Re: [PATCH 1/1] Git config allows value setting from stdin

From: Junio C Hamano <gitster@pobox.com>
Date: Sep 17, 2019, 16:59 UTC
Message-ID: <xmqqy2ym97vk.fsf@gitster-ct.c.googlers.com>
In-Reply-To: <20190917133135.190145-2-git@zjvandeweg.nl>

Zeger-Jan van de Weg <git@zjvandeweg.nl> writes:

> Subject: Re: [PATCH 1/1] Git config allows value setting from stdin

Probably something like this, with the "<area>:" prefix.

	config: learn the --stdin option to take args from the standard input

> When setting values in the git config, the value is part of the
> arguments for execution. This potentially leaks the value through
> logging, or other programs like `ps`.

OK.

> Prior to this change, there was no option to do this. This change adds
> the `--stdin` to be combined with `--add`. When passed, the value cannot
> be passed and is read through stdin.

That's overly verbose.

	Add the `--stdin` option that can be used with `--add` to
	instead take the variables and values from the standard
	input to hide them from prying eyes.

or something? When you say "Add", we know there isn't any right now (that is why you are adding, after all).

Also, shouldn't the variable also be considered sensitive?  IOW

	$ git config --stdin --add <<\EOF
	remote.hidden.url=https://user:pass@over.there/repo
	EOF

instead of

	$ git config --stdin --add remote.hidden.url <<\EOF
	https://user:pass@over.there/repo
	EOF

Incidentally, allowing it to take variable=value pair would also allow you to set many of them in batch, which is another benefit.

> -'git config' [<file-option>] [--type=<type>] --add name value
> +'git config' [<file-option>] [--type=<type>] --add [--stdin] name [value]

This does not convey "you pass name and value without --stdin, or you pass only name with --stdin" and instead allow a nonsense like "git config --add name". Splitting it into two would be a way to tell this unambiguously to the readers, e.g.

	git config [--type=<type>] --add name value
	git config [--type=<type>] --add --stdin name

although I suspect we would also want to allow treating the varilabe names as sensitive.

Thanks.