cloudsmith-cli 1.12.1__tar.gz → 1.14.0__tar.gz

{cloudsmith_cli-1.12.1/cloudsmith_cli.egg-info → cloudsmith_cli-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.12.1
+Version: 1.14.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Home-page: https://github.com/cloudsmith-io/cloudsmith-cli
 Author: Cloudsmith Ltd
@@ -34,9 +34,10 @@ Requires-Dist: json5>=0.9.0
 Requires-Dist: cloudsmith-api<3.0,>=2.0.24
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: mcp==1.9.1
-Requires-Dist: toon-python==0.1.2
+Requires-Dist: python-toon==0.1.2
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
+Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
 Requires-Dist: urllib3>=2.5
 Dynamic: author
@@ -87,6 +88,7 @@ The CLI currently supports the following commands (and sub-commands):
 - `delete`|`rm`:          Delete a package from a repository.
 - `dependencies`|`deps`:  List direct (non-transitive) dependencies for a package.
 - `docs`:                 Launch the help website in your browser.
+- `download`:  Download a package from a repository.
 - `entitlements`|`ents`:  Manage the entitlements for a repository.
   - `create`|`new`:         Create a new entitlement in a repository.
   - `delete`|`rm`:          Delete an entitlement from a repository.
@@ -102,6 +104,7 @@ The CLI currently supports the following commands (and sub-commands):
   - `packages`:             List packages for a repository. (Aliases `repos list`)
   - `repos`:                List repositories for a namespace (owner).
 - `login`|`token`:        Retrieve your API authentication token/key via login.
+- `logout`:               Clear stored authentication credentials and SSO tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
 - `metrics`:              Metrics and statistics for a repository.
   - `tokens`:               Retrieve bandwidth usage for entitlement tokens.
   - `packages`:             Retrieve package usage for repository.
@@ -167,6 +170,7 @@ The CLI currently supports the following commands (and sub-commands):
   - `rpm`:                  Manage rpm upstreams for a repository.
   - `ruby`:                 Manage ruby upstreams for a repository.
   - `swift`:                Manage swift upstreams for a repository.
+- `vulnerabilities`:      Retrieve vulnerability results for a package.
 - `whoami`:               Retrieve your current authentication status.
 
 ## Installation
@@ -304,6 +308,45 @@ cloudsmith push rpm --help
 ```
 
 
+## Downloading Packages
+
+You can download packages from repositories using the `cloudsmith download` command. The CLI supports various filtering options to help you find and download the exact package you need.
+
+For example, to download a specific package:
+
+```
+cloudsmith download your-account/your-repo package-name
+```
+
+You can filter by various attributes like version, format, architecture, operating system, and tags:
+
+```
+# Download a specific version
+cloudsmith download your-account/your-repo package-name --version 1.2.3
+
+# Filter by format and architecture
+cloudsmith download your-account/your-repo package-name --format deb --arch amd64
+
+# Filter by package tag (e.g., latest, stable, beta)
+cloudsmith download your-account/your-repo package-name --tag latest
+
+# Combine tag with metadata filters
+cloudsmith download your-account/your-repo package-name --tag stable --format deb --arch arm64
+
+# Download all associated files (POM, sources, javadoc, etc.)
+cloudsmith download your-account/your-repo package-name --all-files
+
+# Preview what would be downloaded without actually downloading
+cloudsmith download your-account/your-repo package-name --dry-run
+```
+
+For more advanced usage and all available options:
+
+```
+cloudsmith download --help
+```
+
+
 ## Contributing
 
 Yes! Please do contribute, this is why we love open source.  Please see [CONTRIBUTING](https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/CONTRIBUTING.md) for contribution guidelines when making code changes or raising issues for bug reports, ideas, discussions and/or questions (i.e. help required).

{cloudsmith_cli-1.12.1 → cloudsmith_cli-1.14.0}/README.md

@@ -32,6 +32,7 @@ The CLI currently supports the following commands (and sub-commands):
 - `delete`|`rm`:          Delete a package from a repository.
 - `dependencies`|`deps`:  List direct (non-transitive) dependencies for a package.
 - `docs`:                 Launch the help website in your browser.
+- `download`:  Download a package from a repository.
 - `entitlements`|`ents`:  Manage the entitlements for a repository.
   - `create`|`new`:         Create a new entitlement in a repository.
   - `delete`|`rm`:          Delete an entitlement from a repository.
@@ -47,6 +48,7 @@ The CLI currently supports the following commands (and sub-commands):
   - `packages`:             List packages for a repository. (Aliases `repos list`)
   - `repos`:                List repositories for a namespace (owner).
 - `login`|`token`:        Retrieve your API authentication token/key via login.
+- `logout`:               Clear stored authentication credentials and SSO tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
 - `metrics`:              Metrics and statistics for a repository.
   - `tokens`:               Retrieve bandwidth usage for entitlement tokens.
   - `packages`:             Retrieve package usage for repository.
@@ -112,6 +114,7 @@ The CLI currently supports the following commands (and sub-commands):
   - `rpm`:                  Manage rpm upstreams for a repository.
   - `ruby`:                 Manage ruby upstreams for a repository.
   - `swift`:                Manage swift upstreams for a repository.
+- `vulnerabilities`:      Retrieve vulnerability results for a package.
 - `whoami`:               Retrieve your current authentication status.
 
 ## Installation
@@ -249,6 +252,45 @@ cloudsmith push rpm --help
 ```
 
 
+## Downloading Packages
+
+You can download packages from repositories using the `cloudsmith download` command. The CLI supports various filtering options to help you find and download the exact package you need.
+
+For example, to download a specific package:
+
+```
+cloudsmith download your-account/your-repo package-name
+```
+
+You can filter by various attributes like version, format, architecture, operating system, and tags:
+
+```
+# Download a specific version
+cloudsmith download your-account/your-repo package-name --version 1.2.3
+
+# Filter by format and architecture
+cloudsmith download your-account/your-repo package-name --format deb --arch amd64
+
+# Filter by package tag (e.g., latest, stable, beta)
+cloudsmith download your-account/your-repo package-name --tag latest
+
+# Combine tag with metadata filters
+cloudsmith download your-account/your-repo package-name --tag stable --format deb --arch arm64
+
+# Download all associated files (POM, sources, javadoc, etc.)
+cloudsmith download your-account/your-repo package-name --all-files
+
+# Preview what would be downloaded without actually downloading
+cloudsmith download your-account/your-repo package-name --dry-run
+```
+
+For more advanced usage and all available options:
+
+```
+cloudsmith download --help
+```
+
+
 ## Contributing
 
 Yes! Please do contribute, this is why we love open source.  Please see [CONTRIBUTING](https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/CONTRIBUTING.md) for contribution guidelines when making code changes or raising issues for bug reports, ideas, discussions and/or questions (i.e. help required).

{cloudsmith_cli-1.12.1 → cloudsmith_cli-1.14.0}/cloudsmith_cli/cli/commands/__init__.py

@@ -12,6 +12,7 @@ from . import (
     help_,
     list_,
     login,
+    logout,
     mcp,
     metrics,
     move,
@@ -25,5 +26,6 @@ from . import (
     tags,
     tokens,
     upstream,
+    vulnerabilities,
     whoami,
 )

{cloudsmith_cli-1.12.1 → cloudsmith_cli-1.14.0}/cloudsmith_cli/cli/commands/auth.py

@@ -9,14 +9,16 @@ from ..exceptions import handle_api_exceptions
 from ..saml import create_configured_session, get_idp_url
 from ..webserver import AuthenticationWebRequestHandler, AuthenticationWebServer
 from .main import main
-from .tokens import create
+from .tokens import create, request_api_key
 
 # Authentication server configuration
 AUTH_SERVER_HOST = "127.0.0.1"
 AUTH_SERVER_PORT = 12400
 
 
-def _perform_saml_authentication(opts, owner, enable_token_creation=False, json=False):
+def _perform_saml_authentication(
+    opts, owner, enable_token_creation=False, use_stderr=False
+):
     """Perform SAML authentication via web browser and local web server."""
     session = create_configured_session(opts)
     api_host = opts.api_config.host
@@ -25,12 +27,12 @@ def _perform_saml_authentication(opts, owner, enable_token_creation=False, json=
 
     click.echo(
         f"Opening your organization's SAML IDP URL in your browser: {click.style(idp_url, bold=True)}",
-        err=json,
+        err=use_stderr,
     )
-    click.echo(err=json)
+    click.echo(err=use_stderr)
     webbrowser.open(idp_url)
 
-    click.echo("Starting webserver to begin authentication ... ", err=json)
+    click.echo("Starting webserver to begin authentication ... ", err=use_stderr)
 
     auth_server = AuthenticationWebServer(
         (AUTH_SERVER_HOST, AUTH_SERVER_PORT),
@@ -60,14 +62,14 @@ def _perform_saml_authentication(opts, owner, enable_token_creation=False, json=
     "--token",
     default=False,
     is_flag=True,
-    help="Retrieve a user API token after successful authentication.",
+    help="[DEPRECATED: Use --request-api-key] Retrieve a user API token after successful authentication.",
 )
 @click.option(
     "-f",
     "--force",
     default=False,
     is_flag=True,
-    help="Force refresh of user API token without prompts.",
+    help="[DEPRECATED: Use --request-api-key] Force refresh of user API token without prompts.",
 )
 @click.option(
     "--save-config",
@@ -79,17 +81,49 @@ def _perform_saml_authentication(opts, owner, enable_token_creation=False, json=
     "--json",
     default=False,
     is_flag=True,
-    help="Output token details in json format.",
+    help="[DEPRECATED: Use --output-format json] Output token details in JSON format.",
+)
+@click.option(
+    "--request-api-key",
+    "request_api_key_flag",
+    default=False,
+    is_flag=True,
+    help="Retrieve API token (auto-creates or auto-rotates, no prompts). "
+    "Warning: If token exists, this will rotate it and invalidate the old key.",
 )
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options
 @decorators.initialise_api
 @click.pass_context
-def authenticate(ctx, opts, owner, token, force, save_config, json):
+def authenticate(
+    ctx, opts, owner, token, force, save_config, json, request_api_key_flag
+):
     """Authenticate to Cloudsmith using the org's SAML setup."""
-    json = json or utils.should_use_stderr(opts)
-    # If using json output, we redirect info messages to stderr
-    use_stderr = json
+    # Validate mutual exclusivity
+    if request_api_key_flag and (token or force):
+        raise click.UsageError(
+            "--request-api-key cannot be used with --token or --force. "
+            "Use --request-api-key alone for fully automated token retrieval."
+        )
+
+    # Determine if we should redirect info messages to stderr
+    use_stderr = request_api_key_flag or json or utils.should_use_stderr(opts)
+
+    if token:
+        click.secho(
+            "DEPRECATION WARNING: The `--token` flag is deprecated and will be removed in a future release. "
+            "Please use `--request-api-key` instead.",
+            fg="yellow",
+            err=True,
+        )
+
+    if force:
+        click.secho(
+            "DEPRECATION WARNING: The `--force` flag is deprecated and will be removed in a future release. "
+            "Please use `--request-api-key` instead (force is implied).",
+            fg="yellow",
+            err=True,
+        )
 
     if json and not utils.should_use_stderr(opts):
         click.secho(
@@ -106,11 +140,34 @@ def authenticate(ctx, opts, owner, token, force, save_config, json):
         err=use_stderr,
     )
 
+    # Determine if we need to refresh API after SSO (required for token operations)
+    enable_token_creation = token or request_api_key_flag
+
     context_message = "Failed to authenticate via SSO!"
     with handle_api_exceptions(ctx, opts=opts, context_msg=context_message):
         _perform_saml_authentication(
-            opts, owner, enable_token_creation=token, json=json
+            opts,
+            owner,
+            enable_token_creation=enable_token_creation,
+            use_stderr=use_stderr,
         )
 
+    if request_api_key_flag:
+        # Non-interactive token retrieval
+        new_token = request_api_key(ctx, opts, save_config=save_config)
+
+        if not new_token:
+            raise click.ClickException(
+                "Failed to retrieve API token. No token was returned."
+            )
+
+        # Check if JSON output is requested
+        if utils.maybe_print_as_json(opts, new_token):
+            return
+
+        # Default: output only the raw token value to stdout
+        click.echo(new_token.key)
+        return
+
     if token:
         ctx.invoke(create, opts=opts, save_config=save_config, force=force, json=json)

{cloudsmith_cli-1.12.1 → cloudsmith_cli-1.14.0}/cloudsmith_cli/cli/commands/download.py

@@ -42,6 +42,11 @@ from .main import main
 @click.option(
     "--arch", "arch_filter", help="Architecture filter (e.g., 'amd64', 'arm64')."
 )
+@click.option(
+    "--tag",
+    "tag_filter",
+    help="Filter by package tag (e.g., 'latest', 'stable'). Use --format, --arch, --os for metadata filters.",
+)
 @click.option(
     "--outfile",
     type=click.Path(),
@@ -78,6 +83,7 @@ def download(  # noqa: C901
     format_filter,
     os_filter,
     arch_filter,
+    tag_filter,
     outfile,
     overwrite,
     all_files,
@@ -88,7 +94,7 @@ def download(  # noqa: C901
     Download a package from a Cloudsmith repository.
 
     This command downloads a package binary from a Cloudsmith repository. You can
-    filter packages by version, format, operating system, and architecture.
+    filter packages by version, format, operating system, architecture, and tags.
 
     Examples:
 
@@ -104,6 +110,10 @@ def download(  # noqa: C901
     # Download with filters and custom output name
     cloudsmith download myorg/myrepo mypackage --format deb --arch amd64 --outfile my-package.deb
 
+    \b
+    # Download a package with a specific tag
+    cloudsmith download myorg/myrepo mypackage --tag latest
+
     \b
     # Download all associated files (POM, sources, javadoc, etc.) for a Maven/NuGet package
     cloudsmith download myorg/myrepo mypackage --all-files
@@ -150,6 +160,7 @@ def download(  # noqa: C901
                 format_filter=format_filter,
                 os_filter=os_filter,
                 arch_filter=arch_filter,
+                tag_filter=tag_filter,
                 yes=yes,
             )
 

cloudsmith_cli-1.14.0/cloudsmith_cli/cli/commands/logout.py

@@ -0,0 +1,151 @@
+# Copyright 2026 Cloudsmith Ltd
+"""CLI/Commands - Log out and clear authentication state."""
+
+import os
+
+import click
+import cloudsmith_api
+
+from ...core import keyring
+from .. import decorators, utils
+from ..config import CredentialsReader
+from .main import main
+
+
+def _clear_credentials(dry_run, use_stderr):
+    """Clear credential files. Returns result dict."""
+    creds_files = CredentialsReader.find_existing_files()
+    if not creds_files:
+        click.echo("No credentials file found.", err=use_stderr)
+        return {"action": "not_found", "files": []}
+
+    if not dry_run:
+        for path in creds_files:
+            CredentialsReader.clear_api_key(path)
+
+    verb = "Would remove" if dry_run else "Removed"
+    for path in creds_files:
+        click.echo(
+            f"{verb} credentials from: " + click.style(path, bold=True),
+            err=use_stderr,
+        )
+    action = "would_remove" if dry_run else "removed"
+    return {"action": action, "files": list(creds_files)}
+
+
+def _clear_keyring(api_host, dry_run, use_stderr):
+    """Clear SSO tokens from keyring. Returns result dict."""
+    if not keyring.should_use_keyring():
+        click.secho(
+            "Keyring is disabled (CLOUDSMITH_NO_KEYRING is set).",
+            fg="yellow",
+            err=use_stderr,
+        )
+        return {"action": "disabled"}
+
+    if not keyring.has_sso_tokens(api_host):
+        click.echo("No SSO tokens found in system keyring.", err=use_stderr)
+        return {"action": "not_found"}
+
+    if dry_run:
+        click.echo("Would remove SSO tokens from system keyring.", err=use_stderr)
+        return {"action": "would_remove"}
+
+    deleted = keyring.delete_sso_tokens(api_host)
+    action = "removed" if deleted else "failed"
+    msg = f"{'Removed' if deleted else 'Failed to remove'} SSO tokens from system keyring."
+    click.secho(msg, fg=None if deleted else "red", err=use_stderr)
+    return {"action": action} if deleted else {"action": action, "message": msg}
+
+
+def _env_api_key_status():
+    """Return structured status for the CLOUDSMITH_API_KEY env var."""
+    is_set = bool(os.environ.get("CLOUDSMITH_API_KEY"))
+    return {
+        "is_set": is_set,
+        "action": "unset CLOUDSMITH_API_KEY" if is_set else "none",
+    }
+
+
+def _collect_warnings(keyring_only, config_only):
+    """Collect advisory warnings based on flags and environment."""
+    warnings = []
+    if config_only:
+        warnings.append("SSO tokens were not modified (--config-only).")
+    if keyring_only:
+        warnings.append("credentials.ini was not modified (--keyring-only).")
+    if os.environ.get("CLOUDSMITH_API_KEY"):
+        warnings.append(
+            "CLOUDSMITH_API_KEY is set in your environment. "
+            "Run: unset CLOUDSMITH_API_KEY"
+        )
+    return warnings
+
+
+@main.command()
+@click.option(
+    "--api-host",
+    envvar="CLOUDSMITH_API_HOST",
+    default=None,
+    help="The API host to clear keyring tokens for.",
+)
+@click.option(
+    "--keyring-only",
+    is_flag=True,
+    default=False,
+    help="Only clear SSO tokens from the system keyring.",
+)
+@click.option(
+    "--config-only",
+    is_flag=True,
+    default=False,
+    help="Only clear credentials from credentials.ini.",
+)
+@click.option(
+    "--dry-run",
+    is_flag=True,
+    default=False,
+    help="Show what would be removed without removing anything.",
+)
+@decorators.common_cli_config_options
+@decorators.common_cli_output_options
+@click.pass_context
+def logout(ctx, opts, api_host, keyring_only, config_only, dry_run):
+    """Clear stored authentication credentials and SSO tokens."""
+    if keyring_only and config_only:
+        raise click.UsageError(
+            "--keyring-only and --config-only are mutually exclusive."
+        )
+
+    if api_host is None:
+        api_host = opts.api_host or cloudsmith_api.Configuration().host
+
+    use_stderr = utils.should_use_stderr(opts)
+
+    credential_file = (
+        _clear_credentials(dry_run, use_stderr)
+        if not keyring_only
+        else {"action": "skipped", "files": []}
+    )
+    keyring_result = (
+        _clear_keyring(api_host, dry_run, use_stderr)
+        if not config_only
+        else {"action": "skipped"}
+    )
+    warnings = _collect_warnings(keyring_only, config_only)
+
+    for warning in warnings:
+        click.secho(f"Note: {warning}", fg="yellow", err=use_stderr)
+
+    utils.maybe_print_as_json(
+        opts,
+        {
+            "api_host": api_host,
+            "dry_run": dry_run,
+            "sources": {
+                "credential_file": credential_file,
+                "keyring": keyring_result,
+                "environment_api_key": _env_api_key_status(),
+            },
+        },
+    )

{cloudsmith_cli-1.12.1 → cloudsmith_cli-1.14.0}/cloudsmith_cli/cli/commands/tokens.py

@@ -31,6 +31,77 @@ def handle_duplicate_token_error(exc, ctx, opts, save_config, force, json):
     raise exc
 
 
+def request_api_key(ctx, opts, save_config=False):
+    """
+    Request an API key non-interactively.
+
+    This function creates a new token or rotates an existing one without any prompts.
+    Used by the --request-api-key flag in the auth command.
+
+    Returns the token object on success.
+    Raises ApiException on failure.
+    """
+    context_msg = "Failed to retrieve API token!"
+
+    try:
+        # Don't use handle_api_exceptions here so we can catch and handle
+        # the "already has token" error ourselves
+        with utils.maybe_spinner(opts):
+            new_token = api.create_user_token_saml()
+
+        if save_config:
+            create, has_errors = create_config_files(
+                ctx, opts, api_key=new_token.key, force=True
+            )
+            new_config_messaging(has_errors, opts, create, api_key=new_token.key)
+
+        return new_token
+
+    except exceptions.ApiException as exc:
+        if exc.status == 401:
+            # Unauthorized - re-raise with handler
+            with handle_api_exceptions(ctx, opts=opts, context_msg=context_msg):
+                raise
+
+        if (
+            exc.status == 400
+            and exc.detail
+            and "User has already created an API key" in exc.detail
+        ):
+            # Token exists - rotate it automatically
+            click.echo(
+                "Warning: Rotating existing API token. Your old key will be invalidated.",
+                err=True,
+            )
+
+            # List tokens and select the first one
+            with handle_api_exceptions(ctx, opts=opts, context_msg=context_msg):
+                with utils.maybe_spinner(opts):
+                    api_tokens = api.list_user_tokens()
+
+            if not api_tokens:
+                raise click.ClickException("No existing tokens found to rotate.")
+
+            token_slug = api_tokens[0].slug_perm
+
+            # Refresh the token
+            with handle_api_exceptions(ctx, opts=opts, context_msg=context_msg):
+                with utils.maybe_spinner(opts):
+                    new_token = api.refresh_user_token(token_slug)
+
+            if save_config:
+                create, has_errors = create_config_files(
+                    ctx, opts, api_key=new_token.key, force=True
+                )
+                new_config_messaging(has_errors, opts, create, api_key=new_token.key)
+
+            return new_token
+
+        # Other errors - use the handler
+        with handle_api_exceptions(ctx, opts=opts, context_msg=context_msg):
+            raise exc
+
+
 @main.group(cls=command.AliasGroup, name="tokens")
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options