Asymmetric tokens by Eh2406 · Pull Request #10771 · rust-lang/cargo

Eh2406 · 2022-06-18T22:01:38Z

Builds on and is blocked by #10592. This adds initial support for Asymmetric Tokens #10519.

rust-highfive · 2022-06-18T22:01:41Z

(rust-highfive has picked a reviewer for you, use r? to override)

Eh2406 · 2022-06-18T22:52:11Z

Big shout out to @brycx for all the work getting pasetors ready for this PR! Literally could not have done this without your help!

Eh2406 · 2022-06-20T15:48:52Z

@joshtriplett how aggressively do we want to tie this to registry_auth? I think we want them tied together when we stabilize it, but we could choose to be more aggressive and only have one Z flag.

joshtriplett · 2022-06-21T16:38:03Z

@Eh2406 I think we should make them the same feature, since we shouldn't ship authenticated HTTP registries with non-asymmetric tokens.

joshtriplett · 2022-06-21T16:42:52Z

Capturing an idea from the Cargo team meeting: we could make the asymmetric token a private field (and make sure the enum doesn't implement Display), so that it can't be read out and unintentionally transmitted; signing can use methods.

jonhoo · 2022-06-21T17:56:53Z

src/cargo/util/auth.rs

+    }
+}
+
+pub struct Mutation<'a> {


Drive-by comment: this would probably be better as an enum.

bors · 2022-07-01T04:53:55Z

☔ The latest upstream changes (presumably #10802) made this pull request unmergeable. Please resolve the merge conflicts.

Eh2406 · 2022-09-22T15:56:58Z

I just noticed that we have a check for setting the token using the command line, this check should probably be extended to the secret key as well.

cargo/src/cargo/util/config/mod.rs

Line 1264 in 247ca7f

bail!("registry.token cannot be set through --config for security reasons");

ehuss · 2022-11-19T02:58:18Z

With #10592 landed, is there anything needed to be ready for review other than resolving the merge conflicts?

Eh2406 · 2022-11-19T14:43:37Z

It needs to be rebased and updated. I remember that there was significant feedback. I'm planning to come back to this PR the end of this week.

Todos:

rebase and merge conflicts.
update to pasetors 0.6, use the new serde support.
Consistently refer to things as asymmetric tokens
consistently refer to secret keys and public keys, as that is the recommended terminology for PASETO. (Public vs. Private is easy to accidentally misspeak or type.)
add to registry_auth Z flag
try to make the asymmetric token a private field (and make sure the enum doesn't implement Display)
Mutation should be an enum
a check for setting the secret key using the command line
cash tokens so that the same token is not regenerated

arlosi

Could you also update unstable.md to describe the feature?

src/cargo/sources/registry/http_remote.rs

src/cargo/util/auth.rs

crates/cargo-test-support/src/registry.rs

ehuss · 2022-12-29T15:16:24Z

🎉 Thanks! I appreciate that you clearly put in a lot of effort on this.

Can you collect any todo items, and create new issues for them? I think it would help to track what is left, what needs to be decided or resolved, and to organize discussion on those.

@bors r+

bors · 2022-12-29T15:16:25Z

📌 Commit b6adac1 has been approved by ehuss

It is now in the queue for this repository.

bors · 2022-12-29T15:16:32Z

⌛ Testing commit b6adac1 with merge ef565ef...

Asymmetric tokens Builds on and is blocked by #10592. This adds initial support for Asymmetric Tokens #10519.

bors · 2022-12-29T16:17:01Z

💔 Test failed - checks-actions

Eh2406 · 2022-12-29T16:21:27Z

That seams spurious and unrelated.

Eh2406 · 2022-12-29T16:39:00Z

@bors retry

bors · 2022-12-29T16:39:08Z

⌛ Testing commit b6adac1 with merge 7fb01c6...

bors · 2022-12-29T17:29:39Z

☀️ Test successful - checks-actions
Approved by: ehuss
Pushing 7fb01c6 to master...

8 commits in 2381cbdb4e9b07090f552d34a44a529b6e620e44..8c460b2237a6359a7e3335890db8da049bdd62fc 2022-12-23 12:19:27 +0000 to 2023-01-04 14:30:01 +0000 - test: revive nightly plugin tests to work (rust-lang/cargo#11534) - Add note to release notes about rejecting multiple registries. (rust-lang/cargo#11531) - Fix a typo `fresheness` -> `freshness` (rust-lang/cargo#11529) - Reasons for rebuilding (rust-lang/cargo#11407) - Asymmetric tokens (rust-lang/cargo#10771) - Use proper git URL for GitHub repos (rust-lang/cargo#11517) - Add `registry.default` example (rust-lang/cargo#11516) - Support vendoring with different revs from same git repo (rust-lang/cargo#10690) Also update license exceptions and permitted dependencies for new cargo dependency "pasetors". A new dependency `getrandom` is added into `rustc-workspace-hacks`, since it requires feature `js`.

Update cargo 8 commits in 2381cbdb4e9b07090f552d34a44a529b6e620e44..8c460b2237a6359a7e3335890db8da049bdd62fc 2022-12-23 12:19:27 +0000 to 2023-01-04 14:30:01 +0000 - test: revive nightly plugin tests to work (rust-lang/cargo#11534) - Add note to release notes about rejecting multiple registries. (rust-lang/cargo#11531) - Fix a typo `fresheness` -> `freshness` (rust-lang/cargo#11529) - Reasons for rebuilding (rust-lang/cargo#11407) - Asymmetric tokens (rust-lang/cargo#10771) - Use proper git URL for GitHub repos (rust-lang/cargo#11517) - Add `registry.default` example (rust-lang/cargo#11516) - Support vendoring with different revs from same git repo (rust-lang/cargo#10690) Also update license exceptions and permitted dependencies for new cargo dependency "pasetors". A new dependency `getrandom` is added into `rustc-workspace-hacks`, since it requires feature `js`. r? `@ghost`

rust-highfive assigned ehuss Jun 18, 2022

rust-highfive added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jun 18, 2022

Eh2406 force-pushed the asymmetric_tokens branch 2 times, most recently from ae6834c to 429cfe5 Compare June 20, 2022 15:45

Eh2406 force-pushed the asymmetric_tokens branch from 429cfe5 to 7efacff Compare June 20, 2022 16:28

joshtriplett added the T-cargo Team: Cargo label Jun 21, 2022

jonhoo reviewed Jun 21, 2022

View reviewed changes

src/cargo/util/auth.rs Outdated

}

}

pub struct Mutation<'a> {

Copy link

Contributor

jonhoo Jun 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drive-by comment: this would probably be better as an enum.

ehuss mentioned this pull request Oct 25, 2022

Tracking Issue for RFC 3231: Asymmetric Tokens #10519

Open

7 tasks

Eh2406 mentioned this pull request Nov 21, 2022

Implement RFC 3139: alternative registry authentication support #10592

Merged

Eh2406 force-pushed the asymmetric_tokens branch from 7efacff to 862c3c4 Compare December 8, 2022 23:10

arlosi reviewed Dec 9, 2022

View reviewed changes

Eh2406 force-pushed the asymmetric_tokens branch from 862c3c4 to e832894 Compare December 9, 2022 22:53

Eh2406 added 9 commits December 12, 2022 17:49

clap for new login args

5939ed0

unstable_cli_options

d8df142

login/out

a917fa0

Add test for wrighting keys

b907a7f

generate and check secret_key

40325c4

Send Asymmetric Tokens to read endpoints

ccd69bc

Send asymmetric tokens with mutations

6d1c07b

end-to-end tests

2ac1508

remove duplication in auth

c4eb670

Eh2406 force-pushed the asymmetric_tokens branch from 16177ba to b6adac1 Compare December 22, 2022 21:54

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Dec 29, 2022

bors added a commit that referenced this pull request Dec 29, 2022

Auto merge of #10771 - Eh2406:asymmetric_tokens, r=ehuss

ef565ef

Asymmetric tokens Builds on and is blocked by #10592. This adds initial support for Asymmetric Tokens #10519.

bors added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. labels Dec 29, 2022

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Dec 29, 2022

bors merged commit 7fb01c6 into rust-lang:master Dec 29, 2022

bors mentioned this pull request Dec 29, 2022

gitoxide integration: fetch #11448

Merged

16 tasks

This was referenced Dec 29, 2022

Get a Asymmetric Public key from credentials/config #11518

Open

A new type for data that should never be logged. #11519

Closed

Asymmetric Tokens from credential processes #11520

Closed

Asymmetric Tokens and server issuing challenges #11521

Open

weihanglo mentioned this pull request Dec 31, 2022

Update cargo rust-lang/rust#106330

Merged

ehuss added this to the 1.68.0 milestone Jan 28, 2023

Conversation

Eh2406 commented Jun 18, 2022

Uh oh!

rust-highfive commented Jun 18, 2022

Uh oh!

Eh2406 commented Jun 18, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Eh2406 commented Jun 20, 2022

Uh oh!

joshtriplett commented Jun 21, 2022

Uh oh!

joshtriplett commented Jun 21, 2022

Uh oh!

jonhoo Jun 21, 2022

Choose a reason for hiding this comment

Uh oh!

bors commented Jul 1, 2022

Uh oh!

Eh2406 commented Sep 22, 2022

Uh oh!

ehuss commented Nov 19, 2022

Uh oh!

Eh2406 commented Nov 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arlosi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehuss commented Dec 29, 2022

Uh oh!

bors commented Dec 29, 2022

Uh oh!

bors commented Dec 29, 2022

Uh oh!

bors commented Dec 29, 2022

Uh oh!

Eh2406 commented Dec 29, 2022

Uh oh!

Eh2406 commented Dec 29, 2022

Uh oh!

bors commented Dec 29, 2022

Uh oh!

bors commented Dec 29, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Eh2406 commented Jun 18, 2022 •

edited

Loading

Eh2406 commented Nov 19, 2022 •

edited

Loading