microsoft/artifacts-keyring-nofuss

microsoft/artifacts-keyring-nofuss

Description: Minimal, pure-Python keyring backend for Azure DevOps Artifacts feeds. Replaces the official artifacts-keyring (which wraps a ~100 MB .NET binary) with a no-fuss implementation that covers the most common Linux auth scenarios using python-native azure authentication packages.

Language: Python

License: MIT

Stars: 5

Forks: 0

Open issues: 7

Created: 2026-03-13T16:43:54Z

Pushed: 2026-06-19T03:54:09Z

Default branch: main

Fork: no

Archived: no

README:

artifacts-keyring-nofuss


> ⚠️ This is an unsupported Microsoft sample. Unlike > `artifacts-keyring`, this > project is a best-effort alternative focused on convenience > (more auth auto-detection, reuse of existing az CLI logins) and > debuggability (pure Python — no opaque .NET binary). It is not covered by > any Microsoft support program — use at your own risk.

Minimal, pure-Python keyring backend for Azure DevOps Artifacts feeds.

Replaces the official artifacts-keyring (which wraps a ~100 MB .NET binary) with a no-fuss, pure-Python implementation — no .NET required.

Install

Recommended: standalone tool

uv tool install keyring --with artifacts-keyring-nofuss

Or with pipx:

pipx install keyring
pipx inject keyring artifacts-keyring-nofuss

Both install the package in an isolated environment. The keyring CLI is placed on your PATH and works automatically with both pip (--keyring-provider=subprocess) and uv (keyring-provider = "subprocess").

Verified installs (pinned + hash-checked)

The package ships a requirements-lock.txt with SHA-256 hashes for all runtime dependencies — covered by the package's own PyPI attestation. To install with hash-verified, pinned dependencies:

# Extract the lockfile from the attested package on PyPI
pip download --no-deps --only-binary=:all: artifacts-keyring-nofuss -d /tmp/aknf
unzip -p /tmp/aknf/artifacts_keyring_nofuss-*.whl \
artifacts_keyring_nofuss/requirements-lock.txt > /tmp/requirements-lock.txt

# Install with pinned + hash-checked deps
uv tool install keyring --with artifacts-keyring-nofuss \
--with-requirements /tmp/requirements-lock.txt

The lockfile is maintained by Dependabot and regenerated on each release.

Into project environment (no isolation)

pip install artifacts-keyring-nofuss

For development

pip install -e ".[dev]"

How it works

When pip, uv, twine, etc. query the keyring for credentials to an Azure DevOps Artifacts feed, this backend:

1. Discovers the Azure AD tenant by making an unauthenticated request to the feed URL and parsing the WWW-Authenticate header. 2. Obtains a bearer token using one of the supported auth flows (see below). 3. For user tokens (Azure CLI): exchanges the bearer token for a narrower VssSessionToken scoped to vso.packaging. 4. For service principal tokens (managed identity, SP, WIF): returns the Entra bearer token directly as Basic auth credentials. 5. Returns the credentials to the caller.

Auth flows (priority order)

| # | Flow | How it works | |---|------|-------------| | 1 | Environment variable | Reads a bearer token from ARTIFACTS_KEYRING_NOFUSS_TOKEN (or VSS_NUGET_ACCESSTOKEN as fallback). Also supports ARTIFACTS_KEYRING_NOFUSS_TOKEN_FILE pointing to a file, and auto-detects Docker BuildKit secrets at /run/secrets/. Best for CI and Docker builds. | | 2 | Azure CLI | Runs az account get-access-token. Most common for local dev. | | 3 | ADO auth helper | Calls ~/ado-auth-helper (created by the ado-codespaces-auth VS Code extension). Enables seamless auth in GitHub Codespaces. | | 4 | Workload Identity | Exchanges a federated token via AZURE_CLIENT_ID + AZURE_FEDERATED_TOKEN_FILE + AZURE_TENANT_ID. Best for GitHub Actions with azure/login@v2. | | 5 | Azure Identity | Uses DefaultAzureCredential from azure-identity. Handles managed identities (system + user-assigned), service principals (secret/cert), workload identity federation, and more. |

Configuration

Select a specific flow

By default, providers are tried in the order above. To force a specific one:

# Environment variable
export ARTIFACTS_KEYRING_NOFUSS_PROVIDER=azure_cli # or: env_var, ado_auth_helper, workload_identity, azure_identity

Or in ~/.config/python_keyring/keyringrc.cfg:

[artifacts_keyring_nofuss]
provider = azure_cli

User-assigned managed identity

Set AZURE_CLIENT_ID to the client ID of the user-assigned managed identity:

export AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

When unset, system-assigned managed identity is used.

Service principal with secret

Set the standard Azure Identity environment variables:

export AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export AZURE_CLIENT_SECRET=your-secret

This requires the azure-identity package (included as a dependency). The service principal must have permissions on the Azure DevOps feed (e.g. Feed Reader).

Bearer token via environment variable

For CI pipelines and Docker builds, pass a pre-minted bearer token:

export ARTIFACTS_KEYRING_NOFUSS_TOKEN=

For backward compatibility with existing artifacts-keyring CI configs, VSS_NUGET_ACCESSTOKEN is also accepted as a fallback.

Reading tokens from files (_FILE convention)

Set ARTIFACTS_KEYRING_NOFUSS_TOKEN_FILE to a path containing the bearer token. This follows the Docker _FILE convention used by official images (postgres, mysql, etc.):

export ARTIFACTS_KEYRING_NOFUSS_TOKEN_FILE=/run/secrets/my_token

Docker BuildKit secrets (zero config)

When building Docker images with BuildKit, secrets are mounted as files under /run/secrets/ only for the duration of the build step — they are never persisted in image layers.

The env_var provider automatically checks these well-known BuildKit secret paths:

• /run/secrets/ARTIFACTS_KEYRING_NOFUSS_TOKEN
• /run/secrets/ado_token

This means you can use BuildKit secrets with no extra env vars inside the container:

#...