cloudsmith-cli 1.30.0__tar.gz → 1.30.1__tar.gz

{cloudsmith_cli-1.30.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.30.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.30.0
+Version: 1.30.1
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.11.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: certifi>=2024.7.4
+Requires-Dist: certifi>=2026.10.23
 Requires-Dist: click!=8.3.0,>=8.2
 Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/auth.py

@@ -158,10 +158,28 @@ def _perform_saml_authentication(
                 )
 
         auth_server.handle_request()
+        return auth_server.sso_access_token is not None
     finally:
         auth_server.server_close()
 
 
+def _save_workspace(ctx, opts, workspace, use_stderr):
+    """Save the Workspace to config.ini, or warn when the CLI cannot write it."""
+    try:
+        saved_path = opts.get_config_reader().save_workspace(
+            workspace, profile=ctx.meta.get("profile"), path=ctx.meta.get("config_file")
+        )
+    except (OSError, ValueError) as exc:
+        click.secho(
+            f"Could not save the {workspace} Workspace to config.ini: {exc}",
+            fg="yellow",
+            err=True,
+        )
+        return
+    if saved_path:
+        click.echo(f"Saved the {workspace} Workspace to {saved_path}.", err=use_stderr)
+
+
 @main.command(aliases=["auth"])
 @click.option(
     "-t",
@@ -276,7 +294,7 @@ def authenticate(
 
     context_message = "Failed to authenticate via SAML!"
     with handle_api_exceptions(ctx, opts=opts, context_msg=context_message):
-        _perform_saml_authentication(
+        authenticated = _perform_saml_authentication(
             opts,
             workspace,
             enable_token_creation=enable_token_creation,
@@ -285,6 +303,9 @@ def authenticate(
             profile=ctx.meta.get("profile"),
         )
 
+    if authenticated:
+        _save_workspace(ctx, opts, workspace, use_stderr)
+
     if request_api_key_flag:
         # Non-interactive token retrieval
         new_token = request_api_key(ctx, opts, save_config=save_config)

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -351,7 +351,7 @@ def install_cmd(
         sys.exit(ec)
 
     if dry_run:
-        click.echo("Dry run — no changes will be made:", err=use_stderr)
+        click.echo("Dry run - no changes will be made:", err=use_stderr)
     for action in normal:
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
@@ -419,7 +419,7 @@ def uninstall_cmd(ctx, opts, helper: str, bin_dir: str | None, dry_run: bool) ->
         return
 
     if dry_run:
-        click.echo("Dry run — no changes will be made:", err=use_stderr)
+        click.echo("Dry run - no changes will be made:", err=use_stderr)
     for action in normal:
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/main.py

@@ -64,6 +64,7 @@ For issues/contributing: {get_github_website()}
     envvar="CLOUDSMITH_NO_UPDATE_CHECK",
     help="Disable the once-a-day check for a newer version of the CLI.",
 )
+@decorators.keyring_options
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options
 @click.pass_context

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/mcp.py

@@ -16,6 +16,7 @@ import json5
 if TYPE_CHECKING:
     from ...core.mcp import server
     from ...core.mcp.data import OpenAPITool
+    from ..config import Options
 
 from .. import command, decorators, utils
 from .main import main
@@ -196,7 +197,9 @@ def print_groups(group_list: dict[str, list[str]]):
 )
 @decorators.initialise_api
 @click.pass_context
-def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
+def configure(  # pylint: disable=unused-argument
+    ctx: click.Context, opts: Options, client: str | None, is_global: bool
+) -> None:
     """
     Configure the Cloudsmith MCP server for supported clients.
 
@@ -253,7 +256,7 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
             if configure_client(client_name, server_config, is_global, profile):
                 if not use_stderr:
                     click.echo(
-                        click.style(f"✓ Configured {client_name.title()}", fg="green")
+                        click.style(f"Configured {client_name.title()}", fg="green")
                     )
                 success_count += 1
                 results.append({"client": client_name, "success": True})
@@ -261,7 +264,7 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
                 if not use_stderr:
                     click.echo(
                         click.style(
-                            f"✗ Failed to configure {client_name.title()}", fg="red"
+                            f"Failed to configure {client_name.title()}", fg="red"
                         )
                     )
                 results.append(
@@ -275,7 +278,7 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
             if not use_stderr:
                 click.echo(
                     click.style(
-                        f"✗ Error configuring {client_name.title()}: {e!s}", fg="red"
+                        f"Error configuring {client_name.title()}: {e!s}", fg="red"
                     )
                 )
             results.append({"client": client_name, "success": False, "error": str(e)})
@@ -286,14 +289,14 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
     if success_count > 0:
         click.echo(
             click.style(
-                f"\n✓ Successfully configured {success_count} client(s)", fg="green"
+                f"\nSuccessfully configured {success_count} client(s)", fg="green"
             )
         )
         click.echo(
             "\nNote: You may need to restart the client application for changes to take effect."
         )
     else:
-        click.echo(click.style("\n✗ No clients were configured successfully", fg="red"))
+        click.echo(click.style("\nNo clients were configured successfully", fg="red"))
 
 
 def _get_server_config(profile=None):
@@ -502,7 +505,7 @@ def _safe_update_json(path: Path, mutate, *, max_retries: int = 3) -> None:
     for _ in range(max_retries):
         if path.exists():
             mtime_before = path.stat().st_mtime_ns
-            with open(path) as f:
+            with open(path, encoding="utf-8") as f:
                 content = f.read()
             try:
                 config = json5.loads(content)

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/update.py

@@ -85,7 +85,7 @@ def _print_manual_update(opts, current, latest, manifest, data):
     if utils.maybe_print_as_json(opts, data):
         return
     click.echo(
-        f"A new version of the Cloudsmith CLI is available: {current} \u2192 {latest}"
+        f"A new version of the Cloudsmith CLI is available: {current} -> {latest}"
     )
     click.echo(f"See what's changed: {changelog}")
     click.echo("Self-update is not supported for the standalone binary on Windows.")
@@ -150,7 +150,7 @@ def update(ctx, opts, assume_yes):
         if utils.maybe_print_as_json(opts, data):
             return
         click.echo(
-            f"A new version of the Cloudsmith CLI is available: {current} \u2192 {latest}"
+            f"A new version of the Cloudsmith CLI is available: {current} -> {latest}"
         )
         click.echo(f"See what's changed: {changelog}")
         click.echo(f"The CLI was installed via {channel}. To update, run:")

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/commands/vulnerabilities.py

@@ -2,16 +2,27 @@
 
 import click
 
+from ...core.api.exceptions import ApiException
 from ...core.api.vulnerabilities import (
+    NO_SCAN_RESULTS_MSG,
     _print_vulnerabilities_assessment_table,
     _print_vulnerabilities_summary_table,
+    _severity_of,
     get_package_scan_result,
 )
 from .. import decorators, utils, validators
+from ..config import Options
 from ..exceptions import handle_api_exceptions
 from .main import main
 
 
+def _summarise_no_scan_results(
+    _exc: ApiException, detail: str | None, _fields: dict
+) -> str | None:
+    """Show only the detail when the package has no scan results."""
+    return detail if detail == NO_SCAN_RESULTS_MSG else None
+
+
 @main.command()
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options
@@ -41,8 +52,13 @@ from .main import main
 )
 @click.pass_context
 def vulnerabilities(
-    ctx, opts, owner_repo_package, show_assessment, fixable, severity_filter
-):
+    ctx: click.Context,
+    opts: Options,
+    owner_repo_package: tuple[str, str, str],
+    show_assessment: bool,
+    fixable: bool | None,
+    severity_filter: str | None,
+) -> None:
     """
     Retrieve vulnerability scan results for a package.
 
@@ -82,7 +98,12 @@ def vulnerabilities(
 
     context_msg = "Failed to retrieve vulnerability report!"
     with (
-        handle_api_exceptions(ctx, opts=opts, context_msg=context_msg),
+        handle_api_exceptions(
+            ctx,
+            opts=opts,
+            context_msg=context_msg,
+            summarise_error=_summarise_no_scan_results,
+        ),
         utils.maybe_spinner(opts),
     ):
         data = get_package_scan_result(
@@ -99,7 +120,7 @@ def vulnerabilities(
 
     # Filter results if severity or fixable flags are active
     if severity_filter or fixable is not None:
-        scans = getattr(data, "scans", [])
+        scans = getattr(data, "scans", None) or []
 
         allowed_severities = (
             [s.strip().lower() for s in severity_filter.split(",")]
@@ -108,14 +129,12 @@ def vulnerabilities(
         )
 
         for scan in scans:
-            results = getattr(scan, "results", [])
+            results = getattr(scan, "results", None) or []
 
             # 1. Filter by Severity
             if allowed_severities:
                 results = [
-                    res
-                    for res in results
-                    if getattr(res, "severity", "unknown").lower() in allowed_severities
+                    res for res in results if _severity_of(res) in allowed_severities
                 ]
 
             # 2. Filter by Fixable Status

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/config.py

@@ -155,6 +155,44 @@ class ConfigReader(ConfigFileReader):
 
         return True
 
+    @classmethod
+    def get_user_filepath(cls):
+        """Get the user-level config file with the highest precedence, existing or not."""
+        user_paths = [
+            os.path.join(searchpath, filename)
+            for searchpath in cls.config_searchpath
+            for filename in cls.config_files
+            if os.path.isabs(os.path.join(searchpath, filename))
+        ]
+        existing_paths = [path for path in user_paths if os.path.isfile(path)]
+        return (existing_paths or user_paths)[0]
+
+    @classmethod
+    def save_workspace(cls, workspace, profile=None, path=None):
+        """Write the Workspace to the profile section; return the path if it changed."""
+        if path and os.path.isdir(path):
+            path = os.path.join(path, "config.ini")
+        path = path or cls.get_user_filepath()
+        if os.path.exists(path):
+            with open(path) as config_file:
+                content = config_file.read()
+        else:
+            content = read_file(get_data_path(), "config.ini")
+
+        section = (
+            f"profile:{profile}" if profile and profile != "default" else "default"
+        )
+        if _get_section_value(content, section, "workspace") == workspace:
+            return None
+        updated = _set_section_value(content, section, "workspace", workspace)
+        if _get_section_value(updated, section, "workspace") != workspace:
+            raise ValueError(f"the CLI cannot change the [{section}] section of {path}")
+
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        with open(path, "w") as config_file:
+            config_file.write(updated)
+        return path
+
     @classmethod
     def has_default_file(cls):
         """Check if a configuration file exists."""
@@ -249,6 +287,36 @@ class ConfigReader(ConfigFileReader):
             setattr(opts, k, v)
 
 
+def _get_section_value(content, section, key):
+    """Get `key` from the INI `section` of `content`, or None if it does not parse."""
+    parser = configparser.ConfigParser(interpolation=None)
+    parser.optionxform = str
+    try:
+        parser.read_string(content)
+    except configparser.Error:
+        return None
+    return parser.get(section, key, fallback=None)
+
+
+def _set_section_value(content, section, key, value):
+    """Set `key` in the INI `section` of `content`, preserving comments and layout."""
+    line = f"{key} = {value}"
+    header = re.search(rf"^\[{re.escape(section)}\].*$", content, re.MULTILINE)
+    if not header:
+        separator = "\n\n" if content.strip() else ""
+        return f"{content.rstrip()}{separator}[{section}]\n{line}\n"
+
+    next_header = re.compile(r"^\[", re.MULTILINE).search(content, header.end())
+    body_end = next_header.start() if next_header else len(content)
+    body = content[header.end() : body_end]
+    entry = re.compile(rf"^{re.escape(key)}[ \t]*[=:].*$", re.MULTILINE)
+    if entry.search(body):
+        body = entry.sub(lambda _: line, body, count=1)
+    else:
+        body = f"\n{line}{body}"
+    return content[: header.end()] + body + content[body_end:]
+
+
 class CredentialsSchema:
     """Schema for credentials configuration."""
 

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/decorators.py

@@ -11,7 +11,7 @@ from click.core import ParameterSource
 from cloudsmith_cli.cli import validators
 from cloudsmith_cli.core.utils import ColorMode, TTYMode, color_enabled
 
-from ..core import update_check
+from ..core import keyring, update_check
 from ..core.certificate_errors import describe_certificate_error
 from ..core.credentials.chain import CredentialProviderChain
 from ..core.credentials.models import CredentialContext
@@ -118,6 +118,66 @@ def common_package_action_options(f):
     return wrapper
 
 
+def _absolute_path(ctx, param, value):
+    """Expand ``~`` and environment variables in *value* and make it absolute."""
+    if not value:
+        return value
+    return os.path.abspath(os.path.expanduser(os.path.expandvars(value)))
+
+
+def keyring_options(f):
+    """Add hidden options that read the keyring settings from the environment."""
+
+    @click.option(
+        "--no-keyring-env",
+        "no_keyring",
+        envvar="CLOUDSMITH_NO_KEYRING",
+        hidden=True,
+    )
+    @click.option(
+        "--keyring-backend-env",
+        "keyring_backend",
+        envvar="CLOUDSMITH_KEYRING_BACKEND",
+        hidden=True,
+    )
+    @click.option(
+        "--keyring-key-env",
+        "keyring_key",
+        envvar="CLOUDSMITH_KEYRING_KEY",
+        hidden=True,
+    )
+    @click.option(
+        "--keyring-file-path-env",
+        "keyring_file_path",
+        envvar="CLOUDSMITH_KEYRING_FILE_PATH",
+        callback=_absolute_path,
+        hidden=True,
+    )
+    @click.option(
+        "--keyring-dir-env",
+        "keyring_dir",
+        envvar="CLOUDSMITH_KEYRING_DIR",
+        callback=_absolute_path,
+        hidden=True,
+    )
+    @click.pass_context
+    @functools.wraps(f)
+    def wrapper(ctx, *args, **kwargs):
+        keyring.configure(
+            keyring.KeyringSettings(
+                no_keyring=(kwargs.pop("no_keyring") or "").strip().lower()
+                in ("1", "true", "yes"),
+                backend=kwargs.pop("keyring_backend"),
+                key=kwargs.pop("keyring_key"),
+                file_path=kwargs.pop("keyring_file_path"),
+                directory=kwargs.pop("keyring_dir"),
+            )
+        )
+        return ctx.invoke(f, *args, **kwargs)
+
+    return wrapper
+
+
 def common_cli_config_options(f):
     """Add common CLI config options to commands."""
 

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/cli/validators.py

@@ -39,14 +39,19 @@ class IntOrWildcard(click.ParamType):
             self.fail(f"{value!r} is not a valid integer or '*'", param, ctx)
 
 
-def transform_api_header_authorization(param, value):
+def _option_hint(param: str) -> str:
+    """Return the Click error hint for the option that has the param name."""
+    return f"'--{param.replace('_', '-')}'"
+
+
+def transform_api_header_authorization(param: str, value: str) -> str:
     """Transform a username:password value into a base64 string."""
     try:
         username, password = value.split(":", 1)
     except ValueError:
         raise click.BadParameter(
             "Authorization header needs to be Authorization=username:password",
-            param=param,
+            param_hint=_option_hint(param),
         )
 
     value = f"{username.strip()}:{password}"
@@ -57,7 +62,7 @@ def transform_api_header_authorization(param, value):
 API_HEADER_TRANSFORMS["Authorization"] = transform_api_header_authorization
 
 
-def validate_api_headers(param, value):
+def validate_api_headers(param: str, value: str | None) -> dict[str, str] | None:
     """Validate that API headers is a CSV of k=v pairs."""
     # pylint: disable=unused-argument
     if not value:
@@ -73,7 +78,7 @@ def validate_api_headers(param, value):
                 if bad_header == k:
                     raise click.BadParameter(
                         f"{bad_header} is not an allowed header",
-                        param=param,
+                        param_hint=_option_hint(param),
                     )
 
             if k in API_HEADER_TRANSFORMS:
@@ -81,7 +86,8 @@ def validate_api_headers(param, value):
                 v = transform_func(param, v)
         except ValueError:
             raise click.BadParameter(
-                "Values need to be a CSV of key=value pairs", param=param
+                "Values need to be a CSV of key=value pairs",
+                param_hint=_option_hint(param),
             )
 
         headers[k] = v

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/conftest.py

@@ -1,6 +1,7 @@
 import cloudsmith_api
 import pytest
 
+from cloudsmith_cli.core import keyring as core_keyring
 from cloudsmith_cli.core import session, telemetry
 
 #: A syntactically valid DSN that is never contacted: tests that report use
@@ -19,6 +20,12 @@ def no_real_error_reports(monkeypatch):
     monkeypatch.setattr(telemetry, "_transport", None)
 
 
+@pytest.fixture(autouse=True)
+def default_keyring_settings():
+    """Start each test with the default keyring settings."""
+    core_keyring.configure(core_keyring.KeyringSettings())
+
+
 @pytest.fixture()
 def telemetry_config_dir(monkeypatch, tmp_path_factory):
     """An empty config search path, isolated from the developer's config.ini.

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/core/api/exceptions.py

@@ -3,6 +3,7 @@
 import contextlib
 import http.client
 import json
+from collections.abc import Iterator
 
 from cloudsmith_api.rest import ApiException as _ApiException
 
@@ -37,8 +38,26 @@ class ApiException(Exception):
         return f"{self.status} - {self.detail or self.status_description}"
 
 
+def error_detail_and_fields(
+    data: object,
+) -> tuple[str | None, dict[str, object] | None]:
+    """Get the detail and the fields from a parsed API error body of any JSON shape."""
+    if isinstance(data, dict):
+        detail = data.get("detail")
+        fields = data.get("fields")
+        return (
+            None if detail is None else str(detail),
+            fields if isinstance(fields, dict) else None,
+        )
+    if isinstance(data, list):
+        return " ".join(item for item in data if isinstance(item, str)) or None, None
+    if isinstance(data, str):
+        return data or None, None
+    return None, None
+
+
 @contextlib.contextmanager
-def catch_raise_api_exception():
+def catch_raise_api_exception() -> Iterator[None]:
     """Context manager that translates upstream API exceptions."""
     try:
         yield
@@ -48,10 +67,7 @@ def catch_raise_api_exception():
 
         if exc.body:
             try:
-                # pylint: disable=no-member
-                data = json.loads(exc.body)
-                detail = data.get("detail", None)
-                fields = data.get("fields", None)
+                detail, fields = error_detail_and_fields(json.loads(exc.body))
             except ValueError:
                 pass
 

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/core/api/init.py

@@ -9,6 +9,19 @@ import cloudsmith_api
 from ..rest import RestClient
 
 
+def _basic_auth_credentials(encoded: str) -> tuple[str, str]:
+    """Decode a Basic auth token into a username and password."""
+    try:
+        decoded = base64.b64decode(encoded, validate=True).decode("utf-8")
+        username, password = decoded.split(":", 1)
+    except ValueError as exc:
+        raise click.BadParameter(
+            "Authorization header needs to be Authorization=username:password",
+            param_hint="'--api-headers'",
+        ) from exc
+    return username, password
+
+
 def initialise_api(
     debug=False,
     host=None,
@@ -24,7 +37,7 @@ def initialise_api(
     error_retry_backoff=None,
     error_retry_codes=None,
     error_retry_cb=None,
-):
+) -> cloudsmith_api.Configuration:
     """Initialise the cloudsmith_api.Configuration."""
     # FIXME: pylint: disable=too-many-arguments
     config = cloudsmith_api.Configuration()
@@ -60,9 +73,7 @@ def initialise_api(
     if auth_header and " " in auth_header:
         auth_type, encoded = auth_header.split(" ", 1)
         if auth_type == "Basic":
-            decoded = base64.b64decode(encoded)
-            values = decoded.decode("utf-8")
-            config.username, config.password = values.split(":")
+            config.username, config.password = _basic_auth_credentials(encoded)
 
             if config.debug:
                 click.echo("Username and password config values set")

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.30.1}/cloudsmith_cli/core/api/user.py

@@ -43,7 +43,9 @@ def get_user_token(login, password, totp_token=None, two_factor_token=None):
         if e.status == 422 and e.body:
             try:
                 response_data = json.loads(e.body)
-                if response_data.get("two_factor_required"):
+                if isinstance(response_data, dict) and response_data.get(
+                    "two_factor_required"
+                ):
                     two_factor_token = response_data.get("two_factor_token")
                     # Raise custom exception for 2FA requirement
                     raise TwoFactorRequiredException(two_factor_token)