Re: [PATCH v2] Mention that password could be a personal access token.

From: Eric Sunshine <sunshine@sunshineco.com>
Date: Nov 2, 2022, 10:54 UTC
Message-ID: <CAPig+cQ2Tqt8rzvXsRjCsPFTkbq7B06gq2pourKXi5dKNx8oAA@mail.gmail.com>
In-Reply-To: <pull.1396.v2.git.1667385022103.gitgitgadget@gmail.com>

On Wed, Nov 2, 2022 at 6:36 AM M Hickford via GitGitGadget <gitgitgadget@gmail.com> wrote:

Show 13 quoted lines

> These days, the 'password' for a software forge might be personal access
> token or OAuth access token. These are popular, so worth clarifying that
> Git treats them just the same.
>
> Signed-off-by: M Hickford <mirth.hickford@gmail.com>
> ---
> diff --git a/Documentation/gitcredentials.txt b/Documentation/gitcredentials.txt
> @@ -21,6 +21,9 @@ in order to access a remote repository over HTTP. This manual describes
>  the mechanisms Git uses to request these credentials, as well as some
>  features to avoid inputting these credentials repeatedly.
>
> +Some repositories accept multiple passwords, including personal access
> +tokens and OAuth access tokens. Git handles all of these the same.

I easily understood Ævar's point about these types of secrets all being different names for a password, but I find the above change rather confusing when it mentions "multiple passwords". That makes me think I may need to somehow configure multiple passwords for a site (even though I know that's not what you meant).

How about a different approach, calling it a "secret" first, and then defining "secret" as different names for "password". Perhaps something like this:

    Git will sometimes need credentials from the user in order to
    perform operations; for example, it may need to ask for a username
    and secret in order to access a remote repository over HTTP.  The
    secret may be a password, passcode, personal access token, OAuth
    access token, etc.  This manual describes the mechanisms Git uses
    to request these credentials, as well as some features to avoid
    inputting these credentials repeatedly.