# JuliaHub asking for write access to my GitHub repos

**URL:** <https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825>\
**Category:** New to Julia\
**Tags:** juliahub\
**Created:** [July 26, 2022, 1:46pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825 "2022-07-26T13:46:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![user664303](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/user664303/32/37843_2.png) [@user664303](https://discourse.julialang.org/u/user664303)\
**Post date:** [July 26, 2022, 1:46pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825/1 "2022-07-26T13:46:48Z")

</div>

Hello. This is my first post here. I’m a seasoned MATLAB user, and after trying out julia about 7 years ago, I thought I’d give it another go. I’ve started rewriting in julia some of the many useful utilities I have in MATLAB. One of them is a module for getting and storing user specific data. It’s hosted [here on github](https://github.com/ojwoodford/UserConfig.jl). I wanted to add it to the package registry, and am just going through the process on JuliaHub. However, the website has just asked me for write access to all my public repositories:

 ![Screenshot 2022-07-26 at 14.38.58](https://global.discourse-cdn.com/julialang/original/3X/3/b/3be627b56177f8ad3f401b09ef604282f23f67b3.jpeg)  
On the previous page it said “We need additional privileges for your repositories to determine whether you are a contributor of this package.” But I don’t see why write privileges would be necessary for this. So it strikes me as odd, and also a little risky. Is it necessary? Should I accept this?

---

<div class="post-metadata">

**Author:** ![cormullion](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/cormullion/32/49131_2.png) [@cormullion](https://discourse.julialang.org/u/cormullion)\
**Post date:** [July 26, 2022, 1:51pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825/2 "2022-07-26T13:51:41Z")

</div>

A related issue here:

[https://github.com/JuliaComputing/JuliaHub-Feedback/issues/109](https://github.com/JuliaComputing/JuliaHub-Feedback/issues/109)

---

<div class="post-metadata">

**Author:** ![user664303](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/user664303/32/37843_2.png) [@user664303](https://discourse.julialang.org/u/user664303)\
**Post date:** [July 26, 2022, 2:00pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825/3 "2022-07-26T14:00:12Z")

</div>

So I’ve read some of [the thread here](https://github.com/JuliaRegistries/Registrator.jl/issues/329). What’s odd in my case is that I’m logged on to JuliaHub using my GitHub credentials. The site can surely see that I am the owner of the repo, without providing any further authorization.

---

<div class="post-metadata">

**Author:** ![user664303](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/user664303/32/37843_2.png) [@user664303](https://discourse.julialang.org/u/user664303)\
**Post date:** [July 26, 2022, 2:11pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825/4 "2022-07-26T14:11:20Z")

</div>

Anyway, following [the instructions here](https://github.com/JuliaRegistries/Registrator.jl/#via-the-github-app), I commented " [@JuliaRegistrator](https://github.com/JuliaRegistrator) register" on the head commit, opening [this PR here](https://github.com/JuliaRegistries/General/pull/65012).

---

<div class="post-metadata">

**Author:** ![avik](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/avik/32/17_2.png) [@avik](https://discourse.julialang.org/u/avik)\
**Post date:** [July 26, 2022, 3:35pm UTC](https://discourse.julialang.org/t/juliahub-asking-for-write-access-to-my-github-repos/84825/5 "2022-07-26T15:35:20Z")

</div>

Yes, this issue that you link to ([Permissions for Registrator · Issue #329 · JuliaRegistries/Registrator.jl · GitHub](https://github.com/JuliaRegistries/Registrator.jl/issues/329)) explains in detail why we ask for those permissions.

When you log in to juliahub with github, we explicitly do not ask for any write scopes, to minimise the default permissions we get. With those permissions, we cannot, in general, verify your ownership of a package within an org. We could check against the URL for packages hosted on personal github accounts, but that seems to be a vector for various url encoding bugs and security issues. We cannot run a cannonical check without write permissions – this is a limitation of Github’s apis.

So you are being asked to upgrade permissions to write only when you want to register. So any change here will require us to ask for more default permissions, which we do not want to do, and which will likely lead to other complaints.

Hope that helps

Regards

Avik