torb logout

logout is the inverse of torb login: it removes the line of one registry from the user's credentials.trb, and the other registries keep theirs. It does not speak to the registry, so the token itself stays valid there until it expires or is revoked (DELETE /api/1/tokens/<id>, tools/registry).

Synopsis#

torb logout                  Remove the stored token of the registry
  --registry <url>           The registry, instead of the public one (packages.torb.dev)

What it does#

The registry is --registry <url>, else the public registry, named the way torb login names it: a / at the end of the URL makes no difference. credentials.trb is the file in the torb home, or the one TORB_CREDENTIALS names; it is read as strictly as login reads it, so a malformed file is an error at its line and is not rewritten. Without its registry's line, logout says so, changes nothing and succeeds:

$ torb logout --registry https://packages.acme.test
logged out of https://packages.acme.test/: its token is removed from /home/ada/.torb/credentials.trb
$ torb logout --registry https://packages.acme.test
there is no token for https://packages.acme.test/ in /home/ada/.torb/credentials.trb: nothing to remove

Pitfalls#

A token can still be in TORB_TOKEN. logout removes the stored token only; a shell or a CI job that sets TORB_TOKEN keeps sending that one.

Logging out is not revoking. A token copied elsewhere, or one that may have leaked, is revoked at the registry, not by removing it from one machine.

Examples#

Log out of the public registry, where torb login without --registry logged in:

$ torb logout
logged out of https://packages.torb.dev/: its token is removed from /home/ada/.torb/credentials.trb

Related#

• torb login - stores the token, and describes credentials.trb.
• torb publish - which token a request sends.