ykcheungab
399 lines
15 KiB
Python
399 lines
15 KiB
Python
"""PyPI credential setup: locate, inspect and write ``~/.pypirc``.
|
|
|
|
Editing the config from a command rather than by hand avoids the two mistakes
|
|
that actually happen: putting something other than ``__token__`` in ``username``,
|
|
and pasting a TestPyPI token into the ``[pypi]`` section (the two indexes reject
|
|
each other's tokens with 403, and both token kinds start with ``pypi-``).
|
|
|
|
The writer does targeted text edits rather than rewriting through configparser,
|
|
so the explanatory comments in the file survive.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import configparser
|
|
import getpass
|
|
import os
|
|
import sys
|
|
from dataclasses import dataclass, field
|
|
from pathlib import Path
|
|
|
|
INDEXES: dict[str, dict[str, str | None]] = {
|
|
"pypi": {
|
|
"upload_url": "https://upload.pypi.org/legacy/",
|
|
"json_url": "https://pypi.org/pypi/orisys/json",
|
|
"simple_url": "https://pypi.org/simple/",
|
|
"token_url": "https://pypi.org/manage/account/token/",
|
|
"register_url": None,
|
|
},
|
|
"testpypi": {
|
|
"upload_url": "https://test.pypi.org/legacy/",
|
|
"json_url": "https://test.pypi.org/pypi/orisys/json",
|
|
"simple_url": "https://test.pypi.org/simple/",
|
|
"token_url": "https://test.pypi.org/manage/account/token/",
|
|
"register_url": "https://test.pypi.org/account/register/",
|
|
},
|
|
}
|
|
|
|
# Substrings that mark a token slot that was never filled in.
|
|
PLACEHOLDER_MARKERS = ("PASTE", "REPLACE", "TOKEN-HERE", "YOUR-TOKEN", "XXXX")
|
|
|
|
DEFAULT_TEMPLATE = """\
|
|
# PyPI / TestPyPI credentials for twine.
|
|
#
|
|
# Keep this file out of any git repository: a token committed once stays in the
|
|
# history even after you delete it.
|
|
#
|
|
# * username is literally "__token__" - never an account name or email
|
|
# * PyPI and TestPyPI tokens both start with "pypi-" but are NOT
|
|
# interchangeable: each index rejects the other's with 403
|
|
# * TestPyPI is a separate service with a separate account
|
|
|
|
[distutils]
|
|
index-servers =
|
|
"""
|
|
|
|
|
|
@dataclass
|
|
class CredentialState:
|
|
index: str
|
|
configured: bool
|
|
source: str | None = None
|
|
problem: str | None = None
|
|
|
|
|
|
@dataclass
|
|
class TwineLookup:
|
|
"""What twine's own resolver says about one index."""
|
|
|
|
available: bool
|
|
known: bool
|
|
config: dict = field(default_factory=dict)
|
|
error: str | None = None
|
|
|
|
|
|
def pypirc_path() -> Path:
|
|
"""Where twine looks by default: ``~/.pypirc`` (same expansion twine uses)."""
|
|
return Path(os.path.expanduser("~")) / ".pypirc"
|
|
|
|
|
|
def looks_like_placeholder(token: str) -> bool:
|
|
upper = token.upper()
|
|
return any(marker in upper for marker in PLACEHOLDER_MARKERS)
|
|
|
|
|
|
def parse_pypirc(text: str) -> dict[str, dict[str, str]]:
|
|
"""Section -> key -> value, tolerating comments and continuation lines."""
|
|
sections: dict[str, dict[str, str]] = {}
|
|
current: str | None = None
|
|
for raw in text.splitlines():
|
|
line = raw.strip()
|
|
if not line or line.startswith(("#", ";", "%")):
|
|
continue
|
|
if line.startswith("[") and line.endswith("]"):
|
|
current = line[1:-1].strip()
|
|
sections.setdefault(current, {})
|
|
continue
|
|
if current is not None and "=" in line:
|
|
key, _, value = line.partition("=")
|
|
sections[current][key.strip()] = value.strip()
|
|
return sections
|
|
|
|
|
|
def credential_state(
|
|
index: str,
|
|
*,
|
|
path: Path | None = None,
|
|
env: dict | None = None,
|
|
) -> CredentialState:
|
|
"""Is ``index`` usable by twine, and why not when it is not.
|
|
|
|
Delegates to ``twine.utils.get_config`` when twine is importable, because the
|
|
only definition that matters is twine's. The important subtlety that a naive
|
|
check misses: **twine ignores any section not listed in
|
|
``[distutils] index-servers``** (with a fallback of ``pypi testpypi`` when the
|
|
key is absent). A ``[testpypi]`` section without that listing looks configured
|
|
but twine reports "Missing 'testpypi' section".
|
|
"""
|
|
if index not in INDEXES:
|
|
raise ValueError(f"unknown index {index!r}; expected one of {sorted(INDEXES)}")
|
|
|
|
env = os.environ if env is None else env
|
|
if env.get("TWINE_PASSWORD"):
|
|
return CredentialState(index, True, "environment variables")
|
|
|
|
path = path or pypirc_path()
|
|
if not path.is_file():
|
|
return CredentialState(index, False, None, f"{path} does not exist yet")
|
|
|
|
try:
|
|
text = path.read_text(encoding="utf-8", errors="ignore")
|
|
except OSError as exc:
|
|
return CredentialState(index, False, None, f"cannot read {path}: {exc}")
|
|
|
|
sections = parse_pypirc(text)
|
|
if index not in sections and index not in index_servers(text):
|
|
# Do not blame index-servers for a section that simply is not there.
|
|
return CredentialState(index, False, None, f"{path} has no [{index}] section")
|
|
|
|
lookup = _twine_lookup(index, path)
|
|
if lookup.error:
|
|
return CredentialState(index, False, None, f"twine cannot read {path}: {lookup.error}")
|
|
|
|
if lookup.available:
|
|
if not lookup.known:
|
|
return CredentialState(index, False, None, _ignored_section(index, path, text, sections))
|
|
username = str(lookup.config.get("username") or "").strip()
|
|
password = str(lookup.config.get("password") or "").strip()
|
|
if not password:
|
|
# twine knows the index but resolved no password for it: almost always
|
|
# a section that index-servers does not list.
|
|
detail = _ignored_section(index, path, text, sections)
|
|
return CredentialState(index, False, None, detail)
|
|
else:
|
|
# twine is not installed: replicate its rule locally.
|
|
if index not in index_servers(text):
|
|
return CredentialState(index, False, None, _ignored_section(index, path, text, sections))
|
|
section = sections[index]
|
|
username = section.get("username", "").strip()
|
|
password = section.get("password", "").strip()
|
|
|
|
if looks_like_placeholder(password):
|
|
return CredentialState(
|
|
index, False, str(path), f"[{index}] still contains a placeholder token"
|
|
)
|
|
if username != "__token__":
|
|
return CredentialState(
|
|
index,
|
|
False,
|
|
str(path),
|
|
f"[{index}] username is {username!r}; API tokens need the literal '__token__'",
|
|
)
|
|
return CredentialState(index, True, str(path))
|
|
|
|
|
|
def _ignored_section(
|
|
index: str, path: Path, text: str, sections: dict[str, dict[str, str]]
|
|
) -> str:
|
|
"""Name the real cause: absent section, or present but not listed by twine."""
|
|
if index not in sections:
|
|
return f"{path} has no [{index}] section"
|
|
if index not in index_servers(text):
|
|
return (
|
|
f"[{index}] exists in {path} but is not listed in "
|
|
"[distutils] index-servers, so twine ignores it entirely; "
|
|
"fix with `release auth --repair`"
|
|
)
|
|
return f"twine resolves no password for [{index}] from {path}"
|
|
|
|
|
|
def _twine_lookup(index: str, path: Path) -> TwineLookup:
|
|
"""Ask twine itself; ``available=False`` when twine is not installed.
|
|
|
|
``get_config`` is not enough on its own: it always contains a ``pypi`` entry
|
|
(and a ``testpypi`` one when listed) even when it never copied any
|
|
credentials, so the resolved username/password are what matter.
|
|
"""
|
|
try:
|
|
from twine import utils
|
|
except ImportError:
|
|
return TwineLookup(available=False, known=False)
|
|
try:
|
|
config = utils.get_config(str(path))
|
|
except Exception as exc: # twine reports malformed files as exceptions
|
|
return TwineLookup(available=True, known=False, error=f"{type(exc).__name__}: {exc}")
|
|
section = config.get(index)
|
|
if section is None:
|
|
return TwineLookup(available=True, known=False)
|
|
return TwineLookup(available=True, known=True, config=dict(section))
|
|
|
|
|
|
def index_servers(text: str) -> set[str]:
|
|
"""Names twine honours from ``[distutils] index-servers``.
|
|
|
|
Replicates ``twine.utils.get_config``, including its surprising asymmetry:
|
|
|
|
* key **absent** -> falls back to ``pypi testpypi``
|
|
* key **present but empty** -> an empty list, so *no* section is honoured
|
|
(the fallback does not apply), and every section looks configured while
|
|
twine silently ignores it
|
|
* continuation lines are part of the value, so ``index-servers =`` followed
|
|
by indented names is the normal form
|
|
"""
|
|
parser = configparser.RawConfigParser()
|
|
try:
|
|
parser.read_string(text)
|
|
except configparser.Error:
|
|
return set()
|
|
raw = parser.get("distutils", "index-servers", fallback="pypi testpypi")
|
|
return set(raw.split())
|
|
|
|
|
|
def validate_token(token: str) -> list[str]:
|
|
"""Problems with a pasted token. Empty and whitespace are fatal; the rest warn."""
|
|
return [problem for problem in _token_problems(token) if problem.startswith("ERROR")]
|
|
|
|
|
|
def token_warnings(token: str) -> list[str]:
|
|
return [problem for problem in _token_problems(token) if problem.startswith("WARN")]
|
|
|
|
|
|
def _token_problems(token: str) -> list[str]:
|
|
problems: list[str] = []
|
|
if not token:
|
|
problems.append("ERROR the token is empty")
|
|
return problems
|
|
if any(char.isspace() for char in token):
|
|
problems.append("ERROR the token contains whitespace (copy/paste artefact?)")
|
|
if not token.startswith("pypi-"):
|
|
problems.append(
|
|
"WARN PyPI API tokens start with 'pypi-'; a legacy account password also "
|
|
"works but needs username != '__token__'"
|
|
)
|
|
if len(token) < 20:
|
|
problems.append("WARN the token looks too short; check the paste was complete")
|
|
return problems
|
|
|
|
|
|
def unlisted_sections(path: Path | None = None) -> list[str]:
|
|
"""Known indexes whose section exists but is missing from ``index-servers``."""
|
|
path = path or pypirc_path()
|
|
if not path.is_file():
|
|
return []
|
|
text = path.read_text(encoding="utf-8", errors="ignore")
|
|
present = set(parse_pypirc(text))
|
|
listed = index_servers(text)
|
|
return [index for index in sorted(INDEXES) if index in present and index not in listed]
|
|
|
|
|
|
def repair_index_servers(path: Path | None = None) -> list[str]:
|
|
"""List sections that exist but are not in ``index-servers``.
|
|
|
|
This is the state a hand-edited file lands in: the section is present, so it
|
|
looks configured, but twine ignores it completely. Returns the indexes added.
|
|
"""
|
|
path = path or pypirc_path()
|
|
if not path.is_file():
|
|
return []
|
|
text = path.read_text(encoding="utf-8")
|
|
present = set(parse_pypirc(text))
|
|
added: list[str] = []
|
|
for index in sorted(INDEXES):
|
|
if index in present and index not in index_servers(text):
|
|
text = ensure_index_server(text, index)
|
|
added.append(index)
|
|
if added:
|
|
path.write_text(text, encoding="utf-8", newline="")
|
|
_restrict_permissions(path)
|
|
return added
|
|
|
|
|
|
def upsert_token(text: str, index: str, token: str) -> str:
|
|
"""Set ``password`` inside ``[index]``, creating the section if needed."""
|
|
lines = text.splitlines()
|
|
start = next((i for i, line in enumerate(lines) if line.strip() == f"[{index}]"), None)
|
|
|
|
if start is None:
|
|
if lines and lines[-1].strip():
|
|
lines.append("")
|
|
lines.extend(
|
|
[
|
|
f"[{index}]",
|
|
f"repository = {INDEXES[index]['upload_url']}",
|
|
"username = __token__",
|
|
f"password = {token}",
|
|
]
|
|
)
|
|
return "\n".join(lines) + "\n"
|
|
|
|
end = len(lines)
|
|
for offset in range(start + 1, len(lines)):
|
|
stripped = lines[offset].strip()
|
|
if stripped.startswith("[") and stripped.endswith("]"):
|
|
end = offset
|
|
break
|
|
|
|
insert_at = end
|
|
for offset in range(start + 1, end):
|
|
stripped = lines[offset].strip()
|
|
if stripped.startswith("password"):
|
|
lines[offset] = f"password = {token}"
|
|
return "\n".join(lines) + "\n"
|
|
if stripped.startswith(("username", "repository")):
|
|
insert_at = offset + 1
|
|
lines.insert(insert_at, f"password = {token}")
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def ensure_index_server(text: str, index: str) -> str:
|
|
"""Make sure ``[distutils] index-servers`` lists ``index``."""
|
|
if index in index_servers(text):
|
|
return text
|
|
|
|
lines = text.splitlines()
|
|
if "[distutils]" not in (line.strip() for line in lines):
|
|
block = ["[distutils]", "index-servers =", f" {index}", ""]
|
|
return "\n".join(block + lines) + "\n"
|
|
|
|
start = next(i for i, line in enumerate(lines) if line.strip() == "[distutils]")
|
|
for offset in range(start + 1, len(lines)):
|
|
if lines[offset].strip().startswith("index-servers"):
|
|
lines.insert(offset + 1, f" {index}")
|
|
return "\n".join(lines) + "\n"
|
|
lines.insert(start + 1, f" {index}")
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def _restrict_permissions(path: Path) -> None:
|
|
"""Best effort: owner-only. Windows ACLs need icacls, not chmod."""
|
|
try:
|
|
os.chmod(path, 0o600)
|
|
except OSError:
|
|
pass
|
|
|
|
|
|
def write_token(index: str, token: str, *, path: Path | None = None) -> Path:
|
|
"""Write ``token`` into ``[index]`` of the pypirc file, preserving comments."""
|
|
if index not in INDEXES:
|
|
raise ValueError(f"unknown index {index!r}; expected one of {sorted(INDEXES)}")
|
|
|
|
path = path or pypirc_path()
|
|
if path.is_file():
|
|
text = path.read_text(encoding="utf-8")
|
|
else:
|
|
text = DEFAULT_TEMPLATE
|
|
text = upsert_token(text, index, token)
|
|
text = ensure_index_server(text, index)
|
|
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(text, encoding="utf-8", newline="")
|
|
_restrict_permissions(path)
|
|
return path
|
|
|
|
|
|
def prompt_for_token(index: str, *, prompt_fn=None, out=None) -> str | None:
|
|
"""Ask for a token with hidden input. Returns ``None`` if input is unavailable."""
|
|
out = out or sys.stdout
|
|
meta = INDEXES[index]
|
|
print(f"PyPI API token for [{index}]", file=out)
|
|
print(f" create one at: {meta['token_url']}", file=out)
|
|
if meta.get("register_url"):
|
|
print(f" needs an account first: {meta['register_url']}", file=out)
|
|
print(" input is hidden and is written only to your pypirc file", file=out)
|
|
|
|
ask = prompt_fn or getpass.getpass
|
|
try:
|
|
return ask("token: ").strip()
|
|
except (EOFError, KeyboardInterrupt, OSError):
|
|
# OSError covers environments where stdin cannot be read at all (pytest
|
|
# capture, a detached CI stdin): treat that as "cannot prompt", never as a
|
|
# crash.
|
|
print("", file=out)
|
|
print("aborted: no token entered", file=out)
|
|
return None
|
|
|
|
|
|
def read_token_from_stdin() -> str:
|
|
"""For CI: read the token from stdin instead of a prompt or the command line."""
|
|
return (sys.stdin.readline() or "").strip()
|