{"thread":{"id":"58700","subject":"[PATCH] Mention that password could be a personal access token.","startedAt":"2022-10-27T04:45:55Z","lastAt":"2022-11-08T21:48:30Z","messageCount":15,"participants":["M Hickford via GitGitGadget","Junio C Hamano","Jeff King","M Hickford","Ævar Arnfjörð Bjarmason","Eric Sunshine","Philip Oakley","Taylor Blau"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"465864","messageId":"pull.1396.git.1666845947898.gitgitgadget@gmail.com","threadId":"58700","inReplyTo":null,"subject":"[PATCH] Mention that password could be a personal access token.","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2022-10-27T04:45:47Z","receivedAt":"2022-10-27T04:45:55Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nThese days, the 'password' for a software forge might be personal access\ntoken or OAuth access token.\n\nSigned-off-by: M Hickford \n---\n Mention that password could be a personal access token.\n \n These days, the 'password' for a software forge might be personal access\n token or OAuth access token.\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1396%2Fhickford%2Fmore-about-credentials-v1\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1396/hickford/more-about-credentials-v1\nPull-Request: https://github.com/gitgitgadget/git/pull/1396\n\n Documentation/git-credential.txt | 4 +++-\n 1 file changed, 3 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/git-credential.txt b/Documentation/git-credential.txt\nindex f18673017f5..f3bf0bef54b 100644\n--- a/Documentation/git-credential.txt\n+++ b/Documentation/git-credential.txt\n@@ -142,7 +142,9 @@ Git understands the following attributes:\n \n `password`::\n \n-\tThe credential's password, if we are asking it to be stored.\n+\tThe credential's password, if we are asking it to be stored. If the\n+\thost is a software forge, this could also be a personal access\n+\ttoken or OAuth access token.\n \n `url`::\n \n\nbase-commit: 1fc3c0ad407008c2f71dd9ae1241d8b75f8ef886\n-- \ngitgitgadget\n"},{"id":"465885","messageId":"xmqqk04lmagy.fsf@gitster.g","threadId":"58700","inReplyTo":"pull.1396.git.1666845947898.gitgitgadget@gmail.com","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-10-27T17:40:13Z","receivedAt":"2022-10-27T17:40:20Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"M Hickford via GitGitGadget\" writes:\n\n> `password`::\n> \n> -\tThe credential's password, if we are asking it to be stored.\n> +\tThe credential's password, if we are asking it to be stored. If the\n> +\thost is a software forge, this could also be a personal access\n> +\ttoken or OAuth access token.\n\nIs this limited to software forge hosts?\n\nAlso, I wonder if the specific \"it can be access token and not\npassword\" is something worth adding. If there were a service styled\nafter the good-old \"anonymous ftp\", it would expect the constant\nstring 'anonymous' as the \"username\", and would expect to see your\nidentity (e.g. 'mirth.hickford@gmail.com') as the \"password\". The\npoint is that it does not matter what it is called on the end-user's\nside, be it a password or access token or whatever. It is what the\nother end that provides the service wants to see after you claimed\nwho you are by providing \"username\", usually (but not necessarily)\nin order to prove your claim.\n\nSo, I dunno.\n\n\n"},{"id":"465905","messageId":"Y1roZeM6EsPgpHqu@coredump.intra.peff.net","threadId":"58700","inReplyTo":"xmqqk04lmagy.fsf@gitster.g","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2022-10-27T20:21:57Z","receivedAt":"2022-10-27T20:22:01Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Oct 27, 2022 at 10:40:13AM -0700, Junio C Hamano wrote:\n\n> \"M Hickford via GitGitGadget\" writes:\n> \n> > `password`::\n> > \n> > -\tThe credential's password, if we are asking it to be stored.\n> > +\tThe credential's password, if we are asking it to be stored. If the\n> > +\thost is a software forge, this could also be a personal access\n> > +\ttoken or OAuth access token.\n> \n> Is this limited to software forge hosts?\n> \n> Also, I wonder if the specific \"it can be access token and not\n> password\" is something worth adding. If there were a service styled\n> after the good-old \"anonymous ftp\", it would expect the constant\n> string 'anonymous' as the \"username\", and would expect to see your\n> identity (e.g. 'mirth.hickford@gmail.com') as the \"password\". The\n> point is that it does not matter what it is called on the end-user's\n> side, be it a password or access token or whatever. It is what the\n> other end that provides the service wants to see after you claimed\n> who you are by providing \"username\", usually (but not necessarily)\n> in order to prove your claim.\n> \n> So, I dunno.\n\nFWIW, I had the same reaction. From the client perspective for https,\nthis is going over basic-auth, and it might be nice to just say so. But\nof course the whole credential system is abstract, so it gets awkward.\nWe could probably say something like:\n\n The credential's password, if we are asking it to be stored. Note that\n this may not strictly be a traditional password, but rather any secret\n string which is used for authentication. For instance, Git's HTTP\n protocol will generally pass this using an Authorization header;\n depending on what the server is expecting this may be a password typed\n by the user, a personal access token, or some other opaque value.\n\nMaybe that is getting too into the weeds. OTOH, anybody reading this far\ninto git-credential(1) is probably pretty technical. There may be a\nbetter way of wording it, too. Another way of thinking about it that\nit's basically any secret that is a single string, and not part of a\nchallenge/response protocol. I couldn't find a way to word that which\ndidn't end up more confusing, though. ;)\n\n-Peff\n"},{"id":"465910","messageId":"xmqqo7txj5u6.fsf@gitster.g","threadId":"58700","inReplyTo":"Y1roZeM6EsPgpHqu@coredump.intra.peff.net","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-10-27T21:48:33Z","receivedAt":"2022-10-27T21:48:38Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King writes:\n\n> FWIW, I had the same reaction. From the client perspective for https,\n> this is going over basic-auth, and it might be nice to just say so. But\n> of course the whole credential system is abstract, so it gets awkward.\n> We could probably say something like:\n>\n> The credential's password, if we are asking it to be stored. Note that\n> this may not strictly be a traditional password, but rather any secret\n> string which is used for authentication. For instance, Git's HTTP\n> protocol will generally pass this using an Authorization header;\n> depending on what the server is expecting this may be a password typed\n> by the user, a personal access token, or some other opaque value.\n\nThanks. I have no problem with this replacement text.\n\n> Maybe that is getting too into the weeds. OTOH, anybody reading this far\n> into git-credential(1) is probably pretty technical.\n\nTrue, too.\n"},{"id":"466176","messageId":"CAGJzqs=PovTFeVFJAT1HLcKQxHdRjozUACh3Z-x8ih6yuYSb7w@mail.gmail.com","threadId":"58700","inReplyTo":"xmqqk04lmagy.fsf@gitster.g","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2022-11-01T03:54:46Z","receivedAt":"2022-11-01T03:55:29Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"On Thu, 27 Oct 2022 at 18:40, Junio C Hamano wrote:\n\n> Also, I wonder if the specific \"it can be access token and not\n> password\" is something worth adding.\n\nPersonal access tokens are ubiquitous nowadays, maybe even more common\nthan passwords since GitHub disabled passwords last year. I wanted\nto acknowledge this in the docs, even if Git's own behaviour hasn't\nchanged. Maybe the introduction to\nhttps://git-scm.com/docs/gitcredentials would be a better place to do\nthat?\n\n Git will sometimes need credentials from the user in order to\nperform operations; for example, it may need to ask for a username and\npassword in order to access a remote repository over HTTP. **The\nserver may accept or expect a personal access token instead of a\npassword.**\n\n[1] https://github.blog/changelog/2021-08-12-git-password-authentication-is-shutting-down/\n"},{"id":"466185","messageId":"221101.86wn8f3xlp.gmgdl@evledraar.gmail.com","threadId":"58700","inReplyTo":"CAGJzqs=PovTFeVFJAT1HLcKQxHdRjozUACh3Z-x8ih6yuYSb7w@mail.gmail.com","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-11-01T07:58:36Z","receivedAt":"2022-11-01T08:09:14Z","isPatch":true,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Tue, Nov 01 2022, M Hickford wrote:\n\n> On Thu, 27 Oct 2022 at 18:40, Junio C Hamano wrote:\n>\n>> Also, I wonder if the specific \"it can be access token and not\n>> password\" is something worth adding.\n>\n> Personal access tokens are ubiquitous nowadays, maybe even more common\n> than passwords since GitHub disabled passwords last year. I wanted\n> to acknowledge this in the docs, even if Git's own behaviour hasn't\n> changed. Maybe the introduction to\n> https://git-scm.com/docs/gitcredentials would be a better place to do\n> that?\n>\n> Git will sometimes need credentials from the user in order to\n> perform operations; for example, it may need to ask for a username and\n> password in order to access a remote repository over HTTP. **The\n> server may accept or expect a personal access token instead of a\n> password.**\n>\n> [1] https://github.blog/changelog/2021-08-12-git-password-authentication-is-shutting-down/\n\nA \"personal access token\" is just a password by another name. When you\nenter such a token into your .git/config (or provide it via an auth\nhelper) we'll sent it over via HTTP Basic Auth, \"which transmits\ncredentials as user-id/ password pairs, encoded using Base64\"[2].\n\nEven the blog post you linked to makes the distinction, by talking about\n\"account passwords\". I.e. what's really going on here is that providers\nhave been moving to using N passwords instead of 1.\n\nNow, I'm not just trying to be pedantic. I do think there's probably a\ndoc improvement to be made here. If popular providers are calling this a\n\"[personal] access token\" perhaps we should mention it in passing.\n\nBut saying \"this could also be\" is the point at which this could create\nits own confusion. This *is* a password. E.g. if you get such a \"token\"\nand want to try it out with the \"curl\" utility (whose library we use for\nhttp) it'll be e.g.:\n\n\tcurl --user : \n\nNot:\n\n\tcurl --user --personal-access-token \n\nOr whatever. I.e. the entire rest of the stack calls this a \"password\",\nand that stack's a lot more likely to be what stays around in the long\nterm, rather than what amounts to a marketing term for a password.\n\n1. https://www.rfc-editor.org/rfc/rfc7617\n"},{"id":"466195","messageId":"CAGJzqsm1WRQL79012rboSaPyuP_knPh5aSUiucDNntV-_x4SDQ@mail.gmail.com","threadId":"58700","inReplyTo":"221101.86wn8f3xlp.gmgdl@evledraar.gmail.com","subject":"Re: [PATCH] Mention that password could be a personal access token.","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2022-11-01T10:27:15Z","receivedAt":"2022-11-01T10:28:08Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"On Tue, 1 Nov 2022 at 08:09, Ævar Arnfjörð Bjarmason wrote:\n>\n> what's really going on here is that providers\n> have been moving to using N passwords instead of 1.\n\nI like that way of thinking about it.\n"},{"id":"466304","messageId":"pull.1396.v2.git.1667385022103.gitgitgadget@gmail.com","threadId":"58700","inReplyTo":"pull.1396.git.1666845947898.gitgitgadget@gmail.com","subject":"[PATCH v2] Mention that password could be a personal access token.","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2022-11-02T10:30:21Z","receivedAt":"2022-11-02T10:30:35Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nThese days, the 'password' for a software forge might be personal access\ntoken or OAuth access token. These are popular, so worth clarifying that\nGit treats them just the same.\n\nSigned-off-by: M Hickford \n---\n Mention that password could be a personal access token.\n \n These days, the 'password' for a software forge might be personal access\n token or OAuth access token.\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1396%2Fhickford%2Fmore-about-credentials-v2\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1396/hickford/more-about-credentials-v2\nPull-Request: https://github.com/gitgitgadget/git/pull/1396\n\nRange-diff vs v1:\n\n 1: fef359f533a < -: ----------- Mention that password could be a personal access token.\n -: ----------- > 1: 0bb69988ad7 Mention that password could be a personal access token.\n\n\n Documentation/gitcredentials.txt | 3 +++\n 1 file changed, 3 insertions(+)\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex 80517b4eb2c..402e067a6ca 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -21,6 +21,9 @@ in order to access a remote repository over HTTP. This manual describes\n the mechanisms Git uses to request these credentials, as well as some\n features to avoid inputting these credentials repeatedly.\n \n+Some repositories accept multiple passwords, including personal access\n+tokens and OAuth access tokens. Git handles all of these the same.\n+\n REQUESTING CREDENTIALS\n ----------------------\n \n\nbase-commit: c03801e19cb8ab36e9c0d17ff3d5e0c3b0f24193\n-- \ngitgitgadget\n"},{"id":"466305","messageId":"CAPig+cQ2Tqt8rzvXsRjCsPFTkbq7B06gq2pourKXi5dKNx8oAA@mail.gmail.com","threadId":"58700","inReplyTo":"pull.1396.v2.git.1667385022103.gitgitgadget@gmail.com","subject":"Re: [PATCH v2] Mention that password could be a personal access token.","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2022-11-02T10:54:53Z","receivedAt":"2022-11-02T10:55:09Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Wed, Nov 2, 2022 at 6:36 AM M Hickford via GitGitGadget\n wrote:\n> These days, the 'password' for a software forge might be personal access\n> token or OAuth access token. These are popular, so worth clarifying that\n> Git treats them just the same.\n>\n> Signed-off-by: M Hickford \n> ---\n> diff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\n> @@ -21,6 +21,9 @@ in order to access a remote repository over HTTP. This manual describes\n> the mechanisms Git uses to request these credentials, as well as some\n> features to avoid inputting these credentials repeatedly.\n>\n> +Some repositories accept multiple passwords, including personal access\n> +tokens and OAuth access tokens. Git handles all of these the same.\n\nI easily understood Ævar's point about these types of secrets all\nbeing different names for a password, but I find the above change\nrather confusing when it mentions \"multiple passwords\". That makes me\nthink I may need to somehow configure multiple passwords for a site\n(even though I know that's not what you meant).\n\nHow about a different approach, calling it a \"secret\" first, and then\ndefining \"secret\" as different names for \"password\". Perhaps something\nlike this:\n\n Git will sometimes need credentials from the user in order to\n perform operations; for example, it may need to ask for a username\n and secret in order to access a remote repository over HTTP. The\n secret may be a password, passcode, personal access token, OAuth\n access token, etc. This manual describes the mechanisms Git uses\n to request these credentials, as well as some features to avoid\n inputting these credentials repeatedly.\n"},{"id":"466320","messageId":"CAPc5daXmnkGpScihLpTPDXEFOAQF0vm-aWOpeym90X=tktLC2w@mail.gmail.com","threadId":"58700","inReplyTo":"CAPig+cQ2Tqt8rzvXsRjCsPFTkbq7B06gq2pourKXi5dKNx8oAA@mail.gmail.com","subject":"Re: [PATCH v2] Mention that password could be a personal access token.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-11-02T15:44:53Z","receivedAt":"2022-11-02T15:45:49Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"On Wed, Nov 2, 2022 at 3:55 AM Eric Sunshine wrote:\n>\n> How about a different approach, calling it a \"secret\" first, and then\n> defining \"secret\" as different names for \"password\".\n\nOr more directly, say \"password\" and parenthetically add that some hosting\nsites may call it with different names like \"personal tokens\"?\n"},{"id":"466321","messageId":"CAPig+cRy66HNfTnNQC4PcAaMR-m-DwUbdETsy0zBX4saG7F4Ng@mail.gmail.com","threadId":"58700","inReplyTo":"CAPc5daXmnkGpScihLpTPDXEFOAQF0vm-aWOpeym90X=tktLC2w@mail.gmail.com","subject":"Re: [PATCH v2] Mention that password could be a personal access token.","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2022-11-02T15:51:08Z","receivedAt":"2022-11-02T15:51:25Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Wed, Nov 2, 2022 at 11:45 AM Junio C Hamano wrote:\n> On Wed, Nov 2, 2022 at 3:55 AM Eric Sunshine wrote:\n> > How about a different approach, calling it a \"secret\" first, and then\n> > defining \"secret\" as different names for \"password\".\n>\n> Or more directly, say \"password\" and parenthetically add that some hosting\n> sites may call it with different names like \"personal tokens\"?\n\nI tried the parenthetical approach first but the sentence structure\nbecame too complex and more difficult to understand. Having a separate\nsentence helped simplify. That said, perhap something like this?\n\n Git will sometimes need credentials from the user in order to\n perform operations; for example, it may need to ask for a username\n and password in order to access a remote repository over HTTP. In\n place of a password, some sites may instead provide a passcode,\n personal access token, OAuth access token, etc. This manual...\n"},{"id":"466327","messageId":"83d3c28b-9b33-fa17-c0ca-85e790e52dad@iee.email","threadId":"58700","inReplyTo":"CAPig+cRy66HNfTnNQC4PcAaMR-m-DwUbdETsy0zBX4saG7F4Ng@mail.gmail.com","subject":"Re: [PATCH v2] Mention that password could be a personal access token.","fromName":"Philip Oakley","fromEmail":"philipoakley@iee.email","sentAt":"2022-11-02T17:30:21Z","receivedAt":"2022-11-02T17:30:57Z","isPatch":true,"sender":{"key":"philipoakley@iee.email","avatar":"https://avatars.githubusercontent.com/u/914343?v=4"},"body":"On 02/11/2022 15:51, Eric Sunshine wrote:\n> On Wed, Nov 2, 2022 at 11:45 AM Junio C Hamano wrote:\n>> On Wed, Nov 2, 2022 at 3:55 AM Eric Sunshine wrote:\n>>> How about a different approach, calling it a \"secret\" first, and then\n>>> defining \"secret\" as different names for \"password\".\n>> Or more directly, say \"password\" and parenthetically add that some hosting\n>> sites may call it with different names like \"personal tokens\"?\n> I tried the parenthetical approach first but the sentence structure\n> became too complex and more difficult to understand. Having a separate\n> sentence helped simplify. That said, perhap something like this?\n>\n> Git will sometimes need credentials from the user in order to\n> perform operations; for example, it may need to ask for a username\n> and password in order to access a remote repository over HTTP. In\n\nPerhaps s/password/secret 'password'/ here 9above0, and then talk about\nthe names for that \"secret\" in the follow up sentence below.\n> place of a password, some sites may instead provide a passcode,\n> personal access token, OAuth access token, etc. This manual...\n--\nPhilip\n"},{"id":"466815","messageId":"CAGJzqsmazghu9qWx6QXaSsQqgMVXDVhd1W-STv+D9p=NJF1-EQ@mail.gmail.com","threadId":"58700","inReplyTo":"CAPc5daXmnkGpScihLpTPDXEFOAQF0vm-aWOpeym90X=tktLC2w@mail.gmail.com","subject":"Re: [PATCH v2] Mention that password could be a personal access token.","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2022-11-08T12:11:18Z","receivedAt":"2022-11-08T12:12:04Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"On Wed, 2 Nov 2022 at 15:45, Junio C Hamano wrote:\n>\n> Or more directly, say \"password\" and parenthetically add that some hosting\n> sites may call it with different names like \"personal tokens\"?\n\nRight, Git asks for a \"password\", but the user might enter a personal\naccess token instead.\n"},{"id":"466816","messageId":"pull.1396.v3.git.1667912487608.gitgitgadget@gmail.com","threadId":"58700","inReplyTo":"pull.1396.v2.git.1667385022103.gitgitgadget@gmail.com","subject":"[PATCH v3] Mention that password could be a personal access token.","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2022-11-08T13:01:27Z","receivedAt":"2022-11-08T13:01:36Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nGit asks for a \"password\", but the user might use a\npersonal access token or OAuth access token instead.\n\nExample:\n\n Password for 'https://AzureDiamond@github.com':\n\nSigned-off-by: M Hickford \n---\n Mention that password could be a personal access token.\n \n These days, the 'password' for a software forge might be personal access\n token or OAuth access token.\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1396%2Fhickford%2Fmore-about-credentials-v3\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1396/hickford/more-about-credentials-v3\nPull-Request: https://github.com/gitgitgadget/git/pull/1396\n\nRange-diff vs v2:\n\n 1: 0bb69988ad7 ! 1: 7be4a631aca Mention that password could be a personal access token.\n @@ Metadata\n ## Commit message ##\n Mention that password could be a personal access token.\n \n - These days, the 'password' for a software forge might be personal access\n - token or OAuth access token. These are popular, so worth clarifying that\n - Git treats them just the same.\n + Git asks for a \"password\", but the user might use a\n + personal access token or OAuth access token instead.\n +\n + Example:\n +\n + Password for 'https://AzureDiamond@github.com':\n \n Signed-off-by: M Hickford \n \n ## Documentation/gitcredentials.txt ##\n -@@ Documentation/gitcredentials.txt: in order to access a remote repository over HTTP. This manual describes\n - the mechanisms Git uses to request these credentials, as well as some\n - features to avoid inputting these credentials repeatedly.\n +@@ Documentation/gitcredentials.txt: DESCRIPTION\n + \n + Git will sometimes need credentials from the user in order to perform\n + operations; for example, it may need to ask for a username and password\n +-in order to access a remote repository over HTTP. This manual describes\n +-the mechanisms Git uses to request these credentials, as well as some\n +-features to avoid inputting these credentials repeatedly.\n ++in order to access a remote repository over HTTP. Some remotes accept\n ++a personal access token or OAuth access token as a password. This\n ++manual describes the mechanisms Git uses to request these credentials,\n ++as well as some features to avoid inputting these credentials repeatedly.\n \n -+Some repositories accept multiple passwords, including personal access\n -+tokens and OAuth access tokens. Git handles all of these the same.\n -+\n REQUESTING CREDENTIALS\n ----------------------\n - \n\n\n Documentation/gitcredentials.txt | 7 ++++---\n 1 file changed, 4 insertions(+), 3 deletions(-)\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex 80517b4eb2c..6df50e8a144 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -17,9 +17,10 @@ DESCRIPTION\n \n Git will sometimes need credentials from the user in order to perform\n operations; for example, it may need to ask for a username and password\n-in order to access a remote repository over HTTP. This manual describes\n-the mechanisms Git uses to request these credentials, as well as some\n-features to avoid inputting these credentials repeatedly.\n+in order to access a remote repository over HTTP. Some remotes accept\n+a personal access token or OAuth access token as a password. This\n+manual describes the mechanisms Git uses to request these credentials,\n+as well as some features to avoid inputting these credentials repeatedly.\n \n REQUESTING CREDENTIALS\n ----------------------\n\nbase-commit: 3b08839926fcc7cc48cf4c759737c1a71af430c1\n-- \ngitgitgadget\n"},{"id":"466905","messageId":"Y2rOqP9CxKqlo0dB@nand.local","threadId":"58700","inReplyTo":"pull.1396.v3.git.1667912487608.gitgitgadget@gmail.com","subject":"Re: [PATCH v3] Mention that password could be a personal access token.","fromName":"Taylor Blau","fromEmail":"me@ttaylorr.com","sentAt":"2022-11-08T21:48:24Z","receivedAt":"2022-11-08T21:48:30Z","isPatch":true,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"On Tue, Nov 08, 2022 at 01:01:27PM +0000, M Hickford via GitGitGadget wrote:\n> From: M Hickford \n>\n> Git asks for a \"password\", but the user might use a\n> personal access token or OAuth access token instead.\n\nLooks good to me. The only minor issue I noticed was that the commit\nmessage should have been prefixed with an area but wasn't.\n\nI changed it to the following when queueing:\n\n Documentation/gitcredentials.txt: mention password alternatives\n\nThank you for your work. Let's start merging this one down.\n\nThanks,\nTaylor\n"}]}