edcope-ct commented on issue #2148: URL: https://github.com/apache/buildstream/issues/2148#issuecomment-4924551827
Here is an proposal for implementing credential-helper-spec. This follows the spec defined in https://github.com/EngFlow/credential-helper-spec/blob/main/spec.md This spec is used by existing tools such as bazel and buildbox: https://github.com/bazelbuild/proposals/blob/main/designs/2022-06-07-bazel-credential-helpers.md https://gitlab.com/BuildGrid/buildbox/buildbox/-/merge_requests/1115 To implement the spec, buildstream should provide: - A bst flag `--credential-helper <PATH>` to specify the credential helper executable - BST user config entry `auth.credential-helper = "<PATH>"` - API for plugins to use for retrieving credentials For the credential helper, buildstream should: - Timeout after 5 seconds of execution - Provide the helper executable the same environment variables as bst - Set the helper executable working directory to be the repository root The API would be a utility function `get_credentials(uri: str) -> dict[str, Any]`: - It is a new, isolated function rather than changes to `DownloadableFileSource`. - There are plugin sources that pulls from remote (such as git_repo) that doesn't derive of off `DownloadableFileSource` - The function will attempt authentication with a credential helper, and fallback to netrc. - This function would have to sometimes cache the result as specified in the get-credentials response schema: https://github.com/EngFlow/credential-helper-spec/blob/main/schemas/get-credentials-response.schema.json - Cache would be stored in a global state - Return value is a dictionary containing headers for making requests with. - This change will not break existing projects using netrc for authentication. - This function should be used within buildstream as well, for anywhere that previously only used netrc for credentials. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
