From: "brian m. carlson" <sandals@crustytoothpaste.net>
To: Gennady Uraltsev <gennady.uraltsev@gmail.com>
Cc: git@vger.kernel.org
Subject: Re: Git credential store conflicting configuration leads to unexpected behavior
Date: Tue, 6 Dec 2022 22:16:53 +0000 [thread overview]
Message-ID: <Y4+/VQly2NKnMrFY@tapette.crustytoothpaste.net> (raw)
In-Reply-To: <CACH4KQSutGnoyFGP2RmkwQT3yhnEg1RcvedXVSMOVVDAnz_aFg@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1947 bytes --]
On 2022-12-06 at 22:05:22, Gennady Uraltsev wrote:
> Hello everyone,
>
> I have an issue with git credential-store. In my global configuration
> dir (.config/git/config) I had the line
>
> [credential]
> helper = store
>
> while ini a repository's .git/config while I have
>
> [credential]
> helper = "store --file=./.git/git-credentials"
>
> to store credentials "locally".
>
> I thought the latter would overrule the former However what happens is
> the following:
>
> 1) On first run the file repo-local file ./.git/git-credentials gets
> created and the credentials are saved there after the user is queried
> for a password
> 2) On subsequent runs the credentials get recovered from
> ./.git/git-credentials and the user is NOT asked for credentials
> 2b) **Here is the weird behavior** git ALSO creates the
> .git-credentials file in the home directory and saves a copy of
> credentials there.
>
> The behavior 2b leads to exfiltration of passwords to a location a
> user might not expect.
>
> Workaround: Remove the line
>
> [credential]
> helper = store
>
> in the global config.
>
> It seems that the global config somehow does not get shadowed by the local one!
This behaviour is by design. The reason is that sometimes the user may
have two sets of credential helpers, one for one set of domains, and
another for another. For example, I believe AWS has its own custom
credential helper. Git calls credential helpers until it finds a
credential, and then it sends store commands to all of them. A
credential helper which has no credentials for a domain will generally
respond with no credentials.
If you want to override the credential helpers in the `.git/config`
file, you can do so by first writing an empty value, like so:
[credential]
helper =
helper = "store --file=./.git/git-credentials"
--
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 263 bytes --]
next prev parent reply other threads:[~2022-12-06 22:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-06 22:05 Git credential store conflicting configuration leads to unexpected behavior Gennady Uraltsev
2022-12-06 22:16 ` brian m. carlson [this message]
2022-12-06 23:53 ` Gennady Uraltsev
2022-12-07 1:15 ` brian m. carlson
2022-12-07 1:19 ` Gennady Uraltsev
2022-12-07 12:01 ` Philip Oakley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y4+/VQly2NKnMrFY@tapette.crustytoothpaste.net \
--to=sandals@crustytoothpaste.net \
--cc=gennady.uraltsev@gmail.com \
--cc=git@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).