Re: encrypted netrc for Git

On Thu, 14 Jul 2011 11:00:33 -0400 Jeff King <peff@peff.net> wrote: 

JK> On Thu, Jul 14, 2011 at 09:05:50AM -0500, Ted Zlatanov wrote:

TZ> This would also be really nice. ~/.netrc is not a great place to put TZ> passwords for the HTTP transport. In GNU Emacs we have ~/.authinfo.gpg TZ> with the same content as ~/.netrc but encrypted by GPG and thus more TZ> secure (the user is either prompted for the password, if the file is TZ> encrypted symmetrically, or the user simply loads their private key into TZ> the GPG agent). I believe all this can be done with the GPGME library. TZ> There's also the Secrets API on newer Gnome and KDE installs, which has TZ> a pretty nice D-Bus interface.

JK> Check out:

JK>   https://github.com/peff/git/commits/jk/http-auth

JK> which provides an interface for getting credentials from external JK> helpers.

The API is good, but it's not clear from the docs how to configure credential helpers from the user side. From the tests it looks like you set GIT_ASKPASS to them, is that right? And you can also set credential.helper?

Where do those helpers fit with the .netrc file? Are they called before or after or instead of the .netrc parse?

Linking these with external libraries like GPGME and the Secrets API will be pretty easy and improve the user experience. So I'll be glad to work on it and provide you with feedback. Would you be interested in pushing your patches further after the testing? They seem pretty complete.

I'm off-line for the next 10 days or so; I'll start testing when I get back.

Thanks for your help Ted