Re: [PATCH 1/1] credential: do not mask the username

From: Jeff King <peff@peff.net>
Date: Apr 30, 2019, 22:21 UTC
Message-ID: <20190430222146.GA19492@sigill.intra.peff.net>
In-Reply-To: <nycvar.QRO.7.76.6.1904301753030.45@tvgsbejvaqbjf.bet>

On Tue, Apr 30, 2019 at 06:07:15PM -0400, Johannes Schindelin wrote:

Show 13 quoted lines

> >   2. Use another tool besides askpass. I don't know of any askpass
> >      implementations that take something like our ECHO flag, but there
> >      are lots of other tools. I doubt there's any easy portable
> >      solution, though. And anyway, credential helpers are a much more
> >      advanced version of this anyway, so I'd probably steer people in
> >      that direction.
> [...]
> 
> How about inventing a new convention: we could set `GIT_ASKPASS_FLAGS`
> as an environment variable that contains whitespace-delimited flags, in
> the current instance just "echo"?
> 
> We could then teach `git-gui--askpass` to heed that.

Yeah, I almost suggested something like that for my (2) above, but I couldn't actually find an askpass implementation that supported this (though there are lots of general dialog tools that do).

But today I learned about git-gui--askpass. :)

So yeah, I think that is a solution in the right direction, but it may not be helping that many people if it is specific to git-gui--askpass.

> Mind you, these days, this patch is a lot less necessary because Git for
> Windows (which is *the* platform where you'd expect no terminal to be
> available when fetching/pushing, right?) defaults to using the Git
> Credential Manager [*1*].

The no-terminal thing isn't specific to Windows. You can imagine somebody triggering "git fetch" from any GUI on Linux that no longer has a controlling terminal (because the GUI was spawned by a desktop manager or some such).

But I definitely agree that credential helpers are the right way to do fancier prompting. AFAIK your GCM is the only one which actually does prompting (most of the rest are just key-store interfaces), but it's definitely inbounds and was part of the original intent. For usernames, I personally just stick mine in credential.$URL.username config, since they're obviously not a secret. But then my habits may not match most users. :)

Show 5 quoted lines

> What do you think about the `GIT_ASKPASS_FLAGS` thing? It is not perfect,
> but it could be used at least in conjunction with `git-gui--askpass` (or
> with other helpers that would make use of this side channel to receive
> more information about the way they should present the question to the
> user)?

It seems perfectly reasonable to me, but if it were me, I think this:

> Alternatively, I could simply drop that patch from Git for Windows, as it
> really only concerns users who override the default, opting out of using
> Git Credential Manager.

would be the path I would take.

-Peff