fix: resolve credentials for protected HTTP(S) repositories by Ankitsinghsisodya · Pull Request #3637 · knative/func

Ankitsinghsisodya · 2026-04-22T21:07:10Z

Summary

On HTTP(S) clone failure with ErrAuthenticationRequired, retry using credentials sourced from ~/.git-credentials (git credential store format) and ~/.netrc.
Credential lookup is pure-Go — no subprocesses spawned.
Both FilesystemFromRepo (in-memory clone) and Repository.Write (disk clone) are covered.

Problem

kn func create --repository <internal-gitlab-url> failed with authentication required even when the user had credential.helper = store configured and ~/.git-credentials populated, because go-git does not consult the system credential helpers on its own.

Approach

Attempt clone without credentials (unchanged behaviour for public repos).
On ErrAuthenticationRequired, call credentialsForURL which reads, in order:
- ~/.git-credentials — matches on scheme + hostname
- ~/.netrc — matches on hostname, falls back to default stanza
Retry the clone with the resolved BasicAuth.

Testing

Unit tests for credentialsForURL, credentialsFromGitStore, credentialsFromNetRC, scanNetRC, and isAuthError added in pkg/functions/repository_credentials_test.go.
Covers: HTTPS match, token auth (x-oauth-basic), no-match, non-HTTP schemes, missing file, netrc fallback, and wrapped error detection.

Notes

This fix targets credential.helper = store (flat-file) users. SSH and system keychain helpers are out of scope for this change.

knative-prow · 2026-04-22T21:07:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Ankitsinghsisodya
Once this PR has been reviewed and has the lgtm label, please assign matzew for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

knative-prow · 2026-04-22T21:07:21Z

Hi @Ankitsinghsisodya. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot

Pull request overview

Adds HTTP(S) credential resolution for protected template repositories by retrying go-git clones with BasicAuth sourced from ~/.git-credentials and ~/.netrc, addressing cases where go-git doesn’t consult system credential helpers.

Changes:

Retry git.Clone / git.PlainClone on transport.ErrAuthenticationRequired using credentials resolved from ~/.git-credentials, then ~/.netrc.
Implement pure-Go parsers for git credential-store lines and a minimal netrc scanner.
Add unit tests covering core credentialsForURL behavior and isAuthError.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
`pkg/functions/repository.go`	Adds credential lookup + auth-retry logic for in-memory and disk clones; introduces git-credentials and netrc parsing helpers.
`pkg/functions/repository_credentials_test.go`	Adds tests for credential resolution and auth-error detection.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+// TestCredentialsForURL_HTTPS verifies that credentials stored in
+// ~/.git-credentials are returned for a matching HTTPS URL.
+func TestCredentialsForURL_HTTPS(t *testing.T) {


When --repository points to a protected HTTP(S) remote, go-git's pure-Go clone had no access to the system credential stack, causing authentication failures even when the user had credentials configured via ~/.git-credentials or ~/.netrc. Adds credentialsForURL which reads credentials from, in order: 1. ~/.git-credentials (git credential store helper format) 2. ~/.netrc The retry follows git's own challenge/response model: an anonymous clone is attempted first; credentialsForURL is only called when the server responds with HTTP 401 (transport.ErrAuthenticationRequired). This avoids sending credentials to servers that do not require them. No subprocesses are spawned and no git binary on PATH is required. Fixes knative#3415 Signed-off-by: Ankitsinghsisodya <ankitsingh24012005@gmail.com>

codecov · 2026-04-22T21:22:57Z

Codecov Report

❌ Patch coverage is 61.15702% with 47 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.44%. Comparing base (7247657) to head (20d0d3c).

Files with missing lines	Patch %	Lines
pkg/functions/repository.go	61.15%	35 Missing and 12 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3637      +/-   ##
==========================================
+ Coverage   56.33%   58.44%   +2.10%     
==========================================
  Files         180      180              
  Lines       20571    20684     +113     
==========================================
+ Hits        11589    12088     +499     
+ Misses       7780     7382     -398     
- Partials     1202     1214      +12

Flag	Coverage Δ
e2e	`39.43% <8.26%> (+3.21%)`	⬆️
e2e go	`32.17% <0.00%> (-0.69%)`	⬇️
e2e node	`27.95% <0.00%> (-0.68%)`	⬇️
e2e python	`32.54% <8.26%> (-0.69%)`	⬇️
e2e quarkus	`28.10% <0.00%> (-0.67%)`	⬇️
e2e rust	`27.49% <0.00%> (-0.70%)`	⬇️
e2e springboot	`25.99% <0.00%> (-0.66%)`	⬇️
e2e typescript	`28.07% <0.00%> (-0.66%)`	⬇️
e2e-config-ci	`17.45% <0.00%> (-0.61%)`	⬇️
integration	`17.00% <8.26%> (-0.58%)`	⬇️
unit macos-14	`42.78% <61.15%> (-0.53%)`	⬇️
unit macos-latest	`42.78% <61.15%> (-0.53%)`	⬇️
unit ubuntu-24.04-arm	`43.59% <61.15%> (+0.08%)`	⬆️
unit ubuntu-latest	`43.59% <61.15%> (-0.60%)`	⬇️
unit windows-latest	`42.80% <61.15%> (-0.54%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

matejvasek · 2026-04-29T18:51:36Z

Nice addition!

One thing: it appears you are matching only host, not port. Port also should match (with possible exception of implicit ports 80 and 443). On the other hand scheme matching seems to be too restrictive. Credentials valid for http://localhost should match https://localhost in my opinion.

Examples:
http://example.com matches https://example.com
http://example.com:8080 does not match http://example.com

Copilot AI review requested due to automatic review settings April 22, 2026 21:07

knative-prow Bot requested review from dsimansk and jrangelramos April 22, 2026 21:07

knative-prow Bot added the size/L 🤖 PR changes 100-499 lines, ignoring generated files. label Apr 22, 2026

knative-prow Bot added the needs-ok-to-test 🤖 Needs an org member to approve testing label Apr 22, 2026

Copilot started reviewing on behalf of Ankitsinghsisodya April 22, 2026 21:07 View session

Ankitsinghsisodya force-pushed the fix/git-credential-helper branch 2 times, most recently from ce89b19 to f3791f9 Compare April 22, 2026 21:09

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Ankitsinghsisodya force-pushed the fix/git-credential-helper branch from f3791f9 to 20d0d3c Compare April 22, 2026 21:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: resolve credentials for protected HTTP(S) repositories#3637

fix: resolve credentials for protected HTTP(S) repositories#3637
Ankitsinghsisodya wants to merge 1 commit intoknative:mainfrom
Ankitsinghsisodya:fix/git-credential-helper

Ankitsinghsisodya commented Apr 22, 2026 •

edited

Loading

Uh oh!

knative-prow Bot commented Apr 22, 2026

Uh oh!

knative-prow Bot commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

matejvasek commented Apr 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Ankitsinghsisodya commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Approach

Testing

Notes

Uh oh!

knative-prow Bot commented Apr 22, 2026

Uh oh!

knative-prow Bot commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

matejvasek commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Ankitsinghsisodya commented Apr 22, 2026 •

edited

Loading

codecov Bot commented Apr 22, 2026 •

edited

Loading

matejvasek commented Apr 29, 2026 •

edited

Loading