chore: drop dependencies left over from the account features - #2944
Merged
Conversation
Run the repo's `devbox run tidy` after removing the nix cache, cloud secrets, cloud push/pull, and auth. Dropped as direct dependencies: the AWS SDK v2 modules (config, credentials, sts, s3, feature/s3/manager), envsec, typeid, go-jose, oauth2, heredoc, and tablewriter. connectrpc, go-oidc, and pkg/browser go with them transitively. go.jetify.com/pkg stays: filecache and runx still use it. oauth2 is now indirect, reached through runx's GitHub client. vendor-hash is regenerated along with go.mod. flake.nix reads it as the buildGoModule vendorHash, so a stale hash makes Nix reuse the previous vendor tree and every `devbox run` that needs the glibc-patch flake fails to build devbox itself. `go mod tidy` alone is not enough here. README and the other docs never documented the removed commands, so there was nothing to update there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 4, 2026
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
First of five stacked PRs making Devbox account-free. Each PR removes one login-gated feature; the last one drops the dependencies. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting here. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) ⬅ **you are here** - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why The Jetify Nix cache required a Jetify Cloud account: cache URIs and the S3 credentials backing them were fetched from the Jetify API using the logged-in session. Without an account it did nothing; with one it changed `nix build` behavior silently on every `add`/`install`/`shell`. ## What's removed - The `devbox cache` command tree: `upload`/`copy`, `configure`, `credentials`, `enable`, `info`. - `internal/devbox/providers/nixcache`, which fetched AWS credentials and cache URIs from the Jetify API. - The substituter path in `installNixPackagesToStore`, so `nix build` no longer receives `--extra-substituters` or AWS credentials — along with the build-from-source retry that existed only to recover from a failed cache build. - The S3 narinfo probe in `internal/devpkg`. Cache lookups now query only the public `https://cache.nixos.org`. - `internal/setup`, the sudo-task framework whose only task was the nix cache host setup, plus `nix.IncludeDevboxConfig`/`restartDaemon`, which added the user to nix `trusted-users` and wrote `~root/.aws/config` with a `credential_process` pointing back at `devbox cache credentials`. - The nightly `cache-upload` workflow. ## Kept `nix.CurrentConfig`/`Config.IsUserTrusted` stay — they are generic nix.conf helpers with their own tests, not cache-specific. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Second of five stacked PRs making Devbox account-free. **Based on #2940** — review that one first; this PR's diff is only the second commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) ⬅ **you are here** - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox secrets` and `env_from: jetify-cloud` stored secrets in Jetify Cloud, which required an org-scoped login plus a `.jetify/project.json` linking the project to a Jetify org. ## What's removed - The `devbox secrets` command tree (alias `envsec`): `init`, `set`, `remove`/`rm`, `list`/`ls`, `download`, `upload`. - `Devbox.Secrets`/`UninitializedSecrets`, the envsec bindings in `internal/devbox/secrets.go`. ## Behavior change worth a look Projects that still set `env_from` to `jetify-cloud` (or the legacy `envsec` / `jetpack-cloud` spellings) **keep working**. `configEnvs` now warns and skips those secrets rather than failing, so an existing `devbox.json` does not have to be edited before the shell will start: ``` Warning: Ignoring env_from = "jetify-cloud". Jetify Cloud secrets are no longer supported by Devbox. ``` An `env_from` value that is neither a `.env` file nor a legacy cloud value is still an error. Both paths are covered by a new testscript, `testscripts/run/envfrom_jetify_cloud.test.txt`. `ConfigFile.IsEnvsecEnabled` is renamed to `IsJetifyCloudEnvFrom`, since detecting the value is now all it does. ## Why `devbox auth whoami` goes here `whoami` is removed in this PR rather than in the auth PR (#2943): its implementation *was* envsec's `WhoAmI`, so there is nothing left to call once the envsec bindings are gone. Deferring it would have meant writing a throwaway reimplementation. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Third of five stacked PRs making Devbox account-free. **Based on #2941** — this PR's diff is only the third commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) ⬅ **you are here** - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox global push` and `devbox global pull` with no argument synced the global profile to a Jetify-hosted S3 bucket, authenticating by exchanging the logged-in ID token for AWS credentials via `sts:AssumeRoleWithWebIdentity`. ## What changes Both commands now require an argument and keep working for every source that needs no account: git repos, http(s) archives, plain `devbox.json` URLs, and local file paths. - `push` takes a git repo, `pull` takes a git repo / URL / file. - Cobra rejects the no-argument form (`accepts 1 arg(s), received 0`) instead of falling through to the cloud, so the failure is immediate and legible. - `internal/pullbox/s3` is deleted, along with `devopt.Credentials`, which existed only to carry the ID token into it. `push`'s help text previously read "Leave empty to use jetify cloud. Can be a git repo for self storage." — now just "Push a [global] config to a git repo". ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. Manually checked against a build of `main` that the file-path and URL pull paths behave identically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73
added a commit
that referenced
this pull request
Aug 5, 2026
Fourth of five stacked PRs making Devbox account-free. **Based on #2942** — this PR's diff is only the fourth commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) ⬅ **you are here** - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why With the nix cache (#2940), cloud secrets (#2941), and cloud global push/pull (#2942) gone, nothing is left that needs a Jetify account — so the login itself goes. This is the load-bearing PR: after the first three, `internal/devbox/providers/identity` has no callers left except telemetry. ## What's removed - `devbox auth login` / `logout` / `tokens new`, and the `AUTH` feature flag that gated them. (`whoami` went in #2941, where its envsec implementation lived.) - `internal/devbox/providers/identity`, which ran the browser OAuth/PKCE flow, stored sessions under `$XDG_CACHE_HOME/jetify/auth`, and exchanged `DEVBOX_API_TOKEN` for an access token. - The identity lookups in telemetry. `user_id` now comes only from the `GITHUB_USER_NAME` hash and the `org_id` property is dropped, so telemetry no longer reads any token from disk. Telemetry is otherwise untouched — `deviceID`, Sentry, and `DO_NOT_TRACK` all behave as before. - The Jetify endpoints in `internal/build`: `Issuer`, `ClientID`, `JetpackAPIHost`, `SuccessRedirect`, `Audience`, `DashboardHostname`. ## Result Devbox no longer contacts `api.jetpack.io` or `accounts.jetify.com`, and no longer reads or writes an auth token anywhere. Verified by running the suite with a real, valid token still sitting in `~/Library/Caches/jetify/auth/` — nothing touches it. `devbox all` (which lists hidden commands too) shows no `auth`, `cache`, or `secrets`. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Last of five stacked PRs making Devbox account-free. Based on #2943 — this PR's diff is only the fifth commit.
The stack
Each PR is based on the one above it — review and merge bottom-up, starting at #2940.
mainWhat changes
Ran the repo's
devbox run tidyafter the four removal PRs. Dropped as direct dependencies: the AWS SDK v2 modules (config,credentials,sts,s3,feature/s3/manager),envsec,typeid,go-jose,oauth2,heredoc, andtablewriter.connectrpc,go-oidc, andpkg/browsergo with them transitively.go.jetify.com/pkgstays —filecacheandrunxstill use it.oauth2is now indirect, reached through runx's GitHub client.The
vendor-hashbit — worth a lookvendor-hashis regenerated alongsidego.mod.flake.nixreads it as thebuildGoModulevendorHash, so a stale hash makes Nix reuse the previous vendor tree, and everydevbox runthat needs the glibc-patch flake fails to build devbox itself:go mod tidyalone is not enough here, and the breakage is invisible togo buildand the unit tests — it only surfaces in the testscripts (plugin/plugin.test.txtcatches it). Thetidyscript indevbox.jsonpairs the two steps for exactly this reason; noting it here since it cost me a debugging cycle.Docs
No doc changes:
README.md,devbox.md,CONTRIBUTING.md, the agent skill, and the VS Code extension README never documented the removed commands. The published CLI reference is generated from Cobra bydevbox gen-docs, so it picks up the removals automatically.Verification
go build,go vet,go test ./...(including the full testscript suite), andgolangci-lint runall pass on this branch on its own.🤖 Generated with Claude Code