cloudsmith-cli 1.28.0__tar.gz → 1.30.0__tar.gz

{cloudsmith_cli-1.28.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.28.0
+Version: 1.30.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -12,7 +12,6 @@ Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -20,7 +19,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Internet
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
-Requires-Python: >=3.10.0
+Requires-Python: >=3.11.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: certifi>=2024.7.4
@@ -29,26 +28,30 @@ Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
 Requires-Dist: click-spinner>=0.1.7
 Requires-Dist: json5>=0.9.0
-Requires-Dist: cloudsmith-api<3.0,>=2.0.31
+Requires-Dist: cloudsmith-api<3.0,>=2.0.38
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
 Requires-Dist: cryptography>=50.0.0
-Requires-Dist: mcp==2.2.0
+Requires-Dist: mcp==2.3.0
 Requires-Dist: pydantic-settings>=2.14.2
 Requires-Dist: PyJWT[crypto]>=2.13.0
-Requires-Dist: python-toon==0.1.3
-Requires-Dist: requests>=2.18.4
+Requires-Dist: python-toon==0.2.0
+Requires-Dist: requests>=2.32.5
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: urllib3>=2.5
 Requires-Dist: tomlkit>=0.15.0
+Requires-Dist: sentry-sdk<3,>=2
 Provides-Extra: aws
 Requires-Dist: boto3[crt]>=1.26.0; extra == "aws"
+Provides-Extra: gcp
+Requires-Dist: google-auth>=2.40.0; extra == "gcp"
 Provides-Extra: all
 Requires-Dist: boto3[crt]>=1.26.0; extra == "all"
+Requires-Dist: google-auth>=2.40.0; extra == "all"
 Dynamic: license-file
 
 # Cloudsmith Command Line Interface (CLI)
@@ -100,8 +103,8 @@ The CLI currently supports the following commands (and sub-commands):
   - `entitlements`|`ents`:  List entitlements for a repository.
   - `packages`:             List packages for a repository. (Aliases `repos list`)
   - `repos`:                List repositories for a namespace (owner).
-- `login`|`token`:        Retrieve your API authentication token/key via login.
-- `logout`:               Clear stored authentication credentials and SSO tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
+- `login`|`token`:        [DEPRECATED] Retrieve your API authentication token/key via login.
+- `logout`:               Clear stored authentication credentials and SAML tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
 - `metadata`:             Manage arbitrary JSON metadata (SBOM, BuildInfo, custom) attached to a package.
   - `add`:                  Attach a new metadata entry to a package.
   - `list`|`ls`:            List metadata entries for a package, or fetch a single entry by slug.
@@ -232,6 +235,29 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials (ADC) resolution and OIDC ID token generation. It works with an attached Google Cloud service account, a service-account key supplied through `GOOGLE_APPLICATION_CREDENTIALS`, or service-account impersonation configured locally:
+
+```sh
+gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL
+cloudsmith whoami --workspace=YOUR_WORKSPACE --oidc-service-slug=YOUR_SERVICE --oidc-detector-order=gcp
+```
+
+Configure a Cloudsmith OIDC provider to trust `https://accounts.google.com`, the service account's numeric unique ID as the subject, and audience `cloudsmith` (override with `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE`). Local impersonation requires the Service Account Token Creator role on the target service account and the IAM Service Account Credentials API enabled.
+
+On workloads with a metadata identity endpoint, the CLI requests an ID token directly. If that endpoint returns HTTP 404 (as on some Cloud Build environments), it uses IAM `generateIdToken` for the same attached service account. This fallback requires the IAM Service Account Credentials API and `iam.serviceAccounts.getOpenIdToken` on that account; the Service Account OpenID Connect Identity Token Creator role grants this permission. Permission and transport failures are reported, not treated as a missing endpoint.
+
+A plain `gcloud auth application-default login` user session cannot mint an ID token for an arbitrary audience. To use it, set `--oidc-audience` to the session's OAuth client ID and configure Cloudsmith to trust that audience and user subject; otherwise use service-account impersonation. `gcloud auth login` alone does not configure ADC. Other ADC types, including direct external-account federation, are skipped rather than incorrectly treated as ID-token-capable credentials.
+
+See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for credential discovery.
+
 #### All Optional Features
 
 To install all optional dependencies:
@@ -240,7 +266,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extra, the corresponding OIDC detector will gracefully skip itself with no errors.
 
 #### Bitbucket Pipelines OIDC Support
 
@@ -261,6 +287,10 @@ See the [Bitbucket Pipelines OIDC documentation](https://support.atlassian.com/b
 
 In CircleCI, OIDC credential discovery works out of the box with no extra dependencies — the CLI reads the token from the `CIRCLE_OIDC_TOKEN_V2` (preferred) or `CIRCLE_OIDC_TOKEN` environment variable that CircleCI injects into every job. The Cloudsmith OIDC provider must expect the audience CircleCI mints, which is your CircleCI organization UUID. See the [Cloudsmith CircleCI integration guide](https://docs.cloudsmith.com/integrations/integrating-with-circleci).
 
+#### Buildkite OIDC Support
+
+In Buildkite, OIDC credential discovery works out of the box with no extra dependencies — the CLI requests a token for the current job through `buildkite-agent oidc request-token`. By default it requests the `cloudsmith` audience; use `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE` if your Cloudsmith OIDC provider expects a different audience. See the [Buildkite OIDC documentation](https://buildkite.com/docs/pipelines/security/oidc).
+
 #### Azure DevOps OIDC Support
 
 In Azure DevOps Pipelines, OIDC credential discovery works out of the box with no extra dependencies — the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN`. Make sure `SYSTEM_ACCESSTOKEN` is mapped into the step's environment. The Cloudsmith OIDC provider must expect the audience `api://AzureADTokenExchange`, which Azure DevOps always mints (any requested audience is ignored). See the [Cloudsmith Azure DevOps integration guide](https://docs.cloudsmith.com/integrations/integrating-with-azure-devops).
@@ -295,7 +325,7 @@ By default the CLI tries each detector in a fixed priority order and uses the fi
 - **Disable a detector** — set `CLOUDSMITH_OIDC_<DETECTOR>_DISABLED=true` to skip it entirely. Only the literal value `true` (case-insensitive) disables; anything else leaves the detector enabled. For example, `CLOUDSMITH_OIDC_AWS_DISABLED=true` skips the AWS detector so an explicitly-set `CLOUDSMITH_OIDC_TOKEN` is picked up by the generic detector instead.
 - **Reorder evaluation** — use `--oidc-detector-order` (or the `CLOUDSMITH_OIDC_DETECTOR_ORDER` environment variable) with a comma-separated list of detector ids to control both which detectors are considered and the order they are tried in (first match wins). Ids not listed are skipped; unrecognised ids are ignored with a warning. For example, `--oidc-detector-order=generic,aws` tries the generic detector first and considers only those two.
 
-When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `circleci`, `generic`, `github`, `gitlab`.
+When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `buildkite`, `circleci`, `gcp`, `generic`, `github`, `gitlab`.
 
 Both controls can also be set in `config.ini`, under `[default]` or a profile section:
 
@@ -338,7 +368,7 @@ Both configuration files use the simple INI format, such as:
 api_key=1234567890abcdef1234567890abcdef
 ```
 
-Additionally, the CLI will store SSO access and refresh tokens in the system keyring
+Additionally, the CLI will store SAML access and refresh tokens in the system keyring
 using the [`keyring`](https://github.com/jaraco/keyring) library.
 
 
@@ -349,8 +379,9 @@ See the [default config](https://raw.githubusercontent.com/cloudsmith-io/cloudsm
 You can specify the following configuration options:
 
 - `api_host`: The API host to connect to.
-- `api_proxy`: The API proxy to connect through.
-- `api_ssl_verify`: Whether or not to use SSL verification for requests.
+- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` remain supported for compatibility. In config and environment variables, the new name takes precedence over the alias. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
+- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` remain supported for compatibility. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
+- `ssl_verify_strict`: Whether or not to apply strict X.509 certificate verification (`VERIFY_X509_STRICT`, enabled by default on Python 3.13+). Set to `false` (or use `--without-ssl-verify-strict` / `CLOUDSMITH_SSL_VERIFY_STRICT=0`) if a TLS-intercepting proxy issues certificates that fail these checks. `CLOUDSMITH_SSL_VERIFY_STRICT=1` keeps strict verification enabled (the default). Certificates are still verified.
 - `api_user_agent`: The user agent to use for requests.
 
 ### Credentials (credentials.ini)
@@ -389,29 +420,15 @@ cloudsmith auth --owner example --no-browser
 
 #### Getting Your API Key
 
-You can retrieve your API key using the `cloudsmith login` command:
-
-```
-cloudsmith login
-Login: you@example.com
-Password:
-Repeat for confirmation:
-```
-
-*Note:* Please ensure you use your email for the 'Login' prompt and not your user slug/identifier.
-
-The resulting output looks something like:
-
-```
-Retrieving API token for 'you@example.com' ... OK
-Your API token is: 1234567890abcdef1234567890abcdef
-```
+Get your API key from the Cloudsmith web app: click your user icon in the top right corner, then click **Personal API Keys**. See [API Key](https://docs.cloudsmith.com/accounts-and-teams/api-key) for more information. If you authenticated with `cloudsmith auth`, you can also use `cloudsmith tokens create` to create an API key.
 
-Once you have your API key you can then put this into your `credentials.ini`, use it as an environment variable `export CLOUDSMITH_API_KEY=your_key_here` or pass it to the CLI using the `-k your_key_here` flag.
+Give your API key to the CLI in one of these ways:
 
-For convenience the CLI will ask you if you want to install the default configuration files, complete with your API key, if they don't already exist. Say 'y' or 'yes' to create the configuration files.
+- Set the `CLOUDSMITH_API_KEY` environment variable: `export CLOUDSMITH_API_KEY=your_key_here`.
+- Put the key into your `credentials.ini` file.
+- Pass the key to the CLI with the `-k your_key_here` flag.
 
-If the configuration files already exist, you'll have to manually put the API key into the configuration files, but the CLI will print out their locations.
+*Note:* The `cloudsmith login` command and its `cloudsmith token` alias are deprecated. They retrieve your API key with your email address and password, and they will stop working on November 20, 2026, when Cloudsmith disables username and password login. See the [Cloudsmith changelog](https://cloudsmith.com/changelog). After that, both commands fail with a message that explains how to get an API key instead.
 
 
 ## Uploading Packages

{cloudsmith_cli-1.28.0 → cloudsmith_cli-1.30.0}/README.md

@@ -47,8 +47,8 @@ The CLI currently supports the following commands (and sub-commands):
   - `entitlements`|`ents`:  List entitlements for a repository.
   - `packages`:             List packages for a repository. (Aliases `repos list`)
   - `repos`:                List repositories for a namespace (owner).
-- `login`|`token`:        Retrieve your API authentication token/key via login.
-- `logout`:               Clear stored authentication credentials and SSO tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
+- `login`|`token`:        [DEPRECATED] Retrieve your API authentication token/key via login.
+- `logout`:               Clear stored authentication credentials and SAML tokens (Keyring, API key from credential file and emit warning when `$CLOUDSMITH_API_KEY` is still set).
 - `metadata`:             Manage arbitrary JSON metadata (SBOM, BuildInfo, custom) attached to a package.
   - `add`:                  Attach a new metadata entry to a package.
   - `list`|`ls`:            List metadata entries for a package, or fetch a single entry by slug.
@@ -179,6 +179,29 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials (ADC) resolution and OIDC ID token generation. It works with an attached Google Cloud service account, a service-account key supplied through `GOOGLE_APPLICATION_CREDENTIALS`, or service-account impersonation configured locally:
+
+```sh
+gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL
+cloudsmith whoami --workspace=YOUR_WORKSPACE --oidc-service-slug=YOUR_SERVICE --oidc-detector-order=gcp
+```
+
+Configure a Cloudsmith OIDC provider to trust `https://accounts.google.com`, the service account's numeric unique ID as the subject, and audience `cloudsmith` (override with `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE`). Local impersonation requires the Service Account Token Creator role on the target service account and the IAM Service Account Credentials API enabled.
+
+On workloads with a metadata identity endpoint, the CLI requests an ID token directly. If that endpoint returns HTTP 404 (as on some Cloud Build environments), it uses IAM `generateIdToken` for the same attached service account. This fallback requires the IAM Service Account Credentials API and `iam.serviceAccounts.getOpenIdToken` on that account; the Service Account OpenID Connect Identity Token Creator role grants this permission. Permission and transport failures are reported, not treated as a missing endpoint.
+
+A plain `gcloud auth application-default login` user session cannot mint an ID token for an arbitrary audience. To use it, set `--oidc-audience` to the session's OAuth client ID and configure Cloudsmith to trust that audience and user subject; otherwise use service-account impersonation. `gcloud auth login` alone does not configure ADC. Other ADC types, including direct external-account federation, are skipped rather than incorrectly treated as ID-token-capable credentials.
+
+See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for credential discovery.
+
 #### All Optional Features
 
 To install all optional dependencies:
@@ -187,7 +210,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extra, the corresponding OIDC detector will gracefully skip itself with no errors.
 
 #### Bitbucket Pipelines OIDC Support
 
@@ -208,6 +231,10 @@ See the [Bitbucket Pipelines OIDC documentation](https://support.atlassian.com/b
 
 In CircleCI, OIDC credential discovery works out of the box with no extra dependencies — the CLI reads the token from the `CIRCLE_OIDC_TOKEN_V2` (preferred) or `CIRCLE_OIDC_TOKEN` environment variable that CircleCI injects into every job. The Cloudsmith OIDC provider must expect the audience CircleCI mints, which is your CircleCI organization UUID. See the [Cloudsmith CircleCI integration guide](https://docs.cloudsmith.com/integrations/integrating-with-circleci).
 
+#### Buildkite OIDC Support
+
+In Buildkite, OIDC credential discovery works out of the box with no extra dependencies — the CLI requests a token for the current job through `buildkite-agent oidc request-token`. By default it requests the `cloudsmith` audience; use `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE` if your Cloudsmith OIDC provider expects a different audience. See the [Buildkite OIDC documentation](https://buildkite.com/docs/pipelines/security/oidc).
+
 #### Azure DevOps OIDC Support
 
 In Azure DevOps Pipelines, OIDC credential discovery works out of the box with no extra dependencies — the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN`. Make sure `SYSTEM_ACCESSTOKEN` is mapped into the step's environment. The Cloudsmith OIDC provider must expect the audience `api://AzureADTokenExchange`, which Azure DevOps always mints (any requested audience is ignored). See the [Cloudsmith Azure DevOps integration guide](https://docs.cloudsmith.com/integrations/integrating-with-azure-devops).
@@ -242,7 +269,7 @@ By default the CLI tries each detector in a fixed priority order and uses the fi
 - **Disable a detector** — set `CLOUDSMITH_OIDC_<DETECTOR>_DISABLED=true` to skip it entirely. Only the literal value `true` (case-insensitive) disables; anything else leaves the detector enabled. For example, `CLOUDSMITH_OIDC_AWS_DISABLED=true` skips the AWS detector so an explicitly-set `CLOUDSMITH_OIDC_TOKEN` is picked up by the generic detector instead.
 - **Reorder evaluation** — use `--oidc-detector-order` (or the `CLOUDSMITH_OIDC_DETECTOR_ORDER` environment variable) with a comma-separated list of detector ids to control both which detectors are considered and the order they are tried in (first match wins). Ids not listed are skipped; unrecognised ids are ignored with a warning. For example, `--oidc-detector-order=generic,aws` tries the generic detector first and considers only those two.
 
-When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `circleci`, `generic`, `github`, `gitlab`.
+When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `buildkite`, `circleci`, `gcp`, `generic`, `github`, `gitlab`.
 
 Both controls can also be set in `config.ini`, under `[default]` or a profile section:
 
@@ -285,7 +312,7 @@ Both configuration files use the simple INI format, such as:
 api_key=1234567890abcdef1234567890abcdef
 ```
 
-Additionally, the CLI will store SSO access and refresh tokens in the system keyring
+Additionally, the CLI will store SAML access and refresh tokens in the system keyring
 using the [`keyring`](https://github.com/jaraco/keyring) library.
 
 
@@ -296,8 +323,9 @@ See the [default config](https://raw.githubusercontent.com/cloudsmith-io/cloudsm
 You can specify the following configuration options:
 
 - `api_host`: The API host to connect to.
-- `api_proxy`: The API proxy to connect through.
-- `api_ssl_verify`: Whether or not to use SSL verification for requests.
+- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` remain supported for compatibility. In config and environment variables, the new name takes precedence over the alias. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
+- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` remain supported for compatibility. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
+- `ssl_verify_strict`: Whether or not to apply strict X.509 certificate verification (`VERIFY_X509_STRICT`, enabled by default on Python 3.13+). Set to `false` (or use `--without-ssl-verify-strict` / `CLOUDSMITH_SSL_VERIFY_STRICT=0`) if a TLS-intercepting proxy issues certificates that fail these checks. `CLOUDSMITH_SSL_VERIFY_STRICT=1` keeps strict verification enabled (the default). Certificates are still verified.
 - `api_user_agent`: The user agent to use for requests.
 
 ### Credentials (credentials.ini)
@@ -336,29 +364,15 @@ cloudsmith auth --owner example --no-browser
 
 #### Getting Your API Key
 
-You can retrieve your API key using the `cloudsmith login` command:
-
-```
-cloudsmith login
-Login: you@example.com
-Password:
-Repeat for confirmation:
-```
-
-*Note:* Please ensure you use your email for the 'Login' prompt and not your user slug/identifier.
-
-The resulting output looks something like:
-
-```
-Retrieving API token for 'you@example.com' ... OK
-Your API token is: 1234567890abcdef1234567890abcdef
-```
+Get your API key from the Cloudsmith web app: click your user icon in the top right corner, then click **Personal API Keys**. See [API Key](https://docs.cloudsmith.com/accounts-and-teams/api-key) for more information. If you authenticated with `cloudsmith auth`, you can also use `cloudsmith tokens create` to create an API key.
 
-Once you have your API key you can then put this into your `credentials.ini`, use it as an environment variable `export CLOUDSMITH_API_KEY=your_key_here` or pass it to the CLI using the `-k your_key_here` flag.
+Give your API key to the CLI in one of these ways:
 
-For convenience the CLI will ask you if you want to install the default configuration files, complete with your API key, if they don't already exist. Say 'y' or 'yes' to create the configuration files.
+- Set the `CLOUDSMITH_API_KEY` environment variable: `export CLOUDSMITH_API_KEY=your_key_here`.
+- Put the key into your `credentials.ini` file.
+- Pass the key to the CLI with the `-k your_key_here` flag.
 
-If the configuration files already exist, you'll have to manually put the API key into the configuration files, but the CLI will print out their locations.
+*Note:* The `cloudsmith login` command and its `cloudsmith token` alias are deprecated. They retrieve your API key with your email address and password, and they will stop working on November 20, 2026, when Cloudsmith disables username and password login. See the [Cloudsmith changelog](https://cloudsmith.com/changelog). After that, both commands fail with a message that explains how to get an API key instead.
 
 
 ## Uploading Packages

{cloudsmith_cli-1.28.0 → cloudsmith_cli-1.30.0}/cloudsmith_cli/cli/command.py

@@ -6,6 +6,8 @@ from collections import OrderedDict
 import click.exceptions
 from click_didyoumean import DYMGroup
 
+from ..core.certificate_errors import describe_certificate_error
+
 
 def _is_json_output_requested(exception):
     """Determine if JSON output was requested, checking context and argv."""
@@ -35,6 +37,19 @@ def _is_json_output_requested(exception):
     return False
 
 
+def _is_debug_requested(args=None):
+    """Determine if --debug was passed (the click context is gone by now).
+
+    ``args`` are the arguments given to ``main``; click falls back to
+    ``sys.argv`` when they are ``None``, so we do the same.
+    """
+    import sys
+
+    if args is None:
+        args = sys.argv[1:]
+    return any(arg in ("-d", "--debug") for arg in args)
+
+
 def _format_click_exception_as_json(exception):
     """Format a ClickException as a JSON error dict."""
     return {
@@ -45,11 +60,19 @@ def _format_click_exception_as_json(exception):
         },
         "help": {
             "context": "Invalid usage",
-            "hint": "Check your command arguments/flags.",
+            "hint": describe_certificate_error(exception)
+            or "Check your command arguments/flags.",
         },
     }
 
 
+def _echo_certificate_hint(exception):
+    """Explain a TLS certificate failure behind ``exception`` on stderr."""
+    hint = describe_certificate_error(exception)
+    if hint:
+        click.echo(f"Hint: {click.style(hint, fg='yellow')}", err=True)
+
+
 class AliasGroup(DYMGroup):
     """A command group with DYM, alias and lazy-subcommand support.
 
@@ -177,4 +200,23 @@ class AliasGroup(DYMGroup):
             if not original_standalone_mode:
                 raise
             e.show()
+            _echo_certificate_hint(e)
             sys.exit(e.exit_code)
+        except Exception as e:  # pylint: disable=broad-exception-caught
+            # Anything reaching here is unexpected: click's own errors and
+            # handled API errors (which exit via ctx.exit) are dealt with
+            # above or never get this far.
+            if not original_standalone_mode:
+                raise
+            main_args = kwargs.get("args", args[0] if args else None)
+            if _is_debug_requested(main_args):
+                import traceback
+
+                click.echo(traceback.format_exc(), err=True, nl=False)
+            from ..core import telemetry
+
+            # Reporting is silent: the user sees the same line either way.
+            telemetry.report_exception(e)
+            click.echo(f"Error: {telemetry.format_exception_summary(e)}", err=True)
+            _echo_certificate_hint(e)
+            sys.exit(1)

{cloudsmith_cli-1.28.0 → cloudsmith_cli-1.30.0}/cloudsmith_cli/cli/commands/auth.py

@@ -12,7 +12,7 @@ from ...core.sso import (
 )
 from .. import decorators, utils, validators
 from ..exceptions import handle_api_exceptions
-from ..saml import create_configured_session, get_idp_url
+from ..saml import get_idp_url
 from ..webserver import AuthenticationWebRequestHandler, AuthenticationWebServer
 from .main import main
 from .tokens import create, request_api_key
@@ -53,7 +53,7 @@ def _create_auth_server(opts, owner, session, enable_token_creation, profile):
 
 
 def _renew_existing_sso_session(opts, profile):
-    """Return a usable existing SSO session, or fall back to browser auth."""
+    """Return a usable existing SAML session, or fall back to browser auth."""
     renewal = renew_sso_session(opts.api_config.host, opts.session, profile=profile)
     if renewal.status in (
         SsoRenewalStatus.RENEWED,
@@ -64,14 +64,15 @@ def _renew_existing_sso_session(opts, profile):
         renewal.error, requests.RequestException
     ):
         raise click.ClickException(
-            "The SSO session has expired and Cloudsmith could not be reached. "
+            "The SAML session has expired and Cloudsmith could not be reached: "
+            f"{renewal.error}\n"
             "Check your connection, then run 'cloudsmith auth' again."
         ) from renewal.error
     return None
 
 
 def _report_active_sso_session(opts, renewal, use_stderr=False):
-    """Report the usable SSO session without exposing its access token."""
+    """Report the usable SAML session without exposing its access token."""
     expires_at = get_access_token_expiry(renewal.access_token)
     data = {
         "authenticated": True,
@@ -84,16 +85,16 @@ def _report_active_sso_session(opts, renewal, use_stderr=False):
         return
 
     if renewal.status == SsoRenewalStatus.RENEWED:
-        click.secho("SSO session renewed.", fg="green", err=use_stderr)
+        click.secho("SAML session renewed.", fg="green", err=use_stderr)
     elif renewal.error:
         click.secho(
-            "The SSO session could not be renewed; the existing access token "
+            "The SAML session could not be renewed; the existing access token "
             "remains active.",
             fg="yellow",
             err=use_stderr,
         )
     else:
-        click.secho("SSO session is active.", fg="green", err=use_stderr)
+        click.secho("SAML session is active.", fg="green", err=use_stderr)
     if expires_at:
         click.echo(
             f"Access token expires at {utils.fmt_datetime(expires_at)}.",
@@ -110,7 +111,7 @@ def _perform_saml_authentication(
     profile=None,
 ):
     """Perform SAML authentication via web browser and local web server."""
-    session = create_configured_session(opts)
+    session = opts.session
     api_host = opts.api_config.host
 
     auth_server, port = _create_auth_server(
@@ -270,10 +271,10 @@ def authenticate(
         err=use_stderr,
     )
 
-    # Determine if we need to refresh API after SSO (required for token operations)
+    # Determine if we need to refresh API after SAML (required for token operations)
     enable_token_creation = token or request_api_key_flag
 
-    context_message = "Failed to authenticate via SSO!"
+    context_message = "Failed to authenticate via SAML!"
     with handle_api_exceptions(ctx, opts=opts, context_msg=context_message):
         _perform_saml_authentication(
             opts,

{cloudsmith_cli-1.28.0 → cloudsmith_cli-1.30.0}/cloudsmith_cli/cli/commands/check.py

@@ -127,6 +127,4 @@ def service(ctx, opts):
         click.secho("(up-to-date)", fg="green")
 
         click.echo()
-        click.secho(
-            "The API library used by this CLI tool seems to be up-to-date.", fg="green"
-        )
+        click.secho("The API library used by this CLI tool is up-to-date.", fg="green")

{cloudsmith_cli-1.28.0 → cloudsmith_cli-1.30.0}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -9,6 +9,7 @@ Provides ``credential-helper install``, ``credential-helper uninstall``, and
 from __future__ import annotations
 
 import sys
+from urllib.parse import urlsplit
 
 import click
 
@@ -78,10 +79,14 @@ def _get_installer(name: str):
 def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...]:
     """Build the terraformrc ``args`` list from the resolved config.
 
-    Baking ``--org``/``-r``/``-P`` into the block means ``terraform init`` works
+    Baking ``-w``/``-r``/``-P`` into the block means ``terraform init`` works
     with no environment variables and no hand-edited config. Only values
-    actually supplied are written, so an install without ``--org``/``--repo``/
-    ``-P`` leaves ``args = []``.
+    actually supplied are written, so an install without ``-w``/``--repo``/
+    ``-P`` leaves ``args = []``. The API host and proxy are baked in too, so
+    the helper looks up domains on the same API host, through the same proxy,
+    as the install. A proxy URL with credentials is never baked in: Terraform
+    passes ``args`` on the helper's command line, where any local user can read
+    them.
 
     A non-default ``--config-file``/``--credentials-file`` is also baked in: the
     helper is later invoked by ``terraform init`` in a fresh process with none
@@ -91,7 +96,7 @@ def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...
     """
     args: list[str] = []
     if opts.org:
-        args.extend(["--org", opts.org])
+        args.extend(["-w", opts.org])
     if repo:
         args.extend(["-r", repo])
     profile = ctx.meta.get("profile")
@@ -103,9 +108,32 @@ def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...
     creds_file = ctx.meta.get("creds_file")
     if creds_file:
         args.extend(["--credentials-file", creds_file])
+    if opts.api_host:
+        args.extend(["--api-host", opts.api_host])
+    if opts.proxy and not _proxy_has_credentials(opts.proxy):
+        args.extend(["--proxy", opts.proxy])
     return tuple(args)
 
 
+def _proxy_has_credentials(proxy: str) -> bool:
+    """Return True if the proxy URL carries a username or password."""
+    parsed = urlsplit(proxy if "://" in proxy else f"//{proxy}")
+    return parsed.username is not None or parsed.password is not None
+
+
+def _terraform_proxy_next_steps(opts) -> list[str]:
+    """Return the post-install guidance when the proxy was not baked in."""
+    if not opts.proxy or not _proxy_has_credentials(opts.proxy):
+        return []
+    return [
+        (
+            "Next steps: the proxy URL contains credentials, so it was not"
+            " written to the Terraform config. export CLOUDSMITH_PROXY=<proxy-url>"
+            " in the environment that runs `terraform init`."
+        ),
+    ]
+
+
 _REPO_FLAGS = ("-r", "--repo", "--repository")
 
 
@@ -141,6 +169,31 @@ def _terraform_next_steps(helper_args: tuple[str, ...]) -> list[str]:
     ]
 
 
+def _terraform_workspace_next_steps(helper_args: tuple[str, ...]) -> list[str]:
+    """Return the post-install guidance when no Workspace is baked in.
+
+    The helper needs a Workspace to match custom domains and to scope the
+    token for a Cloudsmith-owned host.
+    """
+    if "-w" in helper_args:
+        return []
+    rc_path = _terraformrc_path()
+    return [
+        (
+            "Next steps: the Terraform helper needs a Workspace to match custom"
+            " domains and to scope tokens. Provide it in one of these ways:"
+        ),
+        (
+            "  - export CLOUDSMITH_WORKSPACE=<your-workspace> in the environment"
+            " that runs `terraform init`, or"
+        ),
+        (
+            f"  - add it to the args in {rc_path}, e.g."
+            ' args = ["-w", "<your-workspace>", ...].'
+        ),
+    ]
+
+
 # ---------------------------------------------------------------------------
 # install
 # ---------------------------------------------------------------------------
@@ -149,7 +202,10 @@ def _terraform_next_steps(helper_args: tuple[str, ...]) -> list[str]:
 @click.command("install")
 @click.argument("helper")
 @click.option(
-    "--bin-dir", default=None, help="Directory to install the launcher binary."
+    "--bin-dir",
+    default=None,
+    help="Directory to install the launcher binary. "
+    "[default: ~/.cloudsmith/bin, or Terraform's plugin directory]",
 )
 @click.option(
     "--domain",
@@ -231,7 +287,7 @@ def install_cmd(
     \b
         # Terraform: bake the repository into the terraformrc args so
         # `terraform init` needs no CLOUDSMITH_REPO env var
-        $ cloudsmith credential-helper install terraform --org acme --repo my-repo
+        $ cloudsmith credential-helper install terraform -w acme --repo my-repo
     """
     installer = _get_installer(helper)
 
@@ -278,7 +334,11 @@ def install_cmd(
 
     next_steps: list[str] = []
     if helper == "terraform":
-        next_steps = _terraform_next_steps(helper_args)
+        next_steps = (
+            _terraform_workspace_next_steps(helper_args)
+            + _terraform_next_steps(helper_args)
+            + _terraform_proxy_next_steps(opts)
+        )
 
     data = {
         "helper": helper,
@@ -309,7 +369,10 @@ def install_cmd(
 @click.command("uninstall")
 @click.argument("helper")
 @click.option(
-    "--bin-dir", default=None, help="Directory where the launcher binary was installed."
+    "--bin-dir",
+    default=None,
+    help="Directory where the launcher binary was installed. "
+    "[default: ~/.cloudsmith/bin, or Terraform's plugin directory]",
 )
 @click.option(
     "--dry-run",