Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

`onyxia-init.sh`: automatic clone of private GitHub repos fails (`could not read Username`) — token-only URL credentials dropped by git 2.55

Aperta Adatta ai principianti
  • Qualcosa non va?
#438 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, git, github, shell
Ambito
backend, devops

Direzione di ricerca

Leggi base/scripts/onyxia-init.sh nella parte relativa alla costruzione di CLONE_URL e confronta i formati delle credenziali di GitHub, Bitbucket e GitLab nella diff proposta. Riproduci il problema con il ciclo git ls-remote fornito nell’immagine indicata, usando un repository privato e un token valido; oscura le credenziali in qualsiasi traccia. Il lavoro è completato quando la clonazione automatica si autentica correttamente con i formati URL corretti.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

With git.token and git.repository set, the automatic clone of a private GitHub repository fails at startup:

Cloning into 'MarBLE'...
warning: redirecting to https://github.com/<owner>/<repo>.git/
fatal: could not read Username for 'https://github.com': No such device or address

The service then starts on a workspace folder that does not exist (code-server ... /home/onyxia/work/<repo>) and the user gets an empty VSCode.

The token is valid and has the repo scope. GitHub accepts it, but git sends the follow-up request without credentials (see the trace below).

Environment
  • Image: inseefrlab/onyxia-vscode-python:py3.13.15
    (sha256:e343e00be96d9c9b70abd7bd06eb2b90429e03e6b968a0e10a49d356f2fd8b6c)
  • Ubuntu 24.04.5 LTS
  • git 1:2.55.0-0ppa1~ubuntu24.04.2 (git-core PPA)
  • git-remote-https linked against libcurl-gnutls.so.4 (libcurl 8.5.0-2ubuntu10.16)
  • Service values: 
    git:
  enabled: true
  token: <classic PAT, scope repo>
  repository: https://github.com/<owner>/<private-repo>.git
  branch: main
  asCodeServerRoot: true

This used to work. The failure started with a recent image (our /opt/onyxia-init.sh is dated 2026-10-19).

Root cause

For GitHub, base/scripts/onyxia-init.sh (l. 100) puts the token alone in the userinfo, with no password:

CLONE_URL="$URL_PREFIX"/"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
# -> https:///<TOKEN>@github.com/<owner>/<repo>.git

With git 2.55, the authenticated GET info/refs succeeds. Git then reports a "redirect", although GitHub did not send any 3xx or Location header. It continues on the URL without userinfo, and the POST git-upload-pack goes out unauthenticated and gets a 401:

GET  /<owner>/<repo>.git/info/refs?service=git-upload-pack  -> 401  (challenge, expected)
GET  /<owner>/<repo>.git/info/refs?service=git-upload-pack  -> 200  (Basic auth with user '<TOKEN>')
warning: redirecting to https://github.com/<owner>/<repo>.git/
POST /<owner>/<repo>.git/git-upload-pack                    -> 401  (no Authorization header)
fatal: could not read Username for 'https://github.com': terminal prompts disabled

If the userinfo has a password part (user:password@), git keeps the credentials across this false redirect and the clone succeeds.

I have not checked whether the regression comes from git 2.55 itself or from git 2.55 combined with libcurl 8.5. Either way, <TOKEN>@ no longer works in the current image.

Reproduction

Requires a classic PAT with repo scope and any private repository it can read.

docker run --rm -e TOKEN=<PAT> -e REPO=<owner>/<private-repo> \
  inseefrlab/onyxia-vscode-python:py3.13.15 bash -c '
    export GIT_TERMINAL_PROMPT=0
    for u in "$TOKEN" "$TOKEN:x-oauth-basic" "x-access-token:$TOKEN"; do
      echo "== userinfo: ${u//$TOKEN/<TOKEN>}"
      git ls-remote "https://[email protected]/$REPO.git" HEAD 2>&1 | sed "s/$TOKEN/<TOKEN>/g"
    done'

Observed:

userinfo result
<TOKEN>@ (format used by onyxia-init.sh) ❌ could not read Username
<TOKEN>:x-oauth-basic@ ✅
x-access-token:<TOKEN>@ ✅

The URL actually built by the script (https:///<TOKEN>@github.com/..., with three slashes) fails in the same way. I reproduced this on 3 different private repositories.

To get the HTTP trace above, add GIT_TRACE_CURL=1 GIT_TRACE_CURL_NO_DATA=1 to the failing command. Redact the Authorization lines before sharing.

Proposed fix

In base/scripts/onyxia-init.sh:

             if [ "$REPO_DOMAIN" = "github.com" ]; then
-                CLONE_URL="$URL_PREFIX"/"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
+                CLONE_URL="$URL_PREFIX"x-access-token:"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
             elif echo "$GIT_REPOSITORY" | grep -qi "bitbucket"; then
-                CLONE_URL="$URL_PREFIX"/x-token-auth:"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
+                CLONE_URL="$URL_PREFIX"x-token-auth:"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
             else
                 # GitLab (gitlab.com or hosted instance)
-                CLONE_URL="$URL_PREFIX"/oauth2:"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
+                CLONE_URL="$URL_PREFIX"oauth2:"$GIT_PERSONAL_ACCESS_TOKEN"@"$URL_NO_PREFIX"
             fi
  • GitHub: x-access-token:<TOKEN> works with classic and fine-grained PATs.
  • All providers: this also removes the extra /. $URL_PREFIX already ends with //, so the script currently builds https:///....

Suggestion: when the clone fails, the init script could also stop or log a clear error instead of starting code-server on a folder that does not exist.

Workaround for users

In a terminal inside the service:

git clone https://x-access-token:[email protected]/<owner>/<repo>.git /home/onyxia/work/<repo>

Then reload the window. The same command can go in a custom init script, guarded by [ -d /home/onyxia/work/<repo> ] ||.

Lingua principale
Shell
Stelle
43
Fork
37
Merge medio
3g 17h
PR unite (30g)
10

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di InseeFrLab/images-datascience

Tutte le issue di InseeFrLab/images-datascience

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.