"User permission denied for writing" for unclear reasons #1974

civodul commented 2025年06月04日 23:31:52 +02:00

Comment

Hello,

Several "collaborators" with write access to https://codeberg.org/guix/guix fail to push:

remote: Forgejo: User permission denied for writing.
To ssh://codeberg.org/guix/guix.git
 ! [remote rejected] master -> master (pre-receive hook declined)

This includes @glv, @pelzflorian, @jgart, and @vagrantc (see guix/guix#411 and guix/guix#383). Interestingly, other collaborators (non-owners) do not have that problem, including @ieure and @hako.

I checked permissions and branch protection but I can't find the reason for this.

Any idea what we're missing?

### Comment Hello, Several "collaborators" with write access to https://codeberg.org/guix/guix fail to push: ``` remote: Forgejo: User permission denied for writing. To ssh://codeberg.org/guix/guix.git ! [remote rejected] master -> master (pre-receive hook declined) ``` This includes @glv, @pelzflorian, @jgart, and @vagrantc (see https://codeberg.org/guix/guix/issues/411 and guix/guix#383). Interestingly, other collaborators (non-owners) do not have that problem, including @ieure and @hako. I checked permissions and branch protection but I can't find the reason for this. Any idea what we're missing?

jgart commented 2025年06月05日 20:20:49 +02:00

If this helps in debugging the issue, I tried the following and got a relevant warning but not sure how to proceed from here yet or if this failure is actually relevant to the above or not:

$ ssh git@codeberg.org
PTY allocation request failed on channel 0
Hi there, jgart! You've successfully authenticated with the key named framework, but Forgejo does not provide shell access.
If this is unexpected, please log in with password and setup Forgejo under another user.
Connection to codeberg.org closed.

If this helps in debugging the issue, I tried the following and got a relevant warning but not sure how to proceed from here yet or if this failure is actually relevant to the above or not: ``` $ ssh git@codeberg.org PTY allocation request failed on channel 0 Hi there, jgart! You've successfully authenticated with the key named framework, but Forgejo does not provide shell access. If this is unexpected, please log in with password and setup Forgejo under another user. Connection to codeberg.org closed. ```

Gusted commented 2025年06月06日 16:13:09 +02:00

@civodul wrote in #1974 (comment):

Interestingly, other collaborators (non-owners)

Although it shouldn't matter as being a collaborator should take precedence. Are any of the teams assigned to the guix repository?

@civodul wrote in https://codeberg.org/Codeberg/Community/issues/1974#issue-1737600: > Interestingly, other collaborators (non-owners) Although it shouldn't matter as being a collaborator should take precedence. Are any of the teams assigned to the guix repository?

civodul commented 2025年06月06日 16:16:22 +02:00

@Gusted Teams exist at the org level. What do you mean by "assigned to the guix repository"?

@Gusted Teams exist at the org level. What do you mean by "assigned to the guix repository"?

Gusted commented 2025年06月06日 16:22:44 +02:00

Each team has permissions and you can add repositories to those teams and those permissions will have effect on those repositories. However I presume because teams are used for reviews, the permission system of these teams is not really used?

Each team has permissions and you can add repositories to those teams and those permissions will have effect on those repositories. However I presume because teams are used for reviews, the permission system of these teams is not really used?

civodul commented 2025年06月06日 17:01:11 +02:00

@Gusted Right. The teams all provide read-only access to the repo, but the people mentioned above are also collaborators with write access to the repo.

@Gusted Right. The teams all provide read-only access to the repo, but the people mentioned above are also collaborators with write access to the repo.

Gusted commented 2025年06月06日 19:58:30 +02:00

Were these collaborators added when the repository was private or not yet under the guix organisation? I have reason to believe that if you remove and then re-add these users as collaborators, they will no longer have this permissions problem.

Currently they are lacking entries in the access table and adding collaborators should create such entry. This is quite strange to me, because I've removed and then re-added @glv as collaborator to the guix repository and such entry was created. This likely means when they were first added there must have been some condition from preventing such entry of being created.

I've re-added people as collaborators of whom you mentioned of having this issue, please report if they still face this permission issue.

Were these collaborators added when the repository was private or not yet under the guix organisation? I have reason to believe that if you remove and then re-add these users as collaborators, they will no longer have this permissions problem. Currently they are lacking entries in the `access` table and adding collaborators should create such entry. This is quite strange to me, because I've removed and then re-added @glv as collaborator to the guix repository and such entry was created. This likely means when they were first added there must have been some condition from preventing such entry of being created. I've re-added people as collaborators of whom you mentioned of having this issue, please report if they still face this permission issue.

vagrantc commented 2025年06月06日 20:16:36 +02:00

Wahoo, I can push again! (also, presumably related, I can also propose Pull Requests through the web interface, which had also been broken)

Thanks!

Wahoo, I can push again! (also, presumably related, I can also propose Pull Requests through the web interface, which had also been broken) Thanks!

jgart commented 2025年06月06日 20:21:42 +02:00

@civodul @Gusted

Thanks!

I was able to push some commits now. Much appreciated.

@civodul @Gusted Thanks! I was able to push some commits now. Much appreciated.

civodul commented 2025年06月07日 22:49:54 +02:00

@Gusted Since they are "collaborators", and not "owners", I believe they were added after the guix repo had been created (the guix repository is actually renamed from the former guix-mirror repo, if that matters). But all collaborators were added around the same time, so I'm not sure what's different about these fine people. :-)

Anyhow, thanks a lot for tracking it down and for fixing it!

@Gusted Since they are "collaborators", and not "owners", I believe they were added after the `guix` repo had been created (the `guix` repository is actually renamed from the former `guix-mirror` repo, if that matters). But all collaborators were added around the same time, so I'm not sure what's different about these fine people. :-) Anyhow, thanks a lot for tracking it down and for fixing it!

civodul commented 2025年06月07日 22:50:59 +02:00

I'm closing the issue. @glv, @pelzflorian: please let us know if it doesn't work for you!

I'm closing the issue. @glv, @pelzflorian: please let us know if it doesn't work for you!