Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for secure token storage #1

Open
samcoe opened this issue Mar 8, 2023 · 0 comments
Open

Add support for secure token storage #1

samcoe opened this issue Mar 8, 2023 · 0 comments

Comments

@samcoe
Copy link

samcoe commented Mar 8, 2023

Token storage change in latest release of gh

This is a message from the GitHub CLI team, maintainers of gh, writing to inform you that the most recent release of gh contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file.
The keyrings that are supported are:

  • Keychain on macOS

  • GNOME Keyring on Linux (Secret Service dbus interface)

  • Wincred on Windows

This has huge security benefits for the users of our tool and was one of our oldest outstanding issues. Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.

In order to have continued compatibility with gh there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.

Extensions built in Go using go-gh:

  1. Upgrade your go-gh version to v1.2.1, the latest version.

  2. Verify that in your extension retrieval of the user authentication token is done using the auth.TokenForHost function.

    • If you were previously accessing the authentication token using any other method it will no longer work.
    • Automatic resolution of the authentication token when using the API clients will continue to work without changes.

All other extensions:

  1. Verify that in your extension retrieval of the user authentication token is done by shelling out to the gh auth token command.

    • If you were previously accessing the authentication token using the gh config get command, reading the configuration file directly, or any other methods it will no longer work.

As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a discussion in the gh repo.

Thanks,
The GitHub CLI Team

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant