Repository navigation
feat(publisher): read the login private key from a file or MCP_PRIVATE_KEY - #1734
Open
JosephDoUrden wants to merge 1 commit into
Open
JosephDoUrden wants to merge 1 commit into
JosephDoUrden wants to merge 1 commit into
Conversation
…E_KEY mcp-publisher login dns and login http only took the signing key as --private-key <hex>, which lands in the process list, shell history and CI logs. Add --private-key-file <path> and the MCP_PRIVATE_KEY environment variable, resolved the same way --token falls back to MCP_GITHUB_TOKEN: the two flags are mutually exclusive, either one overrides the env var, and with nothing set the existing "private key (hex) is required" error is unchanged. A PEM file gets a clear error, an empty file is an error rather than a silent fall-through. Docs move the key off the command line in the dns/http examples and under env: in the GitHub Actions workflow. Closes modelcontextprotocol#1704
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mcp-publisher login dnsandlogin httponly take the signing key as--private-key <hex>, so it lands in the process list, shell history and CI logs. #1704 asks for a file or an env var. This adds both:--private-key-file <path>andMCP_PRIVATE_KEY, read the same way--tokenfalls back toMCP_GITHUB_TOKEN(auth/github-at.go:134). The env var name is the one the GitHub Actions docs already use for the secret (github-actions.mdx:245,269); the issue suggestedMCP_PUBLISHER_PRIVATE_KEY, easy to rename if you prefer that.Change
resolvePrivateKeyinlogin.go:--private-keyand--private-key-fileare mutually exclusive, either one overridesMCP_PRIVATE_KEY, and with nothing set the existing "private key (hex) is required" error is unchanged. The file is read with a plainos.ReadFileand trimmed, so LF and CRLF both work. A file that starts with-----BEGINgets a clear error saying to pass the hex key, becausekey.pemis the file the setup steps leave behind and that is the mistake people will make. An empty file is an error rather than a silent fall-through to the env var. No stdin, no PEM parsing. The azure-key-vault and google-kms subcommands are untouched.Docs: the dns and http examples in
authentication.mdxnow pass the key through the env var instead of on the command line,github-actions.mdxmoves the secret underenv:and off therun:line, andcommands.mdlists the flag and the env var and writeskey.hexunderumask 077.Test
Unit tests for
resolvePrivateKeycover file, env, each precedence case, both flags, missing path, directory, empty file with the env var set, CRLF, whitespace around the env value and the PEM prefix. Two black-box logins (file and env) run against an httptest/v0/auth/dnsthat verifies the Ed25519 signature with the generated public key and returns 401 otherwise; flipping a byte of the key makes them fail.go test ./cmd/publisher/...,go vet, gofmt and golangci-lint v2.13.1 (what CI pins) are clean. I also ran the built binary against a closed port for LF, CRLF, uppercase hex, a path with spaces, a symlink and the env route; every one reached the network step, and both-flags, missing path, directory and empty file each produced their error.Closes #1704
AI Disclosure
AI assistance (Claude) was used for issue research and during development. All changes were reviewed and tested by the author.