Repository navigation
fix(no-ticket): quote the standalone binary path in helper launchers - #492
Open
cloudsmith-iduffy wants to merge 1 commit into
Open
cloudsmith-iduffy wants to merge 1 commit into
cloudsmith-iduffy wants to merge 1 commit into
Conversation
The docker, pnpm, cargo and terraform installers each had a copy of the code that builds the launcher command for a standalone binary. The copies put the path in plain double quotes, so a path with `$` or a backtick broke the POSIX launcher. `helper_command()` in `launchers.py` replaces the copies and quotes the path with `shlex.quote`. Windows output does not change. The helpers also had five copies of the "Unable to retrieve credentials" message. It is now one `REFUSAL_MESSAGE` in `common.py`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cloudsmith-iduffy
added this pull request to stack #493
October 16, 2026 21:23
cloudsmith-iduffy
changed the title
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused quoting fix and behavior-preserving refactoring have no unresolved findings, and reported execution checks confirm literal paths and argument forwarding.
No open issues 🎉
What changed in this PR
Fixes standalone credential-helper launchers on POSIX systems by safely quoting executable paths and sharing command construction.
Changes:
- Centralizes launcher commands for Docker, pnpm, Cargo, and Terraform; preserves Windows output.
- Consolidates credential-refusal messages without changing their text.
- Strengthens the path-quoting regression test and documents the fix.
| File | Description |
|---|---|
| cloudsmith_cli/credential_helpers/terraform/runtime.py | Uses shared refusal message. |
| cloudsmith_cli/credential_helpers/terraform/installer.py | Uses shared launcher command. |
| cloudsmith_cli/credential_helpers/pnpm/runtime.py | Uses shared refusal message. |
| cloudsmith_cli/credential_helpers/pnpm/installer.py | Uses shared launcher command. |
| cloudsmith_cli/credential_helpers/launchers.py | Centralizes commands and safe POSIX quoting. |
| cloudsmith_cli/credential_helpers/generic.py | Uses shared refusal message. |
| cloudsmith_cli/credential_helpers/docker/runtime.py | Uses shared refusal message. |
| cloudsmith_cli/credential_helpers/docker/installer.py | Uses shared launcher command. |
| cloudsmith_cli/credential_helpers/common.py | Defines shared refusal message. |
| cloudsmith_cli/credential_helpers/cargo/runtime.py | Uses shared refusal message. |
| cloudsmith_cli/credential_helpers/cargo/installer.py | Uses shared launcher command. |
| cloudsmith_cli/cli/tests/test_credential_helper_terraform.py | Updates refusal-message assertions. |
| cloudsmith_cli/cli/tests/test_credential_helper_pnpm.py | Updates refusal-message assertions. |
| cloudsmith_cli/cli/tests/test_credential_helper_cargo.py | Updates refusal-message assertions. |
| cloudsmith_cli/cli/tests/commands/test_credential_helper.py | Updates refusal-message assertions. |
| cloudsmith_cli/cli/tests/commands/test_credential_helper_install.py | Checks quoting for paths containing $ and spaces. |
| cloudsmith_cli/cli/tests/commands/test_credential_helper_generic.py | Updates refusal-message references. |
| CHANGELOG.md | Documents the POSIX launcher fix. |
Review effort: Balanced
cloudsmith-iduffy
removed this pull request from stack #493
October 16, 2026 21:36
cloudsmith-iduffy
added this pull request to stack #495
October 16, 2026 21:36
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The standalone binary writes launchers that run the binary by its absolute path. The docker, pnpm, cargo and terraform installers each had their own copy of that code, and each copy put the path in plain double quotes. In a POSIX shell,
$and backticks still expand inside double quotes, so a binary under a path such as/opt/price$USD/cloudsmithgave a launcher that ran the wrong command.helper_command()incredential_helpers/launchers.pynow builds the launcher command for every helper. It quotes the path withshlex.quoteon Linux and macOS. The Windows.cmdoutput is the same as before.REFUSAL_MESSAGEincredential_helpers/common.py. The text does not change.Type of Change
Additional Notes
test_frozen_install_launcher_targets_executablenow installs the docker launcher from a path with$in it and checks the exactexecline. It fails on the old code.🤖 Generated with Claude Code