You are viewing a plain text version of this content. The canonical link for it is here.
Posted to builds@apache.org by Steven Gill <st...@gmail.com> on 2014/11/25 22:48:42 UTC
npm credentials on jenkins
Hey Everyone,
So I need to add credentials to my workspace for uploading a nightly build
to npm for cordova.
The command I need to run is `npm login` or `npm addUser`. It would prompt
me to add my username, password and email. I think I only need to do this
once and it would be saved in my workspace, but I would like it to be able
to work if I started a new workspace from scratch.
How do I do this in a way that is secure? I don't want to write my
credentials into my build step.
I assume a similar problem would exist for pushing changes to git.
Thanks!
-Steve
Re: npm credentials on jenkins
Posted by Steven Gill <st...@gmail.com>.
I have created an issue for this. Need to figure this out so cordova can
start publishing nightlies for testing purposes.
https://issues.apache.org/jira/browse/INFRA-8785
On Wed, Nov 26, 2014 at 4:41 PM, Steven Gill <st...@gmail.com> wrote:
> Okay. Thanks for the info! Let me know if I can help in any way. Should I
> create an issue for getting role accounts to work with npm?
>
> I will also continue investigating if I can figure out a different
> solution to publish to npm via jenkins.
>
> On Wed, Nov 26, 2014 at 11:29 AM, David Nalley <da...@gnsa.us> wrote:
>
>> On Wed, Nov 26, 2014 at 2:04 PM, Steven Gill <st...@gmail.com>
>> wrote:
>> > Thanks for responding David!
>> >
>> > Just to clarify, we don't consider nightlys releases. They are just
>> > snapshots and are published under the nightly tag to npm. You need to be
>> > explicit if you want to download it. It is only meant for testing. `npm
>> > install cordova@nightly`.
>> >
>>
>> Ahh, that's a great solution to the lack of non-release publishing to NPM.
>>
>> > I have set the build to run once daily. If it does get triggered by a
>> user,
>> > it isn't a big deal. The version that gets published to npm under
>> nightly
>> > has the date in it. If the script was run twice on the same day, it
>> would
>> > just fail to publish because the version has already been published.
>> >
>> > Do we have any documentation on a role accounts? I'd be interested in
>> > seeing if that would work for our use case.
>> >
>>
>> I don't think that we have any documentation on this (or if we do I
>> haven't seen it, I merely know of role account existence.)
>> It may take us a while to figure out how to apply this to NPM, as I
>> don't think we have anything currently going there.
>>
>> --David
>>
>
>
Re: npm credentials on jenkins
Posted by Andrew Bayer <an...@gmail.com>.
So I'm not familiar with npm publishing - in the Maven land, the creds for
publishing are stored in ~/.m2/settings.xml, and our build slave
puppet/ansible stuff populates that. If there's something similar for npm,
and we can get an ASF "build user" account to publish with, we can add that
for npm as well.
A.
On Wed, Nov 26, 2014 at 4:41 PM, Steven Gill <st...@gmail.com> wrote:
> Okay. Thanks for the info! Let me know if I can help in any way. Should I
> create an issue for getting role accounts to work with npm?
>
> I will also continue investigating if I can figure out a different solution
> to publish to npm via jenkins.
>
> On Wed, Nov 26, 2014 at 11:29 AM, David Nalley <da...@gnsa.us> wrote:
>
> > On Wed, Nov 26, 2014 at 2:04 PM, Steven Gill <st...@gmail.com>
> > wrote:
> > > Thanks for responding David!
> > >
> > > Just to clarify, we don't consider nightlys releases. They are just
> > > snapshots and are published under the nightly tag to npm. You need to
> be
> > > explicit if you want to download it. It is only meant for testing. `npm
> > > install cordova@nightly`.
> > >
> >
> > Ahh, that's a great solution to the lack of non-release publishing to
> NPM.
> >
> > > I have set the build to run once daily. If it does get triggered by a
> > user,
> > > it isn't a big deal. The version that gets published to npm under
> nightly
> > > has the date in it. If the script was run twice on the same day, it
> would
> > > just fail to publish because the version has already been published.
> > >
> > > Do we have any documentation on a role accounts? I'd be interested in
> > > seeing if that would work for our use case.
> > >
> >
> > I don't think that we have any documentation on this (or if we do I
> > haven't seen it, I merely know of role account existence.)
> > It may take us a while to figure out how to apply this to NPM, as I
> > don't think we have anything currently going there.
> >
> > --David
> >
>
Re: npm credentials on jenkins
Posted by Steven Gill <st...@gmail.com>.
Okay. Thanks for the info! Let me know if I can help in any way. Should I
create an issue for getting role accounts to work with npm?
I will also continue investigating if I can figure out a different solution
to publish to npm via jenkins.
On Wed, Nov 26, 2014 at 11:29 AM, David Nalley <da...@gnsa.us> wrote:
> On Wed, Nov 26, 2014 at 2:04 PM, Steven Gill <st...@gmail.com>
> wrote:
> > Thanks for responding David!
> >
> > Just to clarify, we don't consider nightlys releases. They are just
> > snapshots and are published under the nightly tag to npm. You need to be
> > explicit if you want to download it. It is only meant for testing. `npm
> > install cordova@nightly`.
> >
>
> Ahh, that's a great solution to the lack of non-release publishing to NPM.
>
> > I have set the build to run once daily. If it does get triggered by a
> user,
> > it isn't a big deal. The version that gets published to npm under nightly
> > has the date in it. If the script was run twice on the same day, it would
> > just fail to publish because the version has already been published.
> >
> > Do we have any documentation on a role accounts? I'd be interested in
> > seeing if that would work for our use case.
> >
>
> I don't think that we have any documentation on this (or if we do I
> haven't seen it, I merely know of role account existence.)
> It may take us a while to figure out how to apply this to NPM, as I
> don't think we have anything currently going there.
>
> --David
>
Re: npm credentials on jenkins
Posted by David Nalley <da...@gnsa.us>.
On Wed, Nov 26, 2014 at 2:04 PM, Steven Gill <st...@gmail.com> wrote:
> Thanks for responding David!
>
> Just to clarify, we don't consider nightlys releases. They are just
> snapshots and are published under the nightly tag to npm. You need to be
> explicit if you want to download it. It is only meant for testing. `npm
> install cordova@nightly`.
>
Ahh, that's a great solution to the lack of non-release publishing to NPM.
> I have set the build to run once daily. If it does get triggered by a user,
> it isn't a big deal. The version that gets published to npm under nightly
> has the date in it. If the script was run twice on the same day, it would
> just fail to publish because the version has already been published.
>
> Do we have any documentation on a role accounts? I'd be interested in
> seeing if that would work for our use case.
>
I don't think that we have any documentation on this (or if we do I
haven't seen it, I merely know of role account existence.)
It may take us a while to figure out how to apply this to NPM, as I
don't think we have anything currently going there.
--David
Re: npm credentials on jenkins
Posted by Steven Gill <st...@gmail.com>.
Thanks for responding David!
Just to clarify, we don't consider nightlys releases. They are just
snapshots and are published under the nightly tag to npm. You need to be
explicit if you want to download it. It is only meant for testing. `npm
install cordova@nightly`.
I have set the build to run once daily. If it does get triggered by a user,
it isn't a big deal. The version that gets published to npm under nightly
has the date in it. If the script was run twice on the same day, it would
just fail to publish because the version has already been published.
Do we have any documentation on a role accounts? I'd be interested in
seeing if that would work for our use case.
Thanks!
-Steve
On Wed, Nov 26, 2014 at 2:31 AM, David Nalley <da...@gnsa.us> wrote:
> On Tue, Nov 25, 2014 at 4:48 PM, Steven Gill <st...@gmail.com>
> wrote:
> > Hey Everyone,
> >
> > So I need to add credentials to my workspace for uploading a nightly
> build
> > to npm for cordova.
> >
> > The command I need to run is `npm login` or `npm addUser`. It would
> prompt
> > me to add my username, password and email. I think I only need to do this
> > once and it would be saved in my workspace, but I would like it to be
> able
> > to work if I started a new workspace from scratch.
> >
> > How do I do this in a way that is secure? I don't want to write my
> > credentials into my build step.
> >
> > I assume a similar problem would exist for pushing changes to git.
> >
>
>
> So - it depends.
>
> We have this functionality for nexus, but only allow Jenkins to
> publish 'snapshot' builds for developers, and (IIRC) those stay on the
> ASF's Nexus implementation. We use a role account on Nexus for Jenkins
> to publish those snapshots.
>
> We don't allow the Jenkins role account to publish releases. This
> doesn't mean that we wouldn't allow a role account setup on jenkins to
> publish to NPM - but the specific issue is that anyone from any
> project could at any time run a job that publishes an artifact to NPM.
> (I don't think they have the concept of Snapshot builds, from my 30
> seconds of reading.) I suspect that most people consume Cordova from
> NPM rather than downloading source, which makes that something to
> guard closely, rather than having a job that anyone with a jenkins
> account could trigger.
>
> And FTR, I don't think we would ever allow an automated system to
> commit back to a project's source code tree without input from a
> committer. (Obviously we have automated commits for things like
> websites, etc, but again almost all of that is initiated by a
> committer).
>
> --David
>
Re: npm credentials on jenkins
Posted by Roman Shaposhnik <ro...@shaposhnik.org>.
On Wed, Nov 26, 2014 at 2:31 AM, David Nalley <da...@gnsa.us> wrote:
> And FTR, I don't think we would ever allow an automated system to
> commit back to a project's source code tree without input from a
> committer.
Not even to designated branches?
Thanks,
Roman.
Re: npm credentials on jenkins
Posted by David Nalley <da...@gnsa.us>.
On Tue, Nov 25, 2014 at 4:48 PM, Steven Gill <st...@gmail.com> wrote:
> Hey Everyone,
>
> So I need to add credentials to my workspace for uploading a nightly build
> to npm for cordova.
>
> The command I need to run is `npm login` or `npm addUser`. It would prompt
> me to add my username, password and email. I think I only need to do this
> once and it would be saved in my workspace, but I would like it to be able
> to work if I started a new workspace from scratch.
>
> How do I do this in a way that is secure? I don't want to write my
> credentials into my build step.
>
> I assume a similar problem would exist for pushing changes to git.
>
So - it depends.
We have this functionality for nexus, but only allow Jenkins to
publish 'snapshot' builds for developers, and (IIRC) those stay on the
ASF's Nexus implementation. We use a role account on Nexus for Jenkins
to publish those snapshots.
We don't allow the Jenkins role account to publish releases. This
doesn't mean that we wouldn't allow a role account setup on jenkins to
publish to NPM - but the specific issue is that anyone from any
project could at any time run a job that publishes an artifact to NPM.
(I don't think they have the concept of Snapshot builds, from my 30
seconds of reading.) I suspect that most people consume Cordova from
NPM rather than downloading source, which makes that something to
guard closely, rather than having a job that anyone with a jenkins
account could trigger.
And FTR, I don't think we would ever allow an automated system to
commit back to a project's source code tree without input from a
committer. (Obviously we have automated commits for things like
websites, etc, but again almost all of that is initiated by a
committer).
--David