Repository: go
Issue: proposal: cmd/go: add a sub command to manage authentication
Labels: Proposal,Proposal-Hold,modules

### The current state

The Go command utilitizes the ~/.netrc file, both implicitly and explicitly, to authenticate against remote servers when downloading Go code. 

Go uses ~/.netrc implicitly when using "direct" downloads because git uses libcurl to fetch dependencies through https which in turn uses the ~/.netrc file to forward credentials. 

Go uses ~/.netrc explicitly when authenticating against a GOPROXY server by looking for a matching "machine" URL with a valid login and password and forwards those credentials as a BasicAuth header. 

### Problem statement

A Go programmer who wants to set their credentials (whether against a proxy or VCS) must know how to create/edit the .netrc file in their home directory manually. This is has a few problems: 

1. It is not well documented. The only place I can find a mention of the .netrc file is in the [Go FAQ](https://golang.org/doc/faq#git_https) and that is because I was explicitly looking for it. 

2. It is not a good UX: you have to learn/follow the netrc syntax to configure your credentials. Furthermore, Go does not validate the .netrc syntax for you. For example, `machine myproxy.com login mytoken` silently fails and does not send the credentials to `myproxy.com` unless I explicitly put `machine myproxy.com login myuser password mytoken`. On the other hand, `machine github.com login mytoken` works just fine for VCS authentication (since this is handled by git and libcurl directly and not by Go)

3. Most importantly, I found that newcomers to Go find this confusing and hard to deal with in comparison to other languages:

#### Many languages and tools abstract authentication management in their command line:

1. NodeJS has `npm login`, `npm logout`, and `npm config set|get` which all manage the `~/.npmrc` file. 

2. Ruby has `gem signin` and `gem signout` to manage credentials as well (`~/.gem/credentials`)

3. Dart's `pub` command line lets you manage `~/.pub-cache/credentials.json` through an interactive browser that signs in to a Google account when running `pub publish` and it also has `pub signout` to remove those credentials.

4. Docker (though not a language but certainly has a registry) has `docker login` and `docker logout`

5. gcloud (though not a language) can also manage the credentials on the filesystem via `gcloud auth login` and can be static or interactive

And the list goes on. 

### Proposal

Go should provide a more pleasant, and less error prone, way to configure user's credentials for downloading private module dependencies. 

Specifically, Go should be able to create and edit the ~/.netrc file without the user's direct manipulation of it.

Go should be able to add/edit/remove specific lines in the ~/.netrc through the Go command line. 

#### Examples 

**Please note**: The following syntax is arbitrary and can definitely be changed. This proposal is more about getting agreement that we should let the Go command manage the .netrc file and is _not_ picky about what the syntax will look like. 

That said, suggestion on what the command syntax would look like is welcome here.

1. Login to github.com

```
$ go auth login -host=github.com -user=marwan-at-work -password=myToken 

$ cat ~/.netrc
machine github.com login marwan-at-work password myToken
```

```
$ echo "myToken" | go auth login -host=myproxy.com -user=marwan --password-stdin

$ cat ~/.netrc
machine github.com login marwan-at-work password myToken
machine myproxy.com login marwan password myToken
```

2. Logout of github.com

```
$ go auth logout github.com

$ cat ~/.netrc
machine myproxy.com login marwan password myToken
```

3. List current authentications

```
$ go auth list # or go list auth
```


cc: @heschik @bcmills @jayconrod (I added the modules label, but I don't think it's exclusively for modules so I'm not sure what other label this might fit into) 

Thank you!