External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(cloud): support plaintext file credential store on systems without an OS keychain

Browse Source 
› Tenant ID:  fails on headless Linux (containers, VMs, CI) because
no D-Bus Secret Service is available and the keychain resolver refuses
to construct. Add an explicit --insecure-file-store flag that enables
dry's plaintext file fallback (~/.config/safedep/creds.json, mode 0600)
for writing.

Reading is fallback-enabled unconditionally in the credential resolver
chain, logout and setup info, so stored file credentials resolve with
no extra flags and logout can always clear them. On systems with a
working keychain the file provider is never constructed.
This commit is contained in:
Sahilb315
2026-07-15 21:53:55 +05:30
parent 46803f8e70
commit 1cc1520d71
6 changed files with 103 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/cloud/login.go
+18 -4
View File
@@ -9,7 +9,10 @@ import (
"github.com/spf13/cobra"
)
var loginFromEnv bool
var (
loginFromEnv bool
loginInsecureFileStore bool
)
func newLoginCommand() *cobra.Command {
cmd := &cobra.Command{
@@ -20,6 +23,8 @@ func newLoginCommand() *cobra.Command {
cmd.Flags().BoolVar(&loginFromEnv, "from-env", false,
"Read credentials from SAFEDEP_API_KEY and SAFEDEP_TENANT_ID environment variables")
cmd.Flags().BoolVar(&loginInsecureFileStore, "insecure-file-store", false,
"Store credentials in a plaintext file when no OS keychain is available (headless Linux, containers)")
return cmd
}
@@ -89,13 +94,18 @@ func runLogin(cmd *cobra.Command, args []string) error {
}
}
store, err := cloud.NewKeychainCredentialStore()
var opts []cloud.KeychainOption
if loginInsecureFileStore {
opts = append(opts, cloud.WithInsecureFileFallback())
}
store, err := cloud.NewKeychainCredentialStore(opts...)
if err != nil {
ui.ErrorExit(usefulerror.NewUsefulError().
Wrap(err).
WithCode(errcodes.Lifecycle).
WithHumanError("Failed to initialize credential store").
WithHelp("Your system may not support secure credential storage"))
WithHelp("No OS keychain is available. Re-run with --insecure-file-store to use plaintext file storage, or set SAFEDEP_API_KEY and SAFEDEP_TENANT_ID environment variables"))
}
defer func() {
if err := store.Close(); err != nil {
@@ -111,6 +121,10 @@ func runLogin(cmd *cobra.Command, args []string) error {
WithHelp("Your system may not support secure credential storage"))
}
ui.Successf("Credentials saved securely")
if loginInsecureFileStore {
ui.Successf("Credentials saved")
} else {
ui.Successf("Credentials saved securely")
}
return nil
}
cmd/cloud/logout.go
+1 -1
View File
@@ -18,7 +18,7 @@ func newLogoutCommand() *cobra.Command {
}
func runLogout(cmd *cobra.Command, args []string) error {
store, err := cloud.NewKeychainCredentialStore()
store, err := cloud.NewKeychainCredentialStore(cloud.WithInsecureFileFallback())
if err != nil {
ui.ErrorExit(usefulerror.NewUsefulError().
Wrap(err).