{"id":"d18c56a59164f1be","repo":"rust-lang/cargo","slug":"credential-process-failed-with-status","errorCode":null,"errorMessage":"credential process `{}` failed with status {}`","messagePattern":"credential process `(.+?)` failed with status (.+?)`","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/util/credential/process.rs","lineNumber":80,"sourceCode":"        };\n        let request = serde_json::to_string(&req).context(\"failed to serialize request\")?;\n        tracing::debug!(\"credential-process < {req:?}\");\n        writeln!(input_to_child, \"{request}\").context(\"failed to write to credential provider\")?;\n        buffer.clear();\n        output_from_child\n            .read_line(&mut buffer)\n            .context(\"failed to read response from credential provider\")?;\n\n        // Read the Credential Response\n        let response: Result<CredentialResponse, Error> =\n            serde_json::from_str(&buffer).context(\"failed to deserialize response\")?;\n        tracing::debug!(\"credential-process > {response:?}\");\n\n        // Tell the credential process we're done by closing stdin. It should exit cleanly.\n        drop(input_to_child);\n        let status = child.wait().context(\"credential process never started\")?;\n        if !status.success() {\n            return Err(anyhow::anyhow!(\n                \"credential process `{}` failed with status {}`\",\n                self.path.display(),\n                status\n            )\n            .into());\n        }\n        tracing::trace!(\"credential process exited successfully\");\n        Ok(response)\n    }\n}\n\nimpl<'a> Credential for CredentialProcessCredential {\n    fn perform(\n        &self,\n        registry: &RegistryInfo<'_>,\n        action: &Action<'_>,\n        args: &[&str],\n    ) -> Result<CredentialResponse, Error> {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/util/credential/process.rs#L62-L98","documentation":"CredentialProcessCredential::run spawns an external process implementing cargo's credential protocol, exchanges hello/request/response JSON over stdin/stdout, then waits for the child. If the child exits with a non-zero status, Cargo reports the configured credential-process path and the exit status. The failure originates inside the external provider, not in cargo's protocol handling.","triggerScenarios":"A configured `credential-process` binary (set in config.toml) crashes, panics, is killed, or returns a non-zero exit code after (or before) completing the protocol exchange for a get/store/erase/forget action.","commonSituations":"The credential-process binary has a bug, is missing a dependency, cannot reach its backend (1Password, Vault, keychain daemon), the binary path is wrong so the OS returns an error code, or the process was OOM-killed/SIGKILLed.","solutions":["Run the credential-process binary manually with `--cargo-plugin` and a JSON request to see its native error output.","Check the binary's own logs / stderr for the underlying failure.","Verify the binary path in config.toml is correct and executable.","Update or reinstall the credential-process tool; fall back to `cargo:token` while debugging."],"exampleFix":"// config.toml before\n[registry]\nglobal-credential-providers = [\"cred-proc\"]\ncredential-process = \"/wrong/path/cred-proc\"\n\n// after (correct path + working binary)\n[registry]\nglobal-credential-providers = [\"cred-proc\"]\ncredential-process = \"/usr/local/bin/cred-proc\"","handlingStrategy":"try-catch","validationCode":"use std::path::Path;\nfn credential_process_runnable(path: &str) -> bool {\n    Path::new(path).is_file()\n        && std::process::Command::new(path).arg(\"--version\").output().is_ok()\n}","typeGuard":null,"tryCatchPattern":"match provider.perform(&registry, &action, &args[1..]) {\n    Err(e) => {\n        let msg = e.to_string();\n        if msg.contains(\"credential process\") && msg.contains(\"failed with status\") {\n            eprintln!(\"external credential process exited non-zero; check its logs / path\");\n        }\n        return Err(e);\n    }\n    r => r,\n}","preventionTips":["Pin the credential-process binary path and verify it is executable in CI.","Run the provider standalone with `--cargo-plugin` to confirm it works.","Keep a `cargo:token` fallback provider configured while debugging."],"tags":["authentication","credentials","external-process","config"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}