Skip to content

Commit a166798

Browse files
travis-architecttravis-architect
authored
Merge pull request #811 from travis-ci/sc-remove-username-auth
Remove basic auth
2 parents 654e6e1 + 1a2d774 commit a166798

File tree

11 files changed

+57
-233
lines changed

11 files changed

+57
-233
lines changed

‎README.md

+4-35
Original file line numberDiff line numberDiff line change
@@ -233,22 +233,11 @@ default API endpoint dropped (was https://api.travis-ci.com/)
233233
The `login` command will, well, log you in. That way, all subsequent commands that run against the same endpoint will be authenticated.
234234

235235
``` console
236-
$ travis login
237-
We need your GitHub login to identify you.
238-
This information will not be sent to Travis CI, only to GitHub.
239-
The password will not be displayed.
240-
241-
Try running with --github-token or --auto if you don't want to enter your password anyway.
242-
243-
Username: rkh
244-
Password: *******************
245-
246-
Successfully logged in!
236+
$ travis login --pro --github-token ghp_********
237+
Successfully logged in as rkh!
247238
```
248239

249-
As you can see above, it will ask you for your GitHub user name and password, but not send these to Travis CI. Instead, it will use them to create a GitHub API token, show the token to Travis, which then on its own checks if you really are who you say you are, and gives you an access token for the Travis API in return. The client will then delete the GitHub token again, just to be sure. But don't worry, all that happens under the hood and fully automatic.
250-
251-
If you don't want it to send your credentials to GitHub, you can create a GitHub token on your own and supply it via `--github-token`. In that case, the client will not delete the GitHub token (as it can't, it needs your password to do this). Travis CI will not store the token, though - after all, it already should have a valid token for you in the database.
240+
You need to use a GitHub token and supply it via `--github-token`. Travis CI will not store the token, though - after all, it already should have a valid token for you in the database.
252241
*NOTE*: When creating a GitHub token, see [GitHub Permissions used by travis-ci.com](https://docs.travis-ci.com/user/github-oauth-scopes/#travis-ci-for-private-projects) or [GitHub Permissions used by travis-ci.org](https://docs.travis-ci.com/user/github-oauth-scopes/#travis-ci-for-open-source-projects). The token permissions are dependent on use of travis-ci.com or travis-ci.org and not if they are public or private repositories.
253242

254243
A third option is for the really lazy: `--auto`. In this mode the client will try to find a GitHub token for you and just use that. This will only work if you have a [global GitHub token](https://help.github.com/articles/git-over-https-using-oauth-token) stored in your [.netrc](http://blogdown.io/c4d42f87-80dd-45d5-8927-4299cbdf261c/posts/574baa68-f663-4dcf-88b9-9d41310baf2f). If you haven't heard of this, it's worth looking into in general. Again: Travis CI will not store that token.
@@ -1560,26 +1549,6 @@ puts "Hello #{Travis::User.current.name}!"
15601549

15611550
Travis CI will not store that token.
15621551

1563-
It also ships with a tool for generating a GitHub token from a user name and password via the GitHub API:
1564-
1565-
``` ruby
1566-
require 'travis'
1567-
require 'travis/tools/github'
1568-
1569-
# drop_token will make the token a temporary one
1570-
github = Travis::Tools::Github.new(drop_token: true) do |g|
1571-
g.ask_login = -> { print("GitHub login: "); gets }
1572-
g.ask_password = -> { print("Password: "); gets }
1573-
g.ask_otp = -> { print("Two-factor token: "); gets }
1574-
end
1575-
1576-
github.with_token do |token|
1577-
Travis.github_auth(token)
1578-
end
1579-
1580-
puts "Hello #{Travis::User.current.name}!"
1581-
```
1582-
15831552
There is also `travis/auto_login`, which will try to read the CLI configuration or .netrc for a Travis CI or GitHub token to authenticate with automatically:
15841553

15851554
``` ruby
@@ -2027,7 +1996,7 @@ See also [Note on Ubuntu](#ubuntu) below.
20271996
For Ruby 2.3.x, be sure to have a compatible version of `faraday` installed; e.g.,
20281997
20291998
$ gem install faraday -v 1.0.1
2030-
1999+
20312000
### Development Version
20322001
20332002
You can also install the development version via RubyGems:

‎examples/pro_auth.rb

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
require 'travis/tools/github'
33
require 'highline/import' # so we can hide the password
44

5+
github_token = ask("GitHub token: ")
6+
57
# Set up GitHub tool for doing the login handshake.
68
github = Travis::Tools::Github.new(drop_token: true) do |g|
7-
g.ask_login = -> { ask("GitHub login: ") }
8-
g.ask_password = -> { ask("Password: ") { |q| q.echo = "*" } }
9-
g.ask_otp = -> { ask("Two-factor token: ") }
9+
g.github_token = github_token
1010
end
1111

1212
# Create temporary GitHub token and use it to authenticate against Travis CI.
@@ -16,7 +16,7 @@
1616

1717
# Look up the current user.
1818
user = Travis::Pro::User.current
19-
puts "Hello #{user.name}!"
19+
puts "Hello #{user.login}!"
2020

2121
# Display repositories the user is a member of.
2222
repos = Travis::Pro::Repository.find_all(member: user.login)

‎lib/travis/cli/login.rb

+3-16
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ class Login < ApiCommand
1010
description "authenticates against the API and stores the token"
1111
on('-g', '--github-token TOKEN', 'identify by GitHub token')
1212
on('-T', '--auto-token', 'try to figure out who you are automatically (might send another apps token to Travis, token will not be stored)')
13-
on('-p', '--auto-password', 'try to load password from OSX keychain (will not be stored)')
14-
on('-a', '--auto', 'shorthand for --auto-token --auto-password') { |c| c.auto_token = c.auto_password = true }
15-
on('-u', '--user LOGIN', 'user to log in as') { |c,n| c.user_login = n }
16-
on('-M', '--no-manual', 'do not use interactive login')
1713
on('--list-github-token', 'instead of actually logging in, list found GitHub tokens')
1814
on('--skip-token-check', 'don\'t verify the token with github')
1915

@@ -55,17 +51,11 @@ def github
5551
load_gh
5652
Tools::Github.new(session.config['github']) do |g|
5753
g.note = "temporary token to identify with the travis command line client against #{api_endpoint}"
58-
g.manual_login = no_manual.nil?
5954
g.explode = explode?
6055
g.github_token = github_token
6156
g.auto_token = auto_token
62-
g.auto_password = auto_password
63-
g.github_login = user_login
6457
g.check_token = !skip_token_check?
6558
g.drop_token = !list_github_token
66-
g.ask_login = proc { ask("Username: ") }
67-
g.ask_password = proc { |user| ask("Password for #{user}: ") { |q| q.echo = "*" } }
68-
g.ask_otp = proc { |user| ask("Two-factor authentication code for #{user}: ") }
6959
g.login_header = proc { login_header }
7060
g.debug = proc { |log| debug(log) }
7161
g.after_tokens = proc { g.explode = true and error("no suitable github token found") }
@@ -74,12 +64,9 @@ def github
7464
end
7565

7666
def login_header
77-
say "We need your #{color("GitHub login", :important)} to identify you."
78-
say "This information will #{color("not be sent to Travis CI", :important)}, only to #{color(github_endpoint.host, :info)}."
79-
say "The password will not be displayed."
80-
empty_line
81-
say "Try running with #{color("--github-token", :info)} or #{color("--auto", :info)} if you don't want to enter your password anyway."
82-
empty_line
67+
say "GitHub deprecated its Authorizations API exchanging a password for a token."
68+
say "Please visit https://github.blog/2020-07-30-token-authentication-requirements-for-api-and-git-operations for more information."
69+
say "Try running with #{color("--github-token", :info)} or #{color("--auto-token", :info)} ."
8370
end
8471
end
8572
end

‎lib/travis/cli/repo_command.rb

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ module CLI
66
class RepoCommand < ApiCommand
77
GIT_REGEX = %r{/?(.*/.+?)(\.git)?$}
88
TRAVIS = %r{^https://(staging-)?api\.travis-ci\.(org|com)}
9+
on('-g', '--github-token TOKEN', 'identify by GitHub token')
910
on('-r', '--repo SLUG', 'repository to use (will try to detect from current git clone)') do |c, slug|
1011
c.slug = slug
1112
c.error "SLUG should be of the form OWNER/REPO" unless slug.split('/').compact.size == 2

‎lib/travis/cli/setup/releases.rb

+6-4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ class Releases < Service
1010
def run
1111
deploy 'releases' do |config|
1212
github.with_token { |t| config['api_key'] = t }
13+
if config['api_key'].nil?
14+
raise Travis::Client::GitHubLoginFailed, 'all GitHub tokens given were invalid'
15+
end
16+
1317
config['file'] = ask("File to Upload: ").to_s
1418
end
1519
end
@@ -19,9 +23,7 @@ def github
1923
load_gh
2024
Tools::Github.new(session.config['github']) do |g|
2125
g.drop_token = false
22-
g.ask_login = proc { ask("Username: ") }
23-
g.ask_password = proc { |user| ask("Password for #{user}: ") { |q| q.echo = "*" } }
24-
g.ask_otp = proc { |user| ask("Two-factor authentication code for #{user}: ") }
26+
g.github_token = github_token
2527
g.debug = proc { |log| debug(log) }
2628
g.after_tokens = proc { g.explode = true and error("no suitable github token found") }
2729
g.scopes = org? ? ['public_repo'] : ['repo']
@@ -32,4 +34,4 @@ def github
3234
end
3335
end
3436
end
35-
end
37+
end

‎lib/travis/cli/sshkey.rb

+29-24
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ class Sshkey < RepoCommand
1313
on '-c', '--check', 'set exit code depending on key existing'
1414
on '-g', '--generate', 'generate SSH key and set up for given GitHub user'
1515
on '-p', '--passphrase PASSPHRASE', 'pass phrase to decrypt with when using --upload'
16+
on '-g', '--github-token TOKEN', 'identify by GitHub token'
1617

1718
def_delegators :repository, :ssh_key
1819

@@ -51,27 +52,34 @@ def delete_key
5152
end
5253

5354
def generate_key
54-
github.with_basic_auth do |gh|
55-
login = gh['user']['login']
56-
check_access(gh)
57-
empty_line
55+
access_token = nil
56+
github.with_token do |token|
57+
access_token = github_auth(token)
58+
end
59+
session.access_token = nil
60+
unless access_token
61+
raise Travis::Client::GitHubLoginFailed, "all GitHub tokens given were invalid"
62+
end
63+
gh = GH.with(token: github_token)
64+
login = gh['user']['login']
65+
check_access(gh)
66+
empty_line
5867

59-
say "Generating RSA key."
60-
private_key = Tools::SSLKey.generate_rsa
61-
self.description ||= "key for fetching dependencies for #{slug} via #{login}"
68+
say "Generating RSA key."
69+
private_key = Tools::SSLKey.generate_rsa
70+
self.description ||= "key for fetching dependencies for #{slug} via #{login}"
6271

63-
say "Uploading public key to GitHub."
64-
gh.post("/user/keys", :title => "#{description} (Travis CI)", :key => Tools::SSLKey.rsa_ssh(private_key.public_key))
72+
say "Uploading public key to GitHub."
73+
gh.post("/user/keys", :title => "#{description} (Travis CI)", :key => Tools::SSLKey.rsa_ssh(private_key.public_key))
6574

66-
say "Uploading private key to Travis CI."
67-
ssh_key.update(:value => private_key.to_s, :description => description)
75+
say "Uploading private key to Travis CI."
76+
ssh_key.update(:value => private_key.to_s, :description => description)
6877

69-
empty_line
70-
say "You can store the private key to reuse it for other repositories (travis sshkey --upload FILE)."
71-
if agree("Store private key? ") { |q| q.default = "no" }
72-
path = ask("Path: ") { |q| q.default = "id_travis_rsa" }
73-
File.write(path, private_key.to_s)
74-
end
78+
empty_line
79+
say "You can store the private key to reuse it for other repositories (travis sshkey --upload FILE)."
80+
if agree("Store private key? ") { |q| q.default = "no" }
81+
path = ask("Path: ") { |q| q.default = "id_travis_rsa" }
82+
File.write(path, private_key.to_s)
7583
end
7684
end
7785

@@ -97,9 +105,7 @@ def github
97105
Tools::Github.new(session.config['github']) do |g|
98106
g.note = "token for fetching dependencies for #{slug} (Travis CI)"
99107
g.explode = explode?
100-
g.ask_login = proc { ask("Username: ") }
101-
g.ask_password = proc { |user| ask("Password for #{user}: ") { |q| q.echo = "*" } }
102-
g.ask_otp = proc { |user| ask("Two-factor authentication code for #{user}: ") }
108+
g.github_token = github_token
103109
g.login_header = proc { login_header }
104110
g.debug = proc { |log| debug(log) }
105111
g.after_tokens = proc { g.explode = true and error("no suitable github token found") }
@@ -108,10 +114,9 @@ def github
108114
end
109115

110116
def login_header
111-
say "We need the #{color("GitHub login", :important)} for the account you want to add the key to."
112-
say "This information will #{color("not be sent to Travis CI", :important)}, only to #{color(github_endpoint.host, :info)}."
113-
say "The password will not be displayed."
114-
empty_line
117+
say "GitHub deprecated its Authorizations API exchanging a password for a token."
118+
say "Please visit https://github.blog/2020-07-30-token-authentication-requirements-for-api-and-git-operations for more information."
119+
say "Try running with #{color("--github-token", :info)} or #{color("--auto-token", :info)} ."
115120
end
116121
end
117122
end

‎lib/travis/client/auto_login.rb

-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ def authenticate
2424
def github
2525
@github ||= Tools::Github.new(session.config['github']) do |g|
2626
g.explode = true
27-
g.manual_login = false
2827
g.auto_token = @auto_token
2928
g.after_tokens = proc { raise NoTokenError, "no suitable github token found" } if @raise
3029
end

0 commit comments

Comments
 (0)