d755d30bda9df221d6f11 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Apr 11 2024 15:02:27 +0000
Subject: fkinit: Prompt for password and OTP separately


Also runs `klist` afterwards to confirm success.

This adds an explicit dependency on `systemd` for the use of the
systemd-ask-password command. As that package was already an indirect
dependency, this doesn't increase the footprint.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

---

diff --git a/fedora-packager.spec b/fedora-packager.spec
index fc476ab..f1f6f49 100644
--- a/fedora-packager.spec
+++ b/fedora-packager.spec
@@ -20,6 +20,7 @@ Requires:       rpm-build rpmdevtools rpmlint
 Requires:       mock curl openssh-clients
 Requires:       redhat-rpm-config
 Requires:       fedpkg >= 1.0
+Requires:       systemd
 Obsoletes:      fedora-cert < 0.6.0.3-4
 Recommends:     fedora-packager-yubikey
 Recommends:     fedora-packager-kerberos
diff --git a/src/fkinit b/src/fkinit
index 3e09dbc..4ec0766 100755
--- a/src/fkinit
+++ b/src/fkinit
@@ -103,8 +103,16 @@ fi
 
 kinit -n @$domain -c FILE:$armorcache
 
-echo "Enter your password and OTP concatenated. (Ignore that the prompt is for only the token)"
-kinit -T FILE:$armorcache $_arg_user@$domain
+F_PASSWORD=$(systemd-ask-password "FAS password:")
+F_OTP=$(systemd-ask-password "FAS OTP (leave blank if not configured):")
+
+echo -n ${F_PASSWORD}${F_OTP} | kinit -T FILE:$armorcache $_arg_user@$domain >/dev/null
+unset F_PASSWORD
+unset F_OTP
+
+# Display the active credential cache overview
+echo
+klist
 
 
 # ^^^  TERMINATE YOUR CODE BEFORE THE BOTTOM ARGBASH MARKER  ^^^