NuGet push returns 401 (Unauthorized) when using `--api-key`

[A9G-Data-Droid]

Description

I created an organization with my main account. I can use my account to push nuget packages in to the repository for my organization. Then I generated an API token using the GUI, saved that to my password manager. I've been having trouble using that token.

When I run this command:

dotnet nuget push --source gitea {package_file} --api-key {gitea_token}

The response is:

error: Response status code does not indicate success: 401 (Unauthorized).

Gitea Version

Gitea Version: 1.17.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

2022/08/04 14:59:45 ...kages/nuget/nuget.go:25:apiError() [E] [62ec4151-12] context canceled

Screenshots

No response

Git Version

git version 2.31.1

Operating System

Operating System: Red Hat Enterprise Linux 8.6 (Ootpa) CPE OS Name: cpe:/o:redhat:enterprise_linux:8::baseos Kernel: Linux 4.18.0-372.16.1.el8_6.x86_64

How are you running Gitea?

Installed from binary, running as a service.

Database

PostgreSQL

[KN4CK3R]

That's simple, --api-key is not supported. You can just use your token instead of the password when creating the source.

Changed into feature request.

[KN4CK3R]

I have added this in #20717.

[viceice]

I still get 401 when using an api-key on 1.17.2

> dotnet nuget push -s https://gitea.domain.test/api/packages/org/nuget/index.json -k some-api-key .\bin\some.package.2.1.6.nupkg --force-english-output
error: Unable to load the service index for source https://gitea.domain.test/api/packages/org/nuget/index.json.
error:   Response status code does not indicate success: 401 (Unauthorized).

[techknowlogick]

@viceice this was added in 1.18.0-dev, and was not backported to 1.17.2

[viceice]

@techknowlogick what about #20734 ? Isn't that the backport to v1.17.1 ? 😕

Also mentioned in release notes:
https://github.com/go-gitea/gitea/releases/tag/v1.17.1

[KN4CK3R]

Looked at this again, and yes it does not work the way you use it. :-)
If you use it with --source <name> it does work (that's how I tested #20734). You use it with --source <url/index.json>. Here the client makes a request to .../index.json but WITHOUT the token. This request fails then. I will add a second PR to handle this.