Git: Unsetting git credential helper causes git lfs clone to fail

[jasjuang]

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options

16:03:24.278822 git.c:369               trace: built-in: git 'version' '--build-options'
git version 2.13.0.windows.1
built from commit: eba7af3dbb4c846c6303c5f64102acee696c9ab0
sizeof-long: 4
machine: x86_64

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

$ cmd.exe /c ver

Microsoft Windows [Version 10.0.14393]

• What options did you set as part of the installation? Or did you choose the
  defaults?

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt

Path Option: CmdTools
SSH Option: OpenSSH
CURL Option: OpenSSL
CRLF Option: LFOnly
Bash Terminal Option: MinTTY
Performance Tweaks FSCache: Enabled
Use Credential Manager: Disabled
Enable Symlinks: Disabled

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

CMD

I am on a shared windows machine with other people so the credentials won't be cached, so the below is executed,

git config --global --unset credential.helper git config --system --unset credential.helper

However, this causes a problem when I am cloning a repository that contains LFS files, if I run the command git clone https://github.com/jasjuang/portal, I got the below error

``````
C:UsersAdministrator>git clone https://github.com/jasjuang/portal
Cloning into 'portal'...
Username for 'https://github.com': jasjuang
Password for 'https://[email protected]':
remote: Counting objects: 656, done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 656 (delta 0), reused 0 (delta 0), pack-reused 652
Receiving objects: 100% (656/656), 616.73 MiB | 61.51 MiB/s, done.
Resolving deltas: 100% (38/38), done.
Downloading Content/Images/Play_Button.png (11.53 KB)
Error downloading object: Content/Images/Play_Button.png (01c24b145d909a49d0597efa5eeacf331dff8e8f9400c577fb5e6734759c10a0)

Errors logged to C:UsersAdministratorportal.gitlfsobjectslogs20170329T212329.1812799.log
Use git lfs logs last to view the log.
error: external filter 'git-lfs filter-process' failed
fatal: Content/Images/Play_Button.png: smudge filter lfs failed
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry the checkout with 'git checkout -f HEAD'
``````

Seems like a result of the credential helper returning no output and an exit code of 128. Also just to
confirm I have the right settings, below is the global git config

C:\Users\Administrator>git config --global --list [email protected] user.name=Jason Juang filter.lfs.process=git-lfs filter-process filter.lfs.required=true filter.lfs.clean=git-lfs clean -- %f filter.lfs.smudge=git-lfs smudge -- %f lfs.cachecredentials=1

In linux, it will prompt me to input username and password again when cloning lfs files, and after I input it everything will work fine. Why didn't Windows prompt me to enter the username and password again instead of just failing directly?

I filed an issue at GCM here https://github.com/Microsoft/Git-Credential-Manager-for-Windows/issues/404 but the maintainer suggested that this is a git for windows problem.

[whoisj]

Given the tty error when the prompt script runs, it seems like a git-bash error. Potentially, could be the manner in which git-lfs invokes git-credential as well. Regardless, it is specifically not a GCM issue because the issue only repros with GCM disabled (user cannot use the GCM for policy reasons).

[dscho]

Use git lfs logs last to view the log.

Please.

[jasjuang]

@whoisj @dscho Here is the result of git lfs logs last, I do see something bizarre about the user. @ttaylorr do you know why your username is showing up in the log?

``````
C:UsersAdministratorDesktopportal>git lfs logs last
git-lfs/2.1.1 (GitHub; windows amd64; go 1.8.1; git 3314e287)
git version 2.13.0.windows.1

$ git-lfs.exe filter-process
Error downloading object: Content/Images/Play_Button.png (01c24b1): Smudge error: Error downloading Content/Images/Play_Button.png (01c24b145d909a49d0597efa5eeacf331dff8e8f9400c577fb5e6734759c10a0): batch response: Git credentials for https://github.com/jasjuang/portal.git/info/lfs not found.

Git credentials for https://github.com/jasjuang/portal.git/info/lfs not found.
github.com/git-lfs/git-lfs/errors.New
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/errors/errors.go:62
github.com/git-lfs/git-lfs/lfsapi.getGitCreds
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/lfsapi/auth.go:156
github.com/git-lfs/git-lfs/lfsapi.fillGitCreds
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/lfsapi/auth.go:163
github.com/git-lfs/git-lfs/lfsapi.getCreds
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/lfsapi/auth.go:116
github.com/git-lfs/git-lfs/lfsapi.(Client).DoWithAuth
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/lfsapi/auth.go:39
github.com/git-lfs/git-lfs/lfsapi.(Client).DoWithAuth
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/lfsapi/auth.go:58
github.com/git-lfs/git-lfs/tq.(tqClient).Batch
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/tq/api.go:60
github.com/git-lfs/git-lfs/tq.Batch
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/tq/api.go:36
github.com/git-lfs/git-lfs/tq.(TransferQueue).enqueueAndCollectRetriesFor
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/tq/transfer_queue.go:286
github.com/git-lfs/git-lfs/tq.(*TransferQueue).collectBatches
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/tq/transfer_queue.go:258
runtime.goexit
C:/Go/src/runtime/asm_amd64.s:2197
github.com/git-lfs/git-lfs/errors.newWrappedError
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/errors/types.go:166: batch response
github.com/git-lfs/git-lfs/errors.newWrappedError
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/errors/types.go:166: Error downloading Content/Images/Play_Button.png (01c24b145d909a49d0597efa5eeacf331dff8e8f9400c577fb5e6734759c10a0)
github.com/git-lfs/git-lfs/errors.newWrappedError
C:/Users/ttaylorr/go/src/github.com/git-lfs/git-lfs/src/github.com/git-lfs/git-lfs/errors/types.go:166: Smudge error

ENV:
LocalWorkingDir=C:UsersAdministratorDesktopportal
LocalGitDir=C:UsersAdministratorDesktopportal.git
LocalGitStorageDir=C:UsersAdministratorDesktopportal.git
LocalMediaDir=C:UsersAdministratorDesktopportal.gitlfsobjects
LocalReferenceDir=
TempDir=C:UsersAdministratorDesktopportal.gitlfstmp
ConcurrentTransfers=3
TusTransfers=false
BasicTransfersOnly=false
SkipDownloadErrors=false
FetchRecentAlways=false
FetchRecentRefsDays=7
FetchRecentCommitsDays=0
FetchRecentRefsIncludeRemotes=true
PruneOffsetDays=3
PruneVerifyRemoteAlways=false
PruneRemoteName=origin
AccessDownload=none
AccessUpload=none
DownloadTransfers=basic
UploadTransfers=basic
GIT_DIR=.git
GIT_LFS_PATH=C:Program FilesGit LFS

C:UsersAdministratorDesktopportal>
``````

[ttaylorr]

@ttaylorr do you know why your name is showing up in the log?

I compiled the binary, but we should strip these paths out of the build in the future.

[jasjuang]

Could this be the reason that this is failing because no such path in my machine exist?

[dscho]

@ttaylorr am I right to assume that you require a credential helper and fall back to accessing the Win32 Console directly if there is no helper?

If that is correct, calling the Git command with winpty (as described in our Release Notes) should help. @jasjuang you could try this in your setup.

[ttaylorr]

@ttaylorr am I right to assume that you require a credential helper and fall back to accessing the Win32 Console directly if there is no helper?

You are correct 👍 .

[jasjuang]

@dscho winpty git clone https://github.com/jasjuang/portal still shows the same error for me. Nothing seems to change for the outcome.

[larsxschneider]

@ttaylorr am I right to assume that you require a credential helper and fall back to accessing the
Win32 Console directly if there is no helper?

@ttaylorr Unfortunately I don't think this is correct. I just reproduced the issue on Win8 with Git 2.11.0.windows.3 and Git LFS 2.1.1 on cmd.exe and git-bash.exe

[dscho]

@larsxschneider maybe you can offer me an MCVE, then?

[larsxschneider]

This is it:

git -c credential.helper= clone https://path/to/repo.git

However, the repo needs to be private to trigger the problem.

@ttaylorr Can you create a private repo and grant @dscho and myself access? Then I can create a little test repo and provide a full MCVE.

[dscho]

@larsxschneider if we need a private repository, we can always use an invalid one on GitHub (which will not leak the information whether a repository is private or whether it does not exist).

However, I have no luck with that reproducer:

$ git -c credential.helper= clone https://github.com/git-for-windows/secret.git
Cloning into 'secret'...
Username for 'https://github.com':

(I interrupted it using Ctrl+C.)

But then, I used Git Bash, and I just saw that the report uses CMD. So let me try once more in Git CMD:

C:\Users\me>git -c credential.helper= clone https://github.com/git-for-windows/secret.git
Cloning into 'secret'...
Username for 'https://github.com': ^C

Nope, same thing.

But maybe you need a minimal repository using Git LFS for the reproducer? If so, you could try to set one up and then change the Git-LFS URL to an invalid repository on GitHub, maybe that works as a reproducer.

[larsxschneider]

Ahhh. I see now that I've expressed myself poorly 😄

Git (= GfW) always asks properly for the credentials (with and without credentials helper). After this step the credentials are usually stored in a credential helper and the Git LFS smudge filter can just use them. If there is no credential helper then Git LFS has to ask for the credentials by itself. That does work on Linux and macOS but not on Windows.

To be very clear: I don't think this is a bug in GfW. I think it is a bug in Git LFS.

[dscho]

I don't think this is a bug in GfW. I think it is a bug in Git LFS.

It could be a bug in the way Git for Windows calls git-lfs.exe: if there is no console to use, there won't be a way to communicate with the user. But then, maybe it does work with winpty as I suggested earlier (even if the OP indicated that it fails), that's why I want an MCVE.

Is it really that difficult to condense the problem into a tiny repository that demonstrates the problem? (I am asking @jasjuang more than anyone else.)

[jasjuang]

@dscho Here is the step by step guide to reproduce this problem

1. Create a private repo called lfsfail and follow the below command

git clone https://github.com/dscho/lfsfail cd lfsfail git lfs install (copy a random image file into the folder) git lfs track "*.jpg" (after this, there will be a .gitattributes file automatically generated) git add . git commit -m "add jpg file" git push origin master

1. unset credentials and clone to see the failure

``````
cd ..
rm -rf lfsfail
git config --global --unset credential.helper
git clone https://github.com/dscho/lfsfail

You will see the fail here

``````

I am on Windows 10, git 2.13.0, git lfs 2.1.1, all command typed in windows default command prompt.

Let me know if you need any additional information to reproduce the problem.

[ttaylorr]

@jasjuang thanks for posting this. I am able to reproduce the issue with the reproduction steps that you have given. I'm interested in fixing this, but am currently working on releasing Git LFS 2.2.0.

I will be able to devote more time to looking into this in two weeks.

[dscho]

Create a private repo called lfsfail and follow the below command

Why you make it so difficult? Why not simply publish yours?

[larsxschneider]

@dscho Because he would need to grant you private access to the repo and that costs money on GitHub 😉

[jasjuang]

@ttaylorr If you need me to test anything feel free to ping me. I would love to see this fixed.

[ttaylorr]

I don't think this is a bug in GfW. I think it is a bug in Git LFS.

It could be a bug in the way Git for Windows calls git-lfs.exe: if there is no console to use, there won't be a way to communicate with the user. But then, maybe it _does_ work with winpty as I suggested earlier (even if the OP indicated that it fails), that's why I want an MCVE.

@dscho I think that this is likely. In my testing, I was unable to get LFS to see a pty/tty when invoked by Git for Windows. I have set up a test repository that I have reproduced the bug with: https://github.com/ttaylorr/lfs-gfw-bug

which you have been added as a contributor to (you'll have to accept the invitation by going to the repository's page first here).

Please let me know if you are/aren't able to reproduce with:

git -c credential.helper= clone https://github.com/ttaylorr/lfs-gfw-bug.git

and if you think attaching a PTY/TTY to the LFS process would be helpful in solving the issue. Thanks!

[dscho]

Just a note in case anybody was waiting for me to work on this ticket: I won't have time to work on it. Of course, I will gladly assist any volunteer who wants to resolve this.