{"thread":{"id":"18006","subject":"git with https and client cert asks for password repeatedly","startedAt":"2009-02-25T03:11:40Z","lastAt":"2009-02-26T10:17:15Z","messageCount":4,"participants":["Mark Lodato","Daniel Stenberg","Josef Wolf","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"106130","messageId":"ca433830902241911x10b08a4fg8e790000a5cf9f3b@mail.gmail.com","threadId":"18006","inReplyTo":null,"subject":"git with https and client cert asks for password repeatedly","fromName":"Mark Lodato","fromEmail":"lodatom@gmail.com","sentAt":"2009-02-25T03:11:40Z","receivedAt":"2009-02-25T03:11:40Z","isPatch":false,"sender":{"key":"lodatom@gmail.com","avatar":"https://avatars.githubusercontent.com/u/58860?v=4"},"body":"First off, I am fairly new to git, so let me apologize in advance if I\nsuggest anything stupid.\n\nWhen fetching or pushing over https:// with a client certificate\n(http.sslCert / http.sslKey), git asks for a password for every single\nrequested file.  For example, here I push three commits with a couple\nchanged files each:\n\n> git push origin master\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nFetching remote heads...\n  refs/\n  refs/tags/\n  refs/heads/\nupdating 'refs/heads/master'\n  from 1df865db590b4a7d4991c13053437ac90b2780e4\n  to   05e856a6a5ce9b05a5a7d10cb5d10010467eea72\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\n    sending 12 objects\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\nEnter PEM pass phrase:\n    done\nUpdating remote server info\n\nTo make matters worse, when you try to CTRL-C from the \"Enter PEM pass\nphrase\" prompt, it just re-prompts you!  If you want to see this in\naction, set up a webdav server on https://localhost with a copy of\ngit.git and try cloning it with a password-protected client\ncertificate.\n\nThis problem makes client-side certificates unusable with git.  A\npossible workaround is to leave the key unencrypted, but this is\nusually unacceptable for security reasons.  Ideally, I would just type\nmy password once per invocation and git would remember it.  (This is\nhow svn works.)\n\nI think the root problem is that git creates a completely new http(s)\nconnection for every request, rather than using one persistent\nconnection.  Using a persistent connection would theoretically speed\nup the transfers, in addition to fixing the password prompt issue.\nI'm pretty sure that calling `curl_easy_cleanup()' after every request\nis causing this behavior; I don't think this is necessary.\n\nI tried fixing this myself, but the http/curl code is pretty\nconfusing.  Just wondering - why is HTTP_MULTI required for http-push?\n I saw a thread from Jan '08 about this, but it never said *why*\nHTTP_MULTI is required, only that the push doesn't work without it.\nIt doesn't appear to me that git uses concurrent connections in any\nuseful way, so I don't know why having a single connection would not\nwork.\n\n\nFinally, is there interest in refactoring the http code to make it a\nlittle cleaner?  That is, make a wrapper library around curl so that\nyou can just call GET or POST or whatever and not worry about how to\ninvoke curl?\n\n\n--\nMark Lodato\n"},{"id":"106153","messageId":"alpine.DEB.1.10.0902250920540.28808@yvahk2.pbagnpgbe.fr","threadId":"18006","inReplyTo":"ca433830902241911x10b08a4fg8e790000a5cf9f3b@mail.gmail.com","subject":"Re: git with https and client cert asks for password repeatedly","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2009-02-25T08:24:23Z","receivedAt":"2009-02-25T08:24:23Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Tue, 24 Feb 2009, Mark Lodato wrote:\n\n> I think the root problem is that git creates a completely new http(s) \n> connection for every request, rather than using one persistent connection. \n> Using a persistent connection would theoretically speed up the transfers, in \n> addition to fixing the password prompt issue. I'm pretty sure that calling \n> `curl_easy_cleanup()' after every request is causing this behavior; I don't \n> think this is necessary.\n\nThis may or may not be true depending on several circumstances. You didn't \nmention what libcurl version nor did you say if you build git to use the multi \ninterface. But assuming that you don't use multi or that the libcurl is fairly \nold, your conclusion is correct.\n\n-- \n\n  / daniel.haxx.se\n"},{"id":"106263","messageId":"20090225214224.GB4573@raven.wolf.lan","threadId":"18006","inReplyTo":"ca433830902241911x10b08a4fg8e790000a5cf9f3b@mail.gmail.com","subject":"Re: git with https and client cert asks for password repeatedly","fromName":"Josef Wolf","fromEmail":"jw@raven.inka.de","sentAt":"2009-02-25T21:42:24Z","receivedAt":"2009-02-25T21:42:24Z","isPatch":false,"sender":{"key":"jw@raven.inka.de","avatar":null},"body":"On Tue, Feb 24, 2009 at 10:11:40PM -0500, Mark Lodato wrote:\n\n> When fetching or pushing over https:// with a client certificate\n> (http.sslCert / http.sslKey), git asks for a password for every single\n> requested file.  For example, here I push three commits with a couple\n> changed files each:\n[ ... ]\n> This problem makes client-side certificates unusable with git.  A\n> possible workaround is to leave the key unencrypted, but this is\n> usually unacceptable for security reasons.\n\nFor the (pretty much standard) Basic authentication over https, it is\neven worse: you have to put your password in plain text into .netrc :-(\nCheck out http://marc.info/?l=git&m=122426078301793&w=2 if you have a\ncouple of minutes left.\n\n> Ideally, I would just type\n> my password once per invocation and git would remember it.  (This is\n> how svn works.)\n\nYeah, that would be great!\n\n> I think the root problem is that git creates a completely new http(s)\n> connection for every request, rather than using one persistent\n> connection.  Using a persistent connection would theoretically speed\n> up the transfers, in addition to fixing the password prompt issue.\n> I'm pretty sure that calling `curl_easy_cleanup()' after every request\n> is causing this behavior; I don't think this is necessary.\n> \n> I tried fixing this myself, but the http/curl code is pretty\n> confusing.  Just wondering - why is HTTP_MULTI required for http-push?\n\nThe integration of curl into git looks somewhat strange to me, also.\nIt seems to implement some sort of request-queue on top of curl-multi\nand falls back to re-implement some curl-multi functionality in the\ncase when only curl-easy is available.  Or something like that.  I have\nnot looked too much into the details, and have already forgotten what I\nsaw there.\n\nInstead, I looked into curl-lib to implement some sort of credential\ncaching. The idea was to implement something like get_basic_credentials()\nin the LWP::UserAgent perl module.\n\nOnce such a retrieval callback/cache would be implemented in curl, it\nwould be pretty easy to make use of it from git without messing/breaking\ntoo much with the existing code.\n\nSo I went to the curl-library list.  Please feel free to read the\ndiscussion on http://curl.haxx.se/mail/lib-2008-10/index.html#286\n\nCheck out http://curl.haxx.se/mail/lib-2008-11/index.html#38 for a\nfirst draft of the change I suggested.\n\nUnfortunately, I got stuck implementing the regression tests for this\nchange.  Then I got short on time to proceed the work on this topic.\nCheck out http://curl.haxx.se/mail/lib-2008-11/index.html#51 for the\nlast state of affairs I posted.  Once the regression tests are\nimplemented, implementing the remaining functionality would be pretty\nmuch straight forward.  But currently, I have no clue when I will get\naround to continue working on that.\n\n> Finally, is there interest in refactoring the http code to make it a\n> little cleaner?  That is, make a wrapper library around curl so that\n> you can just call GET or POST or whatever and not worry about how to\n> invoke curl?\n\nAs I mentioned above, I figured that implementing the callback method\nin curl-lib would probably be easier than understanding the usage of\ncurl within git.  So I'd say refactoring would be an improvement.  But\nI bet the git gurus will flame me for saying that =:-S\n"},{"id":"106310","messageId":"alpine.DEB.1.00.0902261113340.6258@intel-tinevez-2-302","threadId":"18006","inReplyTo":"20090225214224.GB4573@raven.wolf.lan","subject":"Re: git with https and client cert asks for password repeatedly","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-02-26T10:17:15Z","receivedAt":"2009-02-26T10:17:15Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\n[Josef, it is extremely annoying that you culled the Cc: list; I do not \nknow if Mark will get this mail, and my time is too scarce to undo your \nmistake.]\n\nOn Wed, 25 Feb 2009, Josef Wolf wrote:\n\n> On Tue, Feb 24, 2009 at 10:11:40PM -0500, Mark Lodato wrote:\n> \n> > Finally, is there interest in refactoring the http code to make it a \n> > little cleaner?  That is, make a wrapper library around curl so that \n> > you can just call GET or POST or whatever and not worry about how to \n> > invoke curl?\n> \n> As I mentioned above, I figured that implementing the callback method in \n> curl-lib would probably be easier than understanding the usage of curl \n> within git.  So I'd say refactoring would be an improvement.  But I bet \n> the git gurus will flame me for saying that =:-S\n\nTo the contrary.  I have been waiting for over one year for Mike Hommey to \nsubmit his refactoring patches.\n\nA very quick list search would find you his patch series, I am sure.\n\nStatus quo: the series needs polishing, and we need http-fetch tests (if I \nsaw it correctly, Peff started something like this).\n\nCiao,\nDscho\n"}]}