Unable to install chezmoi and dotfiles on empty machine because GitHub password authentication is deprecated.

[gdtroszak]

What exactly are you trying to do?

Run sh -c "$(curl -fsLS https://chezmoi.io/get)" -- init --apply gdtroszak to get chezmoi and my dotfiles installed on an empty Debian docker container.

I ran the command above and it prompted my for my GH credentials. After providing them, it fails with the following error message:

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/gdtroszak/dotfiles.git/'
chezmoi: exit status 128

In case it matters, my dotfiles repo (named dotfiles) is private and I use 2FA.

What have you tried so far?

The above, with and without an apt-installed version of git (looks like chezmoi comes with its own). I know I could circumvent the issue and directly clone the repo to the correct location, etc., but figured that I'd report that the "happy path" (the first bit of code that is suggested to run in the user guide) didn't "just work".

Where else have you checked for solutions?

• [x] I have read chezmoi's user guide, and not found the answer.
• [x] I have searched chezmoi's reference guide, and not found the answer.
• [ ] Other, please give details.

Output of any commands you've tried with --verbose flag

N/A

Output of chezmoi doctor

N/A

Additional context

To reproduce:

docker run -it debian:latest

# In container shell
$ apt-get update
$ apt-get install curl git
$ sh -c "$(curl -fsLS https://chezmoi.io/get)" -- init --apply $GH_USERNAME

[twpayne]

Is this https://duckduckgo.com/?q=github+password+authentication+was+removed&ia=web ?

[gdtroszak]

So I just made the repo public and all is well.

And yeah, that's exactly the issue. This is what I get for blindly reading the prompts and glazing over the links following the error. Maybe someday they will update the prompts and explicitly call them "Personal Access Tokens", but alas.