[yuuu]

Overview

This PR adds a new shell plugin, snowflakecli, for Snowflake CLI (snow), with support for key pair authentication (SNOWFLAKE_JWT).

It is added as a separate plugin because the existing snowflake plugin targets a different CLI. The two plugins run different executables, so they can be used side by side without conflicts.

	snowflake (existing)	snowflakecli (this PR)
Target	SnowSQL (snowsql)	Snowflake CLI (snow)
Authentication	Password	Key pair (SNOWFLAKE_JWT)
Config files	~/.snowsql/config (INI)	config.toml / connections.toml (TOML)
Provisioning	SNOWSQL_* environment variables	SNOWFLAKE_* environment variables and -x

The plugin is named snowflakecli because plugin names can't contain hyphens (they must match the Go package name).

Credential

• Required: Account, Username, Private Key (PKCS#8 PEM)
• Optional: Private Key Passphrase, Role, Warehouse, Database, Schema

Provisioning

• The connection details are provisioned as environment variables (SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_AUTHENTICATOR=SNOWFLAKE_JWT, SNOWFLAKE_PRIVATE_KEY_RAW, PRIVATE_KEY_PASSPHRASE, etc.), and -x (--temporary-connection) is appended to the command. The private key is never written to disk.
  • Why -x is needed: snow requires either a connection name or -x, and the generic SNOWFLAKE_* environment variables have lower precedence than the values in the user's config files.
  • Passing a temporary config file with --config-file doesn't work: snow opens its config file multiple times, so it hangs while reading the provisioned file.
• Authentication is skipped when -c / --connection, -x, or --config-file is specified.
• Commands that don't connect to Snowflake (connection add|list|remove|set-default, helpers, init, plugin, upgrade, app bundle, etc.) are also skipped, since they don't accept -x.
• If the line breaks of the private key were lost when it was stored (replaced by literal \n sequences or spaces), they are restored to valid PEM format at runtime.

Importer

• Environment variables: SNOWFLAKE_* and PRIVATE_KEY_PASSPHRASE. The private key file pointed to by SNOWFLAKE_PRIVATE_KEY_FILE / SNOWFLAKE_PRIVATE_KEY_PATH is read as well, so a multi-line PEM key can be imported without pasting it into the prompt.
• config.toml / connections.toml in ~/.snowflake/, ~/Library/Application Support/snowflake/ (macOS), and ~/.config/snowflake/ (Linux). Only connections with authenticator = "SNOWFLAKE_JWT" are imported, and the key file is read if private_key_file / private_key_path is set.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• Resolves: #
• Relates: #

How To Test

Prerequisites: a Snowflake user with a registered public key (ALTER USER <user> SET RSA_PUBLIC_KEY='...') and the corresponding PKCS#8 private key.

make snowflakecli/build
SNOWFLAKE_ACCOUNT=<account> SNOWFLAKE_USER=<user> SNOWFLAKE_PRIVATE_KEY_FILE=./rsa_key.p8 op plugin init snow
snow connection test

Tested with Snowflake CLI 3.27.0.

Changelog

Authenticate Snowflake CLI with key pair authentication using Touch ID and other unlock options with 1Password Shell Plugins.