Avoid logging custom certificate secrets

functions/cluster_cert.py

@@ -51,6 +51,15 @@ UPLOAD_DOMAIN_FRAGMENT = '''\t\tconst certificate = await internalCertificate.up
 '''
 
 
+CUSTOM_CERT_LOG_ANCHOR = (
+    '\t\tlogger.info("Writing Custom Certificate:", certificate);'
+)
+
+CUSTOM_CERT_LOG_FRAGMENT = (
+    '\t\tlogger.info(`Writing Custom Certificate: Cert #${certificate.id}`);'
+)
+
+
 SCHEDULER_PROVIDER_ANCHOR = '.andWhere("provider", "letsencrypt")\n'
 
 SCHEDULER_FILTER_ANCHOR = "if (!certificates?.length) {"
@@ -306,6 +315,21 @@ def apply_certificate_js(source: str) -> str:
         )
         log("cluster_cert_upload_domains=added")
 
+    if CUSTOM_CERT_LOG_FRAGMENT in source:
+        log("cluster_cert_safe_logging=already-present")
+    elif CUSTOM_CERT_LOG_ANCHOR in source:
+        source = replace_exactly_once(
+            source,
+            CUSTOM_CERT_LOG_ANCHOR,
+            CUSTOM_CERT_LOG_FRAGMENT,
+            description="custom certificate safe logging",
+        )
+        log("cluster_cert_safe_logging=added")
+    else:
+        raise RuntimeError(
+            "Could not find native or patched custom certificate logging anchor"
+        )
+
     if SCHEDULER_PROVIDER_ANCHOR in source:
         source = replace_exactly_once(
             source,
@@ -369,6 +393,17 @@ def apply_certificate_js(source: str) -> str:
     return source
 
 def verify_certificate_js(source: str) -> None:
+    require_fragment(
+        source,
+        CUSTOM_CERT_LOG_FRAGMENT,
+        description="safe custom certificate logging",
+    )
+
+    if CUSTOM_CERT_LOG_ANCHOR in source:
+        raise RuntimeError(
+            "Sensitive custom certificate object logging is still present"
+        )
+
     require_fragment(
         source,
         UPLOAD_DOMAIN_FRAGMENT,
@@ -441,6 +476,7 @@ def verify_certificate_js(source: str) -> None:
         description="cluster certificate database rollback verification",
     )
 
+    log("cluster_cert_safe_logging_verification=passed")
     log("cluster_cert_upload_domains_verification=passed")
     log("cluster_cert_scheduler_verification=passed")
     log("cluster_cert_renew_helper_verification=passed")