def wrapped(*args, **kwargs):
     try:
         return fn(*args, **kwargs)
     except requests.exceptions.HTTPError as e:
         if e.response.status_code == 401:
             authorizeUser()
             return fn(*args, **kwargs)
         else:
             raise
     except github.BadCredentialsException:
         logger.debug("github: bad credentials")
         authorizeUser()
         logger.debug('trying with authtoken:', settings.getProperty('github', 'authtoken'))
         return fn(*args, **kwargs)
     except github.UnknownObjectException:
         logger.debug("github: unknown object")
         # some endpoints return 404 if the user doesn't have access, maybe
         # it would be better to prompt for another username and password,
         # and store multiple tokens that we can try for each request....
         # but for now we assume that if the user is logged in then a 404
         # really is a 404
         if not _userAuthorized():
             logger.info('failed to fetch Github object, re-trying with authentication...')
             authorizeUser()
             return fn(*args, **kwargs)
         else:
             raise

def _getTarball(url, into_directory, cache_key, origin_info=None):
    '''unpack the specified tarball url into the specified directory'''

    try:
        access_common.unpackFromCache(cache_key, into_directory)
    except KeyError as e:
        tok = settings.getProperty('github', 'authtoken')
        headers = {}
        if tok is not None:
            headers['Authorization'] = 'token ' + str(tok)

        logger.debug('GET %s', url)
        response = requests.get(url, allow_redirects=True, stream=True, headers=headers)
        response.raise_for_status()

        logger.debug('getting file: %s', url)
        logger.debug('headers: %s', response.headers)
        response.raise_for_status()

        # github doesn't exposes hashes of the archives being downloaded as far
        # as I can tell :(
        access_common.unpackTarballStream(
                    stream = response,
            into_directory = into_directory,
                      hash = {},
                 cache_key = cache_key,
               origin_info = origin_info
        )

def _getTags(repo):
    ''' return a dictionary of {tag: tarball_url}'''
    g = Github(settings.getProperty('github', 'authtoken'))
    logger.info('get versions for ' + repo)
    repo = g.get_repo(repo)
    tags = repo.get_tags()
    return {t.name: t.tarball_url for t in tags}

 def wrapped(*args, **kwargs):
     try:
         return fn(*args, **kwargs)
     except restkit_errors.Unauthorized as e:
         github_access.authorizeUser()
         logger.debug('trying with authtoken:', settings.getProperty('github', 'authtoken'))
         return fn(*args, **kwargs)

def getPublicKey(registry=None):
    ''' Return the user's public key (generating and saving a new key pair if necessary) '''
    registry = registry or Registry_Base_URL
    pubkey_pem = None
    if _isPublicRegistry(registry):
        pubkey_pem = settings.getProperty('keys', 'public')
    else:
        for s in _getSources():
            if _sourceMatches(s, registry):
                if 'keys' in s and s['keys'] and 'public' in s['keys']:
                    pubkey_pem = s['keys']['public']
                    break
    if not pubkey_pem:
        pubkey_pem, privatekey_pem = _generateAndSaveKeys()
    else:
        # settings are unicode, we should be able to safely decode to ascii for
        # the key though, as it will either be hex or PEM encoded:
        pubkey_pem = pubkey_pem.encode('ascii')
    # if the key doesn't look like PEM, it might be hex-encided-DER (which we
    # used historically), so try loading that:
    if b'-----BEGIN PUBLIC KEY-----' in pubkey_pem:
        pubkey = serialization.load_pem_public_key(pubkey_pem, default_backend())
    else:
        pubkey_der = binascii.unhexlify(pubkey_pem)
        pubkey = serialization.load_der_public_key(pubkey_der, default_backend())
    return _pubkeyWireFormat(pubkey)

def _getTags(repo):
    """ return a dictionary of {tag: tarball_url}"""
    logger.debug("get tags for %s", repo)
    g = Github(settings.getProperty("github", "authtoken"))
    repo = g.get_repo(repo)
    tags = repo.get_tags()
    logger.debug("tags for %s: %s", repo, [t.name for t in tags])
    return {t.name: t.tarball_url for t in tags}

def _getTags(repo):
    ''' return a dictionary of {tag: tarball_url}'''
    logger.debug('get tags for %s', repo)
    g = Github(settings.getProperty('github', 'authtoken'))
    repo = g.get_repo(repo)
    tags = repo.get_tags()
    logger.debug('tags for %s: %s', repo, [t.name for t in tags])
    return {t.name: _ensureDomainPrefixed(t.tarball_url) for t in tags}

def _getTarball(url, into_directory):
    '''unpack the specified tarball url into the specified directory'''
    resource = Resource(url, pool=connection_pool.getPool(), follow_redirect=True)
    response = resource.get(
        headers = {'Authorization': 'token ' + settings.getProperty('github', 'authtoken')}, 
    )
    logger.debug('getting file: %s', url)
    # TODO: there's an MD5 in the response headers, verify it
    access_common.unpackTarballStream(response.body_stream(), into_directory)

def _getPrivateKey(registry):
    if _isPublicRegistry(registry):
        return settings.getProperty("keys", "private")
    else:
        for s in _getSources():
            if _sourceMatches(s, registry):
                if "keys" in s and s["keys"] and "private" in s["keys"]:
                    return s["keys"]["private"]
        return None

 def retryWithAuthOrRaise(original_exception):
     # in all cases ask for auth, so that in non-interactive mode a
     # login URL is displayed
     auth.authorizeUser(provider='github', interactive=interactive)
     if not interactive:
         raise original_exception
     else:
         logger.debug('trying with authtoken: %s', settings.getProperty('github', 'authtoken'))
         return fn(*args, **kwargs)

def _getTarball(url, into_directory):
    '''unpack the specified tarball url into the specified directory'''
    headers = {'Authorization': 'token ' + str(settings.getProperty('github', 'authtoken'))}

    response = requests.get(url, allow_redirects=True, stream=True, headers=headers)

    logger.debug('getting file: %s', url)
    # TODO: there's an MD5 in the response headers, verify it

    access_common.unpackTarballStream(response, into_directory)

def getPublicKey():
    ''' Return the user's public key (generating and saving a new key pair if necessary) '''
    pubkey_hex = settings.getProperty('keys', 'public')
    if not pubkey_hex:
        k = RSA.generate(2048)
        settings.setProperty('keys', 'private', binascii.hexlify(k.exportKey('DER')))
        pubkey_hex = binascii.hexlify(k.publickey().exportKey('DER'))
        settings.setProperty('keys', 'public', pubkey_hex)
        pubkey_hex, privatekey_hex = _generateAndSaveKeys()
    return _pubkeyWireFormat(RSA.importKey(binascii.unhexlify(pubkey_hex)))

def _getBranchHeads(repo):
    g = Github(settings.getProperty('github', 'authtoken'))
    repo = g.get_repo(repo)
    branches = repo.get_branches()

    # branch tarball URLs aren't supported by the API, so have to munge the
    # master tarball URL. Fetch the master tarball URL once (since that
    # involves a network request), then mumge it for each branch we want:
    master_tarball_url = repo.get_archive_link('tarball')

    return {b.name:_tarballUrlForBranch(master_tarball_url, b.name) for b in branches}

 def wrapped(*args, **kwargs):
     try:
         return fn(*args, **kwargs)
     except requests.exceptions.HTTPError as e:
         if e.response.status_code == requests.codes.unauthorized:
             logger.debug('%s unauthorised', fn)
             github_access.authorizeUser()
             logger.debug('trying with authtoken: %s', settings.getProperty('github', 'authtoken'))
             return fn(*args, **kwargs)
         else:
             raise

def _getTarball(url, into_directory):
    '''unpack the specified tarball url into the specified directory'''
    tok = settings.getProperty('github', 'authtoken')
    headers = {}
    if tok is not None:
        headers['Authorization'] = 'token ' + str(tok)

    logger.debug('GET %s', url)
    response = requests.get(url, allow_redirects=True, stream=True, headers=headers)
    response.raise_for_status()

    logger.debug('getting file: %s', url)
    # TODO: there's an MD5 in the response headers, verify it

    access_common.unpackTarballStream(response, into_directory)

 def wrapped(*args, **kwargs):
     # if yotta is being run noninteractively, then we never retry, but we
     # do call auth.authorizeUser, so that a login URL can be displayed:
     interactive = globalconf.get('interactive')
     if not interactive:
         try:
             return fn(*args, **kwargs)
         except requests.exceptions.HTTPError as e:
             if e.response.status_code == 401:
                 auth.authorizeUser(provider='github', interactive=False)
             raise
         except github.BadCredentialsException:
             logger.debug("github: bad credentials")
             auth.authorizeUser(provider='github', interactive=False)
             raise
         except github.UnknownObjectException:
             logger.debug("github: unknown object")
             # some endpoints return 404 if the user doesn't have access:
             if not _userAuthedWithGithub():
                 logger.info('failed to fetch Github object, try re-authing...')
                 auth.authorizeUser(provider='github', interactive=False)
             raise
     else:
         try:
             return fn(*args, **kwargs)
         except requests.exceptions.HTTPError as e:
             if e.response.status_code == 401:
                 auth.authorizeUser(provider='github')
                 return fn(*args, **kwargs)
             raise
         except github.BadCredentialsException:
             logger.debug("github: bad credentials")
             auth.authorizeUser(provider='github')
             logger.debug('trying with authtoken:', settings.getProperty('github', 'authtoken'))
             return fn(*args, **kwargs)
         except github.UnknownObjectException:
             logger.debug("github: unknown object")
             # some endpoints return 404 if the user doesn't have access, maybe
             # it would be better to prompt for another username and password,
             # and store multiple tokens that we can try for each request....
             # but for now we assume that if the user is logged in then a 404
             # really is a 404
             if not _userAuthedWithGithub():
                 logger.info('failed to fetch Github object, re-trying with authentication...')
                 auth.authorizeUser(provider='github')
                 return fn(*args, **kwargs)
             raise

def defaultTarget():
    set_target = settings.getProperty('build', 'target')
    if set_target:
        return set_target

    machine = platform.machine()

    x86 = machine.find('86') != -1
    arm = machine.find('arm') != -1 or machine.find('aarch') != -1

    prefix = "x86-" if x86 else "arm-" if arm else ""
    platf = 'unknown'

    if sys.platform.startswith('linux'):
        platf = 'linux-native'
    elif sys.platform == 'darwin':
        platf = 'osx-native'
    elif sys.platform.find('win') != -1:
        platf = 'win'
    return prefix + platf + ','

def _getTarball(url, into_directory, cache_key):
    """unpack the specified tarball url into the specified directory"""

    try:
        access_common.unpackFromCache(cache_key, into_directory)
    except KeyError as e:
        tok = settings.getProperty("github", "authtoken")
        headers = {}
        if tok is not None:
            headers["Authorization"] = "token " + str(tok)

        logger.debug("GET %s", url)
        response = requests.get(url, allow_redirects=True, stream=True, headers=headers)
        response.raise_for_status()

        logger.debug("getting file: %s", url)
        logger.debug("headers: %s", response.headers)
        response.raise_for_status()

        # github doesn't exposes hashes of the archives being downloaded as far
        # as I can tell :(
        access_common.unpackTarballStream(stream=response, into_directory=into_directory, hash={}, cache_key=cache_key)

def deauthorize():
    if settings.getProperty('github', 'authtoken'):
        settings.setProperty('github', 'authtoken', '')

def _userAuthorized():
    return settings.getProperty('github', 'authtoken')