How to disable keyring access.

[Icantjuddle]

I want to use the zed tool for some automations. I store my credentials elsewhere so I don't want to use the context subcommand or keyring. However, I cannot seem to disable it trying to save my credentials in the keyring and every invocation brings up the dialogue. I tried setting --permissions-system to file to avoid this but haven't been successful. Is there something I'm missing?

[tstirrat15]

Yeah, this isn't currently supported - when a client is constructed it will automatically reach into the keychain if the keychain is available.

My planned fix for this is a --bypass-keychain boolean flag that will disable this behavior.

[verdverm]

Disabling should be a configuration feature, or rather enabling should be an opt-in feature. I don't want to have to remember and tell all the devs that they always have to use this one flag...

This default has created a big pain for my onboarding to zed. Even uninstalling and reinstalling does not remove access to the keychain. Why can't zed have the same DX as gcloud and kubectl (with accounts and contexts). As of now, I'm writing off using zed and will find another means to interact with the server. Big DX improvement opportunity here. Please don't be an outlier for your preferred security stance, let the user decide instead of zed decrees. I'm just trying to try some things out on localhost and I've now wasted an hour instead of learning the benefits of your software

also, this whole "keychain is safer" falls flat when Authzed provides a one-liner to install some random thing from the internet into my kubernetes cluster: kubectl apply --server-side -k github.com/authzed/spicedb-operator/config (https://authzed.com/docs/spicedb/ops/deploying-spicedb-operator)

[jzelinskie]

Unless a regression occurred at some point, the behavior should be that if all of the environment variables required for a full context are provided, it shouldn't try to use the keyring.