feat!: remove devbox auth and the identity provider - #2943
Merged
Conversation
With the nix cache, cloud secrets, and cloud global push/pull gone,
nothing is left that needs a Jetify account, so remove the login itself.
Removed:
- `devbox auth login / logout / tokens new` and the AUTH feature flag
that gated them
- internal/devbox/providers/identity, which ran the browser OAuth/PKCE
flow, stored sessions under $XDG_CACHE_HOME/jetify/auth, and
exchanged DEVBOX_API_TOKEN for an access token
- the identity lookups in telemetry: user_id now comes only from the
GITHUB_USER_NAME hash and the org_id property is dropped, so
telemetry no longer reads any token from disk
- the Jetify endpoints in internal/build (Issuer, ClientID,
JetpackAPIHost, SuccessRedirect, Audience, DashboardHostname)
Devbox no longer contacts api.jetpack.io or accounts.jetify.com, and no
longer reads or writes an auth token anywhere.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 4, 2026
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
First of five stacked PRs making Devbox account-free. Each PR removes one login-gated feature; the last one drops the dependencies. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting here. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) ⬅ **you are here** - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why The Jetify Nix cache required a Jetify Cloud account: cache URIs and the S3 credentials backing them were fetched from the Jetify API using the logged-in session. Without an account it did nothing; with one it changed `nix build` behavior silently on every `add`/`install`/`shell`. ## What's removed - The `devbox cache` command tree: `upload`/`copy`, `configure`, `credentials`, `enable`, `info`. - `internal/devbox/providers/nixcache`, which fetched AWS credentials and cache URIs from the Jetify API. - The substituter path in `installNixPackagesToStore`, so `nix build` no longer receives `--extra-substituters` or AWS credentials — along with the build-from-source retry that existed only to recover from a failed cache build. - The S3 narinfo probe in `internal/devpkg`. Cache lookups now query only the public `https://cache.nixos.org`. - `internal/setup`, the sudo-task framework whose only task was the nix cache host setup, plus `nix.IncludeDevboxConfig`/`restartDaemon`, which added the user to nix `trusted-users` and wrote `~root/.aws/config` with a `credential_process` pointing back at `devbox cache credentials`. - The nightly `cache-upload` workflow. ## Kept `nix.CurrentConfig`/`Config.IsUserTrusted` stay — they are generic nix.conf helpers with their own tests, not cache-specific. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Second of five stacked PRs making Devbox account-free. **Based on #2940** — review that one first; this PR's diff is only the second commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) ⬅ **you are here** - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox secrets` and `env_from: jetify-cloud` stored secrets in Jetify Cloud, which required an org-scoped login plus a `.jetify/project.json` linking the project to a Jetify org. ## What's removed - The `devbox secrets` command tree (alias `envsec`): `init`, `set`, `remove`/`rm`, `list`/`ls`, `download`, `upload`. - `Devbox.Secrets`/`UninitializedSecrets`, the envsec bindings in `internal/devbox/secrets.go`. ## Behavior change worth a look Projects that still set `env_from` to `jetify-cloud` (or the legacy `envsec` / `jetpack-cloud` spellings) **keep working**. `configEnvs` now warns and skips those secrets rather than failing, so an existing `devbox.json` does not have to be edited before the shell will start: ``` Warning: Ignoring env_from = "jetify-cloud". Jetify Cloud secrets are no longer supported by Devbox. ``` An `env_from` value that is neither a `.env` file nor a legacy cloud value is still an error. Both paths are covered by a new testscript, `testscripts/run/envfrom_jetify_cloud.test.txt`. `ConfigFile.IsEnvsecEnabled` is renamed to `IsJetifyCloudEnvFrom`, since detecting the value is now all it does. ## Why `devbox auth whoami` goes here `whoami` is removed in this PR rather than in the auth PR (#2943): its implementation *was* envsec's `WhoAmI`, so there is nothing left to call once the envsec bindings are gone. Deferring it would have meant writing a throwaway reimplementation. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Third of five stacked PRs making Devbox account-free. **Based on #2941** — this PR's diff is only the third commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) ⬅ **you are here** - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox global push` and `devbox global pull` with no argument synced the global profile to a Jetify-hosted S3 bucket, authenticating by exchanging the logged-in ID token for AWS credentials via `sts:AssumeRoleWithWebIdentity`. ## What changes Both commands now require an argument and keep working for every source that needs no account: git repos, http(s) archives, plain `devbox.json` URLs, and local file paths. - `push` takes a git repo, `pull` takes a git repo / URL / file. - Cobra rejects the no-argument form (`accepts 1 arg(s), received 0`) instead of falling through to the cloud, so the failure is immediate and legible. - `internal/pullbox/s3` is deleted, along with `devopt.Credentials`, which existed only to carry the ID token into it. `push`'s help text previously read "Leave empty to use jetify cloud. Can be a git repo for self storage." — now just "Push a [global] config to a git repo". ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. Manually checked against a build of `main` that the file-path and URL pull paths behave identically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Last of five stacked PRs making Devbox account-free. **Based on #2943** — this PR's diff is only the fifth commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ⬅ **you are here** ## What changes Ran the repo's `devbox run tidy` after the four removal PRs. Dropped as direct dependencies: the AWS SDK v2 modules (`config`, `credentials`, `sts`, `s3`, `feature/s3/manager`), `envsec`, `typeid`, `go-jose`, `oauth2`, `heredoc`, and `tablewriter`. `connectrpc`, `go-oidc`, and `pkg/browser` go with them transitively. `go.jetify.com/pkg` stays — `filecache` and `runx` still use it. `oauth2` is now indirect, reached through runx's GitHub client. ## The `vendor-hash` bit — worth a look `vendor-hash` is regenerated alongside `go.mod`. `flake.nix` reads it as the `buildGoModule` `vendorHash`, so a stale hash makes Nix reuse the previous vendor tree, and **every `devbox run` that needs the glibc-patch flake fails to build devbox itself**: ``` > go.jetify.com/envsec@v0.0.16-...: is marked as explicit in vendor/modules.txt, > but not explicitly required in go.mod ``` `go mod tidy` alone is not enough here, and the breakage is invisible to `go build` and the unit tests — it only surfaces in the testscripts (`plugin/plugin.test.txt` catches it). The `tidy` script in `devbox.json` pairs the two steps for exactly this reason; noting it here since it cost me a debugging cycle. ## Docs No doc changes: `README.md`, `devbox.md`, `CONTRIBUTING.md`, the agent skill, and the VS Code extension README never documented the removed commands. The published CLI reference is generated from Cobra by `devbox gen-docs`, so it picks up the removals automatically. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fourth of five stacked PRs making Devbox account-free. Based on #2942 — this PR's diff is only the fourth commit.
The stack
Each PR is based on the one above it — review and merge bottom-up, starting at #2940.
mainWhy
With the nix cache (#2940), cloud secrets (#2941), and cloud global push/pull (#2942) gone, nothing is left that needs a Jetify account — so the login itself goes. This is the load-bearing PR: after the first three,
internal/devbox/providers/identityhas no callers left except telemetry.What's removed
devbox auth login/logout/tokens new, and theAUTHfeature flag that gated them. (whoamiwent in feat!: remove Jetify Cloud secrets #2941, where its envsec implementation lived.)internal/devbox/providers/identity, which ran the browser OAuth/PKCE flow, stored sessions under$XDG_CACHE_HOME/jetify/auth, and exchangedDEVBOX_API_TOKENfor an access token.user_idnow comes only from theGITHUB_USER_NAMEhash and theorg_idproperty is dropped, so telemetry no longer reads any token from disk. Telemetry is otherwise untouched —deviceID, Sentry, andDO_NOT_TRACKall behave as before.internal/build:Issuer,ClientID,JetpackAPIHost,SuccessRedirect,Audience,DashboardHostname.Result
Devbox no longer contacts
api.jetpack.iooraccounts.jetify.com, and no longer reads or writes an auth token anywhere. Verified by running the suite with a real, valid token still sitting in~/Library/Caches/jetify/auth/— nothing touches it.devbox all(which lists hidden commands too) shows noauth,cache, orsecrets.Verification
go build,go vet,go test ./...(including the full testscript suite), andgolangci-lint runall pass on this branch on its own.🤖 Generated with Claude Code