Revisiting my question, I now realize that Stefan’s original answer was all I needed. I just didn’t understand it at the time.
If you are using an SSH agent, libcurl knows how to get your credentials. But it can only do that if it knows your username for the remote system. I didn’t realize I could use the .netrc file to provide only a username, and not a password! Libcurl will get your username from the .netrc file and then look up your key with the SSH agent. It all works nicely when I have URLs with an scp:// protocol in my Artifacts.toml file.
Hi @danielmatz!
I just stumbled into this thread and I see, that your deep into a similar problem to what I have. May I have some questions to clarify my understanding?
My usecase is similar: building tarballs of a company-private library and wrapping it into a julia package. Our current setup: we authenticate to our Gitlab server via SSH and I already setup a git repo as private registry to work with SSH (on our machines and in Gitlab runners too). This works great for the last couple of months.
Now I am at the point where I need to wrap a binary library into a julia package. I can manage building the binaries and managing the access between Gitlab runners if needed, but not sure about the rest. Do I understand correctly, that delivering the tarballs won’t work with SSH? And I could either push the tarballs to gitlab package registry and setup .netrc files on every machine where I need the package (using gitlab access tokens); OR serve the files via an unauthenticated server (behind company firewall) and I can skip the authentication regarding the tarballs, and for everything else, the SSH authentication is sufficient.
Hi @cserteGT3.
SSH auth does work! I was just missing that I needed both my username in the .netrc file and an SSH agent running with my key loaded.
I’m not actually using a GitLab package registry, though. We have an HPC server, and I’m just uploading the files there. And then in the Artifacts.toml file, I use the scp:// protocol in the URLs.
I’ll have to investigate using the GitLab package registry some more. That could be a nice alternative.
It seems like you could create a deploy token, put that in your .netrc file, and then use https:// URLs to the artifacts in your package registry. But I haven’t tested that, yet.
Please let us know what ends up working for you!
Thanks for confirming! I’ll try it (probably later than sooner) and report back.
I am also thinking on writing a blog post because I feel that the information pieces are bit scattered around about managing private registries.