Subject: RE: git credential doesn't honor git config precedence rules

From: "Coirier, Emmanuel" <[email-masked]>
Date: Thu, 23 Mar 2023 10:34:45 +0000

Dear Jeff,

Thank you for your very instructive answer. I realized that I was only at the half of my journey though the credential system (and the config system also).

I'm still struggling with the manager-core helper that doesn't want to prompt me anything and persist to return blank user and password despite the fact it has no idea of the real values, but this is another story.

Best regards,

--
Emmanuel Coirier

Interne

> -----Message d'origine-----
> De : Jeff King <[email-masked]>
> Envoyé : mercredi 22 mars 2023 18:20
> À : Coirier, Emmanuel <[email-masked]>
> Cc : [email-masked]
> Objet : Re: git credential doesn't honor git config precedence rules
>
> [EMETTEUR EXTERNE] : Soyez vigilant avant d’ouvrir les pièces-jointes ou de
> cliquer sur les liens. En cas de doute, signalez le message via le bouton «
> Signaler un courriel suspect ».
>
> On Wed, Mar 22, 2023 at 04:45:51PM +0000, Coirier, Emmanuel wrote:
>
> > I think I found a bug with git credential: this tool doesn't call the
> > configured credential helper following the configuration rules.
> >
> > It calls the system configured credential helper (git config --system)
> > even if another one is configured (ie: at the global level : git config --global).
>
> That's because credential helpers are not a single variable where later entries
> override earlier ones, but is actually a list of helpers to execute. From "git
> help credentials":
>
>   If there are multiple instances of the credential.helper configuration
>   variable, each helper will be tried in turn, and may provide a
>   username, password, or nothing. Once Git has acquired both a username
>   and a password, no more helpers will be tried.
>
> > The problem I encountered is that the configured system one
> > (manager-core in my case) answers a wrong value instead of giving up.
> > The globally configured (wincred in my case) is then not called at all
> > and my authentication just fail without any way to manually enter login &
> pass.
>
> If you want to clear any prior entries in the list, you can do that explicitly.
> From the paragraph right below the one quoted above:
>
>   If credential.helper is configured to the empty string, this resets
>   the helper list to empty (so you may override a helper set by a
>   lower-priority config file by configuring the empty-string helper,
>   followed by whatever set of helpers you would like).
>
> > > What's different between what you expected and what actually
> happened?
> >
> > In this example, the "bla" credential helper is called even if the
> > wincred should have been the only one to be called.
> >
> > The result is OK since the "bla" credential returned a non zero return
> > code, then the global credential helper (wincred) was called.
>
> Right, this is the correct and documented behavior. You'd just want to reset
> the list in your local config like:
>
>   git config --global credential.helper ""
>   git config --global --add credential.helper wincred
>
> -Peff
Ce message et toutes les pièces jointes (ci-après le «message») sont confidentiels et établis à l’intention exclusive de ses destinataires. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. Si vous recevez ce message par erreur, merci de le détruire sans en conserver de copie et d’en avertir immédiatement l’expéditeur. Internet ne permettant pas de garantir l’intégrité de ce message, la Caisse des Dépôts et Consignations décline toute responsabilité au titre de ce message s’il a été modifié, altéré, déformé ou falsifié. Par ailleurs et malgré toutes les précautions prises pour éviter la présence de virus dans nos envois, nous vous recommandons de prendre, de votre côté, les mesures permettant d'assurer la non-introduction de virus dans votre système informatique. This email message and any attachments (“the email”) are confidential and intended only for the recipient(s) indicated. If you are not an intended recipient, please be advised that any use, dissemination, forwarding or copying of this email whatsoever is prohibited without prior written consent of Caisse des Depots et Consignations. If you have received this email in error, please delete it without saving a copy and notify the sender immediately. Internet emails are not necessarily secure, and Caisse des Depots et Consignations declines responsibility for any changes that may have been made to this email after it was sent. While we take all reasonable precautions to ensure that viruses are not transmitted via emails, we recommend that you take your own measures to prevent viruses from entering your computer system.