cloudsmith-cli 1.23.0__tar.gz → 1.24.0__tar.gz

{cloudsmith_cli-1.23.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.23.0
+Version: 1.24.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -23,7 +23,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.10.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: click!=8.3.0,>=8.1.8
+Requires-Dist: click!=8.3.0,>=8.2
 Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
 Requires-Dist: click-spinner>=0.1.7
@@ -367,13 +367,21 @@ You can authenticate using your organization's SAML provider, if configured, wit
 ```
 cloudsmith auth --owner example
 Beginning authentication for the example org ...
-Opening your organization's SAML IDP URL in your browser: https://example.com/some-saml-idp
+Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
 Starting webserver to begin authentication ...
 
 Authentication complete
 ```
 
+The CLI opens the IDP URL in your browser automatically. If it can't (for example in Cygwin or a headless shell), it tells you to open the URL above manually and carries on waiting for the callback. Use `--no-browser` to skip the automatic launch entirely:
+
+```
+cloudsmith auth --owner example --no-browser
+```
+
+*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+
 #### Getting Your API Key
 
 You can retrieve your API key using the `cloudsmith login` command:
@@ -411,6 +419,12 @@ For example, if you wanted to upload a Debian package, you can do it in one-step
 cloudsmith push deb your-org/your-repo/ubuntu/xenial libxml2-2.9.4-2.x86_64.deb
 ```
 
+To upload a Debian *source* package, give it the `.dsc`. The source and Debian packaging archives listed in the `.dsc` are found and uploaded with it:
+
+```
+cloudsmith push deb your-org/your-repo/ubuntu/xenial hello_2.10-3.dsc
+```
+
 Want to know how to do it with another packaging format? Easy, just ask for help:
 
 ```

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/README.md

@@ -319,13 +319,21 @@ You can authenticate using your organization's SAML provider, if configured, wit
 ```
 cloudsmith auth --owner example
 Beginning authentication for the example org ...
-Opening your organization's SAML IDP URL in your browser: https://example.com/some-saml-idp
+Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
 Starting webserver to begin authentication ...
 
 Authentication complete
 ```
 
+The CLI opens the IDP URL in your browser automatically. If it can't (for example in Cygwin or a headless shell), it tells you to open the URL above manually and carries on waiting for the callback. Use `--no-browser` to skip the automatic launch entirely:
+
+```
+cloudsmith auth --owner example --no-browser
+```
+
+*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+
 #### Getting Your API Key
 
 You can retrieve your API key using the `cloudsmith login` command:
@@ -363,6 +371,12 @@ For example, if you wanted to upload a Debian package, you can do it in one-step
 cloudsmith push deb your-org/your-repo/ubuntu/xenial libxml2-2.9.4-2.x86_64.deb
 ```
 
+To upload a Debian *source* package, give it the `.dsc`. The source and Debian packaging archives listed in the `.dsc` are found and uploaded with it:
+
+```
+cloudsmith push deb your-org/your-repo/ubuntu/xenial hello_2.10-3.dsc
+```
+
 Want to know how to do it with another packaging format? Easy, just ask for help:
 
 ```

cloudsmith_cli-1.24.0/cloudsmith_cli/__main__.py

@@ -0,0 +1,15 @@
+"""Cloudsmith CLI - Main script."""
+
+import sys
+
+from .cli.commands.main import main
+
+if __name__ == "__main__":
+    # sys.exit() is required: AliasGroup.main runs click with
+    # standalone_mode=False, so click returns the exit code (e.g. from
+    # ctx.exit()) instead of raising SystemExit. The console script and the
+    # PyInstaller entry point wrap main() in sys.exit() too; a bare main()
+    # call would discard the code and always exit 0.
+    # Disable false positive for parameters handled by click.
+    # pylint: disable=no-value-for-parameter
+    sys.exit(main())

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/cloudsmith_cli/cli/commands/auth.py

@@ -17,7 +17,7 @@ AUTH_SERVER_PORT = 12400
 
 
 def _perform_saml_authentication(
-    opts, owner, enable_token_creation=False, use_stderr=False
+    opts, owner, enable_token_creation=False, use_stderr=False, no_browser=False
 ):
     """Perform SAML authentication via web browser and local web server."""
     session = create_configured_session(opts)
@@ -26,11 +26,32 @@ def _perform_saml_authentication(
     idp_url = get_idp_url(api_host, owner, session=session)
 
     click.echo(
-        f"Opening your organization's SAML IDP URL in your browser: {click.style(idp_url, bold=True)}",
+        f"Your organization's SAML IDP URL is: {click.style(idp_url, bold=True)}",
         err=use_stderr,
     )
     click.echo(err=use_stderr)
-    webbrowser.open(idp_url)
+
+    if no_browser:
+        click.echo(
+            "Skipping automatic browser launch (--no-browser). "
+            "Please open the URL above manually to continue.",
+            err=use_stderr,
+        )
+    else:
+        try:
+            browser_opened = webbrowser.open(idp_url)
+        except Exception:
+            # Browser launch failures vary by platform (webbrowser.Error on
+            # Cygwin/headless, anything else elsewhere), so catch broadly and
+            # fall back to the manual URL rather than crashing.
+            browser_opened = False
+
+        if not browser_opened:
+            click.echo(
+                "Couldn't open a browser automatically. "
+                "Please open the URL above manually to continue.",
+                err=use_stderr,
+            )
 
     click.echo("Starting webserver to begin authentication ... ", err=use_stderr)
 
@@ -91,12 +112,27 @@ def _perform_saml_authentication(
     help="Retrieve API token (auto-creates or auto-rotates, no prompts). "
     "Warning: If token exists, this will rotate it and invalidate the old key.",
 )
+@click.option(
+    "--no-browser",
+    default=False,
+    is_flag=True,
+    help="Don't try to open a browser automatically; print the SAML IDP URL to "
+    "open manually instead.",
+)
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options
 @decorators.initialise_api
 @click.pass_context
 def authenticate(
-    ctx, opts, owner, token, force, save_config, json, request_api_key_flag
+    ctx,
+    opts,
+    owner,
+    token,
+    force,
+    save_config,
+    json,
+    request_api_key_flag,
+    no_browser,
 ):
     """Authenticate to Cloudsmith using the org's SAML setup."""
     # Validate mutual exclusivity
@@ -150,6 +186,7 @@ def authenticate(
             owner,
             enable_token_creation=enable_token_creation,
             use_stderr=use_stderr,
+            no_browser=no_browser,
         )
 
     if request_api_key_flag:

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/cloudsmith_cli/cli/commands/push.py

@@ -38,6 +38,7 @@ from ...core.api.packages import (
     validate_create_package as api_validate_create_package,
 )
 from .. import command, decorators, utils, validators
+from ..dsc_parser import resolve_dsc_files
 from ..exceptions import handle_api_exceptions
 from ..metadata_common import (
     MetadataContentError,
@@ -75,6 +76,10 @@ METADATA_KWARG_NAMES = (
 #: separately from the metadata payload kwargs so it does not leak into the
 #: package-create API call.
 METADATA_FAILURE_MODE_KWARG = "cli_metadata_failure_mode"
+#: Filename suffix of a Debian source control file. A ``deb`` push whose
+#: PACKAGE_FILE carries it is a source-package upload, so its members can be
+#: derived without ``--dsc-file`` (GitHub issue #56).
+DSC_SUFFIX = ".dsc"
 
 
 def _metadata_failure_is_warn(opts=None):
@@ -1019,6 +1024,13 @@ def upload_files_and_create_package(
     return slug_perm, slug
 
 
+def _implied_dsc_file(package_file):
+    """Return ``package_file`` if it is itself a Debian ``.dsc``, else None."""
+    if isinstance(package_file, str) and package_file.endswith(DSC_SUFFIX):
+        return package_file
+    return None
+
+
 def create_push_handlers():
     """Create a handler for upload per package format."""
     # pylint: disable=fixme
@@ -1181,6 +1193,38 @@ def create_push_handlers():
             parameters = context.get(ctx.info_name)
             kwargs["package_type"] = ctx.info_name
 
+            # deb-only: derive the upstream/native source archive and Debian
+            # packaging archive from a .dsc (see GitHub issue #56). Only the
+            # `deb` subcommand ever registers --dsc-file (below), so this is
+            # a no-op kwargs.pop() for every other format.
+            dsc_file = kwargs.pop("dsc_file", None)
+            if dsc_file is None and not kwargs.get("sources_file"):
+                # Pushing a Debian source package means passing the .dsc as
+                # PACKAGE_FILE, and the API rejects it without a sources
+                # archive, so parse it by default rather than making the user
+                # name the same file twice. An explicit --sources-file means
+                # the caller is driving the members manually; leave them to it.
+                dsc_file = _implied_dsc_file(kwargs.get("package_file"))
+            if dsc_file:
+                resolved_dsc = resolve_dsc_files(dsc_file)
+                if resolved_dsc.ignored_files:
+                    click.secho(
+                        "Not uploading {files}: the deb package format has no "
+                        "field for detached upstream signatures.".format(
+                            files=", ".join(resolved_dsc.ignored_files)
+                        ),
+                        fg="yellow",
+                        err=utils.should_use_stderr(opts),
+                    )
+                # Precedence: explicit --sources-file/--changes-file always
+                # win over values derived from --dsc-file. A user who passes
+                # both wants a manual override, not to have their explicit
+                # flag silently clobbered.
+                if not kwargs.get("sources_file"):
+                    kwargs["sources_file"] = resolved_dsc.sources_file
+                if not kwargs.get("changes_file"):
+                    kwargs["changes_file"] = resolved_dsc.changes_file
+
             owner_repo = kwargs.pop("owner_repo")
             if "distribution" in parameters:
                 kwargs["distribution"] = "/".join(owner_repo[2:])
@@ -1307,6 +1351,39 @@ def create_push_handlers():
             )
             push_handler = decorator(push_handler)
 
+        if key == "deb":
+            # deb-only shim (GitHub issue #56): the generic per-format loop
+            # above is driven entirely by the API's package-format model, so
+            # this stays layered on top rather than becoming a new branch in
+            # that generic system.
+            push_handler = click.option(
+                "--dsc-file",
+                "dsc_file",
+                type=ExpandPath(
+                    dir_okay=False, exists=True, writable=False, resolve_path=True
+                ),
+                default=None,
+                help=(
+                    "Path to a Debian .dsc control file, plain or "
+                    "OpenPGP-clearsigned. Only needed to point at a .dsc "
+                    "other than PACKAGE_FILE: pushing a source package means "
+                    "passing the .dsc as PACKAGE_FILE, and that is parsed "
+                    "automatically unless --sources-file is given. Its "
+                    "'Checksums-Sha256:' (or 'Files:') field supplies "
+                    "--sources-file with the upstream/native source archive "
+                    "and --changes-file with the Debian packaging archive "
+                    "(.debian.tar.* or .diff.gz). Supports the 1.0, 2.0, "
+                    "3.0 (native) and 3.0 (quilt) source formats, and the "
+                    "referenced files must sit next to the .dsc. An explicit "
+                    "--sources-file or --changes-file always takes precedence "
+                    "over the derived value for that field. Detached upstream "
+                    "signatures (*.asc) are skipped with a warning; a "
+                    "multi-component source package (*.orig-*.tar.*) is "
+                    "rejected, because the deb package format has no field "
+                    "for the extra components."
+                ),
+            )(push_handler)
+
         handlers[key] = push_handler
 
 

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/cloudsmith_cli/cli/decorators.py

@@ -1,6 +1,7 @@
 """CLI - Decorators."""
 
 import functools
+import logging
 import os
 
 import click
@@ -28,6 +29,27 @@ def report_retry(seconds, context=None):
         )
 
 
+_DEBUG_LOG_HANDLER_NAME = "cloudsmith-cli-debug"
+
+
+def _configure_debug_logging(enabled):
+    """Install or remove the stderr handler for this package's debug records."""
+    package_logger = logging.getLogger("cloudsmith_cli")
+    for handler in list(package_logger.handlers):
+        if handler.name == _DEBUG_LOG_HANDLER_NAME:
+            package_logger.removeHandler(handler)
+    if not enabled:
+        package_logger.setLevel(logging.NOTSET)
+        package_logger.propagate = True
+        return
+    package_logger.setLevel(logging.DEBUG)
+    package_logger.propagate = False
+    handler = logging.StreamHandler()
+    handler.name = _DEBUG_LOG_HANDLER_NAME
+    handler.setFormatter(logging.Formatter("%(name)s: %(message)s"))
+    package_logger.addHandler(handler)
+
+
 def _pop_boolean_flag(kwargs, name, invert=False):
     """Pop a boolean flag from kwargs, optionally inverting it."""
     value = kwargs.pop(name)
@@ -158,7 +180,8 @@ def common_cli_output_options(f):
     def wrapper(ctx, *args, **kwargs):
         # pylint: disable=missing-docstring
         opts = config.get_or_create_options(ctx)
-        opts.debug = kwargs.pop("debug")
+        opts.debug = kwargs.pop("debug") or opts.debug
+        _configure_debug_logging(opts.debug)
         opts.output = kwargs.pop("output_format")
         opts.verbose = kwargs.pop("verbose")
         kwargs["opts"] = opts

cloudsmith_cli-1.24.0/cloudsmith_cli/cli/dsc_parser.py

@@ -0,0 +1,268 @@
+"""Parse Debian ``.dsc`` control files for ``push deb`` source uploads."""
+
+import os
+from dataclasses import dataclass, field
+from email.parser import Parser
+
+import click
+
+_CLEAR_SIGNED_MESSAGE = "-----BEGIN PGP SIGNED MESSAGE-----"
+_SIGNATURE = "-----BEGIN PGP SIGNATURE-----"
+_DETACHED_SIGNATURE_SUFFIX = ".asc"
+_FILE_LIST_FIELDS = ("Checksums-Sha256", "Files")
+_QUILT_FORMATS = {"2.0", "3.0 (quilt)"}
+_NATIVE_FORMAT = "3.0 (native)"
+
+
+@dataclass(frozen=True)
+class ResolvedDscFiles:
+    """Source-package members resolved from a Debian ``.dsc``."""
+
+    sources_file: str
+    changes_file: str | None = None
+    #: Members deliberately left out of the upload, for the caller to report.
+    ignored_files: tuple[str, ...] = field(default_factory=tuple)
+
+
+def _usage_error(dsc_path, message):
+    # Names the file rather than the option: the .dsc is just as often taken
+    # from PACKAGE_FILE as from an explicit --dsc-file.
+    return click.UsageError(f"Debian source control file {dsc_path!r} {message}")
+
+
+def _unwrap_clearsigned_control(text, dsc_path):
+    """Return deb822 control text from an optional OpenPGP cleartext signature."""
+    lines = text.splitlines(keepends=True)
+    if not lines or lines[0].rstrip("\r\n") != _CLEAR_SIGNED_MESSAGE:
+        return text
+
+    index = 1
+    while index < len(lines) and lines[index].rstrip("\r\n"):
+        index += 1
+    if index == len(lines):
+        raise _usage_error(dsc_path, "has a malformed OpenPGP cleartext signature.")
+
+    cleartext = []
+    for line in lines[index + 1 :]:
+        if line.rstrip("\r\n") == _SIGNATURE:
+            return "".join(cleartext)
+        # RFC 9580 cleartext signatures dash-escape lines beginning with "-".
+        cleartext.append(line.removeprefix("- "))
+
+    raise _usage_error(dsc_path, "has a malformed OpenPGP cleartext signature.")
+
+
+def _read_control_message(dsc_path):
+    """Parse ``dsc_path`` as a plain or OpenPGP-clearsigned deb822 stanza."""
+    try:
+        with open(dsc_path, encoding="utf-8", errors="replace") as dsc_fh:
+            text = dsc_fh.read()
+    except OSError as exc:
+        raise _usage_error(dsc_path, f"could not be read: {exc}") from exc
+
+    return Parser().parsestr(_unwrap_clearsigned_control(text, dsc_path))
+
+
+def _parse_file_list(field_name, field_value, dsc_path):
+    filenames = []
+    for line in field_value.splitlines():
+        if not line.strip():
+            continue
+        parts = line.split()
+        if len(parts) != 3:
+            raise _usage_error(
+                dsc_path,
+                f"has a malformed {field_name!r} entry {line.strip()!r}; "
+                "expected '<checksum> <size> <filename>'.",
+            )
+        filenames.append(parts[2])
+    return filenames
+
+
+def _extract_filenames(message, dsc_path):
+    """Return an agreed filename list, preferring the strong SHA-256 field."""
+    file_lists = {}
+    for field_name in _FILE_LIST_FIELDS:
+        field_value = message.get(field_name)
+        if field_value:
+            filenames = _parse_file_list(field_name, field_value, dsc_path)
+            if filenames:
+                file_lists[field_name] = filenames
+
+    if not file_lists:
+        raise _usage_error(
+            dsc_path,
+            "has no non-empty 'Checksums-Sha256:' or 'Files:' field to parse.",
+        )
+
+    for filenames in file_lists.values():
+        if len(filenames) != len(set(filenames)):
+            raise _usage_error(dsc_path, "lists the same source-package member twice.")
+
+    selected_name = next(iter(file_lists))
+    selected = file_lists[selected_name]
+    for field_name, filenames in file_lists.items():
+        if set(filenames) != set(selected):
+            raise _usage_error(
+                dsc_path,
+                f"has conflicting filenames in {selected_name!r} and {field_name!r}.",
+            )
+
+    return selected
+
+
+def _required_field(message, field_name, dsc_path):
+    value = message.get(field_name)
+    if not value or not value.strip():
+        raise _usage_error(dsc_path, f"has no {field_name!r} field.")
+    return value.strip()
+
+
+def _validate_member_names(filenames, dsc_path):
+    for filename in filenames:
+        if os.path.isabs(filename) or os.path.basename(filename) != filename:
+            raise _usage_error(
+                dsc_path,
+                f"references invalid member filename {filename!r}; source-package "
+                "members must be filenames next to the .dsc, not paths.",
+            )
+
+
+def _is_tar_archive(filename, stem):
+    prefix = f"{stem}.tar."
+    return filename.startswith(prefix) and len(filename) > len(prefix)
+
+
+def _classify_members(message, filenames, dsc_path):
+    """Map source-package members to the two fields accepted by the SDK."""
+    source = _required_field(message, "Source", dsc_path)
+    version = _required_field(message, "Version", dsc_path).split(":", 1)[-1]
+    source_format = _required_field(message, "Format", dsc_path)
+    upstream_version = version.rsplit("-", 1)[0]
+
+    # Detached upstream signatures (e.g. hello_2.10.orig.tar.gz.asc) are
+    # common and have no field in the deb upload model. Nothing in the
+    # uploaded source is lost by leaving them out, so they are skipped with a
+    # warning rather than failing the push.
+    signature_files = [
+        filename
+        for filename in filenames
+        if filename.endswith(_DETACHED_SIGNATURE_SUFFIX)
+    ]
+    # Classify the uploadable members only. A signature shares its tarball's
+    # stem (`*.orig.tar.gz.asc`), so leaving it in would match as a second
+    # source archive.
+    members = [f for f in filenames if f not in set(signature_files)]
+
+    sources = []
+    changes = []
+    component_files = []
+    legacy_non_native = False
+
+    if source_format in _QUILT_FORMATS:
+        orig_stem = f"{source}_{upstream_version}.orig"
+        component_prefix = f"{orig_stem}-"
+        debian_stem = f"{source}_{version}.debian"
+        sources = [f for f in members if _is_tar_archive(f, orig_stem)]
+        changes = [f for f in members if _is_tar_archive(f, debian_stem)]
+        component_files = [
+            f
+            for f in members
+            if f.startswith(component_prefix) and ".tar." in f[len(component_prefix) :]
+        ]
+    elif source_format == "1.0":
+        orig_stem = f"{source}_{upstream_version}.orig"
+        diff_name = f"{source}_{version}.diff.gz"
+        native_stem = f"{source}_{version}"
+        orig_files = [f for f in members if _is_tar_archive(f, orig_stem)]
+        diff_files = [f for f in members if f == diff_name]
+        native_files = [f for f in members if _is_tar_archive(f, native_stem)]
+        if orig_files or diff_files:
+            legacy_non_native = True
+            sources = orig_files
+            changes = diff_files
+        else:
+            sources = native_files
+    elif source_format == _NATIVE_FORMAT:
+        sources = [f for f in members if _is_tar_archive(f, f"{source}_{version}")]
+    else:
+        # '3.0 (git)' ships a git bundle and '3.0 (bzr)' a VCS tarball, neither
+        # of which is a source archive the deb upload model can index, so both
+        # fall through to the unsupported-format error alongside
+        # '3.0 (custom)'.
+        raise _usage_error(
+            dsc_path, f"uses unsupported Debian source format {source_format!r}."
+        )
+
+    if component_files:
+        raise _usage_error(
+            dsc_path,
+            "references a multi-component source package ({files}). Cloudsmith "
+            "does not support multi-component Debian source packages for deb "
+            "uploads.".format(files=", ".join(component_files)),
+        )
+
+    classified = set(sources + changes + component_files)
+    unexpected = [f for f in members if f not in classified]
+    if unexpected:
+        raise _usage_error(
+            dsc_path,
+            "contains unsupported or incorrectly named source-package member(s) "
+            f"({', '.join(unexpected)}) for format {source_format!r}.",
+        )
+    if len(sources) != 1:
+        raise _usage_error(
+            dsc_path,
+            f"must reference exactly one main source archive for format "
+            f"{source_format!r}; found {len(sources)}.",
+        )
+    if source_format in _QUILT_FORMATS and len(changes) != 1:
+        raise _usage_error(
+            dsc_path,
+            f"must reference exactly one Debian packaging archive for format "
+            f"{source_format!r}; found {len(changes)}.",
+        )
+    if legacy_non_native and len(changes) != 1:
+        raise _usage_error(
+            dsc_path,
+            "must reference exactly one Debian packaging diff for non-native "
+            f"format '1.0'; found {len(changes)}.",
+        )
+
+    return sources[0], changes[0] if changes else None, tuple(signature_files)
+
+
+def _resolve_member(base_dir, filename, dsc_path):
+    """Canonicalise a member that ``_validate_member_names`` has vetted."""
+    candidate = os.path.join(base_dir, filename)
+    if not os.path.isfile(candidate):
+        raise _usage_error(
+            dsc_path,
+            f"references {filename!r}, but it is not a regular file next to the .dsc.",
+        )
+    # Uploading the canonical path means a symlink swapped between this check
+    # and the upload cannot redirect the read. The link itself may point
+    # outside the directory: `mk-origtargz --symlink` (the uscan default)
+    # routinely symlinks the .orig tarball in from a download cache.
+    return os.path.realpath(candidate)
+
+
+def resolve_dsc_files(dsc_path):
+    """Return the :class:`ResolvedDscFiles` derived from a Debian ``.dsc``."""
+    message = _read_control_message(dsc_path)
+    filenames = _extract_filenames(message, dsc_path)
+    _validate_member_names(filenames, dsc_path)
+    source_filename, changes_filename, ignored_files = _classify_members(
+        message, filenames, dsc_path
+    )
+
+    base_dir = os.path.realpath(os.path.dirname(os.path.abspath(dsc_path)))
+    return ResolvedDscFiles(
+        sources_file=_resolve_member(base_dir, source_filename, dsc_path),
+        changes_file=(
+            _resolve_member(base_dir, changes_filename, dsc_path)
+            if changes_filename
+            else None
+        ),
+        ignored_files=ignored_files,
+    )

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/cloudsmith_cli/cli/exceptions.py

@@ -171,8 +171,9 @@ def get_401_error_hint(ctx, opts, exc):
 
     if credential:
         return (
-            "Since you have an API key set, this probably means "
-            "you don't have the permission to perform this action."
+            "This usually means your API key is invalid, expired, or "
+            "lacks access to this resource - check your credentials and "
+            "try again."
         )
 
     if ctx.info_name == "token":

{cloudsmith_cli-1.23.0 → cloudsmith_cli-1.24.0}/cloudsmith_cli/core/credentials/oidc/detectors/aws.py

@@ -20,6 +20,38 @@ logger = logging.getLogger(__name__)
 DEFAULT_AUDIENCE = "cloudsmith"
 
 
+def _resolve_region(session) -> str | None:
+    """Resolve the AWS region with the AWS CLI precedence.
+
+    The order is: explicit session config, AWS_REGION, AWS_DEFAULT_REGION,
+    the config file region, then EC2 instance metadata.
+    """
+    try:
+        # Lazy imports: botocore is an optional dependency (the aws extra).
+        from botocore.configprovider import ConfigChainFactory
+        from botocore.exceptions import BotoCoreError
+        from botocore.utils import BadIMDSRequestError, IMDSRegionProvider
+    except ImportError:
+        logger.debug("AWSDetector: region providers unavailable", exc_info=True)
+        return None
+
+    # No public accessor exists for the underlying botocore session.
+    botocore_session = session._session  # pylint: disable=protected-access
+    chain = ConfigChainFactory(session=botocore_session).create_config_chain(
+        instance_name="region",
+        env_var_names=["AWS_REGION", "AWS_DEFAULT_REGION"],
+        config_property_names="region",
+    )
+    region = chain.provide()
+    if region:
+        return region
+    try:
+        return IMDSRegionProvider(session=botocore_session).provide()
+    except (BotoCoreError, BadIMDSRequestError):
+        logger.debug("AWSDetector: IMDS region lookup failed", exc_info=True)
+        return None
+
+
 class AWSDetector(EnvironmentDetector):
     """Detects AWS environments and obtains a JWT via STS GetWebIdentityToken."""
 
@@ -71,7 +103,7 @@ class AWSDetector(EnvironmentDetector):
 
         audience = self.context.oidc_audience or DEFAULT_AUDIENCE
         session = self._session or boto3.Session()
-        sts = session.client("sts")
+        sts = session.client("sts", region_name=_resolve_region(session))
         response = sts.get_web_identity_token(
             Audience=[audience],
             SigningAlgorithm="RS256",