[JENKINS-56569] Prevent automatic pulling of lfs files if no GitLFSPull option is set

Depending on the used method to install git on a system, git lfs is enabled per default on a system via these settings in the system-wide config file:

[filter "lfs"]

    clean = git-lfs clean -- %f

    smudge = git-lfs smudge -- %f

    process = git-lfs filter-process

    required = true

This means that even if no "git lfs pull" is performed explicitly, on checkout lfs files are pulled automatically due to the smudge filter.

Problems

1. If the remote server requires authentication and none is configured on the system on a Jenkins agent (e.g. ssh key in ~/.ssh/), the checkout fails.


2. If lfs files shall not be pulled at all, there is no way to configure this in the plugin.

I therefore suggest to always set the environment variable GIT_LFS_SKIP_SMUDGE=1 even if no "GitLFSPull" option was specified.

This makes sure that no "git lfs" commands that are not controlled by the git-client-plugin are launched and thus resolves the issue that the checkout fails in case the remote server requires authentication.

This also prevents pulling lfs files regardless of a system's configuration and requires to explicitly pull lfs files via the "GitLFSPull" option.

---
Originally reported by renescheibe, imported from: Prevent automatic pulling of lfs files if no GitLFSPull option is set

• status: Open
  
• priority: Major
  
• component(s): git-client-plugin
  
• resolution: Unresolved
  
• votes: 4
  
• watchers: 12
  
• imported: 20251211-071809
  

Raw content of original issue

Depending on the used method to install git on a system, git lfs is enabled per default on a system via these settings in the system-wide config file:



[filter "lfs"]

    clean = git-lfs clean -- %f

    smudge = git-lfs smudge -- %f

    process = git-lfs filter-process

    required = true





This means that even if no "git lfs pull" is performed explicitly, on checkout lfs files are pulled automatically due to the smudge filter.


Problems



	
If the remote server requires authentication and none is configured on the system on a Jenkins agent (e.g. ssh key in ~/.ssh/), the checkout fails.

	
If lfs files shall not be pulled at all, there is no way to configure this in the plugin.



I therefore suggest to always set the environment variable GIT_LFS_SKIP_SMUDGE=1 even if no "GitLFSPull" option was specified.

 This makes sure that no "git lfs" commands that are not controlled by the git-client-plugin are launched and thus resolves the issue that the checkout fails in case the remote server requires authentication.

 This also prevents pulling lfs files regardless of a system's configuration and requires to explicitly pull lfs files via the "GitLFSPull" option.

• environment: git-client-plugin 2.7.6