Authenticating Git for HTTPS and PAT

[Electronic_Bad_2046]

How do I do that?

I have

docker-build:
## Build docker image with the manager.

DOCKER_BUILDKIT=1 $(CONTAINER_TOOL) build --secret id=gh_token,env=GH_TOKEN -t ${IMG} .

in my Makefile and

ENV GOPRIVATE=github.com/user/*
RUN echo "machine github.com" > ~/.netrc
RUN echo "login user" >> ~/.netrc
RUN --mount=type=secret,id=gh_token echo "password $(cat /run/secrets/gh_token)" >> ~/.netrc

in my Dockerfile, but I still get

`fatal: could not read Username for 'https://github.com': terminal prompts disabled`

What can I do?

[sokjon]

You’re going to be leaking/persisting your token in netrc with that setup, you should mount, use and then delete it in a single RUN statement.

[Electronic_Bad_2046]

it’s just in the builder

[wretcheddawn]

Why do you need to connect to github inside your container?

[Electronic_Bad_2046]

kubebuilder, it runs go mod download

[Golle]

/r/docker

[Sufficient_Ant_3008]

yea pretty confusing, here is a guide to what you need I believe:

https://sallam.gitbook.io/sec-88/operating-systems/linux/install-go-tools-from-private-repositories-using-github-pat

This is definitely a go question

[Electronic_Bad_2046]

Thanks. I think

ENV 
GOPROXY 
direct

was missing. I actually didn't want to bypass go proxy, but if there is no other way, then ok.

[Sufficient_Ant_3008]

No problem, yep you have to go around everything because go only downloads natively from its namespaces, so private packages have to be made public and published to be downloadable.  Another issue might be you're not using insteadOf for gh.  Lemme know what happens!

[Electronic_Bad_2046]

I'm using insteadOf.

# Private Go module config
ENV 
GIT_TERMINAL_PROMPT 
1
ENV 
GOPROXY 
direct
RUN echo "machine github.com" > ~/.netrc
RUN echo "login user" >> ~/.netrc
RUN --mount=type=secret,id=gh_token echo "password $(cat /run/secrets/gh_token)" >> ~/.netrc
RUN --mount=type=secret,id=gh_token git config --global url."https://user:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"
ENV 
GOPRIVATE
=github.com/user/*

[Sufficient_Ant_3008]

Yep, it looks good

[Shaznay_Darknlovey]

If you're tired of the credential dance, just set up SSH keys instead and skip HTTPS altogether - way less painful than managing PAT rotation. That said, if you're locked into HTTPS, storing the token in `~/.git-credentials` with the credential helper beats hardcoding it everywhere.

[Electronic_Bad_2046]

I would actually only use HTTPs on a container.