Failed to fetch custom advisory database: authentication failed

[danielhaap83]

Describe the bug
cargo deny fetch fails with errors configuring my custom advisory-db using https and gits credential.helper = store.

A simple git clone https://github.com/xxx/advisory-db is working fine.

To Reproduce
Steps to reproduce the behavior:

1. configure a private repository (https auth) of your choice in deny.toml advisories.db-urls
2. set git credential helper to store git config --global credential.helper store
3. clone the configured repository via git to create the store git clone https://github.com/xxx/private-repo

• enter username and password. I used my private access token as password

5. call cargo deny to fetch the configured repository cargo deny fetch
6. See error

cargo deny --log-level debug fetch
2022-05-05 09:23:16 [INFO] using config from /home/**/deny.toml
2022-05-05 09:23:16 [INFO] fetching crates.io index...
2022-05-05 09:23:16 [DEBUG] Fetching advisory database from 'https://github.com/danielhaap83/private-repo.git'
2022-05-05 09:23:18 [INFO] fetched crates.io index
2022-05-05 09:23:18 [ERROR] failed to fetch database: failed to fetch advisory database: git operation failed: failed to authenticate when downloading repository
attempted to find username/password via git's `credential.helper` support, but failed

This is just example to reproduce. Of course it is not functional to use any repository as advisory-db.

Expected behavior
cargo-deny is fetching the private repository

Device:

• Ubuntu 20.04.4 LTS
• git version 2.25.1
• cargo-deny 0.11.0

[Jake-Shadle]

Thanks for reporting. I won't have any time to look at this in the near future, but if you are motivated you can change the code here to (probably) instead directly use git2 to fetch similar to what cargo does, but that's presumably what rustsec already does, so maybe there is some bug in the rustsec code regarding credential helpers that can be fixed.

[danielhaap83]

I will investigate if the issue is in rustsec already. Nevertheless a cargo like option net.git-fetch-with-cli may help here as well. I will check that.

[danielhaap83]

Issue is already in rustsec. I have created an Issue there as well. Nevertheless I think it is good to have this option using the cli instead of the library.

[Jake-Shadle]

Resoved by #420