{"thread":{"id":"49480","subject":"Fwd: Git credentials not working","startedAt":"2018-10-03T14:06:46Z","lastAt":"2018-10-03T21:35:21Z","messageCount":10,"participants":["Dimitri Kopriwa","Christian Couder","Jeff King","Bryan Turner"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"359523","messageId":"f4f7bd2c-4c48-e749-4df1-ddf05896b337@gmail.com","threadId":"49480","inReplyTo":"a1ceb967-6020-6074-f504-c684242c79ab@gmail.com","subject":"Fwd: Git credentials not working","fromName":"Dimitri Kopriwa","fromEmail":"d.kopriwa@gmail.com","sentAt":"2018-10-03T14:06:38Z","receivedAt":"2018-10-03T14:06:46Z","isPatch":false,"sender":{"key":"d.kopriwa@gmail.com","avatar":"https://gravatar.com/avatar/d87c8b134156008c025b3c5084b041627eaa8b875854ed8b2e04d42a773aa80e?d=mp&s=160"},"body":"Dear Git list,\n\n\nI have tried to used git credentials within Gitlab-CI runners. I have 4 \ninstance of GitLab and discovered a weird bug with Git credentials when \nuse within a CI process.\n\nPlease note before all that the time spend allowed me multiple time to \ncheck that my credentials are valid for the repository. And calling git \nfetch --tags with the full remote url that include the credentials \nalways succeeded.\n\nTested with Git 2.11, 2.19\n\nGit credentials in ~/.git-credentials and ~/.config/git/credentials are \nbeing removed by git upon reading.\n\nThis happen randomly accross my CI runner, and change that make them \nwork on not related.\n\n\n{ Error: Command failed: git fetch --tags \nhttps://git.example.com/example/some-project.git\n18:25:52.554903 git.c:415               trace: built-in: git fetch \n--tags https://git.example.com/example/some-project.git\n18:25:52.555234 run-command.c:637       trace: run_command: GIT_DIR=.git \ngit-remote-https https://git.example.com/example/some-project.git \nhttps://git.example.com/example/some-project.git\n18:25:52.692741 run-command.c:637       trace: run_command: 'git \ncredential-store get'\n18:25:52.697314 git.c:659               trace: exec: \ngit-credential-store get\n18:25:52.697372 run-command.c:637       trace: run_command: \ngit-credential-store get\n18:25:52.936024 run-command.c:637       trace: run_command: 'git \ncredential-store erase'\n18:25:52.940307 git.c:659               trace: exec: \ngit-credential-store erase\n18:25:52.940365 run-command.c:637       trace: run_command: \ngit-credential-store erase\nremote: HTTP Basic: Access denied\nfatal: Authentication failed for \n'https://git.example.com/example/some-project.git/'\n\n\nSee the full question here: \nhttps://stackoverflow.com/questions/52614467/why-does-git-credential-store-call-git-credential-erase-and-make-my-credential-f\n\n\nCan you please help me found why is git credential-store erase called ?\n\n\nBest regards,\n\n"},{"id":"359538","messageId":"CAP8UFD3LEYd7RytZU_-wVcDosH+6VSdM2j3NUcnR0aQc8QfoQg@mail.gmail.com","threadId":"49480","inReplyTo":"f4f7bd2c-4c48-e749-4df1-ddf05896b337@gmail.com","subject":"Re: Git credentials not working","fromName":"Christian Couder","fromEmail":"christian.couder@gmail.com","sentAt":"2018-10-03T16:03:56Z","receivedAt":"2018-10-03T16:04:11Z","isPatch":false,"sender":{"key":"christian.couder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/208954?v=4"},"body":"(removing git-security from CC)\n\nOn Wed, Oct 3, 2018 at 4:09 PM Dimitri Kopriwa <d.kopriwa@gmail.com> wrote:\n\n> Git credentials in ~/.git-credentials and ~/.config/git/credentials are\n> being removed by git upon reading.\n\nhttps://git-scm.com/docs/git-credential says:\n\n\"If the action is reject, git-credential will send the description to\nany configured credential helpers, which may erase any stored\ncredential matching the description.\"\n\nSo maybe this is expected.\n\nAnother possibility is that your .gitlab-ci.yml might launch scripts\nwriting into those files, like the before_script.sh script that is\ndescribed on:\n\nhttps://stackoverflow.com/questions/50553049/is-it-possible-to-do-a-git-push-within-a-gitlab-ci-without-ssh\n\nCould you also check which credential helper and which options are\nused? For example with commands like:\n\n$ git config -l --show-origin | grep -i cred\n$ git config -l --show-origin | grep -i http\n$ git config -l --show-origin | grep -i askpass\n$ env | grep -i askpass\n"},{"id":"359552","messageId":"20181003171104.GA12200@sigill.intra.peff.net","threadId":"49480","inReplyTo":"f4f7bd2c-4c48-e749-4df1-ddf05896b337@gmail.com","subject":"Re: Fwd: Git credentials not working","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2018-10-03T17:11:05Z","receivedAt":"2018-10-03T17:11:08Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Oct 03, 2018 at 09:06:38PM +0700, Dimitri Kopriwa wrote:\n\n> 18:25:52.940307 git.c:659               trace: exec: git-credential-store erase\n> 18:25:52.940365 run-command.c:637       trace: run_command: git-credential-store erase\n> remote: HTTP Basic: Access denied\n> fatal: Authentication failed for\n> 'https://git.example.com/example/some-project.git/'\n> [...]\n> \n> Can you please help me found why is git credential-store erase called ?\n\nThis is expected. We tried to use a credential that was rejected by the\nserver, so we told all of the helpers it was invalid. You can try\nrunning GIT_TRACE_CURL=1 to see the HTTP conversation. There will be an\nHTTP 401 with the authentication failure, though it may not tell you\nanything more useful than that.\n\ngit-credential-store is meant to be used interactively, to insert and\nerase credentials as they're grabbed from the terminal.\n\nIt sounds more like you want to just have a stored credential that you\ntry to use. You could do that with a custom helper. E.g., something like\nthis in your ~/.gitconfig:\n\n  [credential \"https://example.com\"]\n  helper = \"!f() { test $1 = get && echo password=$(cat /path/with/password); }; f\"\n\n-Peff\n"},{"id":"359557","messageId":"d4f5551f-89d2-d63e-49da-dd80f22ea9ce@gmail.com","threadId":"49480","inReplyTo":"CAP8UFD3LEYd7RytZU_-wVcDosH+6VSdM2j3NUcnR0aQc8QfoQg@mail.gmail.com","subject":"Re: Git credentials not working","fromName":"Dimitri Kopriwa","fromEmail":"d.kopriwa@gmail.com","sentAt":"2018-10-03T17:29:46Z","receivedAt":"2018-10-03T17:29:53Z","isPatch":false,"sender":{"key":"d.kopriwa@gmail.com","avatar":"https://gravatar.com/avatar/d87c8b134156008c025b3c5084b041627eaa8b875854ed8b2e04d42a773aa80e?d=mp&s=160"},"body":"\nOn 10/3/18 11:03 PM, Christian Couder wrote:\n> (removing git-security from CC)\n>\n> On Wed, Oct 3, 2018 at 4:09 PM Dimitri Kopriwa <d.kopriwa@gmail.com> wrote:\n>\n>> Git credentials in ~/.git-credentials and ~/.config/git/credentials are\n>> being removed by git upon reading.\n> https://git-scm.com/docs/git-credential says:\n>\n> \"If the action is reject, git-credential will send the description to\n> any configured credential helpers, which may erase any stored\n> credential matching the description.\"\n>\n> So maybe this is expected.\nI am using this script to create my credential file, how am I supposed \nto do in a non tty environment? Is there a prefered way?\n>\n> Another possibility is that your .gitlab-ci.yml might launch scripts\n> writing into those files, like the before_script.sh script that is\n> described on:\n>\n> https://stackoverflow.com/questions/50553049/is-it-possible-to-do-a-git-push-within-a-gitlab-ci-without-ssh\n>\n> Could you also check which credential helper and which options are\n> used? For example with commands like:\n>\n> $ git config -l --show-origin | grep -i cred\n> $ git config -l --show-origin | grep -i http\n> $ git config -l --show-origin | grep -i askpass\n> $ env | grep -i askpass\n  * branch            HEAD       -> FETCH_HEAD\n17:15:36.175966 run-command.c:637       trace: run_command: git gc --auto\n17:15:36.177688 git.c:415               trace: built-in: git gc --auto\n\u001b[32;1m$ git config -l --show-origin | grep -i cred\u001b[0;m\n17:15:36.180191 git.c:415               trace: built-in: git config -l \n--show-origin\nfile:/root/.gitconfig    credential.helper=store\nfile:.git/config    credential.helper=store\n\u001b[32;1m$ git config -l --show-origin | grep -i http\u001b[0;m\n17:15:36.182768 git.c:415               trace: built-in: git config -l \n--show-origin\nfile:.git/config \nremote.origin.url=https://git.example.com/example/sample-project.git\n\u001b[32;1m$ git config -l --show-origin | grep -i askpass || echo nothing \nto do\u001b[0;m\n17:15:36.185306 git.c:415               trace: built-in: git config -l \n--show-origin\nnothing to do\n\u001b[32;1m$ env | grep -i askpass || echo nothing to do\u001b[0;m\nnothing to do\n"},{"id":"359560","messageId":"89f60502-c67d-83b6-593b-a0e6d8567183@gmail.com","threadId":"49480","inReplyTo":"20181003171104.GA12200@sigill.intra.peff.net","subject":"Re: Fwd: Git credentials not working","fromName":"Dimitri Kopriwa","fromEmail":"d.kopriwa@gmail.com","sentAt":"2018-10-03T18:12:11Z","receivedAt":"2018-10-03T18:12:17Z","isPatch":false,"sender":{"key":"d.kopriwa@gmail.com","avatar":"https://gravatar.com/avatar/d87c8b134156008c025b3c5084b041627eaa8b875854ed8b2e04d42a773aa80e?d=mp&s=160"},"body":"Thanks for your reply. I have activated GIT_TRACE_CURL=1 and I can see \nthat the request is failing 401.\n\nI can't see which token is used and using what header ?\n\nThe log say:\n\n17:50:26.414654 http.c:657              => Send header: Authorization: Basic <redacted>\n\nI have retested the token locally and it work when used in the url or \nusing `Private-Token: <token>` as stated in the Gitlab documentation \nhttps://docs.gitlab.com/ee/api/README.html#personal-access-tokens\n\nPeff, what would be the appropriate way to input my git credential in a \n100% success way in a CI?\n\nIs this good:\n\ngit credential approve <<EOF\nprotocol=https\nhost=example.com\nusername=bob\npassword=secr3t\nOEF\n\n?\n\nI would use the custom helper after I can understand how to properly use \nthe git credential store in a CI environment. The fact that I am using a \ngenerated file is simply because this is what the documentation told me \nto do. I did not found anywhere in the doc how I should create that file \nin a non tty terminal.\n\nThanks again for your help.\n\nOn 10/4/18 12:11 AM, Jeff King wrote:\n> On Wed, Oct 03, 2018 at 09:06:38PM +0700, Dimitri Kopriwa wrote:\n>\n>> 18:25:52.940307 git.c:659               trace: exec: git-credential-store erase\n>> 18:25:52.940365 run-command.c:637       trace: run_command: git-credential-store erase\n>> remote: HTTP Basic: Access denied\n>> fatal: Authentication failed for\n>> 'https://git.example.com/example/some-project.git/'\n>> [...]\n>>\n>> Can you please help me found why is git credential-store erase called ?\n> This is expected. We tried to use a credential that was rejected by the\n> server, so we told all of the helpers it was invalid. You can try\n> running GIT_TRACE_CURL=1 to see the HTTP conversation. There will be an\n> HTTP 401 with the authentication failure, though it may not tell you\n> anything more useful than that.\n>\n> git-credential-store is meant to be used interactively, to insert and\n> erase credentials as they're grabbed from the terminal.\n>\n> It sounds more like you want to just have a stored credential that you\n> try to use. You could do that with a custom helper. E.g., something like\n> this in your ~/.gitconfig:\n>\n>    [credential \"https://example.com\"]\n>    helper = \"!f() { test $1 = get && echo password=$(cat /path/with/password); }; f\"\n>\n> -Peff\n"},{"id":"359561","messageId":"20181003182409.GA14848@sigill.intra.peff.net","threadId":"49480","inReplyTo":"89f60502-c67d-83b6-593b-a0e6d8567183@gmail.com","subject":"Re: Fwd: Git credentials not working","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2018-10-03T18:24:09Z","receivedAt":"2018-10-03T18:24:13Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Oct 04, 2018 at 01:12:11AM +0700, Dimitri Kopriwa wrote:\n\n> Thanks for your reply. I have activated GIT_TRACE_CURL=1 and I can see that\n> the request is failing 401.\n> \n> I can't see which token is used and using what header ?\n> \n> The log say:\n> \n> 17:50:26.414654 http.c:657              => Send header: Authorization: Basic <redacted>\n\nYeah, we redact the auth information so people don't accidentally share\nit publicly. If you use the older GIT_CURL_VERBOSE=1, it will include\nthe credential (I think it may be base64 encoded, though, so you'll have\nto decipher it).\n\n> I have retested the token locally and it work when used in the url or using\n> `Private-Token: <token>` as stated in the Gitlab documentation\n> https://docs.gitlab.com/ee/api/README.html#personal-access-tokens\n\nI don't think Git will ever send your token in either of those ways. It\nwill always some as an Authorization header.\n\n> Peff, what would be the appropriate way to input my git credential in a 100%\n> success way in a CI?\n\nI don't know the details of what GitLab would want, but...\n\n> Is this good:\n> \n> git credential approve <<EOF\n> protocol=https\n> host=example.com\n> username=bob\n> password=secr3t\n> OEF\n\nYes, that would work to preload a token into any configured helpers.\n\n-Peff\n"},{"id":"359571","messageId":"84e704e0-fbf9-230f-459c-2927dea19a03@gmail.com","threadId":"49480","inReplyTo":"20181003182409.GA14848@sigill.intra.peff.net","subject":"Re: Fwd: Git credentials not working","fromName":"Dimitri Kopriwa","fromEmail":"d.kopriwa@gmail.com","sentAt":"2018-10-03T19:34:17Z","receivedAt":"2018-10-03T19:34:24Z","isPatch":false,"sender":{"key":"d.kopriwa@gmail.com","avatar":"https://gravatar.com/avatar/d87c8b134156008c025b3c5084b041627eaa8b875854ed8b2e04d42a773aa80e?d=mp&s=160"},"body":"I have replaced the way I fill the git credentials store, I have verify \n~/.git-credentials and information are there, the ~/.gitconfig look fine \ntoo.\n\nI still have 401 error when reading from that file.\n\nThis is the paste log : https://paste.gnome.org/pmntlkdw0\n\nNow that I use git approve, I dont think that I need a custom helper.\n\nAny idea why I still can't log in using git-credential?\n\nThanks in advance,\n\nOn 10/4/18 1:24 AM, Jeff King wrote:\n> On Thu, Oct 04, 2018 at 01:12:11AM +0700, Dimitri Kopriwa wrote:\n>\n>> Thanks for your reply. I have activated GIT_TRACE_CURL=1 and I can see that\n>> the request is failing 401.\n>>\n>> I can't see which token is used and using what header ?\n>>\n>> The log say:\n>>\n>> 17:50:26.414654 http.c:657              => Send header: Authorization: Basic <redacted>\n> Yeah, we redact the auth information so people don't accidentally share\n> it publicly. If you use the older GIT_CURL_VERBOSE=1, it will include\n> the credential (I think it may be base64 encoded, though, so you'll have\n> to decipher it).\n>\n>> I have retested the token locally and it work when used in the url or using\n>> `Private-Token: <token>` as stated in the Gitlab documentation\n>> https://docs.gitlab.com/ee/api/README.html#personal-access-tokens\n> I don't think Git will ever send your token in either of those ways. It\n> will always some as an Authorization header.\n>\n>> Peff, what would be the appropriate way to input my git credential in a 100%\n>> success way in a CI?\n> I don't know the details of what GitLab would want, but...\n>\n>> Is this good:\n>>\n>> git credential approve <<EOF\n>> protocol=https\n>> host=example.com\n>> username=bob\n>> password=secr3t\n>> OEF\n> Yes, that would work to preload a token into any configured helpers.\n>\n> -Peff\n"},{"id":"359586","messageId":"CAGyf7-EL3Ch8iGZ0m4J9OJfQXs0DRxL9Du2UE2C-g9ECx0L10Q@mail.gmail.com","threadId":"49480","inReplyTo":"84e704e0-fbf9-230f-459c-2927dea19a03@gmail.com","subject":"Re: Fwd: Git credentials not working","fromName":"Bryan Turner","fromEmail":"bturner@atlassian.com","sentAt":"2018-10-03T20:03:50Z","receivedAt":"2018-10-03T20:04:04Z","isPatch":false,"sender":{"key":"bturner@atlassian.com","avatar":"https://gravatar.com/avatar/16bcf3167981c1ef7c804e502642366d888a35b0d0b0a4ca01fdc442aa1acb1e?d=mp&s=160"},"body":"On Wed, Oct 3, 2018 at 12:34 PM Dimitri Kopriwa <d.kopriwa@gmail.com> wrote:\n>\n> I have replaced the way I fill the git credentials store, I have verify\n> ~/.git-credentials and information are there, the ~/.gitconfig look fine\n> too.\n>\n> I still have 401 error when reading from that file.\n>\n> This is the paste log : https://paste.gnome.org/pmntlkdw0\n>\n> Now that I use git approve, I dont think that I need a custom helper.\n>\n> Any idea why I still can't log in using git-credential?\n\nI'm pretty sure Peff touched on this in his reply. When it works,\nyou're either sending a \"Private-Token\" header or including it in the\nURL, but, as Peff said, Git will never do either of those things. It\nsends an \"Authorization\" header, and, based on their documentation, it\ndoesn't appear Gitlab accepts access tokens in that header.\n\nIt looks like you're either going to need to include it in the URL\n(like what happens earlier in the posted trace), or adjust your git\nconfig with a \"http.extraHeader\" set to \"Private-Token: <token>\" to\ninclude the \"Private-Token\" header (or you could pass it on the\ncommand line, like `git -c http.extraHeader=\"Private-Token: <token>\"\nclone ...`.\n\nHope this helps!\nBryan\n\n>\n> Thanks in advance,\n>\n> On 10/4/18 1:24 AM, Jeff King wrote:\n> > On Thu, Oct 04, 2018 at 01:12:11AM +0700, Dimitri Kopriwa wrote:\n> >\n> >> Thanks for your reply. I have activated GIT_TRACE_CURL=1 and I can see that\n> >> the request is failing 401.\n> >>\n> >> I can't see which token is used and using what header ?\n> >>\n> >> The log say:\n> >>\n> >> 17:50:26.414654 http.c:657              => Send header: Authorization: Basic <redacted>\n> > Yeah, we redact the auth information so people don't accidentally share\n> > it publicly. If you use the older GIT_CURL_VERBOSE=1, it will include\n> > the credential (I think it may be base64 encoded, though, so you'll have\n> > to decipher it).\n> >\n> >> I have retested the token locally and it work when used in the url or using\n> >> `Private-Token: <token>` as stated in the Gitlab documentation\n> >> https://docs.gitlab.com/ee/api/README.html#personal-access-tokens\n> > I don't think Git will ever send your token in either of those ways. It\n> > will always some as an Authorization header.\n> >\n> >> Peff, what would be the appropriate way to input my git credential in a 100%\n> >> success way in a CI?\n> > I don't know the details of what GitLab would want, but...\n> >\n> >> Is this good:\n> >>\n> >> git credential approve <<EOF\n> >> protocol=https\n> >> host=example.com\n> >> username=bob\n> >> password=secr3t\n> >> OEF\n> > Yes, that would work to preload a token into any configured helpers.\n> >\n> > -Peff\n"},{"id":"359589","messageId":"20181003204312.GC20709@sigill.intra.peff.net","threadId":"49480","inReplyTo":"84e704e0-fbf9-230f-459c-2927dea19a03@gmail.com","subject":"Re: Fwd: Git credentials not working","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2018-10-03T20:43:12Z","receivedAt":"2018-10-03T20:43:16Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Oct 04, 2018 at 02:34:17AM +0700, Dimitri Kopriwa wrote:\n\n> I have replaced the way I fill the git credentials store, I have verify\n> ~/.git-credentials and information are there, the ~/.gitconfig look fine\n> too.\n> \n> I still have 401 error when reading from that file.\n> \n> This is the paste log : https://paste.gnome.org/pmntlkdw0\n> \n> Now that I use git approve, I dont think that I need a custom helper.\n> \n> Any idea why I still can't log in using git-credential?\n\nLooking at your pastebin, it looks like the server sometimes takes it\nand sometimes not. E.g., piping the log through:\n\n  egrep '(Send|Recv) header:' |\n  perl -lpe 's/^.*?(=>|<=) //'\n\nI see:\n\n  Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n  Send header: User-Agent: git/2.19.0\n  ...\n  Recv header: HTTP/1.1 401 Unauthorized\n  Recv header: WWW-Authenticate: Basic realm=\"GitLab\"\n  ...\n  Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n  Send header: Authorization: Basic <redacted>\n  Send header: User-Agent: git/2.19.0\n  ...\n  Recv header: HTTP/1.1 200 OK\n\nSo that works. But then later we get:\n\n  Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n  Send header: User-Agent: git/2.19.0\n  ...\n  Recv header: HTTP/1.1 401 Unauthorized\n  Recv header: WWW-Authenticate: Basic realm=\"GitLab\"\n  ...\n  Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n  Send header: Authorization: Basic <redacted>\n  Send header: User-Agent: git/2.19.0\n  ...\n  Recv header: HTTP/1.1 401 Unauthorized\n\nAnd then that causes credential-store to delete the non-working entry,\nafter which all of them must fail (because you have no working\ncredential, and presumably no terminal to prompt the user).\n\nI have no idea why the same request would sometimes be allowed and\nsometimes not. It's possible the <redacted> data is different in those\ntwo times, but I don't know why that would be. It's also possible you're\nhitting different load-balancing servers that behave differently.\n\n-Peff\n"},{"id":"359592","messageId":"9cdc6dc8-a897-471f-a7e3-83cdfdf86fac@gmail.com","threadId":"49480","inReplyTo":"20181003204312.GC20709@sigill.intra.peff.net","subject":"Re: Fwd: Git credentials not working","fromName":"Dimitri Kopriwa","fromEmail":"d.kopriwa@gmail.com","sentAt":"2018-10-03T21:35:15Z","receivedAt":"2018-10-03T21:35:21Z","isPatch":false,"sender":{"key":"d.kopriwa@gmail.com","avatar":"https://gravatar.com/avatar/d87c8b134156008c025b3c5084b041627eaa8b875854ed8b2e04d42a773aa80e?d=mp&s=160"},"body":"Thanks everyone.\n\nAll your answers helped. I found out that the issue was not related to git.\n\nI am using semantic-release to perform a release, apparently \ngit-credentials is not working with semantic-release.\n\nI did also setup the double authentication and every fix applied on \ngit-credentials were simply useless.\n\nRead more here : \nhttps://github.com/semantic-release/semantic-release/issues/941#issuecomment-426691824\n\nThanks a lot for your help and git is the best software ever made thanks!\n\nDimitri Kopriwa\n\n\nOn 10/4/18 3:43 AM, Jeff King wrote:\n> On Thu, Oct 04, 2018 at 02:34:17AM +0700, Dimitri Kopriwa wrote:\n>\n>> I have replaced the way I fill the git credentials store, I have verify\n>> ~/.git-credentials and information are there, the ~/.gitconfig look fine\n>> too.\n>>\n>> I still have 401 error when reading from that file.\n>>\n>> This is the paste log : https://paste.gnome.org/pmntlkdw0\n>>\n>> Now that I use git approve, I dont think that I need a custom helper.\n>>\n>> Any idea why I still can't log in using git-credential?\n> Looking at your pastebin, it looks like the server sometimes takes it\n> and sometimes not. E.g., piping the log through:\n>\n>    egrep '(Send|Recv) header:' |\n>    perl -lpe 's/^.*?(=>|<=) //'\n>\n> I see:\n>\n>    Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n>    Send header: User-Agent: git/2.19.0\n>    ...\n>    Recv header: HTTP/1.1 401 Unauthorized\n>    Recv header: WWW-Authenticate: Basic realm=\"GitLab\"\n>    ...\n>    Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n>    Send header: Authorization: Basic <redacted>\n>    Send header: User-Agent: git/2.19.0\n>    ...\n>    Recv header: HTTP/1.1 200 OK\n>\n> So that works. But then later we get:\n>\n>    Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n>    Send header: User-Agent: git/2.19.0\n>    ...\n>    Recv header: HTTP/1.1 401 Unauthorized\n>    Recv header: WWW-Authenticate: Basic realm=\"GitLab\"\n>    ...\n>    Send header: GET /example-keys/sample-project.git/info/refs?service=git-upload-pack HTTP/1.1\n>    Send header: Authorization: Basic <redacted>\n>    Send header: User-Agent: git/2.19.0\n>    ...\n>    Recv header: HTTP/1.1 401 Unauthorized\n>\n> And then that causes credential-store to delete the non-working entry,\n> after which all of them must fail (because you have no working\n> credential, and presumably no terminal to prompt the user).\n>\n> I have no idea why the same request would sometimes be allowed and\n> sometimes not. It's possible the <redacted> data is different in those\n> two times, but I don't know why that would be. It's also possible you're\n> hitting different load-balancing servers that behave differently.\n>\n> -Peff\n"}]}