Example of linking and consuming github packages about repo.kotlin.link HOT 13 CLOSED

Hmm, I need more time to investigate, will do this evening

from repo.kotlin.link.

Looks like github packages required auth (https://maven.pkg.github.com/mpetuska/npm-publish/lt/petuska/npm-publish/1.1.1/npm-publish-1.1.1.pom)

I generated token (https://github.com/settings/tokens/new):

And use it in maven section:

But somehow it doesn't work (but I can use same pair in basic auth in browser https://maven.pkg.github.com/mpetuska/npm-publish/lt/petuska/npm-publish/1.1.1/npm-publish-1.1.1.pom).

from repo.kotlin.link.

With repo itself, no problems: https://maven.pkg.github.com/mpetuska/npm-publish/

from repo.kotlin.link.

But even without proxy repo I can't pull from https://maven.pkg.github.com/mpetuska/khakra
Is it "public"?

from repo.kotlin.link.

it is, and I'm able to pull from it directly

from repo.kotlin.link.

repositories {
  maven("https://maven.pkg.github.com/mpetuska/khakra") {
    credentials {
      username = project.properties["gpr.username"]?.toString() ?: System.getenv("GH_PKG_USER")
      password = project.properties["gpr.password"]?.toString() ?: System.getenv("GH_PKG_PASSWORD")
    }
  }
}

from repo.kotlin.link.

Any progress on this? Might be good to setup some github service user credentials to expose gh packages anonymously via this project?

from repo.kotlin.link.

What happens normally:

Gradle -> HEAD maven.pkg.github.com
  Github -> 401, www-authenticate: Basic realm="GitHub Package Registry"
Gradle -> HEAD maven.pkg.github.com, Authorization: Basic <credentials>

What happens with http redirect:

Gradle -> HEAD repo.kotlin.link
  repo.kotlin.link -> 302, maven.pkg.github.com
Gradle -> HEAD, maven.pkg.github.com
  Github -> 401, www-authenticate: Basic realm="GitHub Package Registry"
    Gradle -> Fail

I don't know why client doesn't try to do auth for redirected location, and just fails instead.
It's maybe bug in client used in gradle, or behavior according spec.

from repo.kotlin.link.

Ah, but you need to redirect to https://maven.pkg.github.com/mpetuska/khakra (note the subpath). I think https://repo.kotlin.link/mpetuska/khakra might just work. Ideally you'd support path segments in sub-repos for redirection, not just domain

from repo.kotlin.link.

Yes, location taken into account, I exclude it from explanation to reduce noise:

from repo.kotlin.link.

So conclusion is:

1. Repositories required authentication doesn't work
2. Even if they'll work, it's security risk, since basic auth (essentially open user + token) can be sent to 3rd party repo by gradle

from repo.kotlin.link.

I think github is the main draw to this project. Even if it'd just proxy the auth from the consumer

from repo.kotlin.link.

Yes, github probably is huge source of packages, but currently it not possible to support it. I thinking about organizing enterprise level repository on top of ipfs, but right now it's just idea

from repo.kotlin.link.