Add credential helper support for bundler by atpons · Pull Request #8501 · ruby/rubygems

atpons · 2025-02-18T09:33:48Z

What was the end-user or developer problem that led to this PR?

When using private gem registries (like GitHub Packages), users need to provide authentication credentials.

This PR implements the credential helper mechanism proposed in rubygems/rfcs#59, which allows users to securely retrieve authentication credentials from external processes.

What is your fix for the problem, implemented in this PR?

Added credential-helper setting that specifies path to helper program
- Helper is executed to obtain credentials in username:password format
Support fallbacks to existing credential configuration if helper fails

Here's an example of using it with GitHub Packages with GitHub CLI:

$ bundle config --local credential.helper.rubygems.pkg.github.com "/usr/local/bin/github-cred-helper.sh"

Additionally, It is also possible to place an executable file named bundler-credential-github.

Make sure the following tasks are checked

Describe the problem / feature
Write tests for features and bug fixes
Write code to solve the problem
Make sure you follow the current code style and write meaningful commit messages without tags

rubygems/rfcs#59

welcome · 2025-02-18T09:33:53Z

Thanks for opening a pull request and helping make RubyGems and Bundler better! Someone from the RubyGems team will take a look at your pull request shortly and leave any feedback. Please make sure that your pull request has tests for any changes or added functionality.

We use GitHub Actions to test and make sure your change works functionally and uses acceptable conventions, you can review the current progress of GitHub Actions in the PR status window below.

If you have any questions or concerns that you wish to ask, feel free to leave a comment in this PR or join our #rubygems or #bundler channel on Slack.

For more information about contributing to the RubyGems project feel free to review our CONTRIBUTING guide

simi · 2025-02-28T03:20:40Z

bundler/lib/bundler/settings.rb

+      return unless helper_path
+
+      begin
+        output = `#{helper_path}`.strip


@segiddins do you see any security issues with calling out this? Value is coming from bundle config.

I have a preference that we use the same pattern as https://git-scm.com/docs/gitcredentials#_configuration_options. Additionally, we should be using IO.popen for the subprocess

@simi @segiddins 0e48def...be95a01

Taking security concerns into consideration, I have modified the code to use IO.popen.

Additionally, similar to Git, I have implemented function a that automatically recognizes executables named bundler-credential-{helper-name} for automatically discovering helpers.

deivid-rodriguez · 2025-02-28T09:12:54Z

Planning to dive into this and the RFC soon. I normally use ENV variables to avoid saving credentials to disk, but it seems nice to support something more built in!

- Git-flavored configurations - IO.popen with exectution

bootjp · 2025-04-18T07:12:59Z

This Pull Request is very useful for my current issue. I want to use a private gem for both local development and on CI (GitHub Actions), but I’m having trouble managing the credentials.

• @simi @segiddins If the issues pointed out in the review are resolved, can this Pull Request be merged?

• @atpons: Do you still have the motivation to merge this Pull Request? If not, I can continue with the implementation.

atpons · 2025-04-18T07:20:27Z

Sorry,I haven't been able to work on it because I was busy, but I will continue with the implementation.
I'm also hoping it will be merged.

martinemde

Love it. Can't wait to use this.

Thanks for your work. Just one small nitpick for readability and then I'll defer to @segiddins to finalize the requested git inspired change.

bundler/lib/bundler/settings.rb

Co-authored-by: Martin Emde <martinemde@users.noreply.github.com>

atpons · 2025-05-17T01:56:31Z

Sorry, I've fixed some specs for change to using IO.popen 🙏

segiddins

With checking for exit status of the credential helper

segiddins · 2025-05-17T15:14:39Z

bundler/lib/bundler/settings.rb

+          "bundler-credential-#{command[0]}"
+        end
+
+        output = Bundler.with_unbundled_env { IO.popen(command, &:read) }


nit - lets check $? after IO.popen

thanks, db1e5ab fixed checking Process.last_status (use $? difficult to write specs)

nekketsuuu · 2026-02-27T00:32:56Z

bundler/lib/bundler/settings.rb

    end
+
+    def credentials_from_helper(uri)
+      helper_key = "credential.helper.#{uri.host}"


nit: This key differs from the one written in the RFC: https://github.com/rubygems/rfcs/pull/59/changes#diff-30acc2f7e5e276ac49ae593cd2b11138320356f6ebee37c3ca655624e7f4ea4eR33

But I think both credential.helper and credential-helper are acceptable.

nekketsuuu · 2026-02-27T00:37:33Z

bundler/lib/bundler/settings.rb

      system_bindir
      trust-policy
      version
+      credential.helper


The credential.helper key doesn't have a value, but credential.helper.#{host} keys have string values. So how about adding credential.helper. prefix to is_string method instead of adding credential.helper here? https://github.com/atpons/rubygems/blob/5b91e1db720cb6b8a0ddeeb9952ea2e8a04811c9/bundler/lib/bundler/settings.rb#L369-L372

nekketsuuu · 2026-02-27T00:42:22Z

bundler/lib/bundler/settings.rb

+        command[0] = if command[0].start_with?("/", "~")
+          command[0]
+        else
+          "bundler-credential-#{command[0]}"


I'm not sure why we need a constant prefix here. Isn't it enough to simply run it with the name as is even when the command is specified by a relative path? We can directly write bundler-credential-foobar to the config.

nekketsuuu · 2026-02-27T00:51:38Z

bundler/lib/bundler/settings.rb

+      rescue StandardError => e
+        Bundler.ui.warn "Credential helper failed: #{e.message}"
+        nil


IMHO: I think this rescue clause is unnecessary because failures of the executed command are caught by Process.last_status.success?, and failures of IO.popen such as Errno::EPIPE should be treated as errors.

nekketsuuu · 2026-02-27T00:52:27Z

I arrived at this pull request because I was looking for a solution for short-lived credentials of AWS CodeArtifact. This is exactly one of use cases described at rubygems/rfcs#59. I first thought that injecting credentials can be achieved by Bundler custom plugins, but that wasn't possible because the plugins are executed after Bundler authenticates with sources. So I would be happy if this pull request is merged!

@atpons Are you still busy now? I can hand over the implementation 🤚

atpons · 2026-03-03T01:08:43Z

@nekketsuuu Sorry for the late reply!
Since I don't have plans to use this at work for the time being, I'd be really happy if you could take over the implementation. Thanks for your help!

nekketsuuu · 2026-03-03T15:28:59Z

Thank you for your kind responce! I'll take a look then.

From ruby/rubygems#8501 Co-authored-by: Suleyman Musayev <96992680+msuliq@users.noreply.github.com>

hsbt · 2026-03-04T07:19:15Z

@nekketsuuu @atpons I would like to add this feature, but I don't yet understand the implementation and mechanism of the credential helper. Sorry.

Add credential helper support for private gem registries

e9cb2af

rubygems/rfcs#59

Add man pages for credential helpers

0e48def

atpons force-pushed the add-credential-helper branch from ac0d913 to 0e48def Compare February 18, 2025 14:30

atpons marked this pull request as ready for review February 18, 2025 14:32

simi requested a review from deivid-rodriguez February 28, 2025 03:19

simi reviewed Feb 28, 2025

View reviewed changes

atpons added 2 commits March 10, 2025 13:05

Apply changes from reviews

1ffae05

- Git-flavored configurations - IO.popen with exectution

Use shellwords and adoption for git-credential-helper protocol

972132a

atpons added 3 commits May 12, 2025 06:48

Fix shared helpers usage

5830288

Fix helps

a408b42

Merge branch 'master' into add-credential-helper

be95a01

martinemde approved these changes May 15, 2025

View reviewed changes

bundler/lib/bundler/settings.rb Outdated Show resolved Hide resolved

atpons and others added 2 commits May 17, 2025 10:26

Fix empty line check

c7431fa

Co-authored-by: Martin Emde <martinemde@users.noreply.github.com>

Fix spec for using IO.popen

259610f

segiddins approved these changes May 17, 2025

View reviewed changes

atpons added 2 commits May 18, 2025 12:47

Check Process.last_status for fail execution command

db1e5ab

Merge branch 'master' into add-credential-helper

5b91e1d

hsbt removed the request for review from deivid-rodriguez November 20, 2025 01:40

hsbt added the bundler: feature label Nov 20, 2025

nekketsuuu reviewed Feb 27, 2026

View reviewed changes

matzbot pushed a commit to ruby/ruby that referenced this pull request Mar 4, 2026

Add NEWS.md entry for ENV.fetch_values and that tests

115b4c6

From ruby/rubygems#8501 Co-authored-by: Suleyman Musayev <96992680+msuliq@users.noreply.github.com>

Uh oh!

Conversation

atpons commented Feb 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was the end-user or developer problem that led to this PR?

What is your fix for the problem, implemented in this PR?

Make sure the following tasks are checked

Uh oh!

welcome bot commented Feb 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

deivid-rodriguez commented Feb 28, 2025

Uh oh!

bootjp commented Apr 18, 2025

Uh oh!

atpons commented Apr 18, 2025

Uh oh!

martinemde left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

atpons commented May 17, 2025

Uh oh!

segiddins left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nekketsuuu commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

atpons commented Mar 3, 2026

Uh oh!

nekketsuuu commented Mar 3, 2026

Uh oh!

hsbt commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

atpons commented Feb 18, 2025 •

edited

Loading

nekketsuuu commented Feb 27, 2026 •

edited

Loading