Skip to content

`go get` doesn't work with deploy tokens

Summary

Trying to use go get on private repositories in subgroups requires the client to set up a .netrc file with authentication. I'd expect deploy tokens to work as an authentication method for this, but instead it fails with a 500 error.

Steps to reproduce

  • Create a private project in a subgroup, like: /gitlab-org/subgroup/test-project
  • Create a deploy token for the project
  • Run curl http://<token-username>:<token-password>@localhost:3000/gitlab-org/subgroup/test-project?go-get=1

More broadly, one could put some go code into test-project, set up a .netrc, and run go get <name>, but the above is more direct. The go-get=1 parameter tells gitlab to send the go client instructions about where to download the code from. The client can either clone over http, using the same deploy token, or clone over ssh, using the ssh keys configured for the user, instead.

What is the current bug behavior?

500 error response.

You can use a Personal Access Token instead, but this isn't ideal - which is why we have deploy tokens in the first place.

What is the expected correct behavior?

200 response telling the authenticated client where to download the code from

Relevant logs and/or screenshots

backtrace:

> undefined method `can?' for #<DeployToken:0x000055b33cc773e8>

lib/gitlab/middleware/go.rb, line 132
-------------------------------------

  127   
  128           login, password = user_name_and_password(request)
  129           auth_result = Gitlab::Auth.find_for_git_client(login, password, project: project, ip: request.ip)
  130           return unless auth_result.success?
  131   
> 132           return unless auth_result.actor&.can?(:access_git)
  133   
  134           return unless auth_result.authentication_abilities.include?(:read_project)
  135   
  136           auth_result.actor
  137         end

App backtrace
-------------

 - lib/gitlab/middleware/go.rb:132:in `current_user'
 - lib/gitlab/middleware/go.rb:120:in `project_for_paths'
 - lib/gitlab/middleware/go.rb:99:in `project_path'
 - lib/gitlab/middleware/go.rb:28:in `render_go_doc'
 - lib/gitlab/middleware/go.rb:20:in `call'
 - lib/gitlab/etag_caching/middleware.rb:13:in `call'
 - lib/gitlab/middleware/correlation_id.rb:16:in `block in call'
 - lib/gitlab/middleware/correlation_id.rb:15:in `call'
 - lib/gitlab/middleware/multipart.rb:117:in `call'
 - lib/gitlab/middleware/read_only/controller.rb:48:in `call'
 - lib/gitlab/middleware/read_only.rb:18:in `call'
 - lib/gitlab/middleware/basic_health_check.rb:25:in `call'
 - lib/gitlab/request_context.rb:32:in `call'
 - config/initializers/fix_local_cache_middleware.rb:9:in `call'
 - lib/gitlab/middleware/static.rb:11:in `call'
 - lib/gitlab/webpack/dev_server_middleware.rb:27:in `perform_request'
 - lib/gitlab/metrics/requests_rack_middleware.rb:49:in `call'
 - lib/gitlab/middleware/release_env.rb:12:in `call'
Edited by Nick Thomas