github / github/gh-gei

Add support for secure token storage

Open
#1,580 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
478
Forks
146
Avg merge
7d 21h
Merged PRs (30d)
2

Description

### Token storage change in [latest release](https://github.com/cli/cli/releases/latest) of [gh](https://github.com/cli/cli)

This is a message from the GitHub CLI team, maintainers of `gh`, writing to inform you that the most recent release of `gh` contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file.
The keyrings that are supported are:

- Keychain on macOS

- GNOME Keyring on Linux (Secret Service dbus interface)

- Wincred on Windows

This has huge security benefits for the users of our tool and was one of our oldest outstanding [issues](https://github.com/cli/cli/issues/449). Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.

In order to have continued compatibility with `gh` there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.

### Extensions built in Go using [go-gh](https://github.com/cli/go-gh):

1. Upgrade your `go-gh` version to v1.2.1, the latest version.

- This can be done using `go get github.com/cli/go-gh@v1.2.1`

2. Verify that in your extension retrieval of the user authentication token is done using the `auth.TokenForHost` function.

- If you were previously accessing the authentication token using any other method it will no longer work.
- Automatic resolution of the authentication token when using the API clients will continue to work without changes.

### All other extensions:

1. Verify that in your extension retrieval of the user authentication token is done by shelling out to the `gh auth token` command.

- If you were previously accessing the authentication token using the `gh config get` command, reading the configuration file directly, or any other methods it will no longer work.

As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a [discussion in the gh](https://github.com/cli/cli/discussions) repo.

Thanks,
The GitHub CLI Team

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.