Make fly available for download without authentication to concourse

[ghost]

Enhancement: Make fly download URI available without authentication or ship as separate binary.

[concourse-bot]

Hi there!

We use Pivotal Tracker to provide visibility into what our team is working on. A story for this issue has been automatically created.

The current status is as follows:

• #115872395 Make fly available for download without authentication to concourse

This comment, as well as the labels on the issue, will be automatically updated as the status in Tracker changes.

[zachgersh]

Is there any reason that fly shouldn't be available to download without authentication?

[vito]

It already is downloadable if your CI is publicly reachable, so not sure what this means.

[ghost]

I was unable to reach the the download fly using the URL http://192.168.50.205:8080/api/v1/cli?arch=amd64&platform=linux, it was not reachable. After logging into concourse I can resolve the URL and download the package. I am scripting the fly download and install in chef but cannot download the package on the server running concourseci using wget or remotefile resource.

[zachgersh]

@vito I was actually wondering the opposite. If it isn't public accessible, why can't I still do a sync? Shouldn't sync be one of the few things that doesn't require you to login?

I could imagine a scenario where we make a backwards incompatible change to concourse login and then all of a sudden you can no longer login to get a fly that can actually login. Obviously they would just go to the UI at this point and download it but still

[zachgersh]

done here: vmware-archive/atc#76

cc @vito

[danger-ranger]

Not sure if this is the same issue: #82

[vito]

@dvanbuskirk As mentioned in vmware-archive/atc#76 I'm a little wary of opening any endpoints up except for those that are absolutely necessary for logging in.

If it's acceptable to give creds to your script, you could use basic auth and fetch the CLI like so:

token="$(curl -u user:pass http://your.concourse.ci/api/v1/auth/token | jq -r '.type + " " + .value')"
curl -H "Authorization: $token" 'http://your.concourse.ci/api/v1/cli?arch=amd64&platform=linux'

[ghost]

@vito thanks for the workaround, security is always good.