Skip to content
GitLab Next
Open
Created by Caleb Williamson@calebwDeveloper0 of 1 task completed0/1 task

Group-level Deploy Tokens cannot clone LFS objects

Summary

When cloning a repository with a Group-level deploy token, the clone will fail on LFS objects. This does NOT occur when using a project-level Deploy Token.

This bug happens on GitLab.com as well as a Self-Managed instance running version 13.2.3-ee.

Initially reported by a customer within this ticket (internal use).

!72091 (merged) was submitted to document this bug until it gets fixed. Thus:

Steps to reproduce

  1. Create a repository within a group

  2. Upload an LFS object to the repository

  3. Attempt to clone the repo using a group-level deploy token

Example Project

This project contains an ~800MB LFS object and can be forked for testing. Might be more beneficial to make a new repo with a smaller LFS object for the sake of time.

What is the current bug behavior?

Cloning fails with a 404 on LFS objects specifically.

What is the expected correct behavior?

Clone succeeds for the entire repo, including LFS objects.

Relevant logs and/or screenshots

20:08:16.820857 git.c:703               trace: exec: git-lfs pull
20:08:16.820904 run-command.c:663       trace: run_command: git-lfs pull
20:08:16.830261 trace git-lfs: exec: git 'version'
20:08:16.833002 trace git-lfs: exec: git 'config' '-l'
20:08:16.838487 trace git-lfs: exec: git '-c' 'filter.lfs.smudge=' '-c' 'filter.lfs.clean=' '-c' 'filter.lfs.process=' '-c' 'filter.lfs.required=false' 'rev-parse' 'HEAD' '--symbolic-full-name' 'HEAD'
20:08:16.852376 trace git-lfs: exec: git '-c' 'filter.lfs.smudge=' '-c' 'filter.lfs.clean=' '-c' 'filter.lfs.process=' '-c' 'filter.lfs.required=false' 'rev-parse' 'HEAD' '--symbolic-full-name' 'HEAD'
20:08:16.855921 trace git-lfs: tq: running as batched queue, batch size of 100
20:08:16.861083 trace git-lfs: filepathfilter: accepting ".gitattributes"
20:08:16.861365 trace git-lfs: filepathfilter: accepting "README.md"
20:08:16.861764 trace git-lfs: filepathfilter: accepting "ubuntu-18.04.4-live-server-amd64.iso"
20:08:16.862932 trace git-lfs: fetch ubuntu-18.04.4-live-server-amd64.iso [73b8d860e421000a6e35fdefbb0ec859b9385b0974cf8089f5d70a87de72f6b9]
20:08:16.863468 trace git-lfs: tq: sending batch of size 1
20:08:16.866988 trace git-lfs: api: batch 1 files
20:08:16.867908 trace git-lfs: HTTP: POST https://gitlab+deploy-token-2:<token_here>@gitlab.technotion.co/test_group/sm-lfs.git/info/lfs/objects/batch
20:08:17.198587 trace git-lfs: HTTP: 404
20:08:17.198654 trace git-lfs: api error: Repository or object not found: https://gitlab+deploy-token-2:<token_here>@gitlab.technotion.co/test_group/sm-lfs.git/info/lfs/objects/batch
Check that it exists and that you have proper access to it
batch response: Repository or object not found: https://gitlab+deploy-token-2:<token_here>@gitlab.technotion.co/test_group/sm-lfs.git/info/lfs/objects/batch
Check that it exists and that you have proper access to it
error: failed to fetch some objects from 'https://gitlab+deploy-token-2:<token_here>@gitlab.technotion.co/test_group/sm-lfs.git/info/lfs'

Workaround idea

Using a Project Deploy Token. If this is needed for many projects, this API endpoint may be helpful to semi-automatically create the tokens.

Edited by Katrin Leinweber