[Bug] LFS: Authentication required: Authorization error lfs/locks/verify

[v-byte-cpu]

• Gitea version (or commit ref): 1.12.1
• Operating system: Linux-based
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

git lfs push fails with 401 error. GIT_TRACE=1 GIT_CURL_VERBOSE=1 git lfs push devspace develop logs:

21:51:01.345336 git.c:704               trace: exec: git-lfs push devspace develop
21:51:01.345473 run-command.c:663       trace: run_command: git-lfs push devspace develop
21:51:01.362451 trace git-lfs: exec: git 'version'
21:51:01.368368 trace git-lfs: exec: git '-c' 'filter.lfs.smudge=' '-c' 'filter.lfs.clean=' '-c' 'filter.lfs.process=' '-c' 'filter.lfs.required=false' 'rev-parse' 'HEAD' '--symbolic-full-name' 'HEAD'
21:51:01.373349 trace git-lfs: exec: git 'config' '-l'
21:51:01.376857 trace git-lfs: Upload refs [develop] to remote devspace
21:51:04.428075 trace git-lfs: run_command: ssh -- [email protected] git-lfs-authenticate user/test.git upload
21:51:07.284189 trace git-lfs: HTTP: POST http://git.service.devspace/user/test.git/info/lfs/locks/verify
> POST /user/test.git/info/lfs/locks/verify HTTP/1.1
> Host: git.service.devspace
> Accept: application/vnd.git-lfs+json; charset=utf-8
> Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJSZXBvSUQiOjUsIk9wIjoidXBsb2FkIiwiVXNlcklEIjoxLCJleHAiOjE1OTkzMzMwNjYsIm5iZiI6MTU5OTMzMTg2Nn0.peeWGRaBIF45a1xKHYIs8fxGnz1Smjt1j3_DZDsy0mg
> Content-Length: 37
> Content-Type: application/vnd.git-lfs+json; charset=utf-8
> User-Agent: git-lfs/2.11.0 (GitHub; linux amd64; go 1.14.4)
> 
{"ref":{"name":"refs/heads/develop"}}21:51:07.488902 trace git-lfs: HTTP: 401


< HTTP/1.1 401 Unauthorized
< Content-Length: 26
< Content-Type: text/plain; charset=utf-8
< Date: Sat, 05 Sep 2020 18:51:06 GMT
< Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
< Set-Cookie: i_like_gitea=cc7ff22ea4d0d7b4; Path=/; HttpOnly
< Set-Cookie: _csrf=Ec9qdXFh0CAPGJo1IQwmS4C6cQI6MTU5OTMzMTg2NjYxODE2NDg3Mw; Path=/; Expires=Sun, 06 Sep 2020 18:51:06 GMT; HttpOnly
< Www-Authenticate: Basic realm=gitea-lfs
< X-Frame-Options: SAMEORIGIN
< 
WARNING: Authentication error: Authentication required: Authorization error: http://git.service.devspace/user/test.git/info/lfs/locks/verify
Check that you have proper access to the repository
21:51:07.489590 trace git-lfs: tq: running as batched queue, batch size of 100
21:51:07.489976 trace git-lfs: run_command: git rev-list --objects --ignore-missing --stdin --
21:51:07.497737 trace git-lfs: filepathfilter: rewrite ".git" as "**/.git/**"
21:51:07.497812 trace git-lfs: filepathfilter: rewrite "**/.git" as "**/.git"
21:51:07.497948 trace git-lfs: filepathfilter: accepting "tmp"

[v-byte-cpu]

Possibly linked to #3084

[zeripath]

Would it be possible to get some logs?

[v-byte-cpu]

@zeripath Update: if I set git config lfs.https://git.service.devspace/user/repo.git/info/lfs.locksverify false then git lfs push will succeed, otherwise locksverify fails

Logs from gitea when locksverify is true:

[Macaron] 2020-10-28 11:37:32: Started GET /api/internal/serv/command/3/user/repo?mode=1&verb=git-upload-pack for 127.0.0.1
[Macaron] 2020-10-28 11:37:32: Completed GET /api/internal/serv/command/3/user/repo?mode=1&verb=git-upload-pack 200 OK in 15.876286ms
[Macaron] 2020-10-28 11:37:32: Started POST /api/internal/ssh/3/update/5 for 127.0.0.1
[Macaron] 2020-10-28 11:37:32: Completed POST /api/internal/ssh/3/update/5 200 OK in 12.511578ms
[Macaron] 2020-10-28 11:37:33: Started GET /api/internal/serv/command/3/user/repo?mode=2&verb=git-lfs-authenticate&verb=upload for 12
7.0.0.1
[Macaron] 2020-10-28 11:37:33: Completed GET /api/internal/serv/command/3/user/repo?mode=2&verb=git-lfs-authenticate&verb=upload 200 OK in 23.25224ms
[Macaron] 2020-10-28 11:37:33: Started POST /user/repo.git/info/lfs/locks/verify for 10.1.23.2
[Macaron] 2020-10-28 11:37:33: Completed POST /user/repo.git/info/lfs/locks/verify 401 Unauthorized in 370.689µs

Also I found that with option in app.ini:

[repository]
DISABLE_HTTP_GIT = true

LFS always fails with authorization errors.

[zeripath]

OK This is the third bug report in a row I've had to write this and I'm getting very tired of doing so. In fact I got so tired of repeatedly writing it that I changed the issue template to include the following:

---

It really is important to provide pertinent logs

Please read https://docs.gitea.io/en-us/logging-configuration/#debugging-problems

In addition, if your problem relates to git commands set RUN_MODE=dev at the top of app.ini

[zeripath]

Can we please have some (debug) logs

[v-byte-cpu]

ok, I will provide more detailed logs little bit later. Right now you can try to reproduce it with the following steps:

1. Add remote repo using ssh scheme
2. Try to lfs push files

My Relevant app.ini config:

RUN_MODE = prod
RUN_USER = git

[database]
DB_TYPE  = postgres
HOST     = postgresql:5432
NAME     = your_dbname_here
USER     = your_user_here
PASSWD   = your_pass_here

[security]
PASSWORD_HASH_ALGO = argon2
INSTALL_LOCK       = true

[server]
OFFLINE_MODE     = true
DISABLE_GRAVATAR = true
LFS_START_SERVER = true
LFS_CONTENT_PATH = /data/gitea/lfs
HTTP_PORT        = 3000
SSH_PORT         = 22

[service]
DISABLE_REGISTRATION              = true
REQUIRE_SIGNIN_VIEW               = true
REGISTER_EMAIL_CONFIRM            = false
DEFAULT_KEEP_EMAIL_PRIVATE        = true

[picture]
DISABLE_GRAVATAR        = true
ENABLE_FEDERATED_AVATAR = false

[log]
MODE  = console
LEVEL = info
COLORIZE = false

[session]
PROVIDER = memory

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.