739b70e8bcThe takedown script previously treated any nonempty `ALL_VERSIONS` value, including `false`, as permission to delete every version. Require exactly `true` when the variable is set, and reject other values before sending a request. Enable strict shell error handling in the auth helper so a failed identity-token command stops execution before exchanging an empty token. Validation: `bash -n` and `git diff --check` passed. Mocked command checks confirmed that `false`, `1`, and `TRUE` are rejected before network access, and that identity-token retrieval failure stops before the token exchange. The updated scripts also completed the authorized takedown associated with #1563; public API reads confirmed the deleted record and removal from default results.
35 lines
992 B
Shell
Executable file
35 lines
992 B
Shell
Executable file
#!/bin/bash
|
|
# Simple OIDC authentication helper using gcloud
|
|
|
|
set -euo pipefail
|
|
|
|
REGISTRY_URL="${REGISTRY_URL:-https://registry.modelcontextprotocol.io}"
|
|
|
|
if ! gcloud projects list &> /dev/null; then
|
|
gcloud auth login >&2
|
|
fi
|
|
|
|
# Get Google Cloud identity token
|
|
OIDC_TOKEN=$(gcloud auth print-identity-token)
|
|
|
|
# Exchange for registry token
|
|
RESPONSE=$(curl -sS -X POST "${REGISTRY_URL}/v0/auth/oidc" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"oidc_token\": \"${OIDC_TOKEN}\"}")
|
|
|
|
# Check if successful
|
|
if ! REGISTRY_TOKEN=$(printf '%s\n' "$RESPONSE" | jq -r '.registry_token // empty' 2>/dev/null); then
|
|
REGISTRY_TOKEN=""
|
|
fi
|
|
|
|
if [ -z "$REGISTRY_TOKEN" ]; then
|
|
echo "Error: Authentication failed" >&2
|
|
if ! printf '%s\n' "$RESPONSE" | jq '.' >&2 2>/dev/null; then
|
|
printf '%s\n' "$RESPONSE" >&2
|
|
fi
|
|
exit 1
|
|
fi
|
|
|
|
# Output the export command
|
|
echo "# Successfully authenticated! Now run this to use your token:" >&2
|
|
echo "export REGISTRY_TOKEN='${REGISTRY_TOKEN}'"
|