Skip to content

feat (publish): deprecate --token option #16046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 4, 2025
Merged

feat (publish): deprecate --token option #16046

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6efd504
feat (publish): deprecate `--token` option with warning
omskscream Oct 4, 2025
30a29b4
doc (publish): remove deprecated `--token` option from man, add info …
omskscream Oct 4, 2025
fbae250
doc (publish): use precise links to token config docs
omskscream Oct 4, 2025
d4892c9
doc (publish): hide deprecated `--token` from autocomplete suggestions
omskscream Oct 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions src/bin/cargo/commands/publish.rs
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we also want to update our test

cargo/tests/testsuite/publish.rs

Line 208 in 029de48

p.cargo("publish --no-verify --token sekrit --registry dummy-registry")

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was under impression that this test checks something specific to the cmd option, so wasn't sure about changing it except for adding a warning message 🤔

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Anyway, it is fine keeping as-is.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I overlooked in completion code we also want to hide --token

Fine with either dealing with it in this or a follow-up

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated, thanks for reminder. I, as a Windows user, haven't even thought of autocomplete 😅

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have unstable native completion support also for powershell, if you're a user and wanna try: https://doc.rust-lang.org/cargo/reference/unstable.html#native-completions

Original file line number Diff line number Diff line change
@@ -1,14 +1,19 @@
use crate::command_prelude::*;

use cargo::ops::{self, PublishOpts};
use cargo_credential::Secret;

pub fn cli() -> Command {
subcommand("publish")
.about("Upload a package to the registry")
.arg_dry_run("Perform all checks without uploading")
.arg_index("Registry index URL to upload the package to")
.arg_registry("Registry to upload the package to")
.arg(opt("token", "Token to use when uploading").value_name("TOKEN"))
.arg(
opt("token", "Token to use when uploading")
.value_name("TOKEN")
.hide(true),
)
.arg(flag(
"no-verify",
"Don't verify the contents by building them",
Expand Down Expand Up @@ -45,13 +50,16 @@ pub fn exec(gctx: &mut GlobalContext, args: &ArgMatches) -> CliResult {
.into());
}

let token = args.get_one::<String>("token").cloned().map(Secret::from);
if token.is_some() {
let _ = gctx.shell().warn("`cargo publish --token` is deprecated in favor of using `cargo login` and environment variables");
}

ops::publish(
&ws,
&PublishOpts {
gctx,
token: args
.get_one::<String>("token")
.map(|s| s.to_string().into()),
token,
reg_or_index,
verify: !args.flag("no-verify"),
allow_dirty: args.flag("allow-dirty"),
Expand Down
7 changes: 3 additions & 4 deletions src/doc/man/cargo-publish.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,9 @@ following steps:
and may timeout. In that case, you will need to check for completion
manually. This timeout does not affect the upload.

This command requires you to be authenticated with either the `--token` option
or using {{man "cargo-login" 1}}.
This command requires you to be authenticated using {{man "cargo-login" 1}}
or environment variables of the [`registry.token`](../reference/config.html#registrytoken)
and [`registries.<name>.token`](../reference/config.html#registriesnametoken) config fields.

See [the reference](../reference/publishing.html) for more details about
packaging and publishing.
Expand All @@ -44,8 +45,6 @@ packaging and publishing.
Perform all checks without uploading.
{{/option}}

{{> options-token }}

{{#option "`--no-verify`" }}
Don't verify the contents by building them.
{{/option}}
Expand Down
20 changes: 6 additions & 14 deletions src/doc/man/generated_txt/cargo-publish.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,12 @@ DESCRIPTION
and may timeout. In that case, you will need to check for completion
manually. This timeout does not affect the upload.

This command requires you to be authenticated with either the --token
option or using cargo-login(1).
This command requires you to be authenticated using cargo-login(1) or
environment variables of the registry.token
<https://doc.rust-lang.org/cargo/reference/config.html#registrytoken>
and registries.<name>.token
<https://doc.rust-lang.org/cargo/reference/config.html#registriesnametoken>
config fields.

See the reference
<https://doc.rust-lang.org/cargo/reference/publishing.html> for more
Expand All @@ -37,18 +41,6 @@ OPTIONS
--dry-run
Perform all checks without uploading.

--token token
API token to use when authenticating. This overrides the token
stored in the credentials file (which is created by cargo-login(1)).

Cargo config <https://doc.rust-lang.org/cargo/reference/config.html>
environment variables can be used to override the tokens stored in
the credentials file. The token for crates.io may be specified with
the CARGO_REGISTRY_TOKEN environment variable. Tokens for other
registries may be specified with environment variables of the form
CARGO_REGISTRIES_NAME_TOKEN where NAME is the name of the registry
in all capital letters.

--no-verify
Don’t verify the contents by building them.

Expand Down
16 changes: 3 additions & 13 deletions src/doc/src/commands/cargo-publish.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,9 @@ following steps:
and may timeout. In that case, you will need to check for completion
manually. This timeout does not affect the upload.

This command requires you to be authenticated with either the `--token` option
or using [cargo-login(1)](cargo-login.html).
This command requires you to be authenticated using [cargo-login(1)](cargo-login.html)
or environment variables of the [`registry.token`](../reference/config.html#registrytoken)
and [`registries.<name>.token`](../reference/config.html#registriesnametoken) config fields.

See [the reference](../reference/publishing.html) for more details about
packaging and publishing.
Expand All @@ -40,17 +41,6 @@ packaging and publishing.
<dd class="option-desc">Perform all checks without uploading.</dd>


<dt class="option-term" id="option-cargo-publish---token"><a class="option-anchor" href="#option-cargo-publish---token"></a><code>--token</code> <em>token</em></dt>
<dd class="option-desc">API token to use when authenticating. This overrides the token stored in
the credentials file (which is created by <a href="cargo-login.html">cargo-login(1)</a>).</p>
<p><a href="../reference/config.html">Cargo config</a> environment variables can be
used to override the tokens stored in the credentials file. The token for
crates.io may be specified with the <code>CARGO_REGISTRY_TOKEN</code> environment
variable. Tokens for other registries may be specified with environment
variables of the form <code>CARGO_REGISTRIES_NAME_TOKEN</code> where <code>NAME</code> is the name
of the registry in all capital letters.</dd>


<dt class="option-term" id="option-cargo-publish---no-verify"><a class="option-anchor" href="#option-cargo-publish---no-verify"></a><code>--no-verify</code></dt>
<dd class="option-desc">Don’t verify the contents by building them.</dd>

Expand Down
18 changes: 3 additions & 15 deletions src/etc/man/cargo-publish.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,9 @@ and may timeout. In that case, you will need to check for completion
manually. This timeout does not affect the upload.
.RE
.sp
This command requires you to be authenticated with either the \fB\-\-token\fR option
or using \fBcargo\-login\fR(1).
This command requires you to be authenticated using \fBcargo\-login\fR(1)
or environment variables of the \fI\f(BIregistry.token\fI\fR <https://doc.rust\-lang.org/cargo/reference/config.html#registrytoken>
and \fI\f(BIregistries.<name>.token\fI\fR <https://doc.rust\-lang.org/cargo/reference/config.html#registriesnametoken> config fields.
.sp
See \fIthe reference\fR <https://doc.rust\-lang.org/cargo/reference/publishing.html> for more details about
packaging and publishing.
Expand All @@ -50,19 +51,6 @@ packaging and publishing.
Perform all checks without uploading.
.RE
.sp
\fB\-\-token\fR \fItoken\fR
.RS 4
API token to use when authenticating. This overrides the token stored in
the credentials file (which is created by \fBcargo\-login\fR(1)).
.sp
\fICargo config\fR <https://doc.rust\-lang.org/cargo/reference/config.html> environment variables can be
used to override the tokens stored in the credentials file. The token for
crates.io may be specified with the \fBCARGO_REGISTRY_TOKEN\fR environment
variable. Tokens for other registries may be specified with environment
variables of the form \fBCARGO_REGISTRIES_NAME_TOKEN\fR where \fBNAME\fR is the name
of the registry in all capital letters.
.RE
.sp
\fB\-\-no\-verify\fR
.RS 4
Don\[cq]t verify the contents by building them.
Expand Down
1 change: 1 addition & 0 deletions tests/testsuite/alt_registry.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@ Caused by:
.arg(crates_io.index_url().as_str())
.with_status(101)
.with_stderr_data(str![[r#"
[WARNING] `cargo publish --token` is deprecated in favor of using `cargo login` and environment variables
[UPDATING] crates.io index
[ERROR] failed to verify manifest at `[ROOT]/foo/Cargo.toml`

Expand Down
Loading
Loading