plugin install --url shows the password of a URL with credentials in its messages #1378

What is not working as expected?

notation plugin install --url puts the URL it was given into its messages as it is, so a URL with user info (https://user:pass@host/plugin.tar.gz) shows the password in:

• the parse error: failed to parse plugin download URL <url> with error: parse "<url>": ... (the *url.Error from url.Parse also contains the URL)
• the Downloading plugin from <url> line on stdout (cmd/notation/plugin/install.go)
• the error failed to download plugin from URL <url> with error: ...
• the errors of DownloadPluginFromURL (cmd/notation/internal/plugin/plugin.go) for a bad HTTP status and for the size limit, which print resp.Request.URL with %q, and url.URL.String() includes the password

The errors that http.Client returns already mask it (Get "https://user:***@host/..."), the leak is in the notation messages. This can end up in CI logs.

I found this by reading the code and checked it with unit tests, not against a real server. Before the change the new tests show, for example, GET "http://user:s3cret@127.0.0.1:59472/plugin.tar.gz": https response bad status: 404 Not Found.

What did you expect to happen?

The password is not shown. (*url.URL).Redacted() gives https://user:xxxxx@host/....

How can we reproduce it?

Run notation plugin install --url https://user:secret@localhost:1/p.tar.gz --sha256sum 00, or the unit tests in the linked PR.

Describe your environment

macOS, go1.26.3, notation main (9ba75db)

What is the version of your Notation CLI or Notation Library?

main (9ba75db)