arcsecond 4.3.0__tar.gz → 4.3.1__tar.gz

{arcsecond-4.3.0 → arcsecond-4.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 4.3.0
+Version: 4.3.1
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-4.3.0 → arcsecond-4.3.1}/arcsecond/hosting/token.py

@@ -4,7 +4,8 @@ From the operator's side there is one fact: Arcsecond sent a token, and it
 has to be entered once so the machine can download Arcsecond.local. What it
 is underneath — a login to the container registry the images are pulled
 from, ghcr.io, as the organisation user — is this module's business, not
-theirs, and the words "registry" and "docker" stay out of what they read.
+theirs, and the words "registry" and "docker" stay out of what they read —
+except when Docker's own password store is what failed, which only they can fix.
 
 The token is asked for without echo, or read from standard input for a
 script, and handed to Docker over a pipe. There is deliberately no
@@ -96,7 +97,10 @@ def store_token(token: str) -> None:
         token=token + "\n",
     )
     if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip().splitlines()
+        output = (result.stderr or result.stdout or "").strip()
+        if _is_credential_store_failure(output):
+            raise ArcsecondError(_credential_store_advice(output))
+        detail = output.splitlines()
         reason = detail[-1] if detail else "Docker gave no reason"
         raise ArcsecondError(
             f"The token was refused: {reason}\n"
@@ -105,6 +109,43 @@ def store_token(token: str) -> None:
         )
 
 
+# Docker only saves the credential once the registry has accepted it, so these
+# words mean the token was good and the machine's own keychain failed. Docker
+# Desktop on Linux keeps credentials in `pass`, which is empty until someone
+# runs `pass init` — it says so in its install notes, and nobody reads them.
+_CREDENTIAL_STORE_FAILURES = ("error saving credentials", "error storing credentials")
+
+
+def _is_credential_store_failure(output: str) -> bool:
+    lowered = output.lower()
+    return any(words in lowered for words in _CREDENTIAL_STORE_FAILURES)
+
+
+def _credential_store_advice(output: str) -> str:
+    lowered = output.lower()
+    head = (
+        "The token is good — Arcsecond accepted it — but this machine could not "
+        "save it: Docker keeps it in a password store that refused to write.\n"
+    )
+    if "pass init" in lowered or "pass not initialized" in lowered:
+        return head + (
+            "Docker Desktop on Linux uses `pass`, and it has not been set up yet. "
+            "Set it up once, then run `arcsecond token set` again:\n"
+            "    gpg --generate-key          (any name and e-mail; note the key id it prints)\n"
+            "    pass init <that key id>\n"
+            "Or, if this machine runs Docker Engine without Docker Desktop, remove the "
+            f'"credsStore" line from {docker_config_path()} and Docker will keep the '
+            "token in that file instead."
+        )
+    detail = output.splitlines()[-1] if output else ""
+    return head + (
+        f"It said: {detail}\n"
+        'Unlock or repair that store, or remove the "credsStore" line from '
+        f"{docker_config_path()} so Docker keeps the token in that file, then run "
+        "`arcsecond token set` again."
+    )
+
+
 def prompt_for_token() -> str:
     return click.prompt(
         "Access token from Arcsecond (nothing is shown while you type)", hide_input=True

{arcsecond-4.3.0 → arcsecond-4.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arcsecond"
-version = "4.3.0"
+version = "4.3.1"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

{arcsecond-4.3.0 → arcsecond-4.3.1}/tests/test_hosting_token.py

@@ -65,6 +65,42 @@ def test_a_refused_token_is_explained_without_docker_words(docker):
     assert "registry" not in result.output.lower()
 
 
+def _login_fails_with(monkeypatch, stderr):
+    def fake_run(cmd, input=None, **kwargs):
+        return subprocess.CompletedProcess(cmd, 1, stdout="", stderr=stderr)
+
+    monkeypatch.setattr(token.subprocess, "run", fake_run)
+
+
+def test_an_uninitialised_pass_store_is_not_a_refused_token(docker, monkeypatch):
+    _login_fails_with(
+        monkeypatch,
+        "Error saving credentials: error storing credentials - err: exit status 1, "
+        'out: `pass not initialized: exit status 1: Error: password store is empty. Try "pass init".`',
+    )
+    result = _invoke("token", "set", input="ghp_good\n")
+    assert result.exit_code == 1
+    assert (
+        "token is good" in result.output
+        and "refused" not in result.output.split("\n")[0]
+    )
+    assert "pass init" in result.output and "gpg --generate-key" in result.output
+    assert "team@arcsecond.io" not in result.output
+
+
+def test_any_other_credential_store_failure_names_the_config(
+    docker, monkeypatch, tmp_path
+):
+    _login_fails_with(
+        monkeypatch,
+        "Error saving credentials: error storing credentials - err: exit status 1, out: `keychain locked`",
+    )
+    result = _invoke("token", "set", input="ghp_good\n")
+    assert result.exit_code == 1
+    assert "token is good" in result.output and "keychain locked" in result.output
+    assert "credsStore" in result.output and "gpg" not in result.output
+
+
 def test_chevrons_and_empty_input_never_reach_docker(docker):
     assert "placeholder" in _invoke("token", "set", input="<ghp_good>\n").output
     assert _invoke("token", "set", "--stdin", input="\n").exit_code == 1

{arcsecond-4.3.0 → arcsecond-4.3.1}/uv.lock

@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "arcsecond"
-version = "4.3.0"
+version = "4.3.1"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },