netrc x-oauth-basic no longer works since 1.2.0-rc1

[Sharsie]

• Gitea version: 1.2.0-rc1, 1.2.0-rc2
• Git version: 2.11.0
• Operating system: docker image gitea/gitea on Debian 4.9.30-2+deb9u3 (kernel 4.9.0-3-amd64)
• Database:
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Hello, coming here from drone's discourse forum, it is no longer possible to authenticate using the x-oauth-basic as used previously in version 1.1.4

git clone https://{TOKEN}:x-oauth-basic@gitea.my.domain/Org/Repo.git

yields

remote: invalid credentials fatal: Authentication failed for 'https://{TOKEN}:x-oauth-basic@gitea.my.domain/Org/Repo.git/'

In version 1.1.4 it succesfully clones the repository.

Using

git clone https://{USERNAME}:{TOKEN}@gitea.my.domain/Org/Repo.git

it is possible to clone the repository in version 1.2.0-rc1 and 1.2.0-rc2

This unfortunatelly breaks the drone builds as the plugins/git docker image uses the x-oauth-basic to clone the repository. I am not sure if there was a decistion to drop the x-oauth-basic or if it is a bug since I did not find a relevant issue or a mention of the change in changelog. So it is not clear whether the issue should be fixed from the side of gitea or if the drone plugin should be updated to support the current scheme.

How to reproduce:

1. Create a new private repository on try.gitea.com
2. Add a new application under your profile settings
3. Try to clone the repository using the application's token git clone https://{OAUTH_TOKEN_REDACTED}:x-oauth-basic@try.gitea.com/Org/Repo.git
4. Verify the token is valid by cloning the repo using your username git clone https://{USERNAME}:{TOKEN}@try.gitea.com/Org/Repo.git

[kinnarr]

It's a regression from #2184

[olymk2]

Just hit this myself, anyone working on a fix ?

[lunny]

Have you enabled 2FA?

[olymk2]

nope, just upgraded via docker pull not sure why that would help ?

as far as I know drone does not do two factor in this way.
happy to be proven wrong and give it a try, if I go to enable it I need to give the passcode to drone so not sure where I would do that ?