Skip to content

Support JOB-TOKEN authentication header for generic packages

What does this MR do and why?

This MR adds authentication support using both JOB-TOKEN and Basic Authentication headers for Generic packages. Related issues:

Screenshots or screen recordings

NA

How to set up and validate locally

1️⃣ With CI

  1. Create a project with the following .gitlab-ci.yml file:
    image: curlimages/curl:latest
    
    stages:
      - upload
      - download
    
    upload:
      stage: upload
      script:
        - 'echo "bananas!" > file.txt'
        - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ./file.txt "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'
    
    download_using_header:
      stage: download
      script:
        - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'
    
    download_using_job_token_query_param:
      stage: download
      script:
        - 'curl "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt?job_token=${CI_JOB_TOKEN}"'
    
    download_using_runner_token_query_param:
      stage: download
      script:
        - 'curl "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt?token=${CI_JOB_TOKEN}"'
    
    download_using_basic_auth:
      stage: download
      script:
        - 'curl --user "gitlab-ci-token:${CI_JOB_TOKEN}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'
  2. Commit and watch the runner do its thing 🍿

2️⃣ with $ curl

  • Have a PAT ready.
  • Run the previous scenario to at least publish the generic package to the project's generic registry.

Let's check with the header:

$ curl --header "PRIVATE-TOKEN: <pat>" "http://gdk.test:8000/api/v4/projects/<project_id>/packages/generic/my_package/0.0.1/file.txt"
bananas!

Let's check with basic auth (inline form):

$ curl "http://<username>:<pat>@gdk.test:8000/api/v4/projects/<project_id>/packages/generic/my_package/0.0.1/file.txt" 
bananas!

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by David Fernandez

Merge request reports