Chef Infra needs a way to provide secure credentials in the client.rb

[haidangwa]

Describe the Enhancement:

When specifying the rubygems_url, http_proxy, or https_proxy values in Chef Infra client's client.rb file, it seems that the only way to provide authentication credentials (e.g., to a private rubygems repo), is to embed the username and password in the URL, like https://myuser:mypass@private.rubygems.repo. This is not ideal, as the file could be read by anyone without changing the mode to 640 or stricter. For example, the chef-client::config recipe sets the permissions on the client.rb wide open: https://github.com/chef-cookbooks/chef-client/blob/master/recipes/config.rb#L83

Describe the Need:

Storing credentials in the client.rb file is not secure.

Current Alternative

The best we can do today is setting the file mode to 640 or stricter, but it would be optimal to have a better way to provide the credentials to the Chef client.

Can We Help You Implement This?: