alr publish, user credentials

[dmitry-kazakov]

Say I wanted to automate submission of new releases. This is what

alr publish http://some-server/some-path/my_project.tar

would do (?) ran from some script which first uploads the archive my_project.tar. The GitHub(?) user name must be in the alire.toml file from the archive. Where alr publish takes the user password from?

[mosteo]

This feature doesn't yet exist, and publishing still requires manual involvement. At this time, Alire help ends with the creation of the manifest to be submitted in "${CRATE}/alire/releases".

One could try to automate the manual PR creation with the help of the github command-line tool, I guess.

PS: I owe you an email, sorry about that.

[dmitry-kazakov]

This is an absolute necessity, IMO. If we want the crates regularly and consistently updated.

I understand that GitHub credentials might be difficult and quite unsafe. What about simply maintaining alire's shadow passwords for the purpose? They could be hashed in the alire's GitHub. "alire publish" could use a secure connection to pass the password. The crate maintainer would need to set a password only if automation needed.

P.S. Do not worry about the e-mail. Discussion is better because other people might contribute ideas.

[mosteo]

I envision either having an interactive login, as in docker login, or having the user provide an access token. I haven't yet examined the security implications.

[dmitry-kazakov]

There is no user when a script is running.
Security issue is that a maintainer would have to trust alire his the GitHub access (if alire is supposed to login in on his behalf).
Sourceforge simply provides SFTP/SCP/rsync upload.