Authentication for private formulae

[Airblader]

👋 Hi there. For internal company tooling I want to add a formula to an internal tap. The formula is head-only (for now), and needs to access a file that is behind basic auth. Passing the auth isn't an issue:

auth_header = "Authorization: Basic " + Base64.encode64("#{username}:#{password}")
head "...", header: auth_header

However, the question is: how can I get the username / password from the user? On the one hand, homebrew removes environment variables that contain passwords, so that doesn't seem to be the way. But if I make an interactive prompt, the user is asked for this multiple times during a single brew install invocation, which isn't very user-friendly. Is there a way I can avoid that, is there a better way to provide such credentials, or is this something Homebrew just doesn't want to actively support?

(Note that the environment variable cleaning mechanism is fairly naive and I could easily bypass it, but I'd prefer to see what the "proper" solution here would be.)

[SMillerDev]

Generally the goal for homebrew is supporting open source builds so this isn't an actively supported scenario. But environment variables prefixed with HOMEBREW_ are allowed if you need them.

[Airblader]

But environment variables prefixed with HOMEBREW_ are allowed if you need them.

But only if they don't contain something like "password" in their name, which is why I figured this isn't what Homebrew would want me to do.

So to clarify, there's no way to run the password prompt only once, when the file is being downloaded, right?

Thank you for the answer. Bypassing the sensitive env vars check might still be the best option, I guess. I'll also look into casks more, maybe that's a better fit, too.

[Airblader]

Actually it seems that I can "cache" the value in the environment. It ain't pretty, but it'll do for us, I think:

password = ENV["HOMEBREW_ACME_CACHED_PW"]
if password == nil
  password = STDIN.getpass("Password:")
  ENV["HOMEBREW_ACME_CACHED_PW"] = password
end

[carlocab]

But only if they don't contain something like "password" in their name, which is why I figured this isn't what Homebrew would want me to do.

This is really meant to avoid credentials inadvertently leaking into the build environment. If you know what you're doing, feel free to bypass it.