unkinben
8ced48901f
Anonymous GitHub is capped at 60 requests/hour and cannot read private repositories, so a machine credential usable by a free (non-enterprise) account is needed to lift the request budget and reach private release assets. - Add internal/githubauth: a process-wide credential delivered via env/secret, applied by default to every outbound GitHub request. - Support two modes: a Personal Access Token sent as `Authorization: Bearer`, and a GitHub App that mints a short-lived RS256 JWT (stdlib crypto, no new dependency), exchanges it for a ~1h installation token, caches it, and single-flights a refresh a few minutes before expiry. - Inject the credential at the two GitHub call paths: the rpm github provider (releases scan + ranged asset-header GETs) and the generic byte proxy (private release-asset downloads for github.com hosts). - Honor precedence: a remote's own username/password overrides the server credential; no credential configured stays anonymous. - Fail closed at startup on partial App configuration; never persist the credential to the DB, return it from an API, or log it. - Read GITHUB_TOKEN / GITHUB_APP_ID / GITHUB_APP_INSTALLATION_ID / GITHUB_APP_PRIVATE_KEY[_PATH] via the existing getenv convention. - Document PAT vs App setup, the free-account fine-grained PAT scopes (Contents:read + Metadata:read), precedence, and the rate-limit implication.
103 lines
2.8 KiB
Go
103 lines
2.8 KiB
Go
package generic
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"net/url"
|
|
"path"
|
|
"strings"
|
|
|
|
"git.unkin.net/unkin/artifactapi/internal/githubauth"
|
|
"git.unkin.net/unkin/artifactapi/internal/provider"
|
|
"git.unkin.net/unkin/artifactapi/pkg/models"
|
|
)
|
|
|
|
func init() {
|
|
provider.Register(&Provider{})
|
|
}
|
|
|
|
type Provider struct{}
|
|
|
|
func (p *Provider) Type() models.PackageType { return models.PackageGeneric }
|
|
|
|
func (p *Provider) Classify(_ string) provider.Mutability {
|
|
return provider.Immutable
|
|
}
|
|
|
|
var contentTypeMap = map[string]string{
|
|
".tar.gz": "application/gzip",
|
|
".tgz": "application/gzip",
|
|
".gz": "application/gzip",
|
|
".zip": "application/zip",
|
|
".whl": "application/zip",
|
|
".exe": "application/x-msdownload",
|
|
".rpm": "application/x-rpm",
|
|
".xml": "application/xml",
|
|
".yaml": "text/yaml",
|
|
".yml": "text/yaml",
|
|
".json": "application/json",
|
|
".sig": "application/octet-stream",
|
|
}
|
|
|
|
func (p *Provider) ContentType(filePath string) string {
|
|
lower := strings.ToLower(filePath)
|
|
if strings.HasSuffix(lower, ".tar.gz") {
|
|
return "application/gzip"
|
|
}
|
|
ext := path.Ext(lower)
|
|
if ct, ok := contentTypeMap[ext]; ok {
|
|
return ct
|
|
}
|
|
return "application/octet-stream"
|
|
}
|
|
|
|
func (p *Provider) UpstreamURL(remote models.Remote, reqPath string) string {
|
|
base := strings.TrimRight(remote.BaseURL, "/")
|
|
return base + "/" + strings.TrimLeft(reqPath, "/")
|
|
}
|
|
|
|
func (p *Provider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// AuthHeaders authenticates outbound requests. A per-remote username/password
|
|
// (Basic auth) takes precedence. Otherwise, when the remote points at a GitHub
|
|
// host (e.g. a releases_remote proxying private release assets), the process-wide
|
|
// GitHub credential is attached as a bearer token so private downloads work.
|
|
func (p *Provider) AuthHeaders(ctx context.Context, remote models.Remote) (http.Header, error) {
|
|
h := http.Header{}
|
|
if remote.Username != "" {
|
|
h.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(remote.Username+":"+remote.Password)))
|
|
return h, nil
|
|
}
|
|
if isGitHubHost(remote.BaseURL) {
|
|
if c := githubauth.Server(); c != nil {
|
|
tok, err := c.Token(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if tok != "" {
|
|
h.Set("Authorization", "Bearer "+tok)
|
|
}
|
|
}
|
|
}
|
|
return h, nil
|
|
}
|
|
|
|
// isGitHubHost reports whether rawURL targets a GitHub API/download host that
|
|
// accepts the server credential. objects.githubusercontent.com is deliberately
|
|
// excluded: release-asset downloads 302-redirect there with a pre-signed URL
|
|
// that must not carry an Authorization header.
|
|
func isGitHubHost(rawURL string) bool {
|
|
u, err := url.Parse(rawURL)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
switch strings.ToLower(u.Hostname()) {
|
|
case "github.com", "www.github.com", "api.github.com", "codeload.github.com", "uploads.github.com":
|
|
return true
|
|
}
|
|
return false
|
|
}
|