Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-47018

Git LFS pull uses invalid credentials for Bitbucket branch source

XMLWordPrintable

      When building a branch from Bitbucket branch source with git and additional behavior "git LFS pull after checkout", the initial checkout succeed, but the following LFS pull fails to authenticate to the Bitbucket server, causing the used Bitbucket account to become locked.

      This is the console log when building the project:

      Checking out git http://bitbucket.***.se/scm/***/***.git into /var/lib/jenkins/jobs/Bitbucket/jobs/***/branches/feature-***/workspace@script to read Jenkinsfile
 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url http://bitbucket.***.se/scm/***/***.git # timeout=10
Fetching upstream changes from http://bitbucket.***.se/scm/***/***.git
 > git --version # timeout=10
using GIT_ASKPASS to set credentials Jenkins @ Bitbucket
 > git fetch --tags --progress http://bitbucket.***.se/scm/***/***.git +refs/heads/feature/***:refs/remotes/origin/feature/***
Checking out Revision 20387a2c96a928932c25f80c66b324f04eedfaf8 (feature/***)
Commit message: "***"
Enabling Git LFS pull
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 20387a2c96a928932c25f80c66b324f04eedfaf8
 > git config --get remote.origin.url # timeout=10
using GIT_ASKPASS to set credentials Jenkins @ Bitbucket
 > git lfs pull origin

      At this point the log is stuck. `git-lfs` uses a lot of CPU on the build node, and looking at the Bitbucket audit log shows tons and tons (tens or hundreds each second) of failed authentications (after 5 failed logins, Bitbucket requires a CAPTCHA to continue). This continues for 10 minutes until the git operation times out. Since the checkout succeeds, the credentials are obviously correct - aborting the build and restarting without clearing the CAPTCHA gives this error:

      com.cloudbees.jenkins.plugins.bitbucket.api.BitbucketRequestException: HTTP request error. Status: 401: .
{"errors":[{"context":null,"message":"CAPTCHA required. Your Bitbucket account has been locked. To unlock it and log in again you must solve a CAPTCHA. This is typically caused by too many attempts to login with an incorrect password. The account lock prevents your SCM client from accessing Bitbucket and its mirrors until it is solved, even if you enter your password correctly.\n\nIf you are currently logged in to Bitbucket via a browser you may need to logout and then log back in in order to solve the CAPTCHA.\n\nVisit Bitbucket at http://bitbucket.***.se for more details.","exceptionName":"com.atlassian.bitbucket.auth.CaptchaRequiredAuthenticationException"}]}
	at com.cloudbees.jenkins.plugins.bitbucket.server.client.BitbucketServerAPIClient.getRequest(BitbucketServerAPIClient.java:516)
	at com.cloudbees.jenkins.plugins.bitbucket.server.client.BitbucketServerAPIClient.getBranches(BitbucketServerAPIClient.java:363)
Caused: java.io.IOException: I/O error when accessing URL: /rest/api/1.0/projects/***/repos/***/branches?start=0
	at com.cloudbees.jenkins.plugins.bitbucket.server.client.BitbucketServerAPIClient.getBranches(BitbucketServerAPIClient.java:378)
	at com.cloudbees.jenkins.plugins.bitbucket.BitbucketSCMSource.retrieve(BitbucketSCMSource.java:767)
	at jenkins.scm.api.SCMSource.fetch(SCMSource.java:564)
	at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:95)
	at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:263)
	at hudson.model.ResourceController.execute(ResourceController.java:97)
	at hudson.model.Executor.run(Executor.java:419)
Finished: FAILURE

            markewaite Mark Waite
            estyrke Emil Styrke
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: