It seems like the default anonymous access which grants read and browse role on the repo is not sufficient for “git lfs fetch” command. For some reason it also requires the view-add role. However if you grant that it breaks the upload as it thinks it can add the new item however it can’t without the view-edit role on the repo.
Anyone has any idea why the “add” role would be needed for this to work?
FYI as a work around I created a new user which had only read,browse and add roles for the repo and then set my .lfsconfig as