remote: authenticated clone for private origins (#22)

repo-init/repo-add clone https repos with shared defaults.git
credentials from ~/.werkator.yml via one-shot GIT_ASKPASS

tools/remote

@@ -332,9 +332,65 @@ instance_update() {
     echo "==> Instance updated."
 }
 
-# Sets up the WATCHED repository: an anonymous https clone (a private origin
-# gets its credentials via git.account/git.token in the machine config that
-# `werkator init` creates), the werkator init with the instance fragment
+# Clones one URL into one directory on the host.
+# A private https origin authenticates with the shared `defaults.git.account` /
+# `defaults.git.token` of `~/.werkator.yml` (ADR 0009). The whole authenticated
+# clone runs in one remote python script: the token is read from the instance
+# file on the host and passed to git via a one-shot GIT_ASKPASS script, so it
+# appears in neither the local process list nor a repository config.
+# Public origins (or an instance without shared credentials) clone anonymously.
+clone_repo() {
+    local url="$1" dest="$2"
+    if ssh "$HOST" "test -d '$dest/.git'"; then
+        echo "    (already cloned, skipping)"
+        return 0
+    fi
+    case "$url" in
+        https://*)
+            # The python helper travels base64-encoded: the clone command itself
+            # stays a plain `ssh` line, so no `$` inside the script is ever
+            # expanded by the local shell, and the token never leaves the host.
+            local helper_b64
+            helper_b64="$(python3 -c 'import base64,sys; print(base64.b64encode(sys.stdin.read().encode()).decode())' <<'PYEOF_CLONE'
+import os, stat, subprocess, sys, tempfile, urllib.parse
+url, dest = sys.argv[1], sys.argv[2]
+try:
+    import yaml
+    cfg = yaml.safe_load(open(os.path.expanduser("~/.werkator.yml"))) or {}
+except (FileNotFoundError, ImportError):
+    cfg = {}
+d = (cfg.get("defaults") or {}).get("git") or {}
+account, token = d.get("account"), d.get("token")
+env = dict(os.environ, GIT_TERMINAL_PROMPT="0")
+ask = None
+if account and token:
+    parts = urllib.parse.urlsplit(url)
+    host = parts.netloc.rsplit("@", 1)[-1]
+    url = urllib.parse.urlunsplit(parts._replace(netloc=account + "@" + host))
+    ask = tempfile.NamedTemporaryFile(mode="w", prefix="werkator-clone-askpass-",
+                                      suffix=".sh", delete=False)
+    ask.write("#!/bin/sh\nexec echo \"$WERKATOR_CLONE_TOKEN\"\n")
+    ask.close()
+    os.chmod(ask.name, stat.S_IRWXU)
+    env.update(GIT_ASKPASS=ask.name, WERKATOR_CLONE_TOKEN=token)
+try:
+    subprocess.run(["git", "clone", url, dest], env=env, check=True)
+finally:
+    if ask is not None:
+        os.unlink(ask.name)
+PYEOF_CLONE
+)"
+            ssh "$HOST" "echo '$helper_b64' | base64 -d | python3 - '$url' '$dest'"
+            ;;
+        *)
+            ssh "$HOST" "git clone '$url' '$dest'"
+            ;;
+    esac
+}
+
+# Sets up the WATCHED repository: an https clone (a private origin
+# authenticates with the shared `defaults.git.*` credentials of
+# `~/.werkator.yml`; see `clone_repo`), the werkator init with the instance
 # applied, and the rootfs archive for the sandbox builds. All configuration
 # writing is init's — this script transports and invokes (step 23).
 repo_init() {
@@ -344,11 +400,7 @@ repo_init() {
     ssh "$HOST" "test -x '$WERKATOR_BIN'" || die "no instance on $HOST — run instance-install first"
 
     echo "==> Cloning the watched repository"
-    if ssh "$HOST" "test -d '$REPO_DIR/.git'"; then
-        echo "    (already cloned, skipping)"
-    else
-        ssh "$HOST" "git clone '$REPO_URL' '$REPO_DIR'"
-    fi
+    clone_repo "$REPO_URL" "$REPO_DIR"
 
     if [ "$SANDBOX" = "docker" ]; then
         echo "==> No rootfs needed (WERKATOR_SANDBOX=docker) — the build image is the repository's own Dockerfile"
@@ -401,11 +453,7 @@ repo_add() {
     ssh "$HOST" "test -x '$WERKATOR_BIN'" || die "no instance on $HOST — run instance-install first"
 
     echo "==> Cloning $url as '$name'"
-    if ssh "$HOST" "test -d '$SIBLING_DIR/$name/.git'"; then
-        echo "    (already cloned, skipping)"
-    else
-        ssh "$HOST" "git clone '$url' '$SIBLING_DIR/$name'"
-    fi
+    clone_repo "$url" "$SIBLING_DIR/$name"
 
     # The instance fragment carries the sandbox policy (bwrap rootfs and werkdock
     # binary). Without it a watched repository builds on the bare host, where the