dependabot-cargo 0.363.0 → 0.364.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4503bf35b3f16b8ebb48564283460cfff9b114908045bf1b6a624173ae112c29
-  data.tar.gz: 495a6f4235a61d2fb5e1f8935f146ede3d8e11bd1093fd7cff04fbaa2f479b69
+  metadata.gz: 35e95d570366ab801a6d567d4688200304ac1dce0047e8565f1e2146c40fa65a
+  data.tar.gz: aac79f42481c94ac999a5c7b913ad5f9f7caebbe1e5455261d4be33606048f10
 SHA512:
-  metadata.gz: 645dbc0316c71a144916874d629bd75fc61120f96741de67186eb5ed83b213fcd35a9caaa8786d6bf77c8e08799f56bcba63a1c6148ec520be04aa7e4b583176
-  data.tar.gz: 69382ae33532748f982575fc84daa287cbbe5f44e757332cba9bce5850441844c83c948b77528b7ed95eb4d60a5e85a8228c7090628a5c9878269554340d40d1
+  metadata.gz: a0f0eeb6e1bea7acc19ab4e905740a8a876306444ed18cca36d2132eb29365a7d1a322f040fcbd006352117aba986f37f1b95015d2f90f321524f8c24d934ddf
+  data.tar.gz: 8f9eb615de4723e4a15713ba7b5053ea104a07153ec87f6cff60360c32d8fde3884d73bfc58acf118679d309f33de7edff3b63c608bdaf014808ffd5527877de

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -217,8 +217,10 @@ module Dependabot
         def run_cargo_command(command, fingerprint:)
           start = Time.now
           command = SharedHelpers.escape_command(command)
-          Helpers.setup_credentials_in_environment(credentials)
-          env = ENV.select { |key, _value| key.match(/^CARGO_REGISTRIES_/) }
+          Helpers.bypass_cargo_credential_providers
+          # Pass through any cargo registry configuration via environment variables
+          # (e.g. CARGO_REGISTRIES_CRATES_IO_PROTOCOL, CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS).
+          env = ENV.select { |key, _value| key.match(/^CARGO_REGISTR(Y|IES)_/) }
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
 
@@ -302,10 +304,11 @@ module Dependabot
 
           File.write(lockfile.name, lockfile.content)
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          return unless config
+          config_file = config
+          return unless config_file
 
-          FileUtils.mkdir_p(File.dirname(T.must(config).name))
-          File.write(T.must(config).name, T.must(config).content)
+          FileUtils.mkdir_p(File.dirname(config_file.name))
+          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
         end
 
         sig { void }

data/lib/dependabot/cargo/helpers.rb

@@ -1,28 +1,60 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
-require "yaml"
+require "toml-rb"
 
 module Dependabot
   module Cargo
     module Helpers
       extend T::Sig
 
-      sig { params(credentials: T::Array[Dependabot::Credential]).void }
-      def self.setup_credentials_in_environment(credentials)
-        credentials.each do |cred|
-          next if cred["type"] != "cargo_registry"
-          next if cred["registry"].nil? # this will not be present for org-level registries
-          next if cred["token"].nil?
+      # Disable Cargo's *global* credential providers so that Cargo does not attempt to look up registry tokens
+      # on its own. The dependabot proxy (https://github.com/dependabot/proxy/) handles all registry authentication
+      # transparently by intercepting HTTP requests and injecting the appropriate credentials.
+      #
+      # Note: this only affects the global/default credential provider. Per-registry `credential-provider` settings
+      # in .cargo/config.toml override this env var, so those are stripped separately by `sanitize_cargo_config`.
+      #
+      # Uses ||= so developers can override by setting CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS=cargo:token in their
+      # shell (along with the appropriate CARGO_REGISTRIES_{NAME}_TOKEN vars) for local development without the proxy.
+      sig { void }
+      def self.bypass_cargo_credential_providers
+        ENV["CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS"] ||= ""
+      end
+
+      # Strip per-registry `credential-provider` settings from .cargo/config.toml.
+      #
+      # Users may have entries like:
+      #   [registries.my-registry]
+      #   credential-provider = "cargo:token"
+      #
+      # These per-registry settings override the global CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS env var,
+      # causing Cargo to look up tokens locally. Since the dependabot proxy handles all registry authentication
+      # transparently, we remove these so Cargo makes plain unauthenticated requests that the proxy can intercept.
+      sig { params(config_content: String).returns(String) }
+      def self.sanitize_cargo_config(config_content)
+        parsed = TomlRB.parse(config_content)
+        return config_content unless parsed.is_a?(Hash)
 
-          # If there is a 'token' property, then apply it.
-          # In production Dependabot-Action or Dependabot-CLI will inject the real token via the Proxy.
-          token_env_var = "CARGO_REGISTRIES_#{T.must(cred['registry']).upcase.tr('-', '_')}_TOKEN"
-          ENV[token_env_var] ||= cred["token"]
+        registries = parsed["registries"]
+        if registries.is_a?(Hash)
+          registries.each_value do |registry_config|
+            registry_config.delete("credential-provider") if registry_config.is_a?(Hash)
+          end
         end
 
-        # And set CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS here as well, so Cargo will expect tokens
-        ENV["CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS"] ||= "cargo:token"
+        # Also strip credential-provider from [registry] (crates.io default registry). Users who `cargo publish`
+        # from CI may have this set. It's a per-registry override that takes precedence over the global env var,
+        # so we need to remove it to prevent Cargo from trying to look up a token.
+        registry = parsed["registry"]
+        registry.delete("credential-provider") if registry.is_a?(Hash)
+
+        TomlRB.dump(parsed)
+      rescue TomlRB::Error => e
+        raise Dependabot::DependencyFileNotParseable.new(
+          ".cargo/config.toml",
+          "Failed to parse Cargo config file: #{e.message}"
+        )
       end
     end
   end

data/lib/dependabot/cargo/package/package_details_fetcher.rb

@@ -137,10 +137,10 @@ module Dependabot
                                       .map(&:strip)
                                       .reject(&:empty?)
                                       .filter_map do |line|
-                                        JSON.parse(line)
-                                      rescue JSON::ParserError => e
-                                        Dependabot.logger.warn("Failed to parse line in sparse index: #{e.message}")
-                                        nil
+              JSON.parse(line)
+            rescue JSON::ParserError => e
+              Dependabot.logger.warn("Failed to parse line in sparse index: #{e.message}")
+              nil
             end
 
             { "versions" => parsed_response }

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -186,10 +186,10 @@ module Dependabot
         def run_cargo_command(command, fingerprint: nil)
           start = Time.now
           command = SharedHelpers.escape_command(command)
-          Helpers.setup_credentials_in_environment(credentials)
-          # Pass through any registry tokens supplied via CARGO_REGISTRIES_...
-          # environment variables, and also any CARGO_REGISTRY_... configuration.
-          env = ENV.select { |key, _value| key.match(/^(CARGO_REGISTRY|CARGO_REGISTRIES)_/) }
+          Helpers.bypass_cargo_credential_providers
+          # Pass through any cargo registry configuration via environment variables
+          # (e.g. CARGO_REGISTRIES_CRATES_IO_PROTOCOL, CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS).
+          env = ENV.select { |key, _value| key.match(/^CARGO_REGISTR(Y|IES)_/) }
 
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
@@ -215,10 +215,11 @@ module Dependabot
 
           File.write(T.must(lockfile).name, T.must(lockfile).content) if lockfile
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          return unless config
+          config_file = config
+          return unless config_file
 
-          FileUtils.mkdir_p(File.dirname(T.must(config).name))
-          File.write(T.must(config).name, T.must(config).content)
+          FileUtils.mkdir_p(File.dirname(config_file.name))
+          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
         end
 
         sig { void }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.363.0
+  version: 0.364.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.363.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.364.0
 rdoc_options: []
 require_paths:
 - lib