cgitize 7.0.0__tar.gz → 8.0.0__tar.gz

{cgitize-7.0.0 → cgitize-8.0.0}/.github/workflows/ci.yml

@@ -27,11 +27,11 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
     name: 'Test / ${{ matrix.python-version }}'
     env:
-      CGITIZE_GITHUB_USERNAME: cgitize-test
+      CGITIZE_GITHUB_USERNAME: '${{ secrets.CGITIZE_GITHUB_USERNAME }}'
       CGITIZE_GITHUB_TOKEN: '${{ secrets.CGITIZE_GITHUB_TOKEN }}'
-      CGITIZE_BITBUCKET_USERNAME: cgitize-test
+      CGITIZE_BITBUCKET_EMAIL: '${{ secrets.CGITIZE_BITBUCKET_EMAIL }}'
       CGITIZE_BITBUCKET_TOKEN: '${{ secrets.CGITIZE_BITBUCKET_TOKEN }}'
-      CGITIZE_GITLAB_USERNAME: cgitize-test
+      CGITIZE_GITLAB_USERNAME: '${{ secrets.CGITIZE_GITLAB_USERNAME }}'
       CGITIZE_GITLAB_TOKEN: '${{ secrets.CGITIZE_GITLAB_TOKEN }}'
     steps:
       - name: Checkout
@@ -64,11 +64,11 @@ jobs:
     runs-on: ubuntu-latest
     name: 'Test / example config'
     env:
-      CGITIZE_GITHUB_USERNAME: cgitize-test
+      CGITIZE_GITHUB_USERNAME: '${{ secrets.CGITIZE_GITHUB_USERNAME }}'
       CGITIZE_GITHUB_TOKEN: '${{ secrets.CGITIZE_GITHUB_TOKEN }}'
-      CGITIZE_BITBUCKET_USERNAME: cgitize-test
+      CGITIZE_BITBUCKET_EMAIL: '${{ secrets.CGITIZE_BITBUCKET_EMAIL }}'
       CGITIZE_BITBUCKET_TOKEN: '${{ secrets.CGITIZE_BITBUCKET_TOKEN }}'
-      CGITIZE_GITLAB_USERNAME: cgitize-test
+      CGITIZE_GITLAB_USERNAME: '${{ secrets.CGITIZE_GITLAB_USERNAME }}'
       CGITIZE_GITLAB_TOKEN: '${{ secrets.CGITIZE_GITLAB_TOKEN }}'
     steps:
       - name: Checkout

{cgitize-7.0.0 → cgitize-8.0.0}/.github/workflows/maintenance.yml

@@ -16,8 +16,6 @@ jobs:
         with:
           # I think that by default, pushes don't trigger other workflows, and
           # you need a separate token for that: https://github.com/orgs/community/discussions/37103
-          #
-          # Re-using the Jekyll projects token here BTW:
           token: '${{ secrets.GH_TOKEN }}'
       - name: Set up ssh-agent
         uses: webfactory/ssh-agent@v0.10.0
@@ -27,11 +25,10 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version-file: .python-version
-      - name: Run maintenance
-        id: maintenance
+      - name: Configure git
         run: |
           # See https://github.com/actions/checkout#push-a-commit-using-the-built-in-token
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          make maintenance
+      - name: Run maintenance
+        run: make maintenance

{cgitize-7.0.0 → cgitize-8.0.0}/DEVELOPMENT.md

@@ -18,11 +18,11 @@ test.
 You need to set the following environment variables for the authenticated
 access tests to work:
 
-* `CGITIZE_BITBUCKET_USERNAME`: `cgitize-test`
+* `CGITIZE_BITBUCKET_EMAIL`
 * `CGITIZE_BITBUCKET_TOKEN`
-* `CGITIZE_GITHUB_USERNAME`: `cgitize-test`
+* `CGITIZE_GITHUB_USERNAME`
 * `CGITIZE_GITHUB_TOKEN`
-* `CGITIZE_GITLAB_USERNAME`: `cgitize-test`
+* `CGITIZE_GITLAB_USERNAME`
 * `CGITIZE_GITLAB_TOKEN`
 
 You can run `. test/set_credentials.sh`; it'll ask you to fill in the secrets.

{cgitize-7.0.0 → cgitize-8.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cgitize
-Version: 7.0.0
+Version: 8.0.0
 Summary: Self-host your repositories using cgit
 Author-email: Egor Tensin <egor@tensin.name>
 License-Expression: MIT

{cgitize-7.0.0 → cgitize-8.0.0}/cgitize/bitbucket.py

@@ -12,8 +12,8 @@ from cgitize.repo import Repo, Visibility
 
 
 class Bitbucket:
-    def __init__(self, username=None, password=None):
-        self._impl = Cloud(username=username, password=password, cloud=True)
+    def __init__(self, email=None, token=None):
+        self._impl = Cloud(username=email, password=token, cloud=True)
 
     def get_repo(self, repo):
         try:

{cgitize-7.0.0 → cgitize-8.0.0}/cgitize/config.py

@@ -5,6 +5,7 @@
 
 from abc import ABC, abstractmethod
 import os
+from urllib.parse import quote
 
 import tomli
 
@@ -110,7 +111,7 @@ class GitHubSection(ServiceSection):
 
     @property
     def url_auth(self):
-        return self.token
+        return (self.token, None)
 
     def _enum_org_repositories(self, cfg, api, org):
         for repo in api.get_org_repos(org):
@@ -135,12 +136,6 @@ class GitHubSection(ServiceSection):
         return GitHub(username, token)
 
 
-def two_part_url_auth(username, password):
-    if username is None or password is None:
-        return None
-    return f'{username}:{password}'
-
-
 class BitbucketSection(ServiceSection):
     @property
     def token(self):
@@ -148,11 +143,11 @@ class BitbucketSection(ServiceSection):
 
     @property
     def username(self):
-        return self._get_config_or_env('username', 'CGITIZE_BITBUCKET_USERNAME')
+        return self._get_config_or_env('email', 'CGITIZE_BITBUCKET_EMAIL')
 
     @property
     def url_auth(self):
-        return two_part_url_auth(self.username, self.token)
+        return (self.username, self.token)
 
     def connect_to_service(self):
         username = self.username
@@ -175,7 +170,7 @@ class GitLabSection(ServiceSection):
 
     @property
     def url_auth(self):
-        return two_part_url_auth(self.username, self.token)
+        return (self.username, self.token)
 
     def connect_to_service(self):
         username = self.username

{cgitize-7.0.0 → cgitize-8.0.0}/cgitize/repo.py

@@ -87,8 +87,12 @@ class Repo:
 
         https_url = src.clone_url
         ssh_url = src.ssh_url
-        clone_url = ssh_url if config.main.clone_via_ssh else https_url
-        url_auth = None if config.main.clone_via_ssh else config.github.url_auth
+
+        clone_url = ssh_url
+        url_auth = None
+        if not config.main.clone_via_ssh:
+            clone_url = https_url
+            url_auth = config.github.url_auth
 
         return Repo(
             name,
@@ -113,7 +117,7 @@ class Repo:
         if len(https_urls) != 1:
             raise RuntimeError(f"no https:// clone URL for repository '{name}'?!")
         # Bitbucket leaves the username in the URL... Sigh.
-        https_url = url_remove_auth(https_urls[0]['href'])
+        api_auth, https_url = url_remove_auth(https_urls[0]['href'])
 
         ssh_urls = [
             link for link in src.data['links']['clone'] if link['name'] == 'ssh'
@@ -122,8 +126,18 @@ class Repo:
             raise RuntimeError(f"no ssh:// clone URL for repository '{name}'?!")
         ssh_url = ssh_urls[0]['href']
 
-        clone_url = ssh_url if config.main.clone_via_ssh else https_url
-        url_auth = None if config.main.clone_via_ssh else config.bitbucket.url_auth
+        clone_url = ssh_url
+        url_auth = None
+        if not config.main.clone_via_ssh:
+            clone_url = https_url
+            url_auth = config.bitbucket.url_auth
+            # Bitbucket, since deprecating app passwords, now requires that
+            # users authenticate with their Atlassian email & API token.
+            # Unfortunately (sigh...), if you want to clone a repo via HTTPS,
+            # you can't use the very same email + token combo in the URL, you
+            # have to use your username (double sigh...).  Luckily, for some
+            # reason, Bitbucket leaves the relevant username in the API response.
+            url_auth = api_auth[0], url_auth[1]
 
         return Repo(
             name,
@@ -144,8 +158,12 @@ class Repo:
 
         https_url = src.http_url_to_repo
         ssh_url = src.ssh_url_to_repo
-        clone_url = ssh_url if config.main.clone_via_ssh else https_url
-        url_auth = None if config.main.clone_via_ssh else config.gitlab.url_auth
+
+        clone_url = ssh_url
+        url_auth = None
+        if not config.main.clone_via_ssh:
+            clone_url = https_url
+            url_auth = config.gitlab.url_auth
 
         return Repo(
             name,

{cgitize-7.0.0 → cgitize-8.0.0}/cgitize/utils.py

@@ -9,7 +9,7 @@ import os
 import stat
 import subprocess
 import sys
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import quote, urlsplit, urlunsplit
 
 
 @contextmanager
@@ -97,11 +97,12 @@ def protected_file(path):
             os.unlink(path)
 
 
-def url_replace_auth(url, username, password=None):
+def url_replace_auth(url, auth):
+    username, password = auth
     parts = urlsplit(url)
-    netloc = username
+    netloc = quote(username)
     if password is not None:
-        netloc += f':{password}'
+        netloc += f':{quote(password)}'
     netloc += f'@{parts.hostname}'
     if parts.port is not None:
         netloc += f':{parts.port}'
@@ -111,6 +112,9 @@ def url_replace_auth(url, username, password=None):
 
 def url_remove_auth(url):
     parts = urlsplit(url)
+    auth = parts.username, parts.password
     netloc = parts.hostname
+    if parts.port is not None:
+        netloc += f':{parts.port}'
     parts = parts._replace(netloc=netloc)
-    return urlunsplit(parts)
+    return auth, urlunsplit(parts)

{cgitize-7.0.0 → cgitize-8.0.0}/cgitize.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cgitize
-Version: 7.0.0
+Version: 8.0.0
 Summary: Self-host your repositories using cgit
 Author-email: Egor Tensin <egor@tensin.name>
 License-Expression: MIT

{cgitize-7.0.0 → cgitize-8.0.0}/docker/README.md

@@ -48,13 +48,13 @@ Here's an example docker-compose.yml file:
           SCHEDULE: '0 */3 * * *'
           # Set CGITIZE_{GITHUB,BITBUCKET,GITLAB}_{USERNAME,TOKEN} variables
           # here or in the config file.
-        image: egortensin/cgitize:6
+        image: egortensin/cgitize:8
         restart: unless-stopped
         volumes:
           - ./example.toml:/etc/cgitize/cgitize.toml:ro
           - /srv/volumes/cgitize:/mnt/cgitize
       frontend:
-        image: egortensin/cgitize-frontend:6
+        image: egortensin/cgitize-frontend:8
         ports:
           - '127.0.0.1:80:80'
         restart: unless-stopped

{cgitize-7.0.0 → cgitize-8.0.0}/docs/api.md

@@ -4,10 +4,9 @@ unfortunately, peculiar in their own way.
 Tokens
 ------
 
-All of the forges support access tokens, of course (although they're called
-"app passwords" on Bitbucket).  They can be used to do `git clone https://`
-with authentication info in the URL.  For GitHub, it's enough to just specify
-the token:
+All of the forges support access tokens, of course.  They can be used to do
+`git clone https://` with authentication info in the URL.  For GitHub, it's
+enough to just specify the token:
 
     git clone https://TOKEN@github.com/USER/REPO.git
 
@@ -16,6 +15,9 @@ token in the URL:
 
     git clone https://USER:TOKEN@bitbucket.org/USER/REPO.git
 
+(For Bitbucket, since they deprecated their "app passwords", you need to
+specify not the username, but rather the Atlassian account email.)
+
 Terminology
 -----------
 

{cgitize-7.0.0 → cgitize-8.0.0}/docs/auth.md

@@ -22,11 +22,9 @@ When using HTTPS, there're multiple options to access the private repositories.
 
 2. Use OAuth.  I thought this was too complicated to implement quickly.
 
-3. Use per-application passwords.  This option is pretty cool.  Both GitHub (in
-   the form of "personal access tokens") and Bitbucket (calls them "app
-   passwords") support creating one-purpose passwords that are supposed to be
-   used by a single app only.  They allow to bypass the 2FA also.  Let's do
-   this!
+3. Use application access tokens.  This option is pretty cool.  Both GitHub
+   and Bitbucket support creating read-only tokens.   They allow to bypass the
+   2FA also.  Let's do this!
 
 Passing the access tokens to Git is tricky though.  First, simply including
 them in the clone URL would be incredibly stupid, since that URL is going to be

{cgitize-7.0.0 → cgitize-8.0.0}/examples/cgitize.toml

@@ -7,8 +7,8 @@ output_dir = "/tmp/cgitize"
 # repository's directory path.
 clone_url = "https://yourhost.com/git/{repo}"
 
-# Clones via SSH by default.
-clone_via_ssh = false
+# Clones via SSH by default (instead of Git-over-HTTPS).
+clone_via_ssh = true
 
 # Unless this is specified, cgit is going to derive the owner from the
 # repository's directory ownership.
@@ -19,8 +19,10 @@ owner = "Your Name"
 
 [github]
 # If some of the repositories hosted on GitHub are private (or if you hit the
-# request rate limit), use "access tokens". Set in the config or using the
-# CGITIZE_GITHUB_TOKEN environment variable.
+# request rate limit), use a personal access token. Set in the config or using
+# the CGITIZE_GITHUB_TOKEN environment variable.
+# Required scopes:
+#     * repo
 #token = "XXX"
 # Set the username that owns the token here or using the environment variable
 # CGITIZE_GITHUB_USERNAME.
@@ -56,21 +58,20 @@ dir = "python"
 # Bitbucket
 # =========
 
-# Bitbucket settings are similar to those for GitHub.
-
 [bitbucket]
-# Access tokens are called "app passwords" on Bitbucket.
-# The environment variable is CGITIZE_BITBUCKET_TOKEN.
+# Atlassian API token (environment variable CGITIZE_BITBUCKET_TOKEN).
+# Required scopes:
+#     * read:workspace:bitbucket
+#     * read:repository:bitbucket
 #token = "XXX"
-# The environment variable is CGITIZE_BITBUCKET_USERNAME.
-#username = "your-username"
+# Atlassian account email address (environment variable CGITIZE_BITBUCKET_EMAIL).
+#email = "your-email"
 
 [bitbucket.users.me]
 name = "cgitize-test-workspace"
 dir = "bitbucket-dir"
 #skip = ["repo1", "repo2"]
 
-# The defaults.
 public = true
 private = false
 
@@ -84,12 +85,12 @@ id = "berkeleylab/upc-runtime"
 # GitLab
 # ======
 
-# GitLab settings are similar to those for GitHub.
-
 [gitlab]
-# The environment variable is CGITIZE_GITLAB_TOKEN.
+# Personal access token (environment variable CGITIZE_GITLAB_TOKEN).
+# Required scopes (for legacy tokens):
+#     * read_api
 #token = "XXX"
-# The environment variable is CGITIZE_GITLAB_USERNAME.
+# Gitlab username (environment variable CGITIZE_GITLAB_USERNAME).
 #username = "your-username"
 
 [gitlab.users.me]
@@ -97,7 +98,6 @@ name = "cgitize-test"
 dir = "gitlab-dir"
 #skip = ["repo1", "repo2"]
 
-# The defaults.
 public = true
 private = false
 

{cgitize-7.0.0 → cgitize-8.0.0}/requirements.txt

@@ -1,11 +1,11 @@
 atlassian-python-api==4.0.7
-beautifulsoup4==4.14.3
+beautifulsoup4==4.15.0
 certifi==2026.5.20
 cffi==2.0.0
 charset-normalizer==3.4.7
 cryptography==48.0.0
 Deprecated==1.3.1
-idna==3.16
+idna==3.18
 jmespath==1.1.0
 oauthlib==3.3.1
 pycparser==3.0
@@ -16,8 +16,8 @@ python-gitlab==6.5.0
 requests==2.34.2
 requests-oauthlib==2.0.0
 requests-toolbelt==1.0.0
-soupsieve==2.8.3
+soupsieve==2.8.4
 tomli==2.4.1
 typing_extensions==4.15.0
 urllib3==2.7.0
-wrapt==2.2.0
+wrapt==2.2.1

{cgitize-7.0.0 → cgitize-8.0.0}/test/integration/example/test.sh

@@ -151,7 +151,48 @@ test_ssh() {
         goauthentik-dir/authentik \
         github-dir/public \
         bitbucket-dir/public \
+        gitlab-dir/public
+
+    verify_no_repos \
+        github-dir/private \
+        bitbucket-dir/private \
+        gitlab-dir/private
+
+    verify_origin lens 'git@github.com:ekmett/lens.git'
+    verify_origin chromiumembedded/cef 'git@bitbucket.org:chromiumembedded/cef.git'
+    verify_origin graphviz 'git@gitlab.com:graphviz/graphviz.git'
+    verify_origin goauthentik-dir/authentik 'git@github.com:goauthentik/authentik.git'
+
+    verify_origin github-dir/public 'git@github.com:cgitize-test/public.git'
+    verify_origin bitbucket-dir/public 'git@bitbucket.org:cgitize-test-workspace/public.git'
+    verify_origin gitlab-dir/public 'git@gitlab.com:cgitize-test/public.git'
+
+    cleanup
+    success
+}
+
+test_ssh_private() {
+    echo
+    echo ======================================================================
+    echo "${FUNCNAME[0]}"
+    echo ======================================================================
+
+    setup_ssh
+    setup_private_repos
+    cgitize
+
+    verify_repos \
+        lens \
+        chromiumembedded/cef \
+        graphviz \
+        wireguard/wintun \
+        goauthentik-dir/authentik \
+        github-dir/public \
+        github-dir/private \
+        bitbucket-dir/public \
+        bitbucket-dir/private \
         gitlab-dir/public \
+        gitlab-dir/private
 
     verify_origin lens 'git@github.com:ekmett/lens.git'
     verify_origin chromiumembedded/cef 'git@bitbucket.org:chromiumembedded/cef.git'
@@ -159,8 +200,11 @@ test_ssh() {
     verify_origin goauthentik-dir/authentik 'git@github.com:goauthentik/authentik.git'
 
     verify_origin github-dir/public  'git@github.com:cgitize-test/public.git'
+    verify_origin github-dir/private 'git@github.com:cgitize-test/private.git'
     verify_origin bitbucket-dir/public  'git@bitbucket.org:cgitize-test-workspace/public.git'
+    verify_origin bitbucket-dir/private 'git@bitbucket.org:cgitize-test-workspace/private.git'
     verify_origin gitlab-dir/public  'git@gitlab.com:cgitize-test/public.git'
+    verify_origin gitlab-dir/private 'git@gitlab.com:cgitize-test/private.git'
 
     cleanup
     success
@@ -195,9 +239,9 @@ test_https() {
     verify_origin graphviz 'https://gitlab.com/graphviz/graphviz.git'
     verify_origin goauthentik-dir/authentik 'https://github.com/goauthentik/authentik.git'
 
-    verify_origin github-dir/public  'https://github.com/cgitize-test/public.git'
-    verify_origin bitbucket-dir/public  'https://bitbucket.org/cgitize-test-workspace/public.git'
-    verify_origin gitlab-dir/public  'https://gitlab.com/cgitize-test/public.git'
+    verify_origin github-dir/public 'https://github.com/cgitize-test/public.git'
+    verify_origin bitbucket-dir/public 'https://bitbucket.org/cgitize-test-workspace/public.git'
+    verify_origin gitlab-dir/public 'https://gitlab.com/cgitize-test/public.git'
 
     cleanup
     success
@@ -259,6 +303,7 @@ test_one_repo() {
 main() {
     trap cleanup EXIT
     test_ssh
+    test_ssh_private
     test_https
     test_https_private
     test_one_repo

{cgitize-7.0.0 → cgitize-8.0.0}/test/set_credentials.sh

@@ -1,3 +1,5 @@
+IFS= read -r -s -p 'Bitbucket email: ' CGITIZE_BITBUCKET_EMAIL
+echo
 IFS= read -r -s -p 'Bitbucket token: ' CGITIZE_BITBUCKET_TOKEN
 echo
 IFS= read -r -s -p 'GitHub token: ' CGITIZE_GITHUB_TOKEN
@@ -5,7 +7,7 @@ echo
 IFS= read -r -s -p 'GitLab token: ' CGITIZE_GITLAB_TOKEN
 echo
 
-export CGITIZE_BITBUCKET_USERNAME=cgitize-test
+export CGITIZE_BITBUCKET_EMAIL
 export CGITIZE_BITBUCKET_TOKEN
 export CGITIZE_GITHUB_USERNAME=cgitize-test
 export CGITIZE_GITHUB_TOKEN

{cgitize-7.0.0 → cgitize-8.0.0}/test/unit/test_bitbucket.py

@@ -13,7 +13,7 @@ from requests.exceptions import HTTPError
 class BitbucketTests(unittest.TestCase):
     def setUp(self):
         self.bitbucket = Cloud(
-            username=os.environ.get('CGITIZE_BITBUCKET_USERNAME'),
+            username=os.environ.get('CGITIZE_BITBUCKET_EMAIL'),
             password=os.environ.get('CGITIZE_BITBUCKET_TOKEN'),
             cloud=True,
         )
@@ -65,6 +65,21 @@ class BitbucketTests(unittest.TestCase):
             r.get_link('html'), 'https://bitbucket.org/cgitize-test-workspace/private'
         )
 
+        clone_urls = [
+            link for link in r.data['links']['clone'] if link['name'] == 'https'
+        ]
+        self.assertEqual(len(clone_urls), 1)
+        self.assertEqual(
+            clone_urls[0]['href'],
+            'https://cgitize-test@bitbucket.org/cgitize-test-workspace/private.git',
+        )
+
+        ssh_urls = [link for link in r.data['links']['clone'] if link['name'] == 'ssh']
+        self.assertEqual(len(ssh_urls), 1)
+        self.assertEqual(
+            ssh_urls[0]['href'], 'git@bitbucket.org:cgitize-test-workspace/private.git'
+        )
+
     def test_user(self):
         w = self.bitbucket.workspaces.get('cgitize-test-workspace')
         self.assertEqual(