OXYGENHUB

flow rootfs push and pull use the login oh already saved e38bb032e38b

They needed $OXY_TOKEN although oh auth login had saved a login for the
same hub on the same machine. With no OXY_TOKEN they now take the token
and CA from Oxygen's credential store, as oh and oxy do, and the hub
from --hub, OH_HUB or the runner's; with none, they say to sign in with
oh auth login.

closes #44
Author
Andy McCall @andymccall <[email protected]>
When
· 2026-10-12 00:21 UTC
Signature
✔ signed by Andy McCall
Hash
e38bb032e38bad40c6499ec6191b1043dbb4f2379d7d57d58eb597e325da3d8f
Depends on
4cf0c99a1486 e0918b887850
Depended on by
nothing yet
In bookmarks
main push-uses-login
In tags
v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.5.0 v0.5.1 v0.5.2 v0.5.3
Edits
8 atoms, 0 tree operations, 1 file

Browse the tree at this change

hide whitespace changes
modified crates/flow/src/main.rs +17 −9
… 
133 unchanged lines
134 134 
    /// List the images this home holds
135 135 
    List,
136 136 
    /// Send an image to a hub, so its runners fetch it instead of having it
137 - 
    /// copied to them: only the chunks the hub lacks travel. Uses
138 - 
    /// $OXY_TOKEN (a token that may write repositories) and $OXY_CA
137 + 
    /// copied to them: only the chunks the hub lacks travel. Signs in as
138 + 
    /// `oh` is signed in to that hub, or with $OXY_TOKEN and $OXY_CA
139 139 
    Push {
140 140 
        /// The image's hash, as pipelines pin it (cas://blob/HASH)
141 141 
        hash: String,
142 - 
        /// The hub (default: the runner's, from runner.toml or flow.toml)
142 + 
        /// The hub (default: $OH_HUB, else the runner's, from runner.toml or flow.toml)
143 143 
        #[arg(long)]
144 144 
        hub: Option<String>,
145 145 
    },
146 146 
    /// Fetch an image a hub holds into this home, as a runner does for a
147 - 
    /// job whose image it lacks. Uses $OXY_TOKEN and $OXY_CA
147 + 
    /// job whose image it lacks. Signs in as `oh` is, or with $OXY_TOKEN
148 148 
    Pull {
149 149 
        hash: String,
150 150 
        #[arg(long)]
… 
130 unchanged lines
281 281 
    }
282 282 
}
283 283 

    

  
    

      284
      
      -
      
/// The hub image commands talk to: `--hub`, else the runner's; with

    

  
    

      285
      
      -
      
/// $OXY_TOKEN, else the runner's own token.

    

  
    

      
      284
      +
      
/// The hub image commands talk to: `--hub`, else $OH_HUB, else the

    

  
    

      
      285
      +
      
/// runner's. The token: $OXY_TOKEN, else the login `oh auth login` (or

    

  
    

      
      286
      +
      
/// `oxy auth login`) saved for that hub in Oxygen's credential store

    

  
    

      
      287
      +
      
/// (oxygenflow#44), else the runner's own.

    

  
    

      286
      288
       
      
fn image_client(home: &Home, hub: Option<String>) -> Result<images::Client> {

    

  
    

      287
      289
       
      
    let runner = home.config.runner.clone();

    

  
    

      288
      
      -
      
    let hub = hub.or_else(|| runner.as_ref().map(|r| r.hub.clone())).context("name the hub with --hub https://HUB")?;

    

  
    

      
      290
      +
      
    let hub = hub

    

  
    

      
      291
      +
      
        .or_else(|| std::env::var("OH_HUB").ok().filter(|h| !h.is_empty()))

    

  
    

      
      292
      +
      
        .or_else(|| runner.as_ref().map(|r| r.hub.clone()))

    

  
    

      
      293
      +
      
        .context("name the hub with --hub https://HUB (or set OH_HUB)")?;

    

  
    

      
      294
      +
      
    let (saved_token, saved_ca) = oxy_core::credentials::Credentials::user().lookup(&hub);

    

  
    

      289
      295
       
      
    let token = std::env::var("OXY_TOKEN")

    

  
    

      290
      296
       
      
        .ok()

    

  
    

      
      297
      +
      
        .filter(|t| !t.is_empty())

    

  
    

      
      298
      +
      
        .or(saved_token)

    

  
    

      291
      299
       
      
        .or_else(|| runner.as_ref().map(|r| r.token.clone()))

    

  
    

      292
      
      -
      
        .context("set OXY_TOKEN to a token of yours on the hub")?;

    

  
    

      293
      
      -
      
    let ca = std::env::var_os("OXY_CA").map(PathBuf::from).or_else(|| runner.as_ref().and_then(|r| r.ca.clone()));

    

  
    

      
      300
      +
      
        .with_context(|| format!("no token for {hub}: sign in with `oh auth login --hub {hub}`, or set OXY_TOKEN"))?;

    

  
    

      
      301
      +
      
    let ca = std::env::var_os("OXY_CA").map(PathBuf::from).or(saved_ca).or_else(|| runner.as_ref().and_then(|r| r.ca.clone()));

    

  
    

      294
      302
       
      
    images::Client::new(&hub, &token, ca.as_deref())

    

  
    

      295
      303
       
      
}

    

  
    

      296
      304
       
      

    

  
    

      
      
      …
      
253 unchanged lines