Can't pull or fetch LFS files.

[Ahmed Amin]

Hello,

I'm using Gerrit 2.15.1 with lfs plugin 2.15 stable, when trying to pull \ fetch LFS using git lfs pull

It just hangs at Git LFS: (0 of 310 files) 0 B / 5.07 GB  with no output.

And when I used GIT_TRACE=1, I got the following error: 

Git LFS: (0 of 310 files) 0 B / 5.07 GB                                        10:44:07.814313 trace git-lfs: Filled credentials for https://gerrit_site/project_name

10:44:07.814313 trace git-lfs: HTTP: POST https://gerrit_site/project_name.git/info/lfs/objects/batch

Git LFS: (0 of 310 files) 0 B / 5.07 GB                                        10:44:08.116967 trace git-lfs: HTTP: 401

10:44:08.116967 trace git-lfs: HTTP: {"message":"Not authorized to perform operation download on repository project_name"}

10:44:08.116967 trace git-lfs: api: http response indicates "basic" authentication. Resubmitting..

and the error keeps repeating itself.

I wasn't able to clone also, but cloning without LFS works, using: GIT_LFS_SKIP_SMUDGE=1 git clone <Repo-Url>

But when trying pushing LFS files, everything went fine and I was able to push all files.

I'm suspecting that there might be miss-configuration specifically for LFS downloading since the error states not authorized to download, but the error is affecting all users including admins as well.

When I opened error_log, I found the following error:

[2018-04-12 16:29:14,667] [HTTP-4853] ERROR com.google.gerrit.pgm.http.jetty.HiddenErrorHandler : Error in POST /project_name.git/info/lfs/objects/batch

com.google.gson.JsonSyntaxException: org.eclipse.jetty.io.EofException: Early EOF

at com.google.gson.Gson.fromJson(Gson.java:897)

at com.google.gson.Gson.fromJson(Gson.java:825)

at org.eclipse.jgit.lfs.server.LfsProtocolServlet.doPost(LfsProtocolServlet.java:257)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:648)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)

at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:286)

at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:276)

at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:181)

at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91)

at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:120)

at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135)

at com.google.gerrit.httpd.plugins.LfsPluginServlet.service(LfsPluginServlet.java:84)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)

at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:286)

at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:276)

at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:181)

at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91)

at com.google.gerrit.httpd.raw.StaticModule$PolyGerritFilter.doFilter(StaticModule.java:451)

at com.google.gerrit.httpd.GetUserFilter.doFilter(GetUserFilter.java:75)

at com.google.gerrit.httpd.RequireSslFilter.doFilter(RequireSslFilter.java:72)

at com.google.gerrit.httpd.RunAsFilter.doFilter(RunAsFilter.java:122)

at com.google.gwtexpui.server.CacheControlFilter.doFilter(CacheControlFilter.java:69)

at com.google.gerrit.httpd.ProjectBasicAuthFilter.doFilter(ProjectBasicAuthFilter.java:100)

at com.google.gerrit.httpd.RequestMetricsFilter.doFilter(RequestMetricsFilter.java:57)

at com.google.gerrit.httpd.AllRequestFilter$FilterProxy$1.doFilter(AllRequestFilter.java:133)

at com.google.gerrit.httpd.AllRequestFilter$FilterProxy.doFilter(AllRequestFilter.java:135)

at com.google.gerrit.httpd.RequestContextFilter.doFilter(RequestContextFilter.java:69)

at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:120)

at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1759)

at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:582)

at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:224)

at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1180)

at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:512)

at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)

at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1112)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)

at org.eclipse.jetty.server.Server.handle(Server.java:534)

at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)

at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)

at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:283)

at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:108)

at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:220)

at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:283)

at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:108)

at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)

at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)

at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)

at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)

at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)

at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)

at java.lang.Thread.run(Thread.java:745)

Thanks in advance for your help.

[Matthew Webber]

The obviously question: was this working for you before you upgraded to 2.15.1, or is this the first time that you have tried this?

[Ahmed Amin]

It was working before, on 2.14 specifically. 

[Duft Markus]

We too had permission problems with LFS. It seems that all users who want to read/write to/from LFS need READ permission on ALL refs in the according project. Try granting READ permission on the refs/meta/config ref in the project. It helped for us.

 

There is another thread about this here: https://groups.google.com/forum/#!topic/repo-discuss/UhTS1GX0LLg

 

Cheers,

Markus

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

SSI Schäfer IT Solutions GmbH | Friesachstrasse 15 | 8114 Friesach | Austria
Registered Office: Friesach | Commercial Register: 49324 K | VAT no. ATU28654300
Commercial Court: Landesgericht für Zivilrechtssachen Graz

[Ahmed Amin]

Hello Markus, 

The permission is added but the problem still exists.

On Monday, April 16, 2018 at 5:36:44 PM UTC+2, Markus Duft wrote:

We too had permission problems with LFS. It seems that all users who want to read/write to/from LFS need READ permission on ALL refs in the according project. Try granting READ permission on the refs/meta/config ref in the project. It helped for us.

 

There is another thread about this here: https://groups.google.com/forum/#!topic/repo-discuss/UhTS1GX0LLg

 

Cheers,

Markus

 

From: repo-d...@googlegroups.com [mailto:repo-d...@googlegroups.com] On Behalf Of Ahmed Amin
Sent: Monday, April 16, 2018 5:26 PM
To: Repo and Gerrit Discussion <repo-d...@googlegroups.com>
Subject: Re: Can't pull or fetch LFS files.

 

It was working before, on 2.14 specifically. 

On Monday, April 16, 2018 at 5:22:20 PM UTC+2, Matthew Webber wrote:

The obviously question: was this working for you before you upgraded to 2.15.1, or is this the first time that you have tried this?

--
--
To unsubscribe, email repo-discus...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Ahmed Amin]

Hello, 

The above solution works with adding reading access to refs/* for all users. But it's not preferable as all users will have read access to all refs in the project.

So, Does anyone have an idea about the minimum refs that will allow users to pull LFS files.

Aslo, while viewing this change in the LFS plugin, I found this condition:

 if ((operation.equals(DOWNLOAD)&& !permissionBackend.user(user).project(state.getProject().getNameKey()).testOrFalse(READ))

        || (operation.equals(UPLOAD) && Capable.OK != control.canPushToAtLeastOneRef()))

Maybe this has something to do with the above issue. Any ideas?

B.R