search

mozilla / sccache

Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage.
Apache License 2.0
5.85k stars 552 forks source link

Proposal: Remove `SCCACHE_S3_NO_CREDENTIALS` and AWS credential environment variable check #1753

Open ajschmidt8 opened 1 year ago

ajschmidt8 commented 1 year ago

The code block below throws an error when both SCCACHE_S3_NO_CREDENTIALS and the AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY environment variables are set.

The issue with this check is that it's incomplete.

opendal can load credentials from environment variables or by a number of other ways (credential files, IAM roles, etc).

Therefore it seems like this check should either:

It seems like checking the other credential sources should be something that's reserved for opendal rather than sccache.

Can I open a PR to remove this check from sccache?

jameslamb commented 6 months ago

I just came here to write up a similar issue to this one.

I suspect that this was added in #1403 as extra protection that sccache doesn't accidentally perform any authenticated AWS operations when SCCACHE_S3_NO_CREDENTIALS=true.

I've encountered 2 sources of friction as a result of this error:

  1. Using sccache in unauthenticated read-only mode like this and doing any other authenticated AWS operations in the same environment requires some extra work to avoid this error, like calling unset AWS_ACCESS_KEY_ID (and then later setting it again) or running sccache in a more restricted environment like env -u AWS_ACCESS_KEY_ID sccache.
  2. You have to be very careful about the difference between those variables being truly "unset" and being set to the empty string ''.

Would you consider one of the following changes to this behavior?

I'm very inexperienced with Rust, but would be happy to put up a patch if you agree with either of these proposals.

Thanks very much for your time and consideration.