LinuxSuRen / LinuxSuRen/gh-dev

Add support for secure token storage

Open
#1 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
8
Forks
0
PR merge metrics
No merged PRs in 30d

Description

### Token storage change in [latest release](https://github.com/cli/cli/releases/latest) of [gh](https://github.com/cli/cli)

This is a message from the GitHub CLI team, maintainers of `gh`, writing to inform you that the most recent release of `gh` contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file.
The keyrings that are supported are:

- Keychain on macOS

- GNOME Keyring on Linux (Secret Service dbus interface)

- Wincred on Windows

This has huge security benefits for the users of our tool and was one of our oldest outstanding [issues](https://github.com/cli/cli/issues/449). Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.

In order to have continued compatibility with `gh` there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.

### Extensions built in Go using [go-gh](https://github.com/cli/go-gh):

1. Upgrade your `go-gh` version to v1.2.1, the latest version.

- This can be done using `go get github.com/cli/go-gh@v1.2.1`

2. Verify that in your extension retrieval of the user authentication token is done using the `auth.TokenForHost` function.

- If you were previously accessing the authentication token using any other method it will no longer work.
- Automatic resolution of the authentication token when using the API clients will continue to work without changes.

### All other extensions:

1. Verify that in your extension retrieval of the user authentication token is done by shelling out to the `gh auth token` command.

- If you were previously accessing the authentication token using the `gh config get` command, reading the configuration file directly, or any other methods it will no longer work.

As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a [discussion in the gh](https://github.com/cli/cli/discussions) repo.

Thanks,
The GitHub CLI Team

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating how the extension retrieves the user's authentication token; the issue provides no file or test entry point. Check whether the extension uses go-gh's auth.TokenForHost function or shells out to gh auth token rather than reading configuration directly. Done means token retrieval remains compatible with system keyring storage.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, go, shell
Domain
authentication, cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.