git-updater: Release Assets for private repo: Missing Access Token?

Here’s the answer from GitHub

I reviewed your cURL requests and see that you’re making a call to github.com, > and not the GitHub API (https://api.github.com).

If you’re interested in getting the release for that repository, I recommend > using this endpoint specifying the release’s ID:

https://developer.github.com/v3/repos/releases/#get-a-single-release

Here’s an example cURL request, where “123456” is a fictitious release ID:

curl -H “Authorization: token XXXXX” -IL “https://api.github.com/repos/> ORG/REPO/releases/123456”

You could fetch the releases for a repository using this endpoint, where each > release includes an id field:

https://developer.github.com/v3/repos/releases/#list-releases-for-a-repository

Here’s the accompanying cURL request:

curl -H “Authorization: token XXXXX” -IL “https://api.github.com/repos/> ORG/REPO/releases”

I hope that helps, but let me know if you have any other questions!

---

That didn’t really help but I found a solution diving into the API again:

Assuming we already know the tag name (which is the case in Github Updater), we can access the release directly like this:

curl -s -H "Authorization: token XXXXX" "https://api.github.com/repos/ORG/REPO/releases/tags/v0.1.3"

Which returns

{
    "url": "...",
    "assets": [
        {
          "url": "https://api.github.com/repos/ORG/REPO/releases/assets/123456",
          "id": 123456,
          "name": "br-wordpress-podlove-publisher-s3-v0.1.3.zip",
          "label": "",
          "uploader": {
            ...
          },
          "content_type": "application/zip",
          "state": "uploaded",
          "size": 1167766,
          "download_count": 9,
          "created_at": "2016-10-25T12:36:34Z",
          "updated_at": "2016-10-25T12:36:38Z",
          "browser_download_url": "https://github.com/ORG/REPO/releases/download/v0.1.3/br-wordpress-podlove-publisher-s3-v0.1.3.zip"
        }, {
            # more assets
        }
    ]
}

There can be multiple assets. You could apply the already defined naming scheme and filter, or simply take the first asset.

Now, the browser_download_url is the one we already know doesn’t work except in the browser (as the name suggests 😃).

However, I found this in the API docs:

To download the asset’s binary content, set the Accept header of the request to application/octet-stream. The API will either redirect the client to the location, or stream it directly if possible. API clients should handle both a 200 or 302 response.

curl -L -s -H "Accept: application/octet-stream" "https://api.github.com/repos/ORG/REPO/releases/assets/2528260?access_token=XXXXX" > release.zip

This works—heureka! 💡

• -L: It’s important to follow the location because the actual file is hosted on S3.
• -H "Accept: application/octet-stream": the header that tells GitHub to download rather than return a JSON response
• Access token: I had to use the parameter version here. When I used -H "Authorization: token XXXXX", I got a Bad Request response from Amazon.

It’s probably a fair bit of work to implement but the approach should work. Until then you should add to the readme that asset downloading does not work for private repos for now.

Gave it a try with 6.0.0.16 and it worked 👍

I think you’re going to like this.

Still cleaning up and working out the kinks.