What's next for steamguard-cli? The Big v0.4 Rewrite

[dyc3]

As you all are probably painfully aware, this project suffers from Chronic Flakey Build Syndrome. Because it was the easiest option at the time, when I first made this project, I opted to reuse the work over at https://github.com/geel9/SteamAuth. However, in my infinite, dumb ass, adolescent wisdom I decided to effectively roll my own build system using mono's mcs C# compiler. It has been a complete maintenance disaster, to be honest.

There's also exactly 0 unit or integration tests. I'm hesitant to make changes to the current code for fear of breaking something and not realizing it. Oh, and the password prompt is the jankiest shit in the universe. I could go on.

That's why I'm rewriting steamguard-cli from the ground up in a different language. I've already decided to use Rust, and I've already pushed a branch called rust-rewrite where you can see my work so far. I am aware of how much of a pain in the ass this is going to be compared to other languages, but hopefully on the other end, we'll end up with something more robust, but more importantly, easier to build.

[dyc3]

Ok, so the rewrite is coming along fairly smoothly. Progress is somewhat slow because I'm busy with school and other projects. I'll admit that it feels like I have zero idea what I'm doing. The code that I'm writing doesn't feel great, and could use a lot of improvement. Any advice or recommendations would be greatly appreciated.

On the bright side, startup time is blazing fast compared to the current release.
Here's a comparison of generating 2fa codes:

old steamguard: 0.42s user 0.02s system 53% cpu 0.837 total
new steamguard: 0.11s user 0.03s system 40% cpu 0.358 total

I've also made a draft PR to track the rust-rewrite branch: #56.

[dyc3]

Todo list

• loading existing maFiles
• logging in
• generating 2fa codes
• parsing confirmations
• responding to confirmations (accept/deny)
• UI special cases
  • confirmations menu
• saving session cookies and stuff to file
• account setup
• new CI test pipeline
• new CI release pipeline
• unit tests for parsing confirmations

Test plan

All the things that need to be thoroughly tested. Any help with this would be greatly appreciated.

• First run
  • if no maFiles are found, prompt to set up new account
  • should create manifest.json if it does not exist.
  • should create maFiles directory if it does not exist.
• Generating codes
  • should be valid, and allow the user to log in
• Confirmations
  • trade confirmations
  • market sell confirmations
  • account recovery confirmations
  • unknown confirmation types need to be communicated to the user so they can file an issue
  • unknown confirmations should not block from accepting other confirmations
  • multiple confirmations should be able to be parsed and listed in the UI
  • --accept-all should accept all confirmations
• Account setup
  • should be able to set up an account
  • should display revocation code to user during account setup
  • should be able to import existing accounts
  • should allow user to add a phone number if one is not already present on the Steam account
• Encryption
  • should be able to decrypt accounts encrypted by SDA/old steamguard cli
  • should be able to encrypt accounts, and then subsequently decrypt them

[dyc3]

Important milestone today! It should be possible to use your existing maFiles with the rust branch to both generate codes and accept confirmations!

If you have the github cli installed, you can pull the branch and run it:

git clone https://github.com/dyc3/steamguard-cli.git
cargo run -- --help

Note that it is still not possible to set up accounts yet, and that you will probably get prompted a lot of times to type your password.

I'm going to try and merge in the current code in #56 soon The current code has been merged in, and I'll open issues and make more PRs to add the remaining stuff.

Some discoveries that I've made along the way:

• The login flow has changed slightly. It changed probably more than a year ago, and nobody seems to have noticed (whoops). Everything else seems to be unchanged.
• This also means that as long has you have kept your maFiles' sessions active, the C# steamguard cli and SDA should work for confirmations. Probably. Haven't tested it.
• Apparently, there is a scenario where you can get an "account recovery" mobile confirmation. I did not properly document how to trigger one of these, but IIRC it has something to do with the "forgot password" flow. This is ideally something I want to support (for obvious reasons), so any help in this area would be freakin sweet.

[dyc3]

The rewrite is now mostly complete. Generating codes, account setup, and confirmations are all functional, which are the big things. The only remaining significant thing that is missing is encryption. I also still have to redo the release pipeline .

It's in a state that I feel pretty comfortable recommending the rewrite over the old steamguard-cli. Try it out, but be sure to make backups of your maFiles!

[dyc3]

Released! Check out the readme for install instructions, download build artifacts and see the changelog here: https://github.com/dyc3/steamguard-cli/releases/tag/v0.4.0

[pfdint]

+rep I used it and it didn't steal my entire steam account