{"record":{"id":"5f84f5cf949ccf87","repo":"apereo/cas","slug":"unable-to-pull-changes-from-the-remote-repository-5f84f5","errorCode":null,"errorMessage":"Unable to pull changes from the remote repository. Metadata files may be stale.","messagePattern":"Unable to pull changes from the remote repository\\. Metadata files may be stale\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-metadata-git/src/main/java/org/apereo/cas/support/saml/metadata/resolver/GitSamlRegisteredServiceMetadataResolver.java","lineNumber":82,"sourceCode":"        }\n        val metadataLocation = service.getMetadataLocation();\n        return metadataLocation != null\n            && (metadataLocation.trim().startsWith(getSourceId())\n            || (metadataLocation.trim().startsWith(\"http\") && metadataLocation.trim().endsWith(\".git\")));\n    }\n\n    @Override\n    public String getSourceId() {\n        return \"git://\";\n    }\n\n    @Override\n    public List<SamlMetadataDocument> load() {\n        try {\n            if (gitRepository.pull()) {\n                LOGGER.debug(\"Successfully pulled metadata changes from the remote repository\");\n            } else {\n                LOGGER.warn(\"Unable to pull changes from the remote repository. Metadata files may be stale.\");\n            }\n            val repoDirectory = getMetadataDirectory();\n            val metadataFiles = FileUtils.listFiles(repoDirectory, new String[]{\"xml\"}, false);\n            return metadataFiles\n                .stream()\n                .map(GitSamlRegisteredServiceMetadataResolver::parseFileIntoSamlMetadataDocument)\n                .filter(Objects::nonNull)\n                .collect(Collectors.toList());\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }\n        return List.of();\n    }\n\n    @Override\n    public SamlMetadataDocument store(final SamlMetadataDocument document) {\n        try {\n            document.assignIdIfNecessary();","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-metadata-git/src/main/java/org/apereo/cas/support/saml/metadata/resolver/GitSamlRegisteredServiceMetadataResolver.java#L64-L100","documentation":"WARN log emitted by GitSamlRegisteredServiceMetadataResolver.load when gitRepository.pull() returns false while refreshing the metadata Git repository. The resolver proceeds to list XML metadata files from the local clone, so results reflect the last successfully pulled state. It exists so operators notice that SP metadata loaded from Git may be outdated.","triggerScenarios":"Any invocation of load() (via resolve, findByName, or findById) where the Git pull of the metadata repository fails: remote unreachable, bad credentials, corrupt/non-repository local directory, dirty working tree, or JGit pull returning false.","commonSituations":"Remote metadata Git server is down or firewalled; access token rotated/expired; someone committed directly into the clone causing pull conflicts; clone directory wiped and re-created without git init/clone.","solutions":["Run a manual git pull in the configured metadata directory to expose the real error (auth, DNS, conflict).","Fix remote credentials or URL in cas.authn.saml.* metadata git settings.","Clean the local clone (git reset --hard; remove conflicting edits) so subsequent pulls succeed.","Verify the resolver is scheduled/refreshed once connectivity is restored so stale entries are replaced.","Consider alerts on this log since it silently degrades to stale metadata."],"exampleFix":"// before: stale clone left after failed pull\n$ cd /etc/cas/saml-metadata && git pull\nerror: Your local changes would be overwritten by merge\n// after\n$ git reset --hard origin/main && git clean -fd && git pull\nAlready up to date.","handlingStrategy":"validation","validationCode":"// Pre-flight check before relying on the resolver\nvar dir = new File(metadataRepoDirectory);\nif (!new File(dir, \".git\").exists()) {\n    throw new IllegalStateException(\"Metadata directory is not a git clone: \" + dir);\n}","typeGuard":null,"tryCatchPattern":"try {\n    List<SamlMetadataDocument> docs = resolver.load();\n} catch (Exception e) {\n    LOGGER.error(\"Metadata load failed entirely; serving cached/previous docs\", e);\n}","preventionTips":["Periodically fetch the remote manually to detect auth or connectivity drift","Alert on 'Unable to pull changes' warnings — they mean SP metadata may be outdated","Protect the clone from manual edits that cause pull conflicts","Use HTTPS remotes with rotating-managed tokens rather than long-lived passwords"],"tags":["git","saml-metadata","resolver","stale-data"],"backgroundTag":"git-command-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}