credential provider implementation by arlosi · Pull Request #12334 · rust-lang/cargo

arlosi · 2023-07-07T22:00:05Z

The current credential process protocol only allows sending the credential without any additional information. This changes the protocol in two important ways: Cargo will tell the credential provider what the token is needed for, and the credential provider can tell Cargo how the token can be used.

Since the credential provider knows why Cargo needs a token (publish for example), it can produce a signed token specifically for that operation. This would enable a credential process to produce an asymmetric token, or a token with restricted scope such as PASETO or Biscuit.

The credential process can also indicate back to Cargo if the token can be cached in-memory for subsequent requests. For example, if a credential provider integrates with an SSO identity provider that provides short-lived tokens, Cargo will only continue to use the token while it is valid.

Summary of changes

Rename credential-process to credential-provider in config.
Add a new line-oriented JSON protocol for communicating with external credential providers via stdin/stdout.
Allow built-in credential providers to run in the Cargo process.
Move support for asymmetric tokens (RFC3231) into a built-in credential provider (cargo:paseto).
Change the unstable key for asymmetric tokens from registry-auth to credential-process
Add a new built-in provider to represent the current config/token based system (cargo:token).
Add a new built-in provider for the a "basic" provider that prints only the token on stdout (cargo:basic).
Create a new config key for the fallback credential providers (registry.credential-providers) as a list.
The provider for crates.io no longer also acts as a fallback for other registries.
Adds a [credential-alias] table for defining aliases of credential providers.
Collect all headers from http_registry requests, passing them through to the cred provider.

Everything remains unstable under the -Zcredential-process flag.

How to review this:

I recommend starting with the changes in unstable.md for a more detailed description.

Open questions

Should we pass all the HTTP headers rather than just www-authenticate

rustbot · 2023-07-07T22:00:10Z

r? @ehuss

(rustbot has picked a reviewer for you, use r? to override)

ehuss

This is looking great!

This is just a partial review. I'll try to finish the rest tomorrowish.

ehuss · 2023-07-11T23:53:53Z

@arlosi Your most recent commit seems to have introduced a bunch of formatting changes.

ehuss · 2023-07-11T23:56:31Z

Oh, I think the let-else formatting changes just landed in nightly. Lemme look at that.

ehuss · 2023-07-12T00:00:09Z

Posted #12351 to update the formatting.

ehuss

Review part 2. I think I've gone through everything except the tests, will try to get to those tomorrow.

ehuss · 2023-07-12T00:44:01Z

    }
 }
-
-fn main() {


In the future, how hard would it be to translate the 1password provider back to a standalone executable? We haven't decided if we are going to support these providers directly. One option was to migrate these to a separate repo (perhaps under my name) if we decide that rust-lang isn't going to support these. The maintenance burden isn't too bad, so I'm not sure if it matters (and we can document that we can drop providers in the future if we can't support it).

It's very easy to translate back. Just need to change it back to a bin crate and add:

fn main() { cargo_credential::main(OnePasswordCredential); }

I think I'd also prefer that 1password was a standalone provider that you could cargo install.

bors · 2023-07-12T01:10:26Z

☔ The latest upstream changes (presumably #12351) made this pull request unmergeable. Please resolve the merge conflicts.

bors · 2023-07-20T23:24:20Z

☔ The latest upstream changes (presumably #12310) made this pull request unmergeable. Please resolve the merge conflicts.

arlosi · 2023-07-21T19:37:01Z

Something weird happens if you have a configuration with registries.NAME.credential-providers = ["..."] (notice the s in the key). It seems to ignore that value, and doesn't generate a warning about an unused key. I would expect a warning about an unused key. It also seems to do some basic validation, since if you have credential-providers = "...", it will generate an error about not being a list. In general I'm a little concerned that users will get confused about the subtle distinction of whether or not there is an s in the key.

There was a shared struct that was used for both registries.NAME and registry, with registry allowing more keys. I've separated it out so we get better warnings for unused keys.

I've also renamed the credential-providers to global-credential-providers (name subject to bikeshedding), to make it more distinct from credential-provider.

arlosi · 2023-07-21T22:32:36Z

@ehuss I think this is ready for another round of review.

Given that #12310 was just merged, I've also made changes here to pass all the headers into the credential provider.

ehuss · 2023-07-22T17:31:42Z

Looks great, thanks! If there are thoughts about what needs followup, please file new issues, but I can't think of anything right now.

@bors r+

bors · 2023-07-22T17:31:44Z

📌 Commit 6151a41 has been approved by ehuss

It is now in the queue for this repository.

bors · 2023-07-22T17:31:50Z

⌛ Testing commit 6151a41 with merge a7b6a3c...

bors · 2023-07-22T18:15:23Z

☀️ Test successful - checks-actions
Approved by: ehuss
Pushing a7b6a3c to master...

Update cargo 8 commits in 1b15556767f4b78a64e868eedf4073c423f02b93..7ac9416d82cd4fc5e707c9ec3574d22dff6466e5 2023-07-18 14:44:47 +0000 to 2023-07-24 14:29:38 +0000 - fix(cargo-credential): should enable feature `serde/derive` (rust-lang/cargo#12396) - fix: encode URL params correctly for SourceId in Cargo.lock (rust-lang/cargo#12280) - docs: format config override caveat as a note (rust-lang/cargo#12392) - credential provider implementation (rust-lang/cargo#12334) - feat(crates-io): expose HTTP headers and Error type (rust-lang/cargo#12310) - chore: Don't update test data (rust-lang/cargo#12380) - fix: only skip mtime check on `~/.cargo/{git,registry}` (rust-lang/cargo#12369) - Update docs for artifact JSON debuginfo levels. (rust-lang/cargo#12376) Since rust-lang/cargo#12334 makes built-in credential providers part of the cargo binary, it's no longer needed to build them in bootstrap.

DrChat · 2023-08-02T21:17:34Z

+    if !std::io::stdin().is_terminal() {
+        let token = std::io::read_to_string(std::io::stdin()).unwrap_or_default();
+        if !token.is_empty() {
+            token_from_stdin = Some(token);
        }
    }


Just a friendly heads up - this is causing our CI jobs to hang if we provide the token via the command-line instead of stdin.
I'm happy to open a bug for this, but just wanted to make sure you were aware.

Sorry for the inconvenience!

I didn't quite follow the PR at that time. Is that a regression? If yes, please file an issue with reproduction, and we can then arrange a fix!

Yes, this is a regression.
Sounds good, thanks :)

login: allow passing additional args to provider As part of moving asymmetric token support to a credential provider in #12334, support for passing `--key-subject` to `cargo login` was removed. This change allows passing additional arguments to credential providers when running `cargo login`. For example: `cargo login -- --key-subject foo`. The asymmetric token provider (`cargo:paseto`) is updated to take advantage of this and re-enables setting `--key-subject` from `cargo login`. r? `@Eh2406` cc #8933

# `[registry]` vs `[registries.<name>]` per-key semantics Review notes for [rust-lang#17335] (min-publish-age stabilization), comparing how each config key behaves across the two tables. Verified against PR head `7b009184` with repro tests in `tests/testsuite/registry_table_confusion.rs` and the PR's own `tests/testsuite/min_publish_age.rs`. [rust-lang#17335]: rust-lang#17335 (comment) | Key | `[registry]` | `[registries.crates-io]` | `[registries.<alt>]` | Evidence | |---|---|---|---|---| | `token` | works for crates.io; does **not** follow `registry.default` | **silently ignored** (config and `CARGO_REGISTRIES_CRATES_IO_TOKEN` env) | works | `registries_crates_io_token_ignored_for_crates_io`, `registry_token_does_not_follow_registry_default` | | `credential-provider` | works for crates.io | **silently ignored** | works | `registries_crates_io_credential_provider_ignored` | | `secret-key` / `secret-key-subject` | works for crates.io | silently ignored (same code path as `token`) | works | code: `src/util/auth/mod.rs:212` returns `[registry]` for crates.io before any name lookup | | `min-publish-age` (new) | crates.io only; ignored for alt registries even with `registry.default` pointing at them | **honored; overrides `registry.min-publish-age`** | honored | `registry_alt_ignores_min_publish_age`, `registries_crates_io_overrides_registry_default` | | `global-min-publish-age` (new) | fallback for **all** registries | silently ignored (not a `RegistryConfig` field) | silently ignored | code: `src/context/schema.rs:530` | | `protocol` | silently ignored (not a `GlobalRegistryConfig` field) | honored | parsed but unused (`_protocol`) | code: `SourceId::crates_io_is_sparse` reads `registries.crates-io.protocol` only | | `index` | hard error: "no longer supported" | silently ignored (`SourceId::alt_registry` short-circuits `crates-io`) | required; defines the registry | code: `check_registry_index_not_set`, `src/workspace/source_id.rs:296` | | `default` | selects target registry for `publish`/`login`/`owner`/`yank` when `--registry`/`--index` absent | silently ignored | n/a | code: `src/util/command_prelude.rs:919` | | `global-credential-providers` | fallback providers for **all** registries | silently ignored | silently ignored | code: `src/util/auth/mod.rs:57` | Key asymmetries: * `min-publish-age` is the first key where `[registries.crates-io]` both works and overrides its `[registry]` counterpart; for the auth keys, `[registries.crates-io]` is dead config. * Auth resolves crates.io **by URL first** (`is_crates_io()`, `src/util/auth/mod.rs:212`); min-publish-age resolves **by name first** (`alt_registry_key()`, `src/resolver/version_prefs.rs:279`). A named mirror of crates.io's index gets `[registry]` credentials but `registries.<mirror>.min-publish-age`. * `registries.<name>.global-min-publish-age` and `registry.protocol` are silent no-ops — the same "subtle `s` distinction" concern raised in [rust-lang#12334](rust-lang#12334 (comment)).

rustbot assigned ehuss Jul 7, 2023

weihanglo mentioned this pull request Jul 9, 2023

Tracking Issue for alternative registry authentication (RFC 3139) #10474

Closed

5 tasks

arlosi changed the title ~~Draft credential provider implementation~~ credential provider implementation Jul 10, 2023

ehuss reviewed Jul 11, 2023

View reviewed changes

Comment thread src/doc/src/reference/unstable.md Outdated

Comment thread credential/cargo-credential/Cargo.toml Outdated

Comment thread credential/cargo-credential/src/lib.rs

Comment thread src/cargo/util/credential/process.rs

weihanglo reviewed Jul 11, 2023

View reviewed changes

Comment thread src/cargo/ops/registry/publish.rs Outdated

rustbot added A-git Area: anything dealing with git A-infrastructure Area: infrastructure around the cargo repo, ci, releases, etc. A-manifest Area: Cargo.toml issues labels Jul 11, 2023

ehuss reviewed Jul 12, 2023

View reviewed changes

arlosi force-pushed the cred-ext branch 2 times, most recently from e592978 to 3b8e2c0 Compare July 18, 2023 22:59

arlosi mentioned this pull request Jul 21, 2023

Error message with credential-process and a token is confusing. #12320

Closed

arlosi added 2 commits July 21, 2023 16:02

Credential provider implementation

2b39792

Send all headers to cred provider

6151a41

arlosi force-pushed the cred-ext branch from 3b8e2c0 to 6151a41 Compare July 21, 2023 22:30

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 22, 2023

ehuss mentioned this pull request Jul 22, 2023

Tracking Issue for credential-process RFC 2730 #8933

Closed

16 tasks

bors merged commit a7b6a3c into rust-lang:master Jul 22, 2023

bors mentioned this pull request Jul 22, 2023

Support cargo owner add #11879

Closed

arlosi mentioned this pull request Jul 24, 2023

Update cargo rust-lang/rust#114027

Merged

ehuss added this to the 1.73.0 milestone Jul 30, 2023

DrChat reviewed Aug 2, 2023

View reviewed changes

DrChat mentioned this pull request Aug 2, 2023

Providing a token to cargo login via command line causes a hang on CI #12438

Closed

arlosi mentioned this pull request Aug 14, 2023

login: allow passing additional args to provider #12499

Merged

decathorpe mentioned this pull request Nov 9, 2023

non-target-specific / unconditional dependencies on potentially unusable credential providers #12945

Closed

epage mentioned this pull request Aug 10, 2026

feat(resolver): Stabilize min-publish-age #17335

Merged

weihanglo mentioned this pull request Aug 11, 2026

[registry] vs [registries] per-key semantics weihanglo/cargo#100

Closed

Uh oh!

Uh oh!

Conversation

arlosi commented Jul 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of changes

How to review this:

Open questions

Uh oh!

rustbot commented Jul 7, 2023

Uh oh!

ehuss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehuss commented Jul 11, 2023

Uh oh!

ehuss commented Jul 11, 2023

Uh oh!

ehuss commented Jul 12, 2023

Uh oh!

ehuss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ehuss Jul 12, 2023

Choose a reason for hiding this comment

Uh oh!

arlosi Jul 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bors commented Jul 12, 2023

Uh oh!

bors commented Jul 20, 2023

Uh oh!

arlosi commented Jul 21, 2023

Uh oh!

arlosi commented Jul 21, 2023

Uh oh!

ehuss commented Jul 22, 2023

Uh oh!

bors commented Jul 22, 2023

Uh oh!

bors commented Jul 22, 2023

Uh oh!

bors commented Jul 22, 2023

Uh oh!

DrChat Aug 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

weihanglo Aug 2, 2023

Choose a reason for hiding this comment

Uh oh!

DrChat Aug 2, 2023

Choose a reason for hiding this comment

Uh oh!

DrChat Aug 2, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

arlosi commented Jul 7, 2023 •

edited

Loading

arlosi Jul 13, 2023 •

edited

Loading

DrChat Aug 2, 2023 •

edited

Loading