How to allow unauthorised read access to GitHub packages maven repository? #26634

mstyura · 2020-05-27T09:19:21Z

mstyura
May 27, 2020

Hello,

I have repository with java project and configured GitHub Actions workflow, which publishes jar into GitHub Packages maven repository.

I would like to use the published JAR package in other project, so I need to add it to pom.xml:

<dependency>
  <groupId>my.group</groupId>
  <artifactId>myartifact</artifactId>
  <version>1.0.1</version>
</dependency>

I also need to add maven repository into pom.xml.

    <repository>
      <id>github-me-my-repo</id>
      <layout>default</layout>
      <name>GitHub Packages Repo</name>
      <releases><enabled>true</enabled></releases>
      <snapshots><enabled>false</enabled></snapshots>
      <url>https://maven.pkg.github.com/me/my-repo</url>
    </repository>

This does not work, because when maven attempt to download artifact it failes, because request is unauthorized.

GitHub Packages help tells that I need to add my user name and token into settings.xml.

This probably fixes an issue.
But there is so much nonsense in this requirement.

For example, if I clone some project which rely on dependencies hosted on GitHub Packages maven repo I’ll fail to compile it. Will have to investigate what the heck is going on. Figure out that I need to register on GitHub. Then generate token. Store in in ~/.m2/settings.xml. And only then the project might compile.

On the other hand the dependency JAR could be downloaded manually via https://github.com/me/my-repo/packages, so why on earth authorization is required when downloaded via maven?

Is there any hidden setting to turn off requirement?

Answered by jcansdale

Jun 8, 2020

For example, if I clone some project which rely on dependencies hosted on GitHub Packages maven repo I’ll fail to compile it. Will have to investigate what the heck is going on. Figure out that I need to register on GitHub. Then generate token. Store in in ~/.m2/settings.xml . And only then the project might compile.

There are a few thing you can do to make this a little less painful.

Create a settings.xml file at the root of your repository
Create a .mvn/maven.config file that contains -s settings.xml
Generate a PAT with just the read:packages scope

If your repository is private, you can place the PAT directly in your settings.xml file. If your repository is public, you can’t push t…

View full answer

mstyura · 2020-05-27T09:28:41Z

mstyura
May 27, 2020
Author

Found out topic raising exactly the same issue Download from Github Package Registry without authentication

1 reply

aSemy Jan 19, 2024

GitHub has apparently deleted that topic, which is a shame. Here is a web-archive https://web.archive.org/web/20210121141140/https://github.community/t/download-from-github-package-registry-without-authentication/14407

clarkbw · 2020-05-27T18:51:09Z

clarkbw
May 27, 2020

Our Maven service doesn’t allow for unauthorized access right now. We plan to offer this in the future but need to improve the service a bit before that.

For Actions you can add a PAT to your secrets store or use the GITHUB_TOKEN to authenticate. In your settings.xml we suggest using the environment variable approach (see setup-java) so you don’t store the tokens in the file.

4 replies

nbrugger-tgm Aug 30, 2023

It is 3 4 years now - is there any timespan / updates / plan or ETA?

Siedlerchr Nov 1, 2023

We want to use this to publish an open source library/fork that can be consumed from everyone without a token. So having any kind of auth only makes sense for private packages. I mean container registry public is also without auth

glelouet Jan 4, 2024

That literally defeats the role of a maven repository.
The dev who made the code already has the packages installed on his own machine, since "mvn install" does exactly that.

pmeister Feb 22, 2024

New plan: not gonna happen.
https://github.com/orgs/community/discussions/26634#discussioncomment-8527086

jcansdale · 2020-06-08T13:17:55Z

jcansdale
Jun 8, 2020

For example, if I clone some project which rely on dependencies hosted on GitHub Packages maven repo I’ll fail to compile it. Will have to investigate what the heck is going on. Figure out that I need to register on GitHub. Then generate token. Store in in ~/.m2/settings.xml . And only then the project might compile.

There are a few thing you can do to make this a little less painful.

Create a settings.xml file at the root of your repository
Create a .mvn/maven.config file that contains -s settings.xml
Generate a PAT with just the read:packages scope

If your repository is private, you can place the PAT directly in your settings.xml file. If your repository is public, you can’t push the raw PAT to your repository because GitHub will automatically delete it. What you can do instead is store an XML encoded version of the PAT (to prevent automatic deletion).

You can find an example of this here:

GitHub

jcansdale-test/maven-consume

An example Maven project that consumes a package. Contribute to jcansdale-test/maven-consume development by creating an account on GitHub.

You can now clone and compile like this:

git clone https://github.com/jcansdale-test/maven-consume
cd maven-consume
mvn compile

If you have Docker installed, you can generate an XML encoded PAT like by doing:

docker run jcansdale/gpr encode TOKEN

I hope that helps!

1 reply

pmdevita Feb 22, 2024

My maven.config file had to be -ssettings.xml but this otherwise worked great, thank you!

pmeister · 2020-08-17T23:07:29Z

pmeister
Aug 17, 2020

jcansdale:

xmlEncode

This works! Thank you! One small tweak: it’s just encode, not xmlEncode.

0 replies

mrts · 2021-02-19T13:41:12Z

mrts
Feb 19, 2021

Hi @clarkbw! Any news regarding allowing public access to Maven packages?

0 replies

clarkbw · 2021-02-25T21:22:12Z

clarkbw
Feb 25, 2021

Still in the future column on the roadmap. Hopefully in the fall this year.

0 replies

Fabricio20 · 2021-03-11T21:01:46Z

Fabricio20
Mar 11, 2021

Hey @clarkbw, thanks for the update! I’d like to bring to attention that JCenter is being shut down globally on 1st may this year. JCenter is currently one of the biggest maven repositories in the world in amount of artifacts.

There are several projects currently looking for a new home and while github package registry looks awesome, this one particular (missing) feature is preventing several projects I know from choosing github packages over self-hosting.

It’s pretty rare for a developer to have a github PAT on their maven (or gradle) configuration (much less on both) and it’s quite a barrier to entry for new developers (needing to create a github account → learning which of the 40 options to create a PAT → learning how to configure maven (or/and gradle) and their IDE).

It would be very interesting if this could be prioritized before the JCenter sunsetting deadline and could bring several people to use github packages (it’s A LOT easier than central).

0 replies

Andre601 · 2021-03-11T21:17:18Z

Andre601
Mar 11, 2021

Having this available for pretty much everyone to use would be a great option.

Maven is quite slow according to various developers
Jcenter is obviously shutting down, as stated by @Fabricio20
Selfhosting is either not cheap or resource intense and would require extra stuff like domain, server setup, etc.
Other options may not be free or under heavy restrictions.

I also wanted to use this once, but never got it to work. The publication gave an error with a 4xx code (I believe it was 403) yet (parts of) the package where apparently distributed to the upstream repo.
So because of that did I keep this down for the moment, but if this maven/gradle bug is actually fixed (Support told me it was a bug on your end) AND this allows anyone to download packages without registration and/or a PAT, would I perhaps give it another chance…

0 replies

ftomassetti · 2021-11-11T09:37:14Z

ftomassetti
Nov 11, 2021

I also would love to see this delivered. As of now GitHub packages are useful to provide packages to our clients, but for our open-source work they cannot be used, as I cannot expect users to register to GitHub and set up the CI to obtain a token just for these packages

0 replies

ftomassetti · 2021-11-11T09:40:11Z

ftomassetti
Nov 11, 2021

I wonder if in the meantime one could create a proxy service that access the Maven repo on GitHub and just exposes it without authentication needed. Not ideal and a bit of extra work but it does not seem predictable when we will get this feature from GitHub. Maybe never

0 replies

AAverin · 2022-01-03T11:07:08Z

AAverin
Jan 3, 2022

@clarkbw Any update on the topic? You mentioned fall last year, was it pushed back?

0 replies

daniftodi · 2022-01-18T16:36:54Z

daniftodi
Jan 18, 2022

@clarkbw any news on this?

0 replies

mkep-dev · 2022-02-18T11:07:58Z

mkep-dev
Feb 18, 2022

Yep. It would be great if github solves this.
Public repository with the need of authentication for packages still sounds like a bad april fool…
Please fix this.

0 replies

mkjsix · 2022-05-26T07:28:54Z

mkjsix
May 26, 2022

As I manage some open source Java projects on Github, I can’t ask people to authenticate before using the repo, so I switched to https://jitpack.io as a Maven repo.

0 replies

exbotanical · 2022-08-11T17:40:23Z

exbotanical
Aug 11, 2022

Is there anything we the community can do to help get this feature implemented faster? I won't presume to know the reasoning behind this requirement, but as others have said, it's extremely restrictive.

0 replies

OktarinTentakel · 2023-03-16T11:00:28Z

OktarinTentakel
Mar 16, 2023

This also applies to NPM-packages, which does not make any sense for public packages as well, also breaking developer experience and making it nearly impossible to include GitHub packages in any CI/CD pipeline, which essentially defeats the general purpose of packaging a project.

What's even more baffling is the fact, that you can easily include the GitHub repository URL itself verbatim in NPM, accessing a public repo without any auth, but the package based on exactly that repo is not available without auth. WTF? oO

While using the repo itself is feasible, this is just a git clone, excluding the possibility of packaging steps, also resulting in a weird notation in package.json.

Please allow non-authed installations of GitHub packages. Setting up the registry is alright, but providing a PAT completely breaks the functionality.

0 replies

ThomasOM · 2023-04-10T17:21:06Z

ThomasOM
Apr 10, 2023

The fact that public repositories can be read anonymously but public packages cannot makes no sense to me.
Please allow us to read packages without authentication, we are forced to use jitpack or another third party tool to distribute software when Github basically already has this functionality.

I have written a short shell script that deploys to a separate branch in your project that can be read anonymously for anyone looking for a workaround: https://github.com/ThomasOM/MavenRepoTool

0 replies

jdsalasca · 2023-05-11T16:59:04Z

jdsalasca
May 11, 2023

I Found an almost easy way to use yours repositories, in the pom.xml you have to add your username and a token just with access to read yours packages (:, thats all you need!

Prototype


            <repository>                                                            
          <id>github</id>                                                                         
          <url>https://username:read_access_token@maven.pkg.github.com/jdsalasca/utils-web</url>                  
          <snapshots>        
            <enabled>true</enabled>                                             
          </snapshots>                                                          
        </repository>

Real Example:


            <repository>                                                            
          <id>github</id>                                                                         
          <url>https://jdsalasca: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@maven.pkg.github.com/jdsalasca/utils-web</url>                  
          <snapshots>        
            <enabled>true</enabled>                                             
          </snapshots>                                                          
        </repository>

God Bless you   (:

6 replies

jdsalasca May 11, 2023

Yeah, that is another solution but I found it kind of challenging to implement because I have 22 microservices in a team with 12 developers, configuring each computer and each Fargate container and including the process to adapt the pipeline, is kind of complex, on another hand, I can create a classic token just with access to consume packages and add it in the pom.xml that's a much better solution for me, but yeah what you said is also valid in some scenarios

glelouet Jan 4, 2024

Does not work within another project

I created my first project, made a workflow so it is installed in the packages. So far so good https://github.com/glelouet/common-maven/packages/58114
I created my own package:read PAT
I created a second project which uses the first one as parent, and therefore needs the repository of the first.
I therefore added the repo with

		<repository>
			<id>github-glelouet-commonmaven</id>
			<url>https://glelouet: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@maven.pkg.github.com/glelouet/common-maven</url>
		</repository>

with my package:read PAT in the url
However it fails with a 401
https://github.com/glelouet/tools/actions/runs/7414394564/job/20175374859
Not sure if my PAT is wrong. I lost so much time trying to make that work… and it still does not work.

glelouet Jan 4, 2024

okay I got the answer : it actually works.
BUT placing your token in a git repo will make github revoke it. I received the mail :

We have revoked it to protect your data from unauthorized access, and as a consequence, any app using this token won't be able to authenticate to GitHub.

It works, as in, when I removed the package from my ~/.m2/repository it was downloaded correctly

[INFO] Scanning for projects...
Downloading from github-glelouet-commonmaven: https://glelouet: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@maven.pkg.github.com/glelouet/common-maven/fr/lelouet/common-maven/0.0.18/common-maven-0.0.18.pom
Downloaded from github-glelouet-commonmaven: https://glelouet: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@maven.pkg.github.com/glelouet/common-maven/fr/lelouet/common-maven/0.0.18/common-maven-0.0.18.pom (9.4 kB at 7.8 kB/s)

So next, the question is : how can I make it that the PAT is not revoked ???

glelouet Jan 4, 2024

ROFL

GitHub
Action needed: GitHub Personal Access Token found in discussion, any app using this secret may be affected

A recent scan found a valid GitHub Personal Access Token, RO, linked to your GitHub account in a comment on a discussion. We have revoked it to protect your data from unauthorized access, and as a consequence, any app using this token won't be able to authenticate to GitHub.

Autuan Mar 6, 2024

Same here.

I've created an open-source project, and I want it to be accessible to everyone without authentication on Maven.

However, the access key will be revoked if I include it in the ReadMe.md.

Sad. 😟

thomas-buengener · 2023-06-21T14:14:00Z

thomas-buengener
Jun 21, 2023

Dear github team, Any news on this one after 3 years?

0 replies

aybgim · 2023-07-10T07:31:41Z

aybgim
Jul 10, 2023

jdsalasca's solution worked perfectly for me. Just created a read-only access token for packages, and included in build.gradle. As it is read-only for a public registry, it can be included cleartext.

0 replies

wyvx · 2023-08-16T06:11:30Z

wyvx
Aug 16, 2023

I'd love to have anonymous access to public packages too. I just experimented getting a package published and I was very surprised when I couldn't use it anonymously.

0 replies

firestar · 2023-08-22T02:44:06Z

firestar
Aug 22, 2023

This is still a very important feature. not having the public repos really makes using maven repos not worth it.....

0 replies

40in · 2023-09-20T17:02:52Z

40in
Sep 20, 2023

Having PAT on public NPM packages makes this feature useless. Not a surprise I wasn't able to find any well known open source web projects using NPM Github Packages (checked angular, react, vuejs, bootstrap etc)

0 replies

supertick · 2023-10-14T21:10:30Z

supertick
Oct 14, 2023

Agree with the common sentiment here, not very useful unless it behaves like all the other large package repos

0 replies

lagergren · 2023-11-22T11:01:36Z

lagergren
Nov 22, 2023

Still nothing after all these years. This is extremely frustrating. I'm curious about the politics behind this, as it can't be that hard, and searching for solutions to this problem just comes up with a very wide range of users expressing the same frustration :-(

1 reply

pmeister Nov 23, 2023

It is very strange. Github keeps improving in many excellent ways, but the package repository seems to get no attention whatsoever. It's still plagued by poor performance and stability too.

jo-elimu · 2023-11-24T05:49:03Z

jo-elimu
Nov 24, 2023

Until GitHub removes the auth requirement, here is a good alternative: https://jitpack.io/

5 replies

Siedlerchr Nov 24, 2023

Jitpack is unfortunately very unreliable

jo-elimu Nov 25, 2023

Unreliable how?

tr7zw Nov 26, 2023

Please never use Jitpack. It's an unmaintained and broken mess. Even as the author you can't opt out or delete old builds jitpack created without permission or asking.

jo-elimu Nov 28, 2023

If you are working on an open source project that needs to distribute Maven libraries in a developer-friendly way, isn't Jitpack one of the very few (if not only) options?

Anyway, we have been using Jitpack for a while, and it works well for our purpose (distributing Android .aar libraries to other open source Android apps. It integrates well with the GitHub release system.

Example here: https://jitpack.io/#elimu-ai/content-provider

lagergren Nov 30, 2023

Let's not derail the conversation too much from GitHub packages. It currently does not fit our usage and hosting model. I'm still requesting some info on why the GitHub packages require credentials still, and how hard it would be to potentially fix it? Is it really complex for some reason I can't think of?

Anyway - this is what I want for Christmas, GitHub.

thiagobarbosa · 2023-12-30T21:32:21Z

thiagobarbosa
Dec 30, 2023

Seems like Santa is not coming with this gift this year.
In the meantime, I'm using a custom proxy to handle the Github authentication and exposing my packages publicly.
That allows me to import my libraries like this:

repositories {
    mavenCentral()
    maven {
        url = uri("https://urlForYourProxy")
    }
}

dependencies {
    implementation "com.{your-org-id}.{your-package-name}:{your-version}"
}

You can find the source code here. Can't wait to kill this project when Github allows unauthenticated requests to packages.

0 replies

bitkid · 2024-01-26T14:36:26Z

bitkid
Jan 26, 2024

this is so absurd that it is still not working. are there any plans from github to get that running? @jcansdale and if so? when? :)

0 replies

bantu · 2024-02-06T09:59:35Z

bantu
Feb 6, 2024

This is disappointing to read after having spent significant time getting familiar with and publishing packages to GitHub Packages. We will switch to Maven Central for publishing open source packages.

0 replies

Haarolean · 2024-02-20T09:05:45Z

Haarolean
Feb 20, 2024

Got a reply from support:

Hi Roman,
 
I have finally managed to get a definitive answer for this question.
 
GitHub Packages does not have plans to offer anonymous access for package types that have public registries of record supporting the ecosystem. We advise users to publish packages intended for retrieval without authentication to registries like Maven Central.
 
I'm sorry this wasn't the answer you were hoping to hear!

That's one of a questionable moves for sure, as it defeats the purpose of a maven repository and it's a nice 180 degrees turn on their side considering their past statement.

0 replies

How to allow unauthorised read access to GitHub packages maven repository? #26634

Replies: 39 comments · 19 replies

mstyura May 27, 2020 Author

Replies: 39 comments 19 replies

mstyura
May 27, 2020
Author