Packages Write permission only works when ALL other permissions are set to Write #9074

New Issue

GiteaMirror · 2025-11-02T08:28:28-06:00

GiteaMirror commented

2025-11-02 08:28:28 -06:00

Originally created by @Fogapod on GitHub (Jun 16, 2022).

Description

I have CI account I added to my organization that is used for pushing containers. I created a separate team for it named CI. Account isn't in any other team. Team permissions:

I want this group to only have write access to packages and maybe releases but if i uncheck ANY permission to Read and save, pushing image stops working:

$ podman login git.my.domain
# ...
$ podman push git.my.domain/org/repo:latest
Getting image source signatures
Copying blob da62b97c2205 skipped: already exists  
Copying blob caa0fe6c85de skipped: already exists  
Copying blob 5a2d1674fe82 skipped: already exists  
Copying blob 2a34cef01f5f skipped: already exists  
Copying blob 5b8b24c2f164 skipped: already exists  
Copying blob fce7eced52b0 skipped: already exists  
Copying blob 81267142ac55 skipped: already exists  
Copying blob 95b66a4f2600 skipped: already exists  
Copying blob 637044167be1 skipped: already exists  
Copying config aedda0f877 done  
Writing manifest to image destination
Error: writing manifest: uploading manifest latest to git.my.domain/org/repo: unauthorized: authentication required

When I change all permissions to Write, push works again.

I tried pushing container as admin and linking it to repository but it didn't change anything.

Looks like try.gitea.io doesn't allow creating organizations so i can't test it there.

Gitea Version

1.17.0+dev-719-gf0ce5470e

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Locally compiled binary

Database

PostgreSQL

Originally created by @Fogapod on GitHub (Jun 16, 2022). ### Description I have CI account I added to my organization that is used for pushing containers. I created a separate team for it named CI. Account isn't in any other team. Team permissions: ![image](https://user-images.githubusercontent.com/22667809/174069068-18588437-3e2a-4f1b-9c6d-c1577523791a.png) I want this group to only have write access to packages and maybe releases but if i uncheck ANY permission to Read and save, pushing image stops working: ```sh $ podman login git.my.domain # ... $ podman push git.my.domain/org/repo:latest Getting image source signatures Copying blob da62b97c2205 skipped: already exists Copying blob caa0fe6c85de skipped: already exists Copying blob 5a2d1674fe82 skipped: already exists Copying blob 2a34cef01f5f skipped: already exists Copying blob 5b8b24c2f164 skipped: already exists Copying blob fce7eced52b0 skipped: already exists Copying blob 81267142ac55 skipped: already exists Copying blob 95b66a4f2600 skipped: already exists Copying blob 637044167be1 skipped: already exists Copying config aedda0f877 done Writing manifest to image destination Error: writing manifest: uploading manifest latest to git.my.domain/org/repo: unauthorized: authentication required ``` When I change all permissions to Write, push works again. I tried pushing container as admin and linking it to repository but it didn't change anything. Looks like try.gitea.io doesn't allow creating organizations so i can't test it there. ### Gitea Version 1.17.0+dev-719-gf0ce5470e ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Locally compiled binary ### Database PostgreSQL

GiteaMirror added the type/bug label 2025-11-02 08:28:28 -06:00

GiteaMirror closed this issue

2025-11-02 08:28:28 -06:00

GiteaMirror commented

2025-11-02 08:28:29 -06:00

@dbotwinick commented on GitHub (Jun 20, 2022):

+1
Note I encountered the same behavior for maven package registry on v1.17.0-rc1.

@dbotwinick commented on GitHub (Jun 20, 2022): +1 Note I encountered the same behavior for maven package registry on [v1.17.0-rc1](https://github.com/go-gitea/gitea/releases/tag/v1.17.0-rc1).

GiteaMirror commented

2025-11-02 08:28:29 -06:00

@lunny commented on GitHub (Jun 21, 2022):

Write means Read and Write.

@lunny commented on GitHub (Jun 21, 2022): `Write` means `Read` and `Write`.

GiteaMirror commented

2025-11-02 08:28:29 -06:00

@Fogapod commented on GitHub (Jun 22, 2022):

Write means Read and Write.

I think you misunderstood the issue. In order to be able to push image to registry I had to set Wiki and Issues and Code and everything else to Write, not just Packages

@Fogapod commented on GitHub (Jun 22, 2022): > `Write` means `Read` and `Write`. I think you misunderstood the issue. In order to be able to push image to registry I had to set Wiki and Issues and Code and everything else to `Write`, not just `Packages`

GiteaMirror commented

2025-11-02 08:28:30 -06:00

@lunny commented on GitHub (Jun 22, 2022):

Write means Read and Write.

I think you misunderstood the issue. In order to be able to push image to registry I had to set Wiki and Issues and Code and everything else to Write, not just Packages

Got it.

@lunny commented on GitHub (Jun 22, 2022): > > `Write` means `Read` and `Write`. > > I think you misunderstood the issue. In order to be able to push image to registry I had to set Wiki and Issues and Code and everything else to `Write`, not just `Packages` Got it.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9074