I happened to run into the "Please make sure you have the correct access rights and the repository exists" error when trying to clone a remote server's etckeeper directory:
git clone normaluser@example.com:/etc
Not only is normaluser
not git directory /etc/
's owner (it's user root
's), but the /etc/.git/
directory can only be accessed by user root
.
On the other hand, user normaluser
is in the sudo
group, so having the git pull-cooperating git processes on the remote side run under superuser privileges solves the problem.
git clone --upload-pack 'sudo git-upload-pack' normaluser@example:/etc
The trick here is to provide git clone with the option --upload-pack 'sudo git-upload-pack'
.
By default, when git clone has successfully established the ssh connection to the remote server, it spawns git-upload-pack
, a git-protocol tool cooperating with client-local git-protocol tools. By telling git-clone to spawn sudo git-upload-pack
instead, it receives all privileges to read from /etc/
.
Now this works in my case as my remote server's sudo environment is set up to remember normaluser
's sudo tty ticket:
# this is file /etc/sudoers or some other file inside directory /etc/sudoers.d/
Defaults:normaluser !tty_tickets
# ...
For the crafted git clone ...
to succeed, a sudo tty ticket must first be obtained, e.g. by executing sudo whoami
as user normaluser
and providing the password manually.
In case this sudo tty ticket solution is not a choice, askpass can be leveraged:
git clone --upload-pack 'SUDO_ASKPASS=/path/to/some-askpass sudo -A git-upload-pack' normaluser@example.com:/etc
Notice SUDO_ASKPASS=/path/to/some-askpass
and sudo -A ...
: these information will tell the remote sudo invocation to query the provided askpass executable to provide the password. This could be the X11 graphical ssh-askpass, which in turn would require a client-side X server and enabled X11 Forwarding on both client side or server side.
Alternatively a custom script-based askpass executable can be provided; the only requirement for such executable is to return the password on stdout.