Add credential_hosts source param to scope HTTP(S) credentials - #483
Open
hiddingtrojans wants to merge 2 commits into
Open
Add credential_hosts source param to scope HTTP(S) credentials#483hiddingtrojans wants to merge 2 commits into
hiddingtrojans wants to merge 2 commits into
Conversation
Refs concourse#482. When set, username/password are written to .netrc as machine-scoped entries for the listed hosts instead of the default entry, which matches every host and so sends the credentials to any host a submodule URL points at. Omitting the param keeps the previous behavior. Uses the same machine-scoping mechanism submodule_credentials already uses. Signed-off-by: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
|
|
A bare string (credential_hosts: "host1") previously failed the jq iteration, and because 'local' masks the exit code the function fell through to writing the default netrc entry - silently unscoping the credentials the user meant to restrict. Accept a string (single or space-separated, matching the ignore_paths convention) as well as a list. Signed-off-by: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This implements the opt-in host-list option from #482, with a regression test and README docs.
Refs #482.
What
New optional source param
credential_hosts: a list of hostnames theHTTP(S)
username/passwordmay be sent to.When set, the credentials are written to
.netrcasmachine-scopedentries for the listed hosts (the same mechanism
submodule_credentialsalready uses) instead of the
defaultentry, which matches every host.When omitted, the
defaultentry is written exactly as before, soexisting pipelines are unaffected.
Why
With the
defaultentry, the main repo credentials are sent to whateverhost a submodule URL points at (#482). Scoping to explicit hosts keeps
same-host submodules working; cross-host submodules authenticate via
submodule_credentialsas documented.Test
it_scopes_credentials_to_credential_hostsintest/check.shcovers:machine-scoped entry per listed hostdefaultentry is written.netrcis still cleared between requestsNotes
Hosts are matched by hostname, as netrc does (no protocol). Documented in
the source config table next to
username/password.