github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-07-15 20:09:18 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Question on Release Attachment download for deployment only #4281

New Issue
Closed
opened 2025-11-02 05:44:43 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-02 05:44:43 -06:00
Owner
Copy Link

Originally created by @j-be on GitHub (Nov 10, 2019).

  • Gitea version (or commit ref): 1.9.4
  • Git version: 2.17.1
  • Operating system: Ubuntu Linux Server 18.04 LTS (all packages updated to their current version)
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:
    • Not relevant

Description

I'm looking for a way to download an attachment of a release (i.e. a zipped release binary) using Ansible's get_url (wget or curl would work as well) while exposing as little as possible of the rest of the project. The reason is, that I would like to avoid having to build a release on my server (I guess that would work with Deploy Keys).

In short, what I need is some kind of secret, similar to a Deploy Key, which allows the holder of the secret to just download any attachment of any release of a given project.

My setup:

  • Everything is private (REQUIRE_SIGNIN_VIEW = true)
  • Private repo myRepo is owned by me
  • User ansible is read-only contributor of myRepo
  • An Access Token exists for ansible

I tried (amended the leading https:// and anonymized):

  • my-server.example.com/gitea/attachments/<attachment_uuid>?token=<access_token>
  • my-server.example.com/gitea/attachments/<attachment_uuid>?access_token=<access_token>
  • my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?token=<access_token>
  • my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?access_token=<access_token>

None of them seem to work, and even if they did: API access is not intended in my use-case.

BasicAuth works fine up until here, but as soon as I disable sign-in for ansible it fails too.

Is there any way to achieve what I am trying to do? Did anybody find a different approach for this?

Originally created by @j-be on GitHub (Nov 10, 2019). - Gitea version (or commit ref): 1.9.4 - Git version: 2.17.1 - Operating system: Ubuntu Linux Server 18.04 LTS (all packages updated to their current version) - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: - Not relevant ## Description I'm looking for a way to download an attachment of a release (i.e. a zipped release binary) using Ansible's `get_url` (`wget` or `curl` would work as well) while exposing as little as possible of the rest of the project. The reason is, that I would like to avoid having to build a release on my server (I guess that would work with Deploy Keys). In short, what I need is some kind of secret, similar to a Deploy Key, which allows the holder of the secret to just download any attachment of any release of a given project. My setup: * Everything is private (`REQUIRE_SIGNIN_VIEW = true`) * Private repo `myRepo` is owned by `me` * User `ansible` is read-only contributor of `myRepo` * An Access Token exists for `ansible` I tried (amended the leading https:// and anonymized): * my-server.example.com/gitea/attachments/<attachment_uuid>?token=<access_token> * my-server.example.com/gitea/attachments/<attachment_uuid>?access_token=<access_token> * my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?token=<access_token> * my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?access_token=<access_token> None of them seem to work, and even if they did: API access is not intended in my use-case. BasicAuth works fine up until here, but as soon as I disable sign-in for `ansible` it fails too. Is there any way to achieve what I am trying to do? Did anybody find a different approach for this?
GiteaMirror added the type/questionissue/stale labels 2025-11-02 05:44:43 -06:00
GiteaMirror commented 2025-11-02 05:44:44 -06:00
Author
Owner
Copy Link

@davidsvantesson commented on GitHub (Nov 10, 2019):

Retry after 1.10 is released, see #7909.

@davidsvantesson commented on GitHub (Nov 10, 2019): Retry after 1.10 is released, see #7909.
GiteaMirror commented 2025-11-02 05:44:44 -06:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Jan 10, 2020):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 10, 2020): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
GiteaMirror commented 2025-11-02 05:44:44 -06:00
Author
Owner
Copy Link

@j-be commented on GitHub (Jan 12, 2020):

I can confirm the fix on 1.10.2. It works using:

  • my-server.example.com/gitea/attachments/<attachment_uuid>?token=<access_token>
  • my-server.example.com/gitea/attachments/<attachment_uuid>?access_token=<access_token>

It still does NOT work using either of:

  • my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?token=<access_token>
  • my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?access_token=<access_token>

But I think that can be worked around using other API calls to determine the <attachment_uuid>. Hence, closing.

@j-be commented on GitHub (Jan 12, 2020): I can confirm the fix on 1.10.2. It works using: * my-server.example.com/gitea/attachments/<attachment_uuid>?token=<access_token> * my-server.example.com/gitea/attachments/<attachment_uuid>?access_token=<access_token> It still does NOT work using either of: * my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?token=<access_token> * my-server.example.com/gitea/me/myRepo/releases/download/v1.0/myRepo-release.zip?access_token=<access_token> But I think that can be worked around using other API calls to determine the <attachment_uuid>. Hence, closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label issue/stale type/question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#4281
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?