merge with develop (0.9.1)

nheeb · nheeb · commit 90c58fe62670 · 2026-01-13T12:50:38.000+01:00
diff --git a/.flake8 b/.flake8
@@ -5,3 +5,5 @@
 [flake8]
 max-complexity = 15
 max-line-length = 120
+per-file-ignores =
+    src/hermes/commands/marketplace.py:E231
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.10"
+        python-version: "3.12"
     - name: Install pypa/build
       run: >-
         python3 -m
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10"]  # Ignore Python < 3.10, they are unsupported
+        python-version: ["3.12"]  # Ignore Python < 3.11, they are unsupported
 
     steps:
       - uses: actions/checkout@v4
@@ -26,11 +26,9 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip poetry
-          poetry install
+          poetry install --with dev
       - name: Lint with flake8
         run: |
-          # stop the build if there are Python syntax errors or undefined names
-          poetry run flake8 ./test/ ./src/ --count --select=E9,F63,F7,F82 --show-source --statistics
           # Stop build on errors
           poetry run flake8 ./test/ ./src/ --count --statistics
       - name: Test with pytest
diff --git a/.readthedocs.yaml b/.readthedocs.yaml
@@ -7,7 +7,7 @@ version: 2
 build:
   os: ubuntu-20.04
   tools:
-    python: "3.10"
+    python: "3.12"
   jobs:
     post_create_environment:
       # Install poetry
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,7 +11,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project tries to adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.9.1] - 2026-01-12
 
 ### Added
 
@@ -31,6 +31,10 @@ and this project tries to adhere to [Semantic Versioning](https://semver.org/spe
 
 - Update poetry to more recent version. (#347)
 
+### Security
+
+- Patch raw logging of '-O' values that could have included arbitrary secrets. (https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23)
+
 ## [0.9.0] - 2025-02-26
 
 ### Added
diff --git a/CITATION.cff b/CITATION.cff
@@ -14,7 +14,7 @@ title: hermes
 message: >-
   If you use this software, please cite it using the
   metadata from this file.
-version: 0.9.0
+version: 0.9.1
 license: "Apache-2.0"
 abstract: "Tool to automate software publication. Not stable yet."
 type: software
diff --git a/docs/adr/0002-use-a-common-data-model.md b/docs/adr/0002-use-a-common-data-model.md
@@ -20,7 +20,7 @@ We need a data model that's
 to exchange data between modules.
 
 The chosen option determines the serialization of the data model, too.
-See also [ADR 11](./0011-record-provenance-of-metadata.md) about provenance records in the data model.
+See also [ADR 11](./0011-record-provenance-of-metadata) about provenance records in the data model.
 
 ## Considered Options
 
diff --git a/docs/adr/0003-define-interfaces-for-inter-module-data-exchange.md b/docs/adr/0003-define-interfaces-for-inter-module-data-exchange.md
@@ -14,7 +14,7 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 This depends on the data model (ADR 0002).
 Do we have to expose different parts of the data model structure at different points in the workflow?
 
-Superseded: decisions in [ADR 2](./0002-use-a-common-data-model.md) (use JSON-LD) and [ADR 11](./0011-record-provenance-of-metadata.md)  (create a unified data model of metadata and provenance) will result in a context [DAO](https://en.wikipedia.org/wiki/Data_access_object) from beginning till end of a run.
+Superseded: decisions in [ADR 2](./0002-use-a-common-data-model) (use JSON-LD) and [ADR 11](./0011-record-provenance-of-metadata)  (create a unified data model of metadata and provenance) will result in a context [DAO](https://en.wikipedia.org/wiki/Data_access_object) from beginning till end of a run.
 
 ## Decision Drivers
 
diff --git a/docs/source/conf.py b/docs/source/conf.py
@@ -128,9 +128,10 @@ def read_version_from_pyproject():
 
 # Sphinx API docs configuration, see https://sphinx-autoapi.readthedocs.io/en/latest/reference/config.html
 autoapi_type = "python"
-autoapi_dirs = ["../../src"]
+autoapi_file_patterns = ["*.py"]
 autoapi_root = "api"
-autoapi_ignore = ["*__main__*"]
+autoapi_dirs = ["../../src"]
+autoapi_ignore = ["*/__main__.py"]
 
 # -- Options for HTML output -------------------------------------------------
 
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -8,7 +8,7 @@
 
 [project]
 name = "hermes"
-version = "0.10.0.dev1"
+version = "0.10.0.dev0"
 description = "Workflow to publish research software with rich metadata"
 license = "Apache-2.0 AND LicenseRef-BSD-Caltech"
 authors = [
@@ -38,11 +38,10 @@ dependencies = [
     "pydantic>=2.5.1, <3.0.0",
     "pydantic-settings>=2.1.0, <3.0.0",
     "requests-oauthlib>=2.0.0, <3.0.0",
-    "pynacl>=1.5.0, <2.0.0",
+    "pynacl>=1.6.2, <2.0.0",
     "jinja2 (>=3.1.6,<4.0.0)",
-    "easydataverse>=0.4.4, <0.5.0",
 ]
-requires-python = ">=3.10, <4.0.0"
+requires-python = ">=3.11, <4.0.0"
 
 [project.urls]
 homepage = "https://hermes.software-metadata.pub"
@@ -70,6 +69,9 @@ config_invenio_record_id = "hermes.commands.postprocess.invenio:config_record_id
 config_invenio_rdm_record_id = "hermes.commands.postprocess.invenio_rdm:config_record_id"
 cff_doi = "hermes.commands.postprocess.invenio:cff_doi"
 
+[tool.poetry.dependencies]
+python = ">=3.11,<4.0.0"
+
 [tool.poetry.group.dev.dependencies]
 pytest = "^7.1.1"
 pytest-cov = "^3.0.0"
@@ -82,22 +84,23 @@ requests-mock = "^1.10.0"
 optional = true
 
 [tool.poetry.group.docs.dependencies]
-Sphinx = "^6.2.1"
+Sphinx = "~=8.2"
 # Sphinx - Additional modules
-myst-parser = "^2.0.0"
-sphinx-book-theme = "^1.0.1"
-sphinx-favicon = "^0.2"
-sphinxcontrib-contentui = "^0.2.5"
-sphinxcontrib-images = "^0.9.4"
-sphinx-icon = "^0.1.2"
-sphinx-autobuild = "^2021.3.14"
-sphinx-autoapi = "^3.0.0"
-sphinxemoji = "^0.2.0"
-sphinxext-opengraph = "^0.6.3"
-sphinxcontrib-mermaid="^0.8.1"
-sphinx-togglebutton="^0.3.2"
+myst-parser = "~=4.0"
+sphinx-book-theme = "~=1.1"
+sphinx-favicon = "~=0.2"
+sphinxcontrib-contentui = "~=0.2"
+sphinxcontrib-images = "~=1.0"
+sphinx-icon = "~=0.1"
+sphinx-autobuild = "2021.3.14"
+sphinx-autoapi = "~=3.6"
+sphinxemoji = "~=0.2"
+sphinxext-opengraph = "~=0.6"
+sphinxcontrib-mermaid="~=0.8"
+sphinx-togglebutton="~=0.3.2"
 reuse = "^1.1.2"
-sphinxcontrib-datatemplates = "^0.11.0"
+sphinxcontrib-datatemplates = "~=0.11"
+
 
 [tool.taskipy.tasks]
 docs-build = "poetry run sphinx-build -M html docs/source docs/build -W"
diff --git a/src/hermes/commands/cli.py b/src/hermes/commands/cli.py
@@ -16,6 +16,7 @@
                              HermesHarvestCommand, HermesProcessCommand, HermesCurateCommand,
                              HermesDepositCommand, HermesPostprocessCommand, HermesInitCommand)
 from hermes.commands.base import HermesCommand
+from hermes.utils import mask_options_values
 
 
 def main() -> None:
@@ -63,7 +64,7 @@ def main() -> None:
 
     logger.init_logging()
     log = logger.getLogger("hermes.cli")
-    log.debug("Running hermes with the following command line arguments: %s", args)
+    log.debug("Running hermes with the following command line arguments: %s", mask_options_values(args))
 
     try:
         log.debug("Loading settings...")
diff --git a/src/hermes/commands/deposit/invenio.py b/src/hermes/commands/deposit/invenio.py
@@ -152,7 +152,7 @@ def resolve_doi(self, doi) -> str:
         :return: The record ID on the respective instance.
         """
 
-        res = self.client.get(f'https://doi.org/{doi}')
+        res = self.client.get(f'https://doi.org/{doi}')  # noqa E231
 
         # This is a mean hack due to DataCite answering a 404 with a 200 status
         if res.url == 'https://datacite.org/404.html':
diff --git a/src/hermes/commands/harvest/cff.py b/src/hermes/commands/harvest/cff.py
@@ -80,7 +80,7 @@ def _convert_cff_to_codemeta(self, cff_data: str) -> t.Any:
     def _validate(self, cff_file: pathlib.Path, cff_dict: t.Dict) -> bool:
         audit_log = logging.getLogger('audit.cff')
 
-        cff_schema_url = f'https://citation-file-format.github.io/{_CFF_VERSION}/schema.json'
+        cff_schema_url = f'https://citation-file-format.github.io/{_CFF_VERSION}/schema.json'  # noqa E231
 
         # TODO: we should ship the schema we reference to by default to avoid unnecessary network traffic.
         #       If the requested version is not already downloaded, go ahead and download it.
@@ -101,7 +101,7 @@ def _validate(self, cff_file: pathlib.Path, cff_dict: t.Dict) -> bool:
             audit_log.info('')
             audit_log.info('See the Citation File Format schema guide for further details:')
             audit_log.info(
-                f'<https://github.com/citation-file-format/citation-file-format/blob/{_CFF_VERSION}/schema-guide.md>.')
+                f'<https://github.com/citation-file-format/citation-file-format/blob/{_CFF_VERSION}/schema-guide.md>.')  # noqa E231
             return False
 
         elif len(errors) == 0:
diff --git a/src/hermes/commands/init/base.py b/src/hermes/commands/init/base.py
@@ -130,7 +130,7 @@ def get_git_hoster_from_url(url: str) -> GitHoster:
     Returns the matching GitHoster value to the given url. Returns GitHoster.Empty if none is found.
     """
     parsed_url = urlparse(url)
-    git_base_url = f"{parsed_url.scheme}://{parsed_url.netloc}/"
+    git_base_url = f"{parsed_url.scheme}://{parsed_url.netloc}/"  # noqa E231
     if "github.com" in url:
         return GitHoster.GitHub
     elif connect_gitlab.is_url_gitlab(git_base_url):
diff --git a/src/hermes/commands/init/util/connect_github.py b/src/hermes/commands/init/util/connect_github.py
@@ -49,7 +49,7 @@ def allow_actions(project_url: str, token):
     repo_name = url_split[-1]
 
     # GitHub API URLs
-    repo_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}"
+    repo_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}"  # noqa E231
     action_permissions_url = f"{repo_url}/actions/permissions/workflow"
 
     # Headers for GitHub API requests
@@ -89,7 +89,7 @@ def create_secret(project_url: str, secret_name: str, secret_value, token):
     repo_name = url_split[-1]
 
     # GitHub API URLs
-    repo_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}"
+    repo_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}"  # noqa E231
     public_key_url = f"{repo_url}/actions/secrets/public-key"
     secrets_url = f"{repo_url}/actions/secrets/{secret_name}"
 
diff --git a/src/hermes/commands/init/util/connect_gitlab.py b/src/hermes/commands/init/util/connect_gitlab.py
@@ -16,7 +16,7 @@
 
 site_specific_oauth_clients = [
     {
-        "url": "https://gitlab.com/",
+        "url": "https://gitlab.com/",  # noqa E231
         "client_id": "1133e9cee188c31bd68c9d0e8531774a4aae9d2458e13d83e67991213f868007",
         "name_addition": "gitlab.com"
     }, {
@@ -33,14 +33,14 @@
 
 def is_url_gitlab(url: str) -> bool:
     parsed_url = urlparse(url)
-    return requests.get(f"{parsed_url.scheme}://{parsed_url.netloc}/api/v4/version").status_code == 401
+    return requests.get(f"{parsed_url.scheme}://{parsed_url.netloc}/api/v4/version").status_code == 401  # noqa E231
 
 
 class GitLabConnection:
     def __init__(self, project_url: str):
         self.project_url: str = project_url
         parsed_url = urlparse(project_url)
-        self.base_url: str = f"{parsed_url.scheme}://{parsed_url.netloc}/"
+        self.base_url: str = f"{parsed_url.scheme}://{parsed_url.netloc}/"  # noqa E231
         self.api_url: str = urljoin(self.base_url, "api/v4/")
         self.project_namespace_name: str = parsed_url.path.removeprefix("/")
         self.gitlab_instance_name: str = f"GitLab ({parsed_url.netloc})"
diff --git a/src/hermes/commands/init/util/oauth_process.py b/src/hermes/commands/init/util/oauth_process.py
@@ -93,7 +93,7 @@ def open_browser(self, port: int = None) -> bool:
         if DEACTIVATE_BROWSER_OPENING:
             return False
         port = port or self.local_port
-        return webbrowser.open(f'http://localhost:{port}')
+        return webbrowser.open(f'http://localhost:{port}')  # noqa E231
 
     def get_tokens_from_refresh_token(self, refresh_token: str) -> dict[str: str]:
         """Returns access and refresh token as dict using a refresh token"""
diff --git a/src/hermes/commands/init/util/slim_click.py b/src/hermes/commands/init/util/slim_click.py
@@ -137,9 +137,9 @@ def choose(text: str, options: list[str], default: int = 0) -> int:
     assert 0 <= default < len(options), "Default index should match the options list."
     echo(text)
     for i, option in enumerate(options):
-        index = f"{i:>2d}"
+        index = f"{i:>2d}"  # noqa E231
         if i == default:
-            index = f"*{i:>1d}"
+            index = f"*{i:>1d}"  # noqa E231
         print(f"[{index}] {option}")
     while True:
         chosen_index = -1
@@ -171,7 +171,7 @@ def next_step(description: str):
 def create_console_hyperlink(url: str, word: str) -> str:
     """Use this to have a consistent display of hyperlinks."""
     if USE_FANCY_HYPERLINKS:
-        return f"\033]8;;{url}\033\\{word}\033]8;;\033\\"
+        return f"\033]8;;{url}\033\\{word}\033]8;;\033\\"    # noqa E231,E702
     return f"{word} ({url})"
 
 
diff --git a/src/hermes/commands/postprocess/invenio.py b/src/hermes/commands/postprocess/invenio.py
@@ -34,8 +34,9 @@ def cff_doi(ctx):
     try:
         cff = yaml.load(open('CITATION.cff', 'r'), yaml.Loader)
         new_identifier = {
-                'description': f"DOI for the published version {deposition['metadata']['version']} "
-                               f"[generated by hermes]",
+                'description': "DOI for the published version "
+                f"{deposition['metadata']['version']} "
+                "[generated by hermes]",
                 'type': 'doi',
                 'value': deposition['doi']
             }
diff --git a/src/hermes/utils.py b/src/hermes/utils.py
@@ -8,6 +8,7 @@
 from importlib.metadata import metadata
 from mimetypes import guess_type
 from pathlib import Path
+import argparse
 
 
 def retrieve_project_urls(metadata_urls: list[str]) -> dict[str, str]:
@@ -81,3 +82,26 @@ def guess_file_type(path: Path):
 
     # use non-strict mode to cover more file types
     return guess_type(path, strict=False)
+
+
+def mask_options_values(args: argparse.Namespace) -> argparse.Namespace:
+    """Masks potentially sensitive values in the 'options' argument
+    in the passed argparse.Namespace.
+
+    The main use case for this is preventing potentially sensitive
+    data/secrets being included in raw args logging.
+
+    :param args: The argparse.Namespace to mask.
+    :return: A copy of the namespace with masked sensitive values.
+    """
+    import copy
+
+    masked_args = copy.copy(args)
+
+    # Mask the values for 'options' if they exist
+    if hasattr(masked_args, "options") and masked_args.options:
+        masked_args.options = [
+            (key, "***REDACTED***") for key, value in masked_args.options
+        ]
+
+    return masked_args
diff --git a/test/hermes_test/test_utils.py b/test/hermes_test/test_utils.py
@@ -5,6 +5,7 @@
 
 import toml
 from pathlib import Path
+from argparse import Namespace
 
 pyproject = toml.load(Path(__file__).parent.parent.parent / "pyproject.toml")
 expected_name = pyproject["project"]["name"]
@@ -22,3 +23,12 @@ def test_hermes_user_agent():
     assert (
         hermes_user_agent == f"{expected_name}/{expected_version} ({expected_homepage})"
     )
+
+
+def test_mask_values_options():
+    from hermes.utils import mask_options_values
+    ns = Namespace(foo="bar", options=[("foo", "bar"), ("bar", "foo")])
+    assert mask_options_values(ns) == Namespace(
+        foo="bar",
+        options=[("foo", "***REDACTED***"), ("bar", "***REDACTED***")]
+    )
