Re: [RFC] Add way to make Git credentials accessible from clean/smudge filter

From: Lars Schneider <larsxschneider@gmail.com>
Date: Nov 11, 2016, 09:28 UTC
Message-ID: <77603924-3552-4146-9C9E-A106CFA96D7A@gmail.com>
In-Reply-To: <20161110160809.2gvf67rlnvounulf@sigill.intra.peff.net>

On 10 Nov 2016, at 17:08, Jeff King <peff@peff.net> wrote:

Show 18 quoted lines

> On Thu, Nov 10, 2016 at 01:10:17PM +0100, Matthieu Moy wrote:
> 
>> Lars Schneider <larsxschneider@gmail.com> writes:
>> 
>>> I haven't looked at an implemenation approach at all. I wonder if this could
>>> be OK from a conceptional point of view or if there are obvious security 
>>> problems that I am missing.
>> 
>> Did you consider just running "git credential" from the filter? It may
>> not be the perfect solution, but it should work. I already used it to
>> get credential from a remote-helper (git-remote-mediawiki). When
>> prompting credentials interactively, it grabs the terminal directly, so
>> it work even if stdin/stdout are used for the protocol.
> 
> Yeah, that is the solution I was going to suggest. The credentials are
> totally orthogonal to the filters, and I would rather not shove them
> into the protocol. It's an extra process, but with the new multi-use
> smudge filter, it's one per git invocation, not one per file.

The trouble with "git credential" is that it works only if the credential helper is setup correctly. Although I assume that most people have setup this, I have also worked with a number of people who prefer to enter their passwords every time Git makes a network connection.

- Lars