git-updater: Bitbucket Private Repo with Release Assets: Package download says Bad Request

Hello,

I was struggeling to set up a theme deployment workflow with a private repository hosted on bitbucket using release assets.

When WP tries to download the package it failed, saying “Bad Request”.

I dug into it, looking closely at each cURL request WP is performing, and presumably was able to spot the cause:

1. The initial Download URL is something like https://bitbucket.org/<owner>/<repo>/downloads/<repo>-<tag>.zip. HTTP Basic auth credentials are sent along to Bitbucket.
2. Bitbucket responds with a 302 redirect to a Amazon S3 Bucket or something alike.
3. WordPress opens a second curl request, using the redirect URL. The HTTP Basic Auth header is still present in the follow up request. Amazon doesn’t like it.

That’ what the response looks like:

string(806) "HTTP/1.1 400 Bad Request
x-amz-request-id: <SOME_ID>
x-amz-id-2: <SOME_LONGISH_ID_LOOKING_LIKE_BASE64>
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Wed, 12 Sep 2018 15:43:01 GMT
Connection: close
Server: AmazonS3

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidArgument</Code><Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified</Message><ArgumentName>Authorization</ArgumentName><ArgumentValue>Basic [HTTP_BASIC_AUTH_HEADER_VALUE]</ArgumentValue><RequestId>[SOME_ID]</RequestId><HostId>[SOME_LONGISH_ID_LOOKING_LIKE_BASE64]</HostId></Error>

I finally managed to solve my task by simply deactivating release assets, but I’d like to share my findings here, in case someone runs into the same issue.

Regards, jörn