{"thread":{"id":"59799","subject":"[PATCH] doc: gitcredentials: introduce OAuth helpers","startedAt":"2023-05-28T19:45:34Z","lastAt":"2023-07-08T20:37:00Z","messageCount":7,"participants":["M Hickford via GitGitGadget","brian m. carlson","M Hickford","Jeff King"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"477771","messageId":"pull.1538.git.1685303127237.gitgitgadget@gmail.com","threadId":"59799","inReplyTo":null,"subject":"[PATCH] doc: gitcredentials: introduce OAuth helpers","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2023-05-28T19:45:27Z","receivedAt":"2023-05-28T19:45:34Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nOAuth credential helpers are widely useful but work differently to other\ncredential helpers, so worth introducing in the docs.\n\nLink to relevant projects.\n\nSigned-off-by: M Hickford \n---\n gitcredentials: describe OAuth credential helpers\n \n See also discussion\n https://lore.kernel.org/git/CAGJzqskaM80+8+79yUf435tP93Sk8sFu7marCvyimE=2gOKnog@mail.gmail.com/\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1538%2Fhickford%2Fhelpers-v1\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1538/hickford/helpers-v1\nPull-Request: https://github.com/gitgitgadget/git/pull/1538\n\n Documentation/gitcredentials.txt | 13 +++++++++++++\n 1 file changed, 13 insertions(+)\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex 100f045bb1a..d2a7249d52b 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -105,6 +105,19 @@ $ git config --global credential.helper foo\n -------------------------------------------\n \n \n+=== OAuth credential helpers\n+\n+An alternative to entering passwords or personal access tokens is to use an\n+OAuth credential helper. Many popular Git hosts support OAuth. The first time\n+you authenticate, the helper opens a browser window to the host.\n+Subsequent authentication is non interactive.\n+\n+Two cross-platform open-source OAuth credential helpers are:\n+\n+* https://github.com/git-ecosystem/git-credential-manager[Git Credential Manager]\n+* https://github.com/hickford/git-credential-oauth[git-credential-oauth]\n+\n+\n CREDENTIAL CONTEXTS\n -------------------\n \n\nbase-commit: 79bdd48716a4c455bdc8ffd91d57a18d5cd55baa\n-- \ngitgitgadget\n"},{"id":"477772","messageId":"ZHPa27fbAoKL0uGj@tapette.crustytoothpaste.net","threadId":"59799","inReplyTo":"pull.1538.git.1685303127237.gitgitgadget@gmail.com","subject":"Re: [PATCH] doc: gitcredentials: introduce OAuth helpers","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2023-05-28T22:51:07Z","receivedAt":"2023-05-28T22:51:14Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2023-05-28 at 19:45:27, M Hickford via GitGitGadget wrote:\n> From: M Hickford \n> \n> OAuth credential helpers are widely useful but work differently to other\n> credential helpers, so worth introducing in the docs.\n> \n> Link to relevant projects.\n\nThere are many possible implementations of credential helpers, and I'd\nprefer we didn't specifically propose any of them here. We ship with\nsome in contrib, and I think it would be better to fix them to be\nfunctional for this use case rather than link to external projects.\n\nI expect, however, that functionally, that will be difficult to do,\ngiven the fact that OAuth typically requires registration with the\nremote system, and thus we'd intrinsically be prioritizing some\nwell-known forges over less-known or personally-hosted forges, which\nwe've traditionally tried not to do. For example, your\ngit-credential-oauth contains a hard-coded list of 11 forges (and also\nproposes adding credentials for new ones into the config, which isn't\nreally a secure way to store secrets).\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"477774","messageId":"CAGJzqskGMn9rJDmcC1_ctKV-ut90twK5=FoH9fyUiqKrq6EqFA@mail.gmail.com","threadId":"59799","inReplyTo":"ZHPa27fbAoKL0uGj@tapette.crustytoothpaste.net","subject":"Re: [PATCH] doc: gitcredentials: introduce OAuth helpers","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2023-05-29T09:50:18Z","receivedAt":"2023-05-29T09:51:00Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"On Sun, 28 May 2023 at 23:51, brian m. carlson\n wrote:\n>\n> On 2023-05-28 at 19:45:27, M Hickford via GitGitGadget wrote:\n> > From: M Hickford \n> >\n> > OAuth credential helpers are widely useful but work differently to other\n> > credential helpers, so worth introducing in the docs.\n> >\n> > Link to relevant projects.\n>\n> There are many possible implementations of credential helpers, and I'd\n> prefer we didn't specifically propose any of them here. We ship with\n> some in contrib, and I think it would be better to fix them to be\n> functional for this use case rather than link to external projects.\n\nThanks Brian for your reply. I'd love to upstream OAuth functionality\nin Git, but I think it'd be prohibitively difficult technically without\nintroducing extra dependencies. git-credential-oauth is little more\nthan 100 lines of Go, but it takes advantage of Go's broad standard\nlibrary and a library for OAuth. I expect that would require tens of\nthousands of lines of challenging C.\nhttps://github.com/hickford/git-credential-oauth/issues/8\n\nI think OAuth is such a boon for usable security that it's worth\ndescribing and linking to external projects. The text aims to inform\nthe user rather than tell them to use a particular project. An\nalternative would be to link to a new 'credential helpers' page on\ngit-scm.com\n\n>\n> I expect, however, that functionally, that will be difficult to do,\n> given the fact that OAuth typically requires registration with the\n> remote system, and thus we'd intrinsically be prioritizing some\n> well-known forges over less-known or personally-hosted forges, which\n> we've traditionally tried not to do. For example, your\n\nIn that spirit, the patch avoids naming \"popular Git hosts\".\n\n> git-credential-oauth contains a hard-coded list of 11 forges (and also\n> proposes adding credentials for new ones into the config, which isn't\n> really a secure way to store secrets).\n\nTo clarify, it's expected that client credentials in OAuth native apps\n(unlike web apps) are non-confidential. \"It is assumed that any client\nauthentication credentials included in the application can be\nextracted\" https://datatracker.ietf.org/doc/html/rfc6749#section-2.1\n\n\n> --\n> brian m. carlson (he/him or they/them)\n> Toronto, Ontario, CA\n"},{"id":"478610","messageId":"CAGJzqs=NbfCt78NtANCxTNJxWG+Oc4bLCjhSSQhrOgr0YWuucg@mail.gmail.com","threadId":"59799","inReplyTo":"ZHPa27fbAoKL0uGj@tapette.crustytoothpaste.net","subject":"Re: [PATCH] doc: gitcredentials: introduce OAuth helpers","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2023-06-21T06:28:01Z","receivedAt":"2023-06-21T06:29:09Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"> I expect, however, that functionally, that will be difficult to do,\n> given the fact that OAuth typically requires registration with the\n> remote system, and thus we'd intrinsically be prioritizing some\n> well-known forges over less-known or personally-hosted forges, which\n> we've traditionally tried not to do. For example, your\n> git-credential-oauth contains a hard-coded list of 11 forges\n\nForge diversity is my motivation! Consider the average Git user. They\ncontribute to several projects on GitHub. They are deterred from\ncontributing to worthy projects elsewhere by the setup cost of\nconfiguring personal access tokens or SSH keys. To use five forges\nfrom three machines, you have to generate 15 personal access tokens or\nupload SSH keys 15 times. Whereas a git-credential-oauth user can\ncontribute to projects on many popular hosts without any setup. That's\nprogress surely.\n"},{"id":"478614","messageId":"pull.1538.v2.git.1687332624780.gitgitgadget@gmail.com","threadId":"59799","inReplyTo":"pull.1538.git.1685303127237.gitgitgadget@gmail.com","subject":"[PATCH v2] doc: gitcredentials: link to helper list","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2023-06-21T07:30:24Z","receivedAt":"2023-06-21T07:30:49Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nLink to community list of credential helpers. This is useful information\nfor users.\n\nDescribe how OAuth credential helpers work. OAuth is a user-friendly\nalternative to personal access tokens and SSH keys. Reduced setup cost\nmakes it easier for users to contribute to projects across multiple\nforges.\n\nSigned-off-by: M Hickford \n---\n gitcredentials: link to list of helpers\n \n Add link to list of helpers\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1538%2Fhickford%2Fhelpers-v2\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1538/hickford/helpers-v2\nPull-Request: https://github.com/gitgitgadget/git/pull/1538\n\nRange-diff vs v1:\n\n 1: 49e2a6fc9f2 ! 1: 26818290468 doc: gitcredentials: introduce OAuth helpers\n @@ Metadata\n Author: M Hickford \n \n ## Commit message ##\n - doc: gitcredentials: introduce OAuth helpers\n + doc: gitcredentials: link to helper list\n \n - OAuth credential helpers are widely useful but work differently to other\n - credential helpers, so worth introducing in the docs.\n + Link to community list of credential helpers. This is useful information\n + for users.\n \n - Link to relevant projects.\n + Describe how OAuth credential helpers work. OAuth is a user-friendly\n + alternative to personal access tokens and SSH keys. Reduced setup cost\n + makes it easier for users to contribute to projects across multiple\n + forges.\n \n Signed-off-by: M Hickford \n \n ## Documentation/gitcredentials.txt ##\n -@@ Documentation/gitcredentials.txt: $ git config --global credential.helper foo\n +@@ Documentation/gitcredentials.txt: $ git help credential-foo\n + $ git config --global credential.helper foo\n -------------------------------------------\n \n - \n -+=== OAuth credential helpers\n -+\n -+An alternative to entering passwords or personal access tokens is to use an\n -+OAuth credential helper. Many popular Git hosts support OAuth. The first time\n -+you authenticate, the helper opens a browser window to the host.\n -+Subsequent authentication is non interactive.\n -+\n -+Two cross-platform open-source OAuth credential helpers are:\n ++=== Available helpers\n +\n -+* https://github.com/git-ecosystem/git-credential-manager[Git Credential Manager]\n -+* https://github.com/hickford/git-credential-oauth[git-credential-oauth]\n ++The community maintains a comprehensive\n ++https://git-scm.com/doc/credential-helpers[list of Git credential helpers]\n ++available.\n +\n ++=== OAuth\n +\n ++An alternative to inputting passwords or personal access tokens is to use an\n ++OAuth credential helper. Initial authentication opens a browser window to the\n ++host. Subsequent authentication happens in the background. Many popular Git\n ++hosts support OAuth.\n + \n CREDENTIAL CONTEXTS\n -------------------\n - \n\n\n Documentation/gitcredentials.txt | 12 ++++++++++++\n 1 file changed, 12 insertions(+)\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex 100f045bb1a..a266870a042 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -104,6 +104,18 @@ $ git help credential-foo\n $ git config --global credential.helper foo\n -------------------------------------------\n \n+=== Available helpers\n+\n+The community maintains a comprehensive\n+https://git-scm.com/doc/credential-helpers[list of Git credential helpers]\n+available.\n+\n+=== OAuth\n+\n+An alternative to inputting passwords or personal access tokens is to use an\n+OAuth credential helper. Initial authentication opens a browser window to the\n+host. Subsequent authentication happens in the background. Many popular Git\n+hosts support OAuth.\n \n CREDENTIAL CONTEXTS\n -------------------\n\nbase-commit: 79bdd48716a4c455bdc8ffd91d57a18d5cd55baa\n-- \ngitgitgadget\n"},{"id":"478871","messageId":"20230627082101.GG1226768@coredump.intra.peff.net","threadId":"59799","inReplyTo":"pull.1538.v2.git.1687332624780.gitgitgadget@gmail.com","subject":"Re: [PATCH v2] doc: gitcredentials: link to helper list","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2023-06-27T08:21:01Z","receivedAt":"2023-06-27T08:21:06Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Jun 21, 2023 at 07:30:24AM +0000, M Hickford via GitGitGadget wrote:\n\n> From: M Hickford \n> \n> Link to community list of credential helpers. This is useful information\n> for users.\n> \n> Describe how OAuth credential helpers work. OAuth is a user-friendly\n> alternative to personal access tokens and SSH keys. Reduced setup cost\n> makes it easier for users to contribute to projects across multiple\n> forges.\n\nKind of seems like two topics in one patch, but OK.\n\nI don't have much of an opinion on either topic, but...\n\n> diff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\n> index 100f045bb1a..a266870a042 100644\n> --- a/Documentation/gitcredentials.txt\n> +++ b/Documentation/gitcredentials.txt\n> @@ -104,6 +104,18 @@ $ git help credential-foo\n> $ git config --global credential.helper foo\n> -------------------------------------------\n> \n> +=== Available helpers\n> +\n> +The community maintains a comprehensive\n> +https://git-scm.com/doc/credential-helpers[list of Git credential helpers]\n> +available.\n\nI'd note that full hyperlinks like this are kind of lousy in the manpage\nbuilds. You get:\n\n Available helpers\n\tThe community maintains a comprehensive list of Git credential\n\thelpers[1] available.\n\nin the text, and then way down at the bottom of the manpage:\n\n NOTES\n\t1. list of Git credential helpers\n\t https://git-scm.com/doc/credential-helpers\n\nSomething like:\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex fd5ecede13..1c7d302f18 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -106,9 +106,8 @@ $ git config --global credential.helper foo\n \n === Available helpers\n \n-The community maintains a comprehensive\n-https://git-scm.com/doc/credential-helpers[list of Git credential helpers]\n-available.\n+The community maintains a comprehensive list of Git credential helpers\n+at https://git-scm.com/doc/credential-helpers.\n \n === OAuth\n \n\nyields nicer text in the manpage, and asciidoc is smart enough to turn\nit into a hyperlink in the html version.\n\n-Peff\n"},{"id":"479334","messageId":"pull.1538.v3.git.1688848614262.gitgitgadget@gmail.com","threadId":"59799","inReplyTo":"pull.1538.v2.git.1687332624780.gitgitgadget@gmail.com","subject":"[PATCH v3] doc: gitcredentials: link to helper list","fromName":"M Hickford via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2023-07-08T20:36:54Z","receivedAt":"2023-07-08T20:37:00Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"From: M Hickford \n\nLink to community list of credential helpers. This is useful information\nfor users.\n\nDescribe how OAuth credential helpers work. OAuth is a user-friendly\nalternative to personal access tokens and SSH keys. Reduced setup cost\nmakes it easier for users to contribute to projects across multiple\nforges.\n\nSigned-off-by: M Hickford \n---\n gitcredentials: link to list of helpers\n \n Add link to list of helpers\n\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1538%2Fhickford%2Fhelpers-v3\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1538/hickford/helpers-v3\nPull-Request: https://github.com/gitgitgadget/git/pull/1538\n\nRange-diff vs v2:\n\n 1: 26818290468 ! 1: a6265156eed doc: gitcredentials: link to helper list\n @@ Documentation/gitcredentials.txt: $ git help credential-foo\n \n +=== Available helpers\n +\n -+The community maintains a comprehensive\n -+https://git-scm.com/doc/credential-helpers[list of Git credential helpers]\n -+available.\n ++The community maintains a comprehensive list of Git credential helpers at\n ++https://git-scm.com/doc/credential-helpers.\n +\n +=== OAuth\n +\n\n\n Documentation/gitcredentials.txt | 11 +++++++++++\n 1 file changed, 11 insertions(+)\n\ndiff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt\nindex 65d652dc40e..71dd19731af 100644\n--- a/Documentation/gitcredentials.txt\n+++ b/Documentation/gitcredentials.txt\n@@ -104,6 +104,17 @@ $ git help credential-foo\n $ git config --global credential.helper foo\n -------------------------------------------\n \n+=== Available helpers\n+\n+The community maintains a comprehensive list of Git credential helpers at\n+https://git-scm.com/doc/credential-helpers.\n+\n+=== OAuth\n+\n+An alternative to inputting passwords or personal access tokens is to use an\n+OAuth credential helper. Initial authentication opens a browser window to the\n+host. Subsequent authentication happens in the background. Many popular Git\n+hosts support OAuth.\n \n CREDENTIAL CONTEXTS\n -------------------\n\nbase-commit: 061c58647eb4b3f0e2c898333577d4b2af115b1d\n-- \ngitgitgadget\n"}]}