Merge ~cjwatson/lp-codeimport:git-auth-launchpad-services into lp-codeimport:master

[Colin Watson]

Authenticate using +launchpad-services rather than empty username

We previously authenticated to git using the empty username and a non-user-bound macaroon. This is syntactically valid and works with current versions of git and curl, but it's the sort of edge case in the URL specification that's easy to mishandle, and modern versions of git built against versions of curl prior to 7.62.0 fail to send an Authorization header. Using a reserved username is safer.

See also the similar https://code.launchpad.net/~cjwatson/launchpad/+git/launchpad/+merge/407532, which added support to Launchpad for authenticating using this reserved username.

[Ioana Lasc (ilasc)]

review: Approve

diff --git a/lib/lp/codehosting/codeimport/worker.py b/lib/lp/codehosting/codeimport/worker.py
index f547cfb..9391324 100644
--- a/lib/lp/codehosting/codeimport/worker.py
+++ b/lib/lp/codehosting/codeimport/worker.py
@@ -1157,15 +1157,14 @@ class GitToGitImportWorker(ImportWorker):
         unauth_target_url = urljoin(
             config.codehosting.git_browse_root, self.source_details.target_id)
         split = urlsplit(unauth_target_url)
-        target_netloc = ":%s@%s" % (
+        target_netloc = "+launchpad-services:%s@%s" % (
             self.source_details.macaroon.serialize(), split.hostname)
         if split.port:
             target_netloc += ":%s" % split.port
         target_url = urlunsplit([
             split.scheme, target_netloc, split.path, "", ""])
         # XXX cjwatson 2016-10-11: Ideally we'd put credentials in a
-        # credentials store instead.  However, git only accepts credentials
-        # that have both a non-empty username and a non-empty password.
+        # credentials store instead.
         self._logger.info("Getting existing repository from hosting service.")
         try:
             self._runGit(