chore: not display privatekey

[beck-8]

Related Issues

Let the user's private key no longer be displayed in the terminal to prevent malicious monitoring of the screen and stealing the private key.

Proposed Changes

$ ./lotus wallet import
Enter private key(not display in the terminal): 
imported key f1xxxxxxx successfully!

$ ./lotus wallet import
Enter private key(not display in the terminal): 
ERROR: saving to keystore: checking key before put 'wallet-f1xxxxxxx': key already exists

$ echo 7bxxxxxxx | ./lotus wallet import
imported key f1xxxxxxx successfully!

$ echo 7bxxxxxxx | ./lotus wallet import
ERROR: saving to keystore: checking key before put 'wallet-f1xxxxxxx': key already exists

Additional Info

Checklist

Before you mark the PR ready for review, please make sure that:

• Commits have a clear commit message.
• PR title is in the form of of <PR type>: <area>: <change being made>
  • example: fix: mempool: Introduce a cache for valid signatures
  • PR type: fix, feat, build, chore, ci, docs, perf, refactor, revert, style, test
  • area, e.g. api, chain, state, market, mempool, multisig, networking, paych, proving, sealing, wallet, deps
• New features have usage guidelines and / or documentation updates in
  • Lotus Documentation
  • Discussion Tutorials
• Tests exist for new functionality or change in behavior
• CI is green

[Stebalien]

Seems reasonable to me but could you switch to https://pkg.go.dev/golang.org/x/term? The library you're using is deprecated.

[Stebalien]

Ah, wait. So, it looks like this code is designed for reading the key from stdin, not from a user typing it.

[Stebalien]

Hm... although it still prompts.... Ok, I think the right answer is:

1. Check IsTerminal.
2. If it's a terminal, read it as a password (letting the user type it).
3. Otherwise, just read it from stdin.

[beck-8]

Seems reasonable to me but could you switch to https://pkg.go.dev/golang.org/x/term? The library you're using is deprecated.

this is ok

[beck-8]

Hm... although it still prompts.... Ok, I think the right answer is:

1. Check IsTerminal.
2. If it's a terminal, read it as a password (letting the user type it).
3. Otherwise, just read it from stdin.

I just want to hide the private key display in the original logic, and the terminal's judgment already exists.I try my best to keep the original logic unchanged, so as to prevent some people's scripts from failing.

[Stebalien]

Are you sure this works when stdin is a pipe, not a terminal? That's why I suggested calling IsTerminal first.

[beck-8]

Are you sure this works when stdin is a pipe, not a terminal? That's why I suggested calling IsTerminal first.

I see what you mean, thank you very much.

[beck-8]

forgive me for using force-push, I just want to make the commit cleaner

[Stebalien]

LGTM!