Page MenuHomePhabricator

You may not set new credentials after authenticating conduit
Closed, ResolvedPublic

Description

Someone reported this to me yesterday and I just hit it myself today:

> arc patch --nobranch D22362 --trace
libphutil loaded from '/home/josh/workspace/github.com/joshuaspence/dotfiles/modules/phabricator/libphutil/src'.
arcanist loaded from '/home/josh/workspace/github.com/joshuaspence/dotfiles/modules/phabricator/arcanist/src'.
Config: Reading user configuration file "/home/josh/.arcrc"...
Config: Did not find system configuration at "/etc/arcconfig".
Working Copy: Reading .arcconfig from "/home/josh/workspace/git.mydomain.com/eng/site/.arcconfig".
Working Copy: Path "/home/josh/workspace/git.mydomain.com/eng/site" is part of `git` working copy "/home/josh/workspace/git.mydomain.com/eng/site".
Working Copy: Project root is at "/home/josh/workspace/git.mydomain.com/eng/site".
Config: Did not find local configuration at "/home/josh/workspace/git.mydomain.com/eng/site/.git/arc/config".
Loading phutil library from '/home/josh/workspace/git.mydomain.com/eng/site/support/flarc/src'...
>>> [0] <conduit> differential.querydiffs() <bytes = 76>
>>> [1] <http> https://phabricator.mydomain.com/api/differential.querydiffs
<<< [1] <http> 1,150,089 us
<<< [0] <conduit> 1,153,731 us
>>> [2] <conduit> conduit.connect() <bytes = 555>
>>> [3] <http> https://phabricator.mydomain.com/api/conduit.connect
<<< [3] <http> 363,746 us
<<< [2] <conduit> 364,390 us
>>> [4] <conduit> differential.querydiffs() <bytes = 200>
>>> [5] <http> https://phabricator.mydomain.com/api/differential.querydiffs
<<< [5] <http> 371,120 us
<<< [4] <conduit> 371,851 us
>>> [6] <exec> $ git remote show -n origin
<<< [6] <exec> 6,242 us
>>> [7] <conduit> repository.query() <bytes = 244>
>>> [8] <http> https://phabricator.mydomain.com/api/repository.query
<<< [8] <http> 361,050 us
<<< [7] <conduit> 361,681 us
>>> [9] <exec> $ git diff --no-ext-diff --no-textconv --raw 'HEAD' --
>>> [10] <exec> $ git ls-files --others --exclude-standard
<<< [10] <exec> 119,503 us
<<< [9] <exec> 132,776 us
>>> [11] <exec> $ git diff-files --name-only
<<< [11] <exec> 38,095 us
>>> [12] <exec> $ git show -s --format='%H' '07729d85436c4b852a114683dbf965114531c2a6' --
<<< [12] <exec> 3,047 us
>>> [13] <conduit> differential.query() <bytes = 192>
>>> [14] <http> https://phabricator.mydomain.com/api/differential.query
<<< [14] <http> 400,084 us
<<< [13] <conduit> 400,470 us
>>> [15] <conduit> differential.query() <bytes = 453>
>>> [16] <http> https://phabricator.mydomain.com/api/differential.query
<<< [16] <http> 421,317 us
<<< [15] <conduit> 421,872 us
>>> [17] <exec> $ git show -s --format='%H' '' --
<<< [17] <exec> 4,613 us
>>> [18] <exec> $ git show -s --format='%H' '' --
<<< [18] <exec> 4,428 us
>>> [19] <exec> $ git show -s --format='%H' '' --
<<< [19] <exec> 4,556 us
>>> [20] <exec> $ git show -s --format='%H' '' --
<<< [20] <exec> 4,863 us
>>> [21] <exec> $ git show -s --format='%H' '' --
<<< [21] <exec> 10,936 us
>>> [22] <exec> $ git show -s --format='%H' '' --
<<< [22] <exec> 4,050 us
>>> [23] <exec> $ git show -s --format='%H' '' --
<<< [23] <exec> 3,717 us
>>> [24] <conduit> differential.query() <bytes = 453>
>>> [25] <http> https://phabricator.mydomain.com/api/differential.query
<<< [25] <http> 416,275 us
<<< [24] <conduit> 416,904 us
>>> [26] <exec> $ git show -s --format='%H' '' --
<<< [26] <exec> 4,914 us
>>> [27] <exec> $ git show -s --format='%H' '' --
<<< [27] <exec> 4,215 us
>>> [28] <exec> $ git show -s --format='%H' '' --
<<< [28] <exec> 6,646 us
>>> [29] <exec> $ git show -s --format='%H' '' --
<<< [29] <exec> 4,487 us
>>> [30] <exec> $ git show -s --format='%H' '' --
<<< [30] <exec> 6,309 us
>>> [31] <exec> $ git show -s --format='%H' '' --
<<< [31] <exec> 4,538 us
>>> [32] <exec> $ git show -s --format='%H' '' --
<<< [32] <exec> 4,266 us
>>> [33] <conduit> differential.query() <bytes = 219>
>>> [34] <http> https://phabricator.mydomain.com/api/differential.query
<<< [34] <http> 387,173 us
<<< [33] <conduit> 387,789 us
>>> [35] <exec> $ git show -s --format='%H' '' --
<<< [35] <exec> 4,251 us
>>> [36] <conduit> differential.query() <bytes = 804>
>>> [37] <http> https://phabricator.mydomain.com/api/differential.query
<<< [37] <http> 716,864 us
<<< [36] <conduit> 717,468 us

[2015-08-13 00:50:09] EXCEPTION: (Exception) You may not set new credentials after authenticating conduit. at [<arcanist>/src/workflow/ArcanistWorkflow.php:222]
arcanist(), flarc(), phutil()
  #0 ArcanistWorkflow::setConduitCredentials(array) called at [<arcanist>/src/workflow/ArcanistWorkflow.php:600]
  #1 ArcanistWorkflow::buildChildWorkflow(string, array) called at [<arcanist>/src/workflow/ArcanistPatchWorkflow.php:944]
  #2 ArcanistPatchWorkflow::applyDependencies(ArcanistBundle) called at [<arcanist>/src/workflow/ArcanistPatchWorkflow.php:456]
  #3 ArcanistPatchWorkflow::run() called at [<arcanist>/src/workflow/ArcanistPatchWorkflow.php:397]
  #4 ArcanistPatchWorkflow::run() called at [<arcanist>/scripts/arcanist.php:382]

Revisions and Commits

Event Timeline

joshuaspence raised the priority of this task from to Needs Triage.
joshuaspence updated the task description. (Show Details)
joshuaspence added a project: Arcanist.
joshuaspence updated the task description. (Show Details)
joshuaspence added a subscriber: joshuaspence.

Interesting... this happens consistently for certain diffs (for my own reference, D22362) but works fine for others.

I think arc patch has some old, sketchy code around authentication. The problem is that arc patch is currently unique in that it wants to use authentication if it's available, but does not require it. This never really got built properly and is kind of a hack job.

We should probably:

  • Look for credentials.
    • If they exist, try to use them.
      • If they don't work, fail with an error.
    • If they don't exist, check if the workflow allows public users.
      • If it does, proceed without authenticating.

But I think the current behavior is more like:

  • Look for credentials.
  • Garbage.
  • Crash.

In the future, more workflows will work in this mode (arc list, arc tasks) after T7715.

Why would it reproduce consistently for certain diffs but not for others though?

Policy settings, or policy settings on the repositories they belong to? Or ghosts.

Seems like this happens when you have multiple layers of dependent diffs.