From cdf70c51f4d8de376fb09dee5db50401531cdfd4 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 06:43:00 +0530 Subject: [PATCH 1/5] LTS-5452: README step to set credentials as env vars Export BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY in the shell and never commit them; the CLI reads them from the environment. Co-Authored-By: Claude Opus 5.5 --- README.md | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5bd6ecf..ea6d066 100644 --- a/README.md +++ b/README.md @@ -65,13 +65,31 @@ If the check fails, do not run the binary. -6. **Run tests using BrowserStack CLI** +6. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + + ```sh + # macOS / Linux + export BROWSERSTACK_USERNAME="" + export BROWSERSTACK_ACCESS_KEY="" + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + $env:BROWSERSTACK_ACCESS_KEY = "" + ``` + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +7. **Run tests using BrowserStack CLI** ```sh ./browserstack-cli load run ``` -7. **View Test Results** +8. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. From cd07379220331b6bd776f8f252a12919675ba97b Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:13:24 +0530 Subject: [PATCH 2/5] LTS-5452: address review on the credentials step Hidden prompt for the access key so it stays out of bash/zsh and PSReadLine history (CodeRabbit); note the variables last for the current session and how to spot an unset one; per-repo fixes from the code review. Co-Authored-By: Claude Opus 5.5 --- README.md | 17 ++++++++++++++--- java/README.md | 33 +++++++++++++++++++++++++++++++-- jest/README.md | 33 +++++++++++++++++++++++++++++++-- junit-4/README.md | 33 +++++++++++++++++++++++++++++++-- junit-5/README.md | 33 +++++++++++++++++++++++++++++++-- serenity-cucumber/README.md | 33 +++++++++++++++++++++++++++++++-- testng/README.md | 33 +++++++++++++++++++++++++++++++-- 7 files changed, 200 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index ea6d066..b6ad1df 100644 --- a/README.md +++ b/README.md @@ -70,25 +70,36 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh - # macOS / Linux + # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - export BROWSERSTACK_ACCESS_KEY="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY ``` ```powershell # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - $env:BROWSERSTACK_ACCESS_KEY = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. 7. **Run tests using BrowserStack CLI** ```sh + # macOS / Linux ./browserstack-cli load run ``` + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + 8. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/java/README.md b/java/README.md index e43d16a..afcd2e2 100644 --- a/java/README.md +++ b/java/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/jest/README.md b/jest/README.md index 884e3ec..61e01c8 100644 --- a/jest/README.md +++ b/jest/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/junit-4/README.md b/junit-4/README.md index 6197b0e..c01b848 100644 --- a/junit-4/README.md +++ b/junit-4/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/junit-5/README.md b/junit-5/README.md index aa2d171..cab987d 100644 --- a/junit-5/README.md +++ b/junit-5/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/serenity-cucumber/README.md b/serenity-cucumber/README.md index 2f99d77..8769cf9 100644 --- a/serenity-cucumber/README.md +++ b/serenity-cucumber/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. diff --git a/testng/README.md b/testng/README.md index e640f62..16bddb6 100644 --- a/testng/README.md +++ b/testng/README.md @@ -59,13 +59,42 @@ If the check fails, do not run the binary. -5. **Run tests using BrowserStack CLI** +5. **Set your credentials** + + The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh + # macOS / Linux (bash or zsh) + export BROWSERSTACK_USERNAME="" + # Type the key at the prompt: it is not echoed, and it stays out of your shell history + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo + export BROWSERSTACK_ACCESS_KEY + ``` + + ```powershell + # Windows (PowerShell) + $env:BROWSERSTACK_USERNAME = "" + # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history + $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password + ``` + + These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + + **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings. + +6. **Run tests using BrowserStack CLI** + + ```sh + # macOS / Linux ./browserstack-cli load run ``` -6. **View Test Results** + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + +7. **View Test Results** Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs. From 0991e862ffa907fb72e9d01bb0a45f3bd2079c52 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:32:19 +0530 Subject: [PATCH 3/5] LTS-5452: one-line key prompt; review follow-ups Prompt and export on one line, so pasting the block can't feed the export line to read. Robot: per-OS signature check, .gitignore for the CLI binary. Selenium: ignore browserstack-cli.exe. Co-Authored-By: Claude Opus 5.5 --- .gitignore | 1 + README.md | 3 +-- java/README.md | 3 +-- jest/README.md | 3 +-- junit-4/README.md | 3 +-- junit-5/README.md | 3 +-- serenity-cucumber/README.md | 3 +-- testng/README.md | 3 +-- 8 files changed, 8 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 5a07883..a7f21da 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ **/target/ **/log **/browserstack-cli +**/browserstack-cli.exe **/.DS_Store **/node_modules/ **/yarn.lock diff --git a/README.md b/README.md index b6ad1df..17e495f 100644 --- a/README.md +++ b/README.md @@ -73,8 +73,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/java/README.md b/java/README.md index afcd2e2..f82e77d 100644 --- a/java/README.md +++ b/java/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/jest/README.md b/jest/README.md index 61e01c8..283dd4d 100644 --- a/jest/README.md +++ b/jest/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/junit-4/README.md b/junit-4/README.md index c01b848..a590591 100644 --- a/junit-4/README.md +++ b/junit-4/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/junit-5/README.md b/junit-5/README.md index cab987d..e07f508 100644 --- a/junit-5/README.md +++ b/junit-5/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/serenity-cucumber/README.md b/serenity-cucumber/README.md index 8769cf9..600a01f 100644 --- a/serenity-cucumber/README.md +++ b/serenity-cucumber/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell diff --git a/testng/README.md b/testng/README.md index 16bddb6..ec93630 100644 --- a/testng/README.md +++ b/testng/README.md @@ -67,8 +67,7 @@ # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history - printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo - export BROWSERSTACK_ACCESS_KEY + printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell From a9d5ff4020ad1c1a300f97d5887fa2a1a30b57d6 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:47:27 +0530 Subject: [PATCH 4/5] LTS-5452: shell labels in prose; .exe in the binary note zsh (macOS default) has interactive_comments off, so pasted '#' lines printed errors; the labels now sit outside the sh fences. The placement note names browserstack-cli.exe for Windows. Co-Authored-By: Claude Opus 5.5 --- README.md | 11 +++++------ java/README.md | 11 +++++------ jest/README.md | 11 +++++------ junit-4/README.md | 11 +++++------ junit-5/README.md | 11 +++++------ serenity-cucumber/README.md | 11 +++++------ testng/README.md | 11 +++++------ 7 files changed, 35 insertions(+), 42 deletions(-) diff --git a/README.md b/README.md index 17e495f..36f6477 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 5. **Verify the BrowserStack CLI** @@ -69,17 +69,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -90,7 +90,6 @@ 7. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/java/README.md b/java/README.md index f82e77d..b61a040 100644 --- a/java/README.md +++ b/java/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/jest/README.md b/jest/README.md index 283dd4d..8aab453 100644 --- a/jest/README.md +++ b/jest/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/junit-4/README.md b/junit-4/README.md index a590591..82f3519 100644 --- a/junit-4/README.md +++ b/junit-4/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/junit-5/README.md b/junit-5/README.md index e07f508..d0ffc2a 100644 --- a/junit-5/README.md +++ b/junit-5/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/serenity-cucumber/README.md b/serenity-cucumber/README.md index 600a01f..8fb13e2 100644 --- a/serenity-cucumber/README.md +++ b/serenity-cucumber/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` diff --git a/testng/README.md b/testng/README.md index ec93630..aa04fcd 100644 --- a/testng/README.md +++ b/testng/README.md @@ -39,7 +39,7 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. 4. **Verify the BrowserStack CLI** @@ -63,17 +63,17 @@ The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh - # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" - # Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` + On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell - # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" - # Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -84,7 +84,6 @@ 6. **Run tests using BrowserStack CLI** ```sh - # macOS / Linux ./browserstack-cli load run ``` From 082fb74fbc152598c8e4b96c18367dfcd73dbca1 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 08:14:28 +0530 Subject: [PATCH 5/5] LTS-5452: verify the CLI's signing certificate, not just its team ID codesign -dv's TeamIdentifier can be forged on an ad hoc signature; require an Apple-anchored leaf cert with OU YQ5FZQ855D instead (checked against the current macOS arm64 build: passes; a wrong OU fails). Add chmod +x after unzip (CodeRabbit). Co-Authored-By: Claude Opus 5.5 --- README.md | 6 +++--- java/README.md | 6 +++--- jest/README.md | 6 +++--- junit-4/README.md | 6 +++--- junit-5/README.md | 6 +++--- serenity-cucumber/README.md | 6 +++--- testng/README.md | 6 +++--- 7 files changed, 21 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index 36f6477..27cc4f6 100644 --- a/README.md +++ b/README.md @@ -45,16 +45,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 5. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/java/README.md b/java/README.md index b61a040..db50730 100644 --- a/java/README.md +++ b/java/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/jest/README.md b/jest/README.md index 8aab453..9a1b719 100644 --- a/jest/README.md +++ b/jest/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/junit-4/README.md b/junit-4/README.md index 82f3519..1b34964 100644 --- a/junit-4/README.md +++ b/junit-4/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/junit-5/README.md b/junit-5/README.md index d0ffc2a..8b3ac2d 100644 --- a/junit-5/README.md +++ b/junit-5/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/serenity-cucumber/README.md b/serenity-cucumber/README.md index 8fb13e2..cd1eddf 100644 --- a/serenity-cucumber/README.md +++ b/serenity-cucumber/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack. diff --git a/testng/README.md b/testng/README.md index aa04fcd..a629131 100644 --- a/testng/README.md +++ b/testng/README.md @@ -39,16 +39,16 @@ - **Linux ARM** [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) - > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. + > The download is a zip. Extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of your project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. 4. **Verify the BrowserStack CLI** Before running the binary, check that it is signed by BrowserStack: - - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc). + - **macOS**: the command must succeed. It only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack.