feat: PyPI Token Security with 1Password Integration

[Anselmoo]

Summary

Integrate the ability to securely store and retrieve PyPI API tokens within 1Password, enhancing the security and convenience of Python package publishing workflows.

Use Cases

• Secure Storage: Developers need a safe place to store their PyPI API tokens to prevent unauthorized access and potential security breaches.

• Automated Workflows: Continuous Integration (CI) and manual upload via $HOME/.pypirc systems require access to PyPI tokens to publish packages. Storing these tokens in 1Password allows for secure retrieval during automated deployment processes.

• Team Collaboration: In collaborative environments, sharing PyPI tokens securely among team members is essential. 1Password facilitates controlled access, ensuring only authorized personnel can use the tokens.

Proposed Solution

Develop a 1Password integration that allows users to:

1. Store PyPI Tokens: Save PyPI API tokens in a designated vault within 1Password.

2. Retrieve Tokens via CLI: Use the 1Password CLI to fetch tokens during CI processes or local development, ensuring tokens are not hard-coded or stored in less secure locations.

3. Access Control: Utilize 1Password's sharing features to manage who can access specific tokens, enhancing security in team settings.

Is There a Workaround to Accomplish This Today?

Currently, developers can manually store PyPI tokens in 1Password and retrieve them as needed. However, this process lacks automation and may not seamlessly integrate with CI workflows.

References & Prior Work

• 1Password CLI Documentation: Provides guidance on integrating 1Password with development workflows.

• PyPI API Token Creation: Details on generating and managing PyPI API tokens.

• OAuthManager: A Python package that manages API authentication using 1Password Service Accounts and securely caches credentials, but comes without link to the repository oai_citation_attribution:0‡pypi.org

• onepassword Python Library: A Python wrapper for the 1Password CLI, facilitating interaction with 1Password vaults with last update five years ago. oai_citation_attribution:1‡pypi.org and repository

• 1pass: A command-line interface and Python library for reading passwords from 1Password, useful for integrating 1Password into development workflows with last update eight years ago. oai_citation_attribution:2‡pypi.org and repository