From mboxrd@z Thu Jan 1 00:00:00 1970 From: anothersms@gmail.com (=?utf-8?Q?Nicol=C3=B2?= Balzarotti) Subject: [GitHub] [GitHub API] Deprecation notice for authentication via URL query parameters Date: Wed, 12 Feb 2020 10:36:22 +0100 Message-ID: <87sgjgi1ux.fsf@guixSD.i-did-not-set--mail-host-address--so-tickle-me> References: <5e43c323226a8_a853f9f616cd9601987b0@github-lowworker-6313c1a.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:48745) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1j1oRb-0007I5-8y for guix-devel@gnu.org; Wed, 12 Feb 2020 04:36:32 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1j1oRZ-0008DT-RQ for guix-devel@gnu.org; Wed, 12 Feb 2020 04:36:31 -0500 Received: from mail-wr1-x444.google.com ([2a00:1450:4864:20::444]:42985) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1j1oRZ-0008Cx-IM for guix-devel@gnu.org; Wed, 12 Feb 2020 04:36:29 -0500 Received: by mail-wr1-x444.google.com with SMTP id k11so1324972wrd.9 for ; Wed, 12 Feb 2020 01:36:29 -0800 (PST) Received: from guixSD ([23.129.64.200]) by smtp.gmail.com with ESMTPSA id d16sm9817916wrg.27.2020.02.12.01.36.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Feb 2020 01:36:27 -0800 (PST) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane-mx.org@gnu.org Sender: "Guix-devel" To: Guix-devel --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello Guix! Just used `guix refresh enchive` and received this email from github: > On February 12th, 2020 at 09:19 (UTC) your personal access token (guix re= fresh) using GNU Guile was used as part of a query parameter to access an e= ndpoint through the GitHub API: > https://api.github.com/repositories/83831780/releases > Please use the Authorization HTTP header instead, as using the `access_to= ken` query parameter is deprecated and will be removed July 1st, 2020. > Depending on your API usage, we'll be sending you this email reminder onc= e every 3 days for each token and User-Agent used in API calls made on your= behalf. > Just one URL that was accessed with a token and User-Agent combination wi= ll be listed in the email reminder, not all. > Visit https://developer.github.com/changes/2019-11-05-deprecated-password= s-and-authorizations-api/#authenticating-using-query-parameters for more in= formation. > Thanks, > The GitHub Team I think the code responsible is import/github.scm:159 A tentative fix is attached, but I'm not sure how to test it Thanks, Nicol=C3=B2 --=-=-= Content-Type: text/x-patch Content-Disposition: attachment; filename=0001-try-fix-github.patch >From f5f3b4c88dbc18702581e897354ac14a2763c8aa Mon Sep 17 00:00:00 2001 From: nixo Date: Wed, 12 Feb 2020 10:34:11 +0100 Subject: [PATCH] try fix github --- guix/import/github.scm | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/guix/import/github.scm b/guix/import/github.scm index df5f6ff32f..54054cb343 100644 --- a/guix/import/github.scm +++ b/guix/import/github.scm @@ -150,22 +150,19 @@ empty list." (github-user-slash-repository url) "/tags")) - (define headers + (define (headers) ;; Ask for version 3 of the API as suggested at ;; . `((Accept . "application/vnd.github.v3+json") - (user-agent . "GNU Guile"))) + (user-agent . "GNU Guile") + ,(when (%github-token) + `(Authorization . ,(string-append "token " (%github-token)))))) - (define (decorate url) - (if (%github-token) - (string-append url "?access_token=" (%github-token)) - url)) - - (match (json-fetch (decorate release-url) #:headers headers) + (match (json-fetch release-url #:headers (headers)) (#() ;; We got the empty list, presumably because the user didn't use GitHub's ;; "release" mechanism, but hopefully they did use Git tags. - (json-fetch (decorate tag-url) #:headers headers)) + (json-fetch tag-url #:headers (headers))) (x x))) (define (latest-released-version url package-name) -- 2.25.0 --=-=-=--