fix: resolve registry auth tokens for cargo upgrade#960
Open
r0wdiggity wants to merge 2 commits into
Open
Conversation
r0wdiggity
force-pushed
the
fix/registry-auth-token
branch
from
7bcfe2c to
b975138
Compare
cargo-edit 0.13.10 uses tame_index with its own reqwest client that never reads auth tokens from Cargo's credential-provider, credentials.toml, or environment variables. This causes 401 Unauthorized errors when upgrading dependencies from private registries (e.g. AWS CodeArtifact). This commit: - Adds registry_token() to resolve tokens from env vars, credentials.toml, credential-provider commands, and config.toml (in priority order) - Injects resolved tokens into RemoteIndex Authorization headers - Treats dependencies with no explicit source as default registry deps, so source-replaced crates-io deps are also authenticated - Caches tokens per registry to avoid repeated credential-provider calls Fixes killercup#931
r0wdiggity
force-pushed
the
fix/registry-auth-token
branch
from
b975138 to
ff8583c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cargo upgradein 0.13.10 fails with401 Unauthorizedwhen dependencies come from private registries (e.g. AWS CodeArtifact) becausetame_index's reqwest client never reads auth tokens from any of Cargo's token sources.This PR adds token resolution that checks (in priority order):
CARGO_REGISTRIES_<NAME>_TOKENcredentials.tomlcredential-providercommand (cargo:token-from-stdout)tokenfield inconfig.tomlIt also fixes two related issues:
replace-with) were skipped entirely because they have no explicit registry sourceFixes #931
Changes
src/registry.rs: Addregistry_token(),resolve_registry_name(),read_config_auth(),read_credentials_token(),run_credential_command()+ 18 unit testssrc/index.rs: Add token storage toIndexCacheand injectAuthorizationheader inRemoteIndex::krate()src/bin/upgrade/upgrade.rs: Wire up token resolution with per-registry cachingCargo.toml: Addtempfiledev dependency for testsTesting
credential-provider = "cargo:token-from-stdout aws codeartifact get-authorization-token ..."This PR was written with the assistance of Claude