Re: git credential cache and sudo

From: Jeff King <peff@peff.net>
Date: Mar 15, 2021, 18:56 UTC
Message-ID: <YE+t6z6j2ITeqpnD@coredump.intra.peff.net>
In-Reply-To: <YEwoyeYM7ac+6aIx@google.com>

On Fri, Mar 12, 2021 at 06:51:53PM -0800, Jonathan Nieder wrote:

Show 13 quoted lines

> > Note that it's a little funky to be accessing the cache as a different user than
> > the one who created it. This should work reliably when the cache was created by
> > your normal user, but then accessed as root, because root has permissions to
> > access the socket. But if you spawn a cache daemon as root (because the _first_
> > operation you perform is as root, which automatically starts a daemon to store
> > the cached credential), then it's likely you won't be able to access it as your
> > regular user.
> 
> I wonder if this suggests a missing feature in
> git-credential-cache(1): if the manpage advertised a way to launch the
> daemon through an explicit command, similar to 'ssh-agent', then a
> user could run that as themselves before running other commands that
> communicate with it as another user.

Perhaps. The daemon side of the credential-cache helper does not work quite like ssh-agent, though, in that it tries to be ephemeral. So after starting, you have 30 seconds to give it some data to cache before it will exit. Normally this is fine since it's started by the client side of the helper, which will then immediately supply it with data.

So after starting it, you'd need to immediately prime it with data, either manually or by running a Git command. And then hope that command, including time to talk to the other side on the network and for you to type your password, does not exceed the timeout.

-Peff