Some attachments in private repos are not downloaded (HTTPError: Not Found), but can be accessed in a browser session #477

Activity

1. Iamrodos commented on Jan 11, 2026

   

   Iamrodos

   on Jan 11, 2026

   Last edited by Iamrodos

   Contributor

   More actions

   To help debug this, could you share a bit more info?

   1. Check the manifest.json

   The manifest files contain the actual HTTP status code and full URLs. Could you share an example entry from a failed download?

     find /path/to/backup -name "manifest.json" -exec cat {} \;

   Looking for entries with "success": false - specifically the http_status and url fields.

   2. Manual curl test

   If you can share one of the failing URLs (or reproduce with a public repo), this curl command emulates what the tool does:

     curl -v -H "Authorization: token YOUR_TOKEN" \
          -H "Accept: application/octet-stream" \
          "https://github.com/user-attachments/assets/ACTUAL_UUID"
   

   The -v output would show us the full HTTP response and any redirects.

   3. Token type

   You mentioned using a fine-grained token. Have you tried with a classic PAT to see if the behavior differs?

   4. Debug logging

   Running with --log-level debug might surface additional insight:

   github-backup ... --log-level debug
   
2. Iamrodos commented on Jan 11, 2026

   

   Iamrodos

   on Jan 11, 2026

   Contributor

   More actions

   Update, I have investigated more by create a fine-grained PAT and can reproduced the issue.

   Root Cause

   This appears to be a GitHub platform limitation with fine-grained PATs and user-attachments URLs in private repos. Classic PATs work consistently, but fine-grained PATs have inconsistent behavior. Others have reported having the same issue with the this when calling the API.

   I tested a private repo with both token types:

   Token Type	Result
   Classic PAT (ghp_...)	Works for all attachments
   Fine-grained PAT (github_pat_...)	Mixed - some 302 (success), some 404

   In my testing, newer attachments worked while older attachments failed with fine-grained PATs. The exact criteria GitHub uses is unclear, can't see why some work and some do not.

   What You Can Do Now

   Use a classic PAT instead of a fine-grained PAT when backing up attachments from private repositories. Classic tokens with repo scope work consistently.

   Potential improvements

   There is a partial workaround using GitHub's Markdown API for /assets/ URLs that gets a JWT that can be used to get image assets only. But this would still leave /files/ assets still not working with a fine-grained PAT.

   I can also document the limitation in the readme on /files/ and issue a warning when warning when --attachments is used with a fine-grained token.

   Let me know how you get on and if you think support images is sufficient enough to worth doing without files. Or if you are going to have to use classic anyway so its not worth it.

   ❤️React with ❤️1Reacted by Lukas Bestle
3. lukasbestle commented on Jan 11, 2026

   

   lukasbestle

   on Jan 11, 2026

   Last edited by lukasbestle

   ContributorAuthor

   More actions

   Thanks for your investigation.

   IMO the JWT workaround for assets seems worthwhile. Images are a lot more common as issue/PR attachments than other file types. It doesn’t seem warranted to reduce security by using a classic token just for /files/.

   So I think the fix could be a combination of:

   • Implement the workaround so as many attachments as possible can be backed up using a fine-grained token
   • Document the limitation of attachment files in private repos (with solution to use a classic token if these need to be backed up)
4. Iamrodos commented on Jan 11, 2026

   

   Iamrodos

   on Jan 11, 2026

   Contributor

   More actions

   Thanks for the insight @lukasbestle, I should be able to get this done in the next few days. In the meantime the classic PAT is your friend. Lets leave this open and we can reference in the PR.

   👍React with 👍1Reacted by Lukas Bestle
5. Iamrodos

   added a commit that references this issue on Jan 13, 2026

   Fix fine-grained PAT attachment downloads for private repos (josegonz…

   ...

   fce4abb
6. josegonzalez

   closed this as completedin #478on Jan 13, 2026