Merge branch 'master' into iduffy/circleci

Author: cloudsmith-iduffy

Dockerfile

@@ -16,5 +16,9 @@ RUN mkdir -p /opt/cloudsmith \
  && curl -1sLf -o /opt/cloudsmith/cloudsmith "https://dl.cloudsmith.io/public/${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}/raw/names/cloudsmith-cli/versions/${CLOUDSMITH_CLI_VERSION}/cloudsmith.pyz" \
  && chmod +x /opt/cloudsmith/cloudsmith
 
+# Run as a non-root user
+RUN adduser -D -u 1000 cloudsmith
+USER cloudsmith
+
 # Default command
 ENTRYPOINT [ "cloudsmith" ]

cloudsmith_cli/core/credentials/oidc/cache.py

@@ -41,15 +41,16 @@ def _cache_key(api_host: str, org: str, service_slug: str) -> str:
 
 
 def _decode_jwt_exp(token: str) -> float | None:
-    """Decode the exp claim from a JWT without verification."""
+    """Read the exp claim from a JWT payload.
+
+    The token is only inspected to determine a cache TTL; it is never used to
+    make an authorization decision, so the signature is deliberately not
+    verified (the API rejects tampered tokens regardless).
+    """
     try:
         import jwt
 
-        payload = jwt.decode(
-            token,
-            options={"verify_signature": False},
-            algorithms=["RS256", "ES256", "HS256"],
-        )
+        payload = jwt.decode(token, options={"verify_signature": False})
         exp = payload.get("exp")
         if exp is not None:
             return float(exp)

cloudsmith_cli/core/download.py

@@ -583,7 +583,7 @@ def _verify_checksum(filepath: str, expected: str) -> bool:
 
         # Try SHA1
         if len(expected) == 40:
-            sha1_hash = hashlib.sha1()
+            sha1_hash = hashlib.sha1(usedforsecurity=False)
             with open(filepath, "rb") as f:
                 for chunk in iter(lambda: f.read(4096), b""):
                     sha1_hash.update(chunk)

cloudsmith_cli/core/utils.py

@@ -35,7 +35,7 @@ def read_file(*path):
 
 def calculate_file_md5(filepath, blocksize=2**20):
     """Calculate an MD5 hash for a file."""
-    checksum = hashlib.md5()
+    checksum = hashlib.md5(usedforsecurity=False)
 
     with click.open_file(filepath, "rb") as f:
 

requirements.in

@@ -8,4 +8,4 @@ pre-commit
 pylint
 pytest-cov
 python-toon
-mcp==1.9.1
+mcp==1.27.2

requirements.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile --output-file=requirements.txt requirements.in setup.py
+#    pip-compile --no-emit-index-url --output-file=requirements.txt requirements.in setup.py
 #
 annotated-types==0.7.0
     # via pydantic
@@ -14,6 +14,10 @@ anyio==4.12.1
     #   starlette
 astroid==4.0.3
     # via pylint
+attrs==26.1.0
+    # via
+    #   jsonschema
+    #   referencing
 backports-tarfile==1.2.0
     # via jaraco-context
 build==1.4.0
@@ -28,6 +32,8 @@ certifi==2026.1.4
     #   httpcore
     #   httpx
     #   requests
+cffi==2.0.0
+    # via cryptography
 cfgv==3.5.0
     # via pre-commit
 charset-normalizer==3.4.4
@@ -51,6 +57,8 @@ configparser==7.2.0
     # via click-configfile
 coverage[toml]==7.13.1
     # via pytest-cov
+cryptography==48.0.0
+    # via pyjwt
 dill==0.4.1
     # via pylint
 distlib==0.4.0
@@ -77,7 +85,7 @@ httpx-sse==0.4.3
     # via mcp
 identify==2.6.16
     # via pre-commit
-idna==3.11
+idna==3.18
     # via
     #   anyio
     #   httpx
@@ -96,13 +104,17 @@ jaraco-functools==4.4.0
     # via keyring
 json5==0.13.0
     # via cloudsmith-cli (setup.py)
+jsonschema==4.26.0
+    # via mcp
+jsonschema-specifications==2025.9.1
+    # via jsonschema
 keyring==25.7.0
     # via cloudsmith-cli (setup.py)
 markdown-it-py==4.0.0
     # via rich
 mccabe==0.7.0
     # via pylint
-mcp==1.9.1
+mcp==1.27.2
     # via
     #   -r requirements.in
     #   cloudsmith-cli (setup.py)
@@ -131,6 +143,8 @@ pluggy==1.6.0
     #   pytest-cov
 pre-commit==4.5.1
     # via -r requirements.in
+pycparser==3.0
+    # via cffi
 pydantic==2.12.5
     # via
     #   mcp
@@ -139,44 +153,55 @@ pydantic-core==2.41.5
     # via pydantic
 pydantic-settings==2.12.0
     # via mcp
-pygments==2.19.2
+pygments==2.20.0
     # via
     #   pytest
     #   rich
-pyjwt==2.12.1
-    # via cloudsmith-cli (setup.py)
+pyjwt[crypto]==2.12.1
+    # via
+    #   cloudsmith-cli (setup.py)
+    #   mcp
+    #   pyjwt
 pylint==4.0.4
     # via -r requirements.in
 pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-pytest==9.0.2
+pytest==9.0.3
     # via pytest-cov
 pytest-cov==7.0.0
     # via -r requirements.in
 python-dateutil==2.9.0.post0
     # via
     #   cloudsmith-api
     #   freezegun
-python-dotenv==1.2.1
+python-dotenv==1.2.2
     # via pydantic-settings
-python-multipart==0.0.21
+python-multipart==0.0.32
     # via mcp
 python-toon==0.1.2
     # via
     #   -r requirements.in
     #   cloudsmith-cli (setup.py)
 pyyaml==6.0.3
     # via pre-commit
-requests==2.32.5
+referencing==0.37.0
+    # via
+    #   jsonschema
+    #   jsonschema-specifications
+requests==2.34.2
     # via
     #   cloudsmith-cli (setup.py)
     #   requests-toolbelt
 requests-toolbelt==1.0.0
     # via cloudsmith-cli (setup.py)
 rich==14.3.3
     # via cloudsmith-cli (setup.py)
+rpds-py==0.30.0
+    # via
+    #   jsonschema
+    #   referencing
 semver==3.0.4
     # via cloudsmith-cli (setup.py)
 six==1.17.0
@@ -186,7 +211,7 @@ six==1.17.0
     #   python-dateutil
 sse-starlette==3.2.0
     # via mcp
-starlette==0.52.1
+starlette==1.2.1
     # via
     #   mcp
     #   sse-starlette
@@ -203,19 +228,23 @@ typing-extensions==4.15.0
     # via
     #   anyio
     #   astroid
+    #   cryptography
     #   exceptiongroup
+    #   mcp
     #   pydantic
     #   pydantic-core
     #   pyjwt
+    #   referencing
     #   starlette
     #   typing-inspection
     #   uvicorn
     #   virtualenv
 typing-inspection==0.4.2
     # via
+    #   mcp
     #   pydantic
     #   pydantic-settings
-urllib3==2.6.3
+urllib3==2.7.0
     # via
     #   cloudsmith-api
     #   cloudsmith-cli (setup.py)

setup.py

@@ -56,8 +56,11 @@ def get_long_description():
         "json5>=0.9.0",  # For parsing JSONC (JSON with comments) in VS Code settings
         "cloudsmith-api>=2.0.25,<3.0",  # Compatible upto (but excluding) 3.0+
         "keyring>=25.4.1",
-        "mcp==1.9.1",
-        "PyJWT>=2.0.0",
+        "mcp==1.27.2",
+        # The crypto extra must be declared here: mcp requires pyjwt[crypto],
+        # and a bare PyJWT requirement makes the PEX zipapp resolver drop the
+        # extra (and with it the cryptography wheels).
+        "PyJWT[crypto]>=2.0.0",
         "python-toon==0.1.2",
         "requests>=2.18.4",
         "requests_toolbelt>=1.0.0",