feat: add credential provider chain concept#275
Open
cloudsmith-iduffy wants to merge 3 commits intoiduffy/pre-release-clifrom
Open
feat: add credential provider chain concept#275cloudsmith-iduffy wants to merge 3 commits intoiduffy/pre-release-clifrom
cloudsmith-iduffy wants to merge 3 commits intoiduffy/pre-release-clifrom
Conversation
cloudsmith-iduffy
force-pushed
the
iduffy/credential-provider-chain
branch
8 times, most recently
from
6e1792c to
8862812
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/credential-provider-chain
branch
from
8862812 to
368db92
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/credential-provider-chain
branch
from
368db92 to
a60887d
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The goal here is to introduce a credential provider chain similar to https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html to give us a pluggable system for inserting various methods of authentication, such as api keys in envvars, cli params, config, automatic discovery of the environment you're running on, OIDC exchange, running an external process, etc.
Type of Change
Additional Notes
I manually tested this to a large extent the results of this are below
Credential Provider Chain — Test Results
Comparison of published CLI (
uvx --from=cloudsmith-cli) vs this branch.API Key Scenarios
Scenario 1: Anonymous (no credentials)
Published CLI:
Local CLI (this branch):
Scenario 2: API key via CLOUDSMITH_API_KEY env var
Published CLI:
Local CLI (this branch):
Scenario 3: API key via --api-key flag
Published CLI:
Local CLI (this branch):
Scenario 4: API key via -k short flag
Published CLI:
Local CLI (this branch):
Scenario 5: API key via credentials.ini (~/.cloudsmith/)
Published CLI:
Local CLI (this branch):
Scenario 6: API key via credentials.ini (app dir)
Published CLI:
Local CLI (this branch):
Scenario 7: API key via credentials.ini (current dir)
Published CLI:
Local CLI (this branch):
Scenario 8: API key via --credentials-file flag
Published CLI:
Local CLI (this branch):
Scenario 9: API key via CLOUDSMITH_CREDENTIALS_FILE env var
Published CLI:
Local CLI (this branch):
Scenario 10: Profile via -P flag
credentials.ini has empty [default] and key in [profile:staging]
Published CLI:
Local CLI (this branch):
Scenario 11: Profile via CLOUDSMITH_PROFILE env var
credentials.ini has empty [default] and key in [profile:staging]
Published CLI:
Local CLI (this branch):
Priority / Override Scenarios
Scenario 12: Priority: --api-key flag vs env var
Both set. Source should show CLI flag.
Published CLI:
Local CLI (this branch):
Scenario 13: Priority: env var vs credentials.ini
Both set. Source should show env var.
Published CLI:
Local CLI (this branch):
Scenario 14: Priority: --api-key flag vs credentials.ini
Both set. Source should show CLI flag.
Published CLI:
Local CLI (this branch):
Scenario 15: Priority: flag + env var + config (all set)
All three set. CLI flag should win.
Published CLI:
Local CLI (this branch):
SSO / Keyring Scenarios
Removed SSO tokens from system keyring.
Note: credentials.ini was not modified (--keyring-only).
Scenario 16: SSO token via keyring (whoami)
After
cloudsmith auth -o iduffy-demo— SSO token stored in system keyring.Local CLI (this branch):
Scenario 17: Priority: SSO token vs env var
SSO token in keyring + CLOUDSMITH_API_KEY set. SSO token should take priority.
Local CLI (this branch):
Scenario 18: Priority: SSO token vs credentials.ini
SSO token in keyring + API key in credentials.ini. SSO token should take priority.
Local CLI (this branch):
Scenario 19: CLOUDSMITH_NO_KEYRING=1 bypasses SSO
SSO token in keyring but CLOUDSMITH_NO_KEYRING=1. Should fall through to anonymous.
Local CLI (this branch):
Scenario 20: Logout clears SSO token
After
cloudsmith logout --keyring-only, SSO token should be cleared.Logout output:
Local CLI (this branch) — whoami after logout: