composer: Don't dump sensitive fields from config

cmd/osbuild-composer/config.go

@@ -148,6 +148,8 @@ func loadConfigFromEnv(intf interface{}) error {
 	return nil
 }
 
-func DumpConfig(c *ComposerConfigFile, w io.Writer) error {
+func DumpConfig(c ComposerConfigFile, w io.Writer) error {
+	// sensor sensitive fields
+	c.Worker.PGPassword = ""
 	return toml.NewEncoder(w).Encode(c)
 }

cmd/osbuild-composer/config_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"os"
 	"testing"
 
@@ -94,3 +95,18 @@ func TestWeldrDistrosImageTypeDenyList(t *testing.T) {
 
 	require.Equal(t, expectedWeldrDistrosImageTypeDenyList, config.weldrDistrosImageTypeDenyList())
 }
+
+func TestDumpConfig(t *testing.T) {
+	config := &ComposerConfigFile{
+		Worker: WorkerAPIConfig{
+			PGPassword: "sensitive",
+		},
+	}
+
+	var buf bytes.Buffer
+	require.NoError(t, DumpConfig(*config, &buf))
+	require.Contains(t, buf.String(), "pg_password = \"\"")
+	require.NotContains(t, buf.String(), "sensitive")
+	// DumpConfig takes a copy
+	require.Equal(t, "sensitive", config.Worker.PGPassword)
+}

cmd/osbuild-composer/main.go

@@ -43,7 +43,7 @@ func main() {
 	}
 
 	logrus.Info("Loaded configuration:")
-	err = DumpConfig(config, logrus.StandardLogger().WriterLevel(logrus.InfoLevel))
+	err = DumpConfig(*config, logrus.StandardLogger().WriterLevel(logrus.InfoLevel))
 	if err != nil {
 		logrus.Fatalf("Error printing configuration: %v", err)
 	}