From cf5880062cb41173950c94a3833e373e19a5e00c Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 06:43:12 +0530 Subject: [PATCH 1/5] LTS-5452: README step to set credentials as env vars Export BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY in the shell and never commit them; the CLI reads them from the environment. Co-Authored-By: Claude Opus 5.5 --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 73e24d4..2d0eb5d 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,24 @@ # browserstack-playwright-robot-load-testing-sample Sample repository for Playwright framework to do load testing +## Set your credentials + +The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: + +```sh +# macOS / Linux +export BROWSERSTACK_USERNAME="" +export BROWSERSTACK_ACCESS_KEY="" +``` + +```powershell +# Windows (PowerShell) +$env:BROWSERSTACK_USERNAME = "" +$env:BROWSERSTACK_ACCESS_KEY = "" +``` + +**Never commit your credentials.** Keep your access key out of `browserstack-load.yml` and every other file you push. If a key is ever exposed, regenerate it from Account Settings. + ## Notes before you adapt this sample - **Dependencies are hash-pinned.** `requirements.txt` is a lock with a hash for every package, so pip refuses anything that doesn't match. Edit the direct dependencies in `requirements.in`, then regenerate the lock: From 06584205c98875970192ed8934de3d4bbda1a5bc Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:13:43 +0530 Subject: [PATCH 2/5] LTS-5452: address review on the credentials step Hidden prompt for the access key so it stays out of bash/zsh and PSReadLine history (CodeRabbit); note the variables last for the current session and how to spot an unset one; per-repo fixes from the code review. Co-Authored-By: Claude Opus 5.5 --- README.md | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2d0eb5d..bcbafea 100644 --- a/README.md +++ b/README.md @@ -6,19 +6,53 @@ Sample repository for Playwright framework to do load testing The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: ```sh -# macOS / Linux +# macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" -export BROWSERSTACK_ACCESS_KEY="" +# Type the key at the prompt: it is not echoed, and it stays out of your shell history +printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo +export BROWSERSTACK_ACCESS_KEY ``` ```powershell # Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" -$env:BROWSERSTACK_ACCESS_KEY = "" +# Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history +$env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` +These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from. + **Never commit your credentials.** Keep your access key out of `browserstack-load.yml` and every other file you push. If a key is ever exposed, regenerate it from Account Settings. +## Run the sample + +1. Download the BrowserStack CLI for your operating system. The download is a zip: extract it and place the `browserstack-cli` binary in the root of this project. + - [macOS x86](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=x64) + - [macOS ARM](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=arm64) + - [Windows x86](https://load-api.browserstack.com/api/v1/binary?os=win&arch=x64) + - [Linux x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64) + - [Linux ARM](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) +2. Before running it, check that it is signed by BrowserStack. On macOS the output must include `TeamIdentifier=YQ5FZQ855D`; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. + + ```sh + codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + ``` + + ```powershell + Get-AuthenticodeSignature .\browserstack-cli.exe | Format-List Status, SignerCertificate + ``` +3. Start the test: + + ```sh + # macOS / Linux + ./browserstack-cli load run + ``` + + ```powershell + # Windows (PowerShell) + .\browserstack-cli.exe load run + ``` + ## Notes before you adapt this sample - **Dependencies are hash-pinned.** `requirements.txt` is a lock with a hash for every package, so pip refuses anything that doesn't match. Edit the direct dependencies in `requirements.in`, then regenerate the lock: From 97abc7ec8b6aa175c8f900ac0fd05a8a02c71194 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:32:31 +0530 Subject: [PATCH 3/5] LTS-5452: one-line key prompt; review follow-ups Prompt and export on one line, so pasting the block can't feed the export line to read. Robot: per-OS signature check, .gitignore for the CLI binary. Selenium: ignore browserstack-cli.exe. Co-Authored-By: Claude Opus 5.5 --- .gitignore | 3 +++ README.md | 9 +++++---- 2 files changed, 8 insertions(+), 4 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b98996f --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +# BrowserStack CLI binary, downloaded into the project root (see README) +browserstack-cli +browserstack-cli.exe diff --git a/README.md b/README.md index bcbafea..00e32a8 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,7 @@ The BrowserStack CLI reads your credentials from environment variables. Copy you # macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" # Type the key at the prompt: it is not echoed, and it stays out of your shell history -printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo -export BROWSERSTACK_ACCESS_KEY +printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` ```powershell @@ -26,19 +25,21 @@ These variables last only for the current terminal session. If the CLI reports a ## Run the sample -1. Download the BrowserStack CLI for your operating system. The download is a zip: extract it and place the `browserstack-cli` binary in the root of this project. +1. Download the BrowserStack CLI for your operating system. The download is a zip: extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of this project. - [macOS x86](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=x64) - [macOS ARM](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=arm64) - [Windows x86](https://load-api.browserstack.com/api/v1/binary?os=win&arch=x64) - [Linux x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64) - [Linux ARM](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) -2. Before running it, check that it is signed by BrowserStack. On macOS the output must include `TeamIdentifier=YQ5FZQ855D`; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. +2. On macOS and Windows, check that the binary is signed by BrowserStack before running it. On macOS the output must include `TeamIdentifier=YQ5FZQ855D`; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. There is no signature check for the Linux build. ```sh + # macOS codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier ``` ```powershell + # Windows (PowerShell) Get-AuthenticodeSignature .\browserstack-cli.exe | Format-List Status, SignerCertificate ``` 3. Start the test: From 4be6bb6eb98af9ae37de355508a3fe452a40b723 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 07:47:44 +0530 Subject: [PATCH 4/5] LTS-5452: shell labels in prose; .exe in the binary note zsh (macOS default) has interactive_comments off, so pasted '#' lines printed errors; the labels now sit outside the sh fences. The placement note names browserstack-cli.exe for Windows. Co-Authored-By: Claude Opus 5.5 --- README.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 00e32a8..681de91 100644 --- a/README.md +++ b/README.md @@ -5,17 +5,17 @@ Sample repository for Playwright framework to do load testing The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from: +On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history: + ```sh -# macOS / Linux (bash or zsh) export BROWSERSTACK_USERNAME="" -# Type the key at the prompt: it is not echoed, and it stays out of your shell history printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY ``` +On Windows, run these in PowerShell. The second line prompts for the key in the same way: + ```powershell -# Windows (PowerShell) $env:BROWSERSTACK_USERNAME = "" -# Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history $env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password ``` @@ -34,7 +34,6 @@ These variables last only for the current terminal session. If the CLI reports a 2. On macOS and Windows, check that the binary is signed by BrowserStack before running it. On macOS the output must include `TeamIdentifier=YQ5FZQ855D`; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. There is no signature check for the Linux build. ```sh - # macOS codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier ``` @@ -45,7 +44,6 @@ These variables last only for the current terminal session. If the CLI reports a 3. Start the test: ```sh - # macOS / Linux ./browserstack-cli load run ``` From fc3c311ec357f312953603e5d1b062d518e9172c Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 6 Nov 2026 08:14:33 +0530 Subject: [PATCH 5/5] LTS-5452: verify the CLI's signing certificate, not just its team ID codesign -dv's TeamIdentifier can be forged on an ad hoc signature; require an Apple-anchored leaf cert with OU YQ5FZQ855D instead (checked against the current macOS arm64 build: passes; a wrong OU fails). Add chmod +x after unzip (CodeRabbit). Co-Authored-By: Claude Opus 5.5 --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 681de91..ee9752a 100644 --- a/README.md +++ b/README.md @@ -25,16 +25,16 @@ These variables last only for the current terminal session. If the CLI reports a ## Run the sample -1. Download the BrowserStack CLI for your operating system. The download is a zip: extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of this project. +1. Download the BrowserStack CLI for your operating system. The download is a zip: extract it and place the `browserstack-cli` binary (`browserstack-cli.exe` on Windows) in the root of this project. On macOS or Linux, also run `chmod +x browserstack-cli`, since some unzip tools drop the executable bit. - [macOS x86](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=x64) - [macOS ARM](https://load-api.browserstack.com/api/v1/binary?os=macos&arch=arm64) - [Windows x86](https://load-api.browserstack.com/api/v1/binary?os=win&arch=x64) - [Linux x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64) - [Linux ARM](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64) -2. On macOS and Windows, check that the binary is signed by BrowserStack before running it. On macOS the output must include `TeamIdentifier=YQ5FZQ855D`; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. There is no signature check for the Linux build. +2. On macOS and Windows, check that the binary is signed by BrowserStack before running it. On macOS the command must succeed: it only passes if an Apple-issued certificate for BrowserStack's team (`YQ5FZQ855D`) signed the binary; on Windows, `Status` must be `Valid` with BrowserStack as the signer. If the check fails, do not run the binary. There is no signature check for the Linux build. ```sh - codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier + codesign --verify --strict -R '=anchor apple generic and certificate leaf[subject.OU] = "YQ5FZQ855D"' ./browserstack-cli ``` ```powershell