You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When repository.authenticate is set to always, username and password are used both at upload and download time.
When this happens the credentials are leaked in the logs when uploading the package (put)
Finding package to upload
Glob output/* matched files: ['/tmp/build/put/output/package-0.0.7-py3-none-any.whl', '/tmp/build/put/output/package-0.0.7.tar.gz']
Check that the package name = input name
Uploading /tmp/build/put/output/package-0.0.7.tar.gz version 0.0.7
Uploading distributions to https://username:password@repo_url.com/
Uploading package-0.0.7.tar.gz
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 168.0/168.0 kB • 00:00 • 84.9 MB/s
Note that the leakage does not happen at download time (get), even though username and password are still required for the download to succeed.
Output directory: /tmp/build/get
Try 1 of 3 to call function `download_version` from module `pypi_resource.in_`
Downloading https://repo_url.com/package/package-0.0.7.tar.gz (164 kB)
I believe a way to fix this issue would be to sanitize the url in the upload_package function here:
The reasoning is that the username and password are removed from the URL, but this should work because twine receives username and password from the environmental variables as well.
The text was updated successfully, but these errors were encountered:
def get_repository_from_config(
config_file: str,
repository: str,
repository_url: Optional[str] = None,
) -> RepositoryConfig:
"""Get repository config command-line values or the .pypirc file."""
# Prefer CLI `repository_url` over `repository` or .pypirc
if repository_url:
_validate_repository_url(repository_url)
return {
"repository": repository_url,
"username": None,
"password": None,
}
try:
return get_config(config_file)[repository]
except OSError as exc:
raise exceptions.InvalidConfiguration(str(exc))
except KeyError:
raise exceptions.InvalidConfiguration(
f"Missing '{repository}' section from {config_file}.\n"
f"More info: https://packaging.python.org/specifications/pypirc/ "
)
Meaning that username and password are managed separately (and thus not leaked) when they are passed as environmental variables (they are actually managed by the auth.Resolver object).
Hi,
When
repository.authenticate
is set toalways
, username and password are used both at upload and download time.When this happens the credentials are leaked in the logs when uploading the package (
put
)Note that the leakage does not happen at download time (
get
), even though username and password are still required for the download to succeed.I believe a way to fix this issue would be to sanitize the url in the
upload_package
function here:The reasoning is that the username and password are removed from the URL, but this should work because twine receives username and password from the environmental variables as well.
The text was updated successfully, but these errors were encountered: