Re: Disabling credential helper?

From: Jeff King <peff@peff.net>
Date: Dec 3, 2014, 01:21 UTC
Message-ID: <20141203012148.GB29427@peff.net>
In-Reply-To: <20141203005953.GB6527@google.com>

On Tue, Dec 02, 2014 at 04:59:53PM -0800, Jonathan Nieder wrote:

Show 10 quoted lines

> brian m. carlson wrote:
> 
> > We've used GIT_ASKPASS=/bin/echo, which seems to solve the problem,
> > although it's ugly and I'm concerned it might break in the future.  Is
> > there a better way to do this?
> 
> That's a good question.  Before falling back to the askpass based
> prompt, Git tries each credential helper matching the URL in turn, and
> there doesn't seem to be an option to override that behavior and disable
> credential helpers.

I think this has nothing at all to do with credential helpers. Git tries the helpers, of which there are none, and falls back to askpass and prompting on the terminal. There is no way to design a helper to say "I tried and failed; do not bother prompting on the terminal". Git only sees that no helper provided an answer and uses its internal methods.

I did at one point consider making the terminal prompt a credential helper (since it is, after all, no different from git's perspective; it's just a mechanism for "somehow" coming up with a username/password pair). But people generally thought that was unnecessarily complicated (and it certainly is for the common cases).

> As long as you have no credential helpers configured, your GIT_ASKPASS
> based approach should work fine.

Yeah, it's fine (as is GIT_ASKPASS=true). You could also provide a credential helper that gives you an empty username and password. But in both cases, I think that git will then feed the empty password to the server again, resulting in an extra useless round-trip. You probably instead want to say "stop now, git, there is nothing else to be done".

We could teach the credential-helper code to do that (e.g., a helper returns "stop=true" and we respect that). But I think you can do it reasonably well today by making the input process fail. Sadly setting GIT_ASKPASS to "false" just makes git complain and then try harder[1]. But you can dissociate git from the terminal, like:

  $ setsid -w git ls-remote https://github.com/private/repo
  fatal: could not read Username for 'https://github.com': No such device or address

That might have other fallouts if you use process groups for anything. I have no problem with either an option to disable the terminal prompting, or teaching the credential-helper interface to allow helpers to stop lookup, either of which would be cleaner.

-Peff

[1] Courtesy of 84d7273 (prompt: fall back to terminal if askpass fails, 2012-02-03).