renv::restore() fails for packages hosted on a GitHub Enterprise server when gitcreds is installed

[ezraporter]

Steps to recreate the issue

renv::install(c("gitcreds", "remotes"))
remotes::install_github(repo = "REPO/PACKAGE",  host = "GHE_SERVER_URL/api/v3")
renv::snapshot(type="all")
renv::rebuild("PACKAGE")

This fails with an error like:

Error: error downloading 'https://GHE_SERVER_URL/api/v3/repos/REPO/PACKAGE/tarball/COMMIT_SHA' [curl: (22) The requested URL returned error: 401]

Apologies that I can't give a real GHE server to make this fully reproducible.

However if gitcreds is not installed it works.

Possible Solution

It looks like the call to gitcreds::gitcreds_get() is always using the default github.com url:

renv/R/download.R

Lines 546 to 548 in e7c23ea

	token <- tryCatch(gitcreds::gitcreds_get(), error = function(cnd) {
	warning(conditionMessage(cnd))
	NULL

Is there a way to pass down the RemoteHost in renv.lock to give gitcreds a shot at finding the right PAT?

Alternatively, is there a way to shut off authenticating altogether which will be fine as long as I'm using public repos?

[kevinushey]

Are you able to make use of the existing renv authentication mechanism? See https://rstudio.github.io/renv/articles/package-install.html#authentication for more details.

[kevinushey]

Should be resolved via 8f99f05; please let me know if that seems sufficient for your use case.

[ezraporter]

Thanks! Tested the development version and it worked great.

The only issue I hit was that my keychain was using a password rather than PAT to authenticate which didn't work. I guess my GHE server still allows this. Once I switched to a PAT it worked fine. I wouldn't expect you to support authenticating with a password anyways so all good.

The renv.gitcreds.enabled option is great too. I tested that would do the trick without changing my keychain setup and it worked.

[ezraporter]

Are you able to make use of the existing renv authentication mechanism? See https://rstudio.github.io/renv/articles/package-install.html#authentication for more details.

For anyone not wanting to use the dev version just yet I found this met my needs:

options(renv.auth = function(package, record) {
  if (!is.null(record$RemoteHost) && record$RemoteHost == "GHE_SERVER_URL/api/v3") {
    return(list(GITHUB_PAT = MY_GHE_PAT))
  }
})

[kevinushey]

Awesome, thanks for confirming! I intend to submit a new version of renv to CRAN soon, so it's good to know this functions as intended.