config::load_credentials: Support credentials script on Unix #5899
Conversation
|
Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @matklad (or someone else) soon. If any changes to this PR are deemed necessary, please add them as extra commits. This ensures that the reviewer can see what has changed since they last reviewed the code. Due to the way GitHub handles out-of-date commits, this should also make it reasonably obvious what issues have or haven't been addressed. Large or tricky changes may require several passes of review and changes. Please see the contribution instructions for more information. |
src/cargo/util/config.rs
Outdated
| ) | ||
| })?; | ||
|
|
||
| if cfg!(not(unix)) || (metadata.mode() & 0100 == 0) { |
There was a problem hiding this comment.
I (surprisingly) couldn't find something better to do than metadata.mode() & 0100 == 0 to check if the file is executable.
This is technically incorrect, as the executable bit cargo should check depends on the file's ownership.
This allows providing an executable `~/.cargo/credentials` files, which is executed and its standard output is used where we would currently use the contents of the file. An example use-case would be to pull the crates.io credentials from a password manager rather than storing them in plaintext on disk: #!/bin/sh -e cat <<EOF [registry] token = "$(pass crates.io)" EOF
|
Thanks for the PR! This is a relatively large feature though and I'd be hesitant to accept it purely with a PR. This is something I think we'll want to have more discussion about either on the internal forums or on an RFC. Would you be willing to write and RFC for this or start a thread on internals? |
|
See also #5638, which is also about avoiding storing secrets in |
|
The idea of executing a script to get this information seems interesting, but I'd be hesitant to make that script be |
|
Ok this has been quite for quite some time now, so I'm going to close this. It can of course be resubmitted though with some discussion on internals and such! |
This allows providing an executable
~/.cargo/credentialsfiles, which is executed and its standard output is used where we would currently use the contents of the file.An example use-case would be to pull the crates.io credentials from a password manager rather than storing them in plaintext on disk: