Implement Git LFS workaround affecting Pull Request clones

[StanleyGoldman]

In an LFS project, I have a pull request from a user, github-for-unity/Unity#207 He has enabled the checkbox that allows maintainers to push to his branch

I've cloned the PR with the GitHub Extension for Visual Studio and I realize that I'm unable to push to the remote with the git command line.

$ git push MunchyYDL pr/207--changes-direct-usages-of-gui-enabled-to-instead-use-editorgui-begin
Authentication required: You must have push access to verify locks
error: failed to push some refs to 'https://github.com/MunchyYDL/Unity.git'

This is due to the bug here: Due to an issue here: https://github.com/git-lfs/git-lfs/pull/1456 and a workaround would be to add the following git configuration to my local repository.

$ git config remote.MunchyYDL.lfsurl https://lfs.github.com/github-for-unity/Unity

In order to assist users in this scenario, we could bypass the potential problem and implement the workaround while we are adding the remote to the fork and cloning the PR branch.

New Issue

https://github.com/git-lfs/git-lfs/pull/2706

[technoweenie]

To be clear, this should only be done for GitHub URLs. It's only an issue with the way our permissions work. I thought long about this during LFS dev, and then the maintainer PR access totally gets around it :)

[StanleyGoldman]

Hey @technoweenie I mentioned it in our chats a while back, I just looked to the issue now and realized I never mentioned it here.

I tried this workaround manually and it did not work for me. The error message I received remained consistent.

[StanleyGoldman]

So I put some work in to reproduce this issue...

1. I created a repo https://github.com/StanleyGoldman/lfs-pull-request-test
2. I forked the repo https://github.com/EvilStanleyGoldman/lfs-pull-request-test
3. I created a branch in the fork https://github.com/EvilStanleyGoldman/lfs-pull-request-test/tree/EvilStanleyGoldman-patch-1
4. I created a pull request to the orig https://github.com/StanleyGoldman/lfs-pull-request-test/pull/1
5. I added the remote and fetched

   ✔ ~/Projects/lfs-pull-request-test [master|✔]
   10:02 $ git remote add EvilStanleyGoldman https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git
   ✔ ~/Projects/lfs-pull-request-test [master|✔]
   10:02 $ git fetch --all
   Fetching origin
   Fetching EvilStanleyGoldman
   remote: Counting objects: 3, done.
   remote: Compressing objects: 100% (2/2), done.
   remote: Total 3 (delta 0), reused 3 (delta 0), pack-reused 0
   Unpacking objects: 100% (3/3), done.
   From https://github.com/EvilStanleyGoldman/lfs-pull-request-test
   * [new branch]      EvilStanleyGoldman-patch-1 -> EvilStanleyGoldman/EvilStanleyGoldman-patch-1
   * [new branch]      master     -> EvilStanleyGoldman/master

6. I made a change, committed and tried to push

   
   ✔ ~/Projects/lfs-pull-request-test [EvilStanleyGoldman-patch-1 ↑·1|✔]
   10:04 $ git push EvilStanleyGoldman EvilStanleyGoldman-patch-1:EvilStanleyGoldman-patch-1
   Authentication required: You must have push access to verify locks
   error: failed to push some refs to 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'
   ✘-1 ~/Projects/lfs-pull-request-test [EvilStanleyGoldman-patch-1 ↑·1|✔]
   10:07 $ GIT_TRACE=1 GIT_LFS_TRACE=1 git push EvilStanleyGoldman EvilStanleyGoldman-patch-1:EvilStanleyGoldman-patch-1
   10:07:57.514136 git.c:371               trace: built-in: git 'push' 'EvilStanleyGoldman' 'EvilStanleyGoldman-patch-1:EvilStanleyGoldman-patch-1'
   10:07:57.515154 run-command.c:369       trace: run_command: 'git-remote-https' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'
   10:07:57.762001 run-command.c:369       trace: run_command: 'git credential-manager get'
   10:07:57.800988 git.c:596               trace: exec: 'git-credential-manager' 'get'
   10:07:57.802010 run-command.c:369       trace: run_command: 'git-credential-manager' 'get'
   10:07:58.332365 run-command.c:369       trace: run_command: 'git credential-manager store'
   10:07:58.379553 git.c:596               trace: exec: 'git-credential-manager' 'store'
   10:07:58.379553 run-command.c:369       trace: run_command: 'git-credential-manager' 'store'
   10:07:58.560786 run-command.c:369       trace: run_command: 'git credential-wincred store'
   10:07:58.594804 git.c:596               trace: exec: 'git-credential-wincred' 'store'
   10:07:58.594804 run-command.c:369       trace: run_command: 'git-credential-wincred' 'store'
   10:07:58.628339 run-command.c:369       trace: run_command: '.git/hooks/pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'
   10:07:58.663960 git.c:596               trace: exec: 'git-lfs' 'pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'
   10:07:58.663960 run-command.c:369       trace: run_command: 'git-lfs' 'pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'
   trace git-lfs: run_command: 'git' version
   trace git-lfs: run_command: 'git' config -l
   trace git-lfs: tq: running as batched queue, batch size of 100
   trace git-lfs: creds: git credential fill ("https", "github.com", "EvilStanleyGoldman/lfs-pull-request-test.git")
   trace git-lfs: Filled credentials for https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git
   trace git-lfs: HTTP: POST https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git/info/lfs/locks/verify
   trace git-lfs: HTTP: 403
   trace git-lfs: HTTP: {"documentation_url":"https://github.com/contact","message":"You must have push access to verify locks","request_id":"DA7D:20807:5611FC:A02FFD:59DCD440"}

Authentication required: You must have push access to verify locks error: failed to push some refs to 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'

7. I made the configuration change and tried to push

✘-INT ~/Projects/lfs-pull-request-test [EvilStanleyGoldman-patch-1 ↑·1|✔] 10:08 $ git config remote.EvilStanleyGoldman.lfsurl https://lfs.github.com/EvilStanleyGoldman/lfs-pull-request-test ✔ ~/Projects/lfs-pull-request-test [EvilStanleyGoldman-patch-1 ↑·1|✔] 10:09 $ GIT_TRACE=1 GIT_LFS_TRACE=1 git push EvilStanleyGoldman EvilStanleyGoldman-patch-1:EvilStanleyGoldman-patch-1 10:09:16.509671 git.c:371 trace: built-in: git 'push' 'EvilStanleyGoldman' 'EvilStanleyGoldman-patch-1:EvilStanleyGoldman-patch-1' 10:09:16.510672 run-command.c:369 trace: run_command: 'git-remote-https' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git' 10:09:16.774976 run-command.c:369 trace: run_command: 'git credential-manager get' 10:09:16.840496 git.c:596 trace: exec: 'git-credential-manager' 'get' 10:09:16.840496 run-command.c:369 trace: run_command: 'git-credential-manager' 'get' 10:09:17.391470 run-command.c:369 trace: run_command: 'git credential-manager store' 10:09:17.439035 git.c:596 trace: exec: 'git-credential-manager' 'store' 10:09:17.439035 run-command.c:369 trace: run_command: 'git-credential-manager' 'store' 10:09:17.634490 run-command.c:369 trace: run_command: 'git credential-wincred store' 10:09:17.677818 git.c:596 trace: exec: 'git-credential-wincred' 'store' 10:09:17.677818 run-command.c:369 trace: run_command: 'git-credential-wincred' 'store' 10:09:17.701825 run-command.c:369 trace: run_command: '.git/hooks/pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git' 10:09:17.737733 git.c:596 trace: exec: 'git-lfs' 'pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git' 10:09:17.737733 run-command.c:369 trace: run_command: 'git-lfs' 'pre-push' 'EvilStanleyGoldman' 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git' trace git-lfs: run_command: 'git' version trace git-lfs: run_command: 'git' config -l trace git-lfs: tq: running as batched queue, batch size of 100 trace git-lfs: HTTP: POST https://lfs.github.com/EvilStanleyGoldman/lfs-pull-request-test/locks/verify trace git-lfs: HTTP: 401 trace git-lfs: HTTP: {"documentation_url":"https://github.com/contact","message":"You must have push access to verify locks","request_id":"DB4A:20802:524F01:919E43:59DCD48F"}

trace git-lfs: setting repository access to basic trace git-lfs: run_command: 'git' config lfs.https://lfs.github.com/EvilStanleyGoldman/lfs-pull-request-test.access basic trace git-lfs: api: http response indicates "basic" authentication. Resubmitting... trace git-lfs: creds: git credential fill ("https", "lfs.github.com", "EvilStanleyGoldman/lfs-pull-request-test") trace git-lfs: Filled credentials for https://lfs.github.com/EvilStanleyGoldman/lfs-pull-request-test trace git-lfs: HTTP: POST https://lfs.github.com/EvilStanleyGoldman/lfs-pull-request-test/locks/verify trace git-lfs: HTTP: 403 trace git-lfs: HTTP: {"documentation_url":"https://github.com/contact","message":"You must have push access to verify locks","request_id":"DB4A:20802:524F4D:919E4D:59DCD48F"}

Authentication required: You must have push access to verify locks error: failed to push some refs to 'https://github.com/EvilStanleyGoldman/lfs-pull-request-test.git'

[StanleyGoldman]

After some input from @technoweenie I realized we documented the workaround incorrectly... I previously had...

$ git config remote.MunchyYDL.lfsurl https://lfs.github.com/MunchyYDL/Unity

That is incorrect, it should have been

$ git config remote.MunchyYDL.lfsurl https://lfs.github.com/github-for-unity/Unity

I'm correcting that in the issue above...

[technoweenie]

To explain in evil twin terms:

• evilstanley forks the repo and creates a pull request with the flag that allows maintainers to push to just that branch.
• stanley only has read-only access to the fork, but can push to that specific branch.
• LFS locks and objects API calls don't pass ref information along, so they only go by repo permissions.
• Changing the LFS url to the repo you can push to works because LFS objects are shared in a single repository network. Pushing objects to StanleyGoldman/lfs-pull-request-test will make them available in EvilStanleyGoldman/lfs-pull-request-test and vice versa.

There is an old PR to fix this that was initiated by a contributor using some other git host with ref-specific permissions. They never finished it, so it just sat there. Also, locking came out since then, so it needs to be updated for that too.

I just finished the LFS v2.3.x bug fixes, so I can look at resurrecting that old PR: https://github.com/git-lfs/git-lfs/pull/1456

[StanleyGoldman]

New issue: https://github.com/git-lfs/git-lfs/pull/2706

[technoweenie]

That PR was getting big, so I moved the extra tasks to tracking issue: https://github.com/git-lfs/git-lfs/issues/2712.