Add support for API keys

A scary number of people embed their PyPI username and password in their Travis config (using Travis encrypted variables), to enable automatic releases for certain branches (Travis even has a guide for it).

In addition, the packaging docs example encourages users to save their password in plaintext on disk in their .pypirc (they can of course use twine’s password prompting, but I wonder how many read that far, rather than just copy the example verbatim?)

Whilst in an ideal world credentials of any form wouldn’t be saved unencrypted to disk (or given to a third-party such as Travis) and instead users prompted every time - I don’t think this is realistic in practice.

API keys would offer the following advantages:

1. Higher-entropy credentials that are guaranteed to have not been reused on multiple sites.
2. The ability to give the API key a smaller permissions scope than that of the owner’s username/password. For example an API key would not be permitted to change a user’s listed GPG key or in the future, their 2FA settings. Or an API key could be limited to a specific package.
3. Since this would be separate from the existing username/password auth, a signing based approach (eg HMAC) could be used, without breaking older clients. This would ensure that if a connection was MiTMed (eg due to a protocol or client exploit), the API key itself would still remain secure.
4. Eventually support could be dropped for the password field in .pypirc, leaving a much safer choice between password prompting every time, or creating an API key that could be saved to disk.
5. If/when support is added for 2FA, users who need to automate PyPI uploads won’t have to forgo 2FA for their whole account. They could instead choose to just create a 2FA-circumventing API key for just the one package that needs uploads in automation.

Many thanks 😃

(I’ve filed this against warehouse since I’m presuming this is beyond the scope of maintenance-only changes being made to the old PyPI codebase)

[brainwane]

Good news - this work is now underway, and you can expect to see @woodruffw working on it. Thanks to Open Tech Fund for making this work possible!

[lukesneeringer]

(Poking to say this is in progress; a PR will be coming soon-ish.)