Download GitLab Generic Package File using Deploy Token

user_21429 0
Viewed 1543

I have a project (A), with CI pipeline, in GitLab. This pipeline has a dependency on a package from another project (B). During the build of project A, I want to download the package from project B's package registry. The packages are uploaded as (zip files) generic packages. The projects are all private so I need some kind of access token to authenticate.

I'm trying to use Deploy Tokens as these seem to provide the required read_package_registry access scope. However, I cannot find any documentation describing how to authenticate with a deploy token when downloading generic package files.

I'm using the following request, described in the previous link.

GET https://gitlab.com/api/v4/projects/<project_B_id>/packages/generic/<package_name>/<package_version>/<package_file>

I have tried

  • adding the deploy token username and password to the URL, basic/digest authentication
  • Adding a header to the request PRIVATE-TOKEN: [deploy-token]
  • Adding a header to the request DEPLOY-TOKEN: [deploy-token]
  • Adding a header to the request Authorization: Bearer [deploy-token]
  • I've also tried each of the above headers but with [deploy-token-username][deploy-token] as the value

I can't find documentation stating that I can't use a deploy token.

Does anyone have a working example of how to do this, or does anyone know if this is/isn't possible?

I can switch to a private access token, but I'd prefer to use the correct tool for the job, and that seems to be deploy tokens.

gitlab-ci continuous-integration
2 Answers
user_17472320

I've been looking for this answer too.

The docs (https://docs.gitlab.com/ee/user/packages/generic_packages/index.html#authenticate-to-the-package-registry) say

To authenticate to the Package Registry, you need either a personal access token or CI job token.

No mention of Deploy Tokens. Those seem to be limited to docker, npm, etc.

Also, the Job Token you have in project B allows you to publish your artifact. But, the Job Token you have in project A does not seem to be authorized to download it.

I believe the answer is that you cannot use a Deploy Token, but I'd love to be proven wrong.

user_5086160
Related