git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Temporary credentials timeout during long operations

From
PAPeterson, Alex <alexpete@amazon.com>
Date
Jul 13, 2020, 19:48 UTC
Message-ID
<18381efb749d43d097665960021a76ef@EX13D10UWA004.ant.amazon.com>
Greetings,  recently I've run into an issue where long push operations fail when using a credential helper like the AWS CodeCommit helper because it provides time-limited credentials which expire during the operation.  Is there an existing method to enforce refreshing credentials from a credential helper on the client or should I go down the path of creating a credential.timeout feature that automatically refills credentials from helpers during long operations to avoid this issue?
Steps to reproduce:
1. Create a repository with LFS
2. Add a large file that will take a long time to push (long enough for the credentials to expire)
3. Enable a helper that provides temporary credentials 
4. Set a remote that uses HTTPS and git push
All initial HTTPS commands authenticate OK and the LFS file uploads fine but by the time it is done, the credentials have expired so the final git-receive-pack fails and the entire push operation fails.
> POST /v1/repos/example/git-receive-pack HTTP/1.1

< HTTP/1.1 403 error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403 fatal: the remote end hung up unexpectedly

For testing purposes I modified post_rpc() so that it always requests new credentials before every HTTPS request, and was able to push any number of large files.
SSH works fine (with keepalives enabled) and so does HTTPS with a permanent username/password, it's just the credential helpers that provide time-limited credentials.
Thoughts?
Next: brian m. carlson
Message 1 of 2 in “Temporary credentials timeout during long operations”
  1. Peterson, AlexJul 13, 2020
  2. brian m. carlsonAug 26, 2020

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.