Re: [yocto] Bitbake fetch private Github repository release archive

On 25 Sep 2025, at 12:13, Oliver Kästner via lists.yoctoproject.org <[email protected]> wrote:
> 
> We do it like this (recipe snippet) and pass the GITHUB_TOKEN (replaced with an appropriately authorized PAT/GitHub app) via env var:
> # disable all other mirrors (our private mirror will be :prepend-ed)
> PREMIRRORS = ""
> MIRRORS = ""
> 
> SRC_URI = "https://api.github.com/repos/<ORG>/<REPO>/releases/assets/${GH_ASSET_ID};subdir=${BP};downloadfilename=${BP}.tar.gz
> 
> # don't include the GitHub PAT in the task hash for SSTATE
> # that way, we don't have to try to fetch it again, if no token is set but the tarball is already downloaded etc
> do_fetch[vardepsexclude] += "GITHUB_TOKEN FETCHCMD_wget"
> 
> python do_fetch:prepend() {
> gh_token = d.getVar("GITHUB_TOKEN", False)
> 
> if not gh_token:
> bb.fatal(d.getVar('PN') + ": GITHUB_TOKEN is not set")
> 
> wget_cmd = d.getVar("FETCHCMD_wget") or "/usr/bin/env wget -t 2 -T 30 --passive-ftp --no-check-certificate" \
> + " --header 'Authorization: Bearer {}'".format(gh_token) \
> + " --header 'Accept: application/octet-stream'" \
> + " --header 'X-GitHub-Api-Version: 2022-11-28'"
> d.setVar("FETCHCMD_wget", wget_cmd)
> }
> 
> I would be very interested in further improvements.

Clearly, that works but it’s not very clean. :)

I can see two alternatives:
1) Extend the wget fetcher to support adding headers via bitbake variables somehow.
2) Subclass the wget fetcher to a dedicated Private GitHub fetcher that would mean you just set GITHUB_TOKEN and it sets the headers

Right now I’m unsure what of those would be better…

Ross