Add an opt-in OS credential store for gem and bundler credentials

[hsbt]

RubyGems keeps the push API key in ~/.gem/credentials and Bundler keeps host credentials in .bundle/config, both as plain text on disk. This adds an opt-in credential store, shared by both, that keeps those secrets in the operating system's native store instead. It shells out to the platform's own tools with no new dependency or C extension, the security command on macOS, secret-tool on Linux, and the Windows Credential Manager through PowerShell. Secrets are passed over stdin or the environment so they never appear in argv. Every operation falls back to the existing file storage with a warning when the native store is missing, locked, or otherwise fails.

Nothing changes unless you turn it on. For gem, set :credential_store: true in ~/.gemrc or export RUBYGEMS_CREDENTIAL_STORE=true. For Bundler it is the credential_store setting (BUNDLE_CREDENTIAL_STORE).

$ gem signin                                         # API key goes to the OS store, not ~/.gem/credentials
$ bundle config set credential_store true
$ bundle config set rubygems.example.com user:pass   # stored in the OS store, read back at auth time

Existing plain-text credentials are not migrated automatically. Re-run gem signin or bundle config set <host> <user:pass> with the setting enabled to move each one into the store.

The setting also accepts a backend name so a third party can ship an alternative store as its own gem, loaded only when selected. Setting credential_store to 1password requires rubygems/credential_store/backends/1password, which registers itself:

# lib/rubygems/credential_store/backends/1password.rb, shipped in a third-party gem
class OnePasswordBackend
  def get(service, account) = ...
  def set(service, account, secret) = ...
  def delete(service, account) = ...
  def delete_all(service) = ...
end

Gem::CredentialStore.register_backend("1password", OnePasswordBackend.new)

Backend names are restricted to /\A[a-z0-9_-]+\z/ and only ever feed that fixed require prefix, so a value from configuration stays data and never becomes a path or a command. RubyGems' own platform backends live outside the directory a name can reach.

This is the first, fully opt-in step. Making the store the default and dropping the dual writes are deliberately left for later changes.

[Copilot]

Pull request overview

This PR introduces an opt-in shared credential store for RubyGems and Bundler, allowing secrets (RubyGems API keys and Bundler host credentials) to be stored in the OS-native credential manager instead of plaintext files, with transparent fallback to existing file-based behavior when unavailable.

Changes:

• Add Gem::CredentialStore with native backends for macOS (Keychain), Linux (Secret Service via secret-tool), and Windows (Credential Manager via PowerShell).
• Wire RubyGems commands/config to read/write API keys via the credential store when enabled (precedence over credentials file).
• Wire Bundler settings to read/write host user:pass credentials via the credential store when enabled, and document the new setting.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/rubygems/test_gem_gemcutter_utilities.rb	Adds tests asserting credential-store API key precedence and fallback behavior for gem push.
test/rubygems/test_gem_credential_store.rb	New unit tests for Gem::CredentialStore behavior (memoization, safe no-ops, warnings, backend resolution).
test/rubygems/test_gem_credential_store_windows_backend.rb	New tests verifying Windows backend behavior and that secrets are not passed via argv.
test/rubygems/test_gem_credential_store_macos_backend.rb	New tests for macOS Keychain backend behavior and stdin-based secret passing.
test/rubygems/test_gem_credential_store_linux_backend.rb	New tests for Linux secret-tool backend availability detection and stdin handling.
test/rubygems/test_gem_config_file.rb	Adds tests for :credential_store: config/env parsing and credential-store routing/fallback for API keys.
test/rubygems/test_gem_commands_signout_command.rb	Adds coverage for signing out when only a credential-store key exists.
test/rubygems/helper.rb	Adds with_fake_credential_store helper for RubyGems tests.
test/rubygems/fake_credential_backend.rb	New in-memory backend for RubyGems test suite.
spec/support/fake_credential_backend.rb	New in-memory backend for Bundler specs.
spec/bundler/settings_spec.rb	Adds specs covering Bundler credential_store behavior for storing/reading/unsetting host credentials.
Manifest.txt	Adds new credential store files to the manifest.
lib/rubygems/gemcutter_utilities.rb	Prefers credential-store API keys over file keys when enabled.
lib/rubygems/credential_store/native/windows.rb	Implements Windows Credential Manager backend via PowerShell + env vars.
lib/rubygems/credential_store/native/macos.rb	Implements macOS Keychain backend via security (including -i mode for writes).
lib/rubygems/credential_store/native/linux.rb	Implements Linux Secret Service backend via secret-tool with availability detection.
lib/rubygems/credential_store.rb	Adds core credential store API, backend loading/validation, caching, and error swallowing/warnings.
lib/rubygems/config_file.rb	Adds credential_store setting, routes API key reads/writes/unset to the store when enabled.
lib/rubygems/commands/signout_command.rb	Updates signout to consider credential-store sign-in state and remove stored key on signout.
lib/rubygems/commands/signin_command.rb	Documents that signin will store API key in the credential store when enabled.
lib/rubygems/commands/push_command.rb	Documents credential store behavior for push authentication.
lib/bundler/settings.rb	Adds Bundler credential_store setting and routes host credential storage/read through Gem::CredentialStore.
lib/bundler/man/bundle-config.1.ronn	Documents credential_store / BUNDLE_CREDENTIAL_STORE.
lib/bundler/man/bundle-config.1	Generated manpage update for the new credential_store setting.

Comments suppressed due to low confidence (1)

lib/rubygems/commands/signout_command.rb:33

• The success message claims "signed out from all sessions", but with credential_store enabled unset_api_key! only deletes the default rubygems_api_key entry from the credential store (and cannot remove other per-host entries). Consider making the message accurate so users don’t assume all stored credentials were removed.

    else
      Gem.configuration.unset_api_key!
      say "You have successfully signed out from all sessions."
    end

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nekketsuuu]

When using a third-party backend gem in conjunction with Bundler, how is the third-party gem itself expected to be installed? Is it intended to be installed as an individual gem without being managed by Bundler?

Also, what would be the best way to handle falling back from a third-party gem to the default backend? I am wondering how to implement a process where only specific credentials are handled by the custom backend, while the rest are passed through to the default backend (or any other backend like 1password).

For example, in the use case at #8501 (comment), I want to handle only the credentials for the AWS CodeArtifact source myself and delegate the rest to the default backend.

Furthermore, in the case of CodeArtifact credentials, get would involve calling the AWS API on the spot and delete could be a no-op (or call the default backend), but I am unsure how to handle set. Since returning an error causes a fallback to plain text, the implementation would likely involve either making it a no-op or ensuring that explicitly set credentials take precedence.