Cargo login (rustlang): Method to store token for crates.io

[Kreyren]

How should i handle cargo login on gitpod? This requires new file in $HOME/.cargo/credentials with content cargo login <TOKEN>:

[JesterOrNot]

@Kreyren
I don't know but maybe you could set the token to a global env variable from the gitpod dashboard and then retrieve it in the gitpod tasks phase in a .gitpod.yml file

[Kreyren]

@JesterOrNot The issue is that this token is confidential (basically allows write access to crates which is eqvivalent to end-user having write access to the git repository) so it cannot be stored this way.

Ideally gitpod should have a method to store cargo config directory per user.

EDIT: or in theory just running the cargo login command per user

[jankeromnes]

Hi @Kreyren,

How should i handle cargo login on gitpod? This requires new file in $HOME/.cargo/credentials with content cargo login <TOKEN>

In Gitpod, new files can safely be created under $HOME. They're only accessible by you (unless you share the workspace with someone else), so that works with sensitive data like tokens.

The caveat is that $HOME is not backed up, only /workspace/, thus if the workspace times out and you restart it later, the credentials will be gone and you'll have to log in again.

I don't know but maybe you could set the token to a global env variable from the gitpod dashboard and then retrieve it in the gitpod tasks phase in a .gitpod.yml file

The issue is that this token is confidential (basically allows write access to crates which is eqvivalent to end-user having write access to the git repository) so it cannot be stored this way.

https://gitpod.io/environment-variables/ was designed specifically for storing confidential tokens and share them with specific workspaces (e.g. you can decide to only expose them in your workspaces for a specific repository user/repo, or for a specific org org/*).

Do you have a specific security concern that is preventing you from using this?

[Kreyren]

Do you have a specific security concern that is preventing you from using this?

I see what you mean and i trying that atm, but to be honest i don't like this solution since the variable or the file is still accessible (in case ports are exposed and the attacker knows what is he/she looking for that would cause a thread assuming that i have port 6080 exposed for vnc on most of my repos and the url can be in theory leaked due to the pebcak with screenshot utility) i would prefer this being stored in a directory that is accesible only to group dedicated to cargo and set as not readable and not writable by anyone else.

Also some standardization of this would be great alike adding

# FIXME: Add method to check if cargo is executable
RUN if command -v cargo >/dev/null && [ -n "$CARGO_TOKEN" ]; then { cargo login "$CARGO_TOKEN" || printf 'FATAL: %s\n' "Cargo failed to register your CARGO_TOKEN suspecting invalid token" ;} && unset CARGO_TOKEN; fi

in gitpod's dockerimages so that this woudn't have to be added invidually per repository

The more gitpod does out of the box and/or through user-specific configuration to work ootb the better since configuring gitpod per repository takes me around 8 mins per each

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.