git@vger.kernel.org mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
From: "Peterson, Alex" <alexpete@amazon.com>
To: "git@vger.kernel.org" <git@vger.kernel.org>
Subject: Temporary credentials timeout during long operations
Date: Mon, 13 Jul 2020 19:48:50 +0000	[thread overview]
Message-ID: <18381efb749d43d097665960021a76ef@EX13D10UWA004.ant.amazon.com> (raw)

Greetings,  recently I've run into an issue where long push operations fail when using a credential helper like the AWS CodeCommit helper because it provides time-limited credentials which expire during the operation.  Is there an existing method to enforce refreshing credentials from a credential helper on the client or should I go down the path of creating a credential.timeout feature that automatically refills credentials from helpers during long operations to avoid this issue?

Steps to reproduce:
1. Create a repository with LFS
2. Add a large file that will take a long time to push (long enough for the credentials to expire)
3. Enable a helper that provides temporary credentials 
4. Set a remote that uses HTTPS and git push

All initial HTTPS commands authenticate OK and the LFS file uploads fine but by the time it is done, the credentials have expired so the final git-receive-pack fails and the entire push operation fails.

> POST /v1/repos/example/git-receive-pack HTTP/1.1
< HTTP/1.1 403 
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403 
fatal: the remote end hung up unexpectedly 

For testing purposes I modified post_rpc() so that it always requests new credentials before every HTTPS request, and was able to push any number of large files.

SSH works fine (with keepalives enabled) and so does HTTPS with a permanent username/password, it's just the credential helpers that provide time-limited credentials.

Thoughts?

             reply	other threads:[~2020-07-13 19:48 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-13 19:48 Peterson, Alex [this message]
     [not found] ` <20200713231153.GI8360@camp.crustytoothpaste.net>
     [not found]   ` <1f95e9da5e734dd3a8f94c1337f8c756@EX13D10UWA004.ant.amazon.com>
2020-08-26  1:44     ` Temporary credentials timeout during long operations brian m. carlson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: http://vger.kernel.org/majordomo-info.html

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=18381efb749d43d097665960021a76ef@EX13D10UWA004.ant.amazon.com \
    --to=alexpete@amazon.com \
    --cc=git@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://80x24.org/mirrors/git.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).