{"thread":{"id":"22588","subject":"git + davfs2, is it safe?","startedAt":"2010-02-09T16:39:32Z","lastAt":"2010-02-09T17:57:12Z","messageCount":2,"participants":["Gábor Farkas","Shawn O. Pearce"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"134045","messageId":"2c173a351002090839v45d01d5dt17e4b4af37e84615@mail.gmail.com","threadId":"22588","inReplyTo":null,"subject":"git + davfs2, is it safe?","fromName":"Gábor Farkas","fromEmail":"gabor@nekomancer.net","sentAt":"2010-02-09T16:39:32Z","receivedAt":"2010-02-09T16:39:32Z","isPatch":false,"sender":{"key":"gabor@nekomancer.net","avatar":null},"body":"hi,\n\nfor various reasons our git repositories are hosted using https (webdav),\nwhich is http-auth and client-certificate authenticated.\n\n(linux on both the server and the client)\n\nit's possible to somehow persuade git to push/fetch from such repositories,\nbut it's very annoying because either you have to enter your\nusername+password+cert_password\non every fetch and twice on every push, or you have to write them down\nin $HOME/.netrc .\n\nan alternative that seems to work is to mount the webdav directory using davfs2,\nand then use it with git as a normal mounted filesystem.\n\nit seems to work ok (a little slow, but usable), but i'm a little\nworried about possible corner-cases.\nfor example, will it be ok if two people are trying to push into it at\nthe same time, etc?\n\nso generally, is it safe/recommended to use git in such a deployment, or not?\n\np.s: or, does anyone know about a better way to handle the\nusername/password/cert_password\nwhen accessing the webdav-repo directly (without davfs2)?\n\nthanks,\ngabor\n"},{"id":"134058","messageId":"20100209175712.GB28936@spearce.org","threadId":"22588","inReplyTo":"2c173a351002090839v45d01d5dt17e4b4af37e84615@mail.gmail.com","subject":"Re: git + davfs2, is it safe?","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2010-02-09T17:57:12Z","receivedAt":"2010-02-09T17:57:12Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"G?bor Farkas <gabor@nekomancer.net> wrote:\n> for various reasons our git repositories are hosted using https (webdav),\n> which is http-auth and client-certificate authenticated.\n> \n> (linux on both the server and the client)\n> \n> it's possible to somehow persuade git to push/fetch from such repositories,\n> but it's very annoying because either you have to enter your\n> username+password+cert_password\n> on every fetch and twice on every push, or you have to write them down\n> in $HOME/.netrc .\n\nThis is why I prefer SSH.  You have ssh-agent around to retain your\nkey for you.\n\nA more modern Git (1.6.6 or later IIRC) should avoid prompting for\nthe password twice, because the HTTP client should actually reuse\nthe connection for the subsequent requests.  But I haven't tested it.\n\nYou might also want to consider upgrading your server to post-1.6.6\nand stop using WebDAV... but instead use smart HTTP for push.\nThat should only need one authentication cycle to perform the push.\n\n\nIt sounds like its time for a proper curl-agent for libcurl though.\nUsers and applications shouldn't have to keep implementing their\npassword stores as text files...\n \n-- \nShawn.\n"}]}