From: Junio C Hamano <gitster@pobox.com>
Date: Tue, 13 May 2025 16:59:33 GMT
Subject: Re: Cleaning up "contrib/"
Message-ID: <xmqq8qn0h2fe.fsf@gitster.g>
In-Reply-To: <aCMLgaWXr_gM8g3l@pks.im>

Patrick Steinhardt <ps@pks.im> writes:

> Yup. I think safe credential helpers should rather be moved into our
> official tree. This includes at least libsecret and osxkeychain.

Yes.  s|^contrib/|| should be sufficient for them.

> I'm not
> sure about the netrc one though -- it's unsafe by nature, and I'm not
> sure I would feel comfortable with shipping such a credential helper
> that is known-unsafe.

That depends.  It is a known-convenient helper that can often be
used in an unsafe way, but when used with GPG encrypted netrc files,
especially on a single user box that is reasonably secured, it is
unfair to call it known-unsafe, I would have to say.

Thanks.