mirror of
https://github.com/git/git.git
synced 2026-03-14 18:59:04 +01:00
3fc3ee7332
This is like "cache", except that we actually put the credentials on disk. This can be terribly insecure, of course, but we do what we can to protect them by filesystem permissions, and we warn the user in the documentation. This is not unlike using .netrc to store entries, but it's a little more user-friendly. Instead of putting credentials in place ahead of time, we transparently store them after prompting the user for them once. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
152 lines
4.5 KiB
Plaintext
152 lines
4.5 KiB
Plaintext
gitcredentials(7)
|
|
=================
|
|
|
|
NAME
|
|
----
|
|
gitcredentials - providing usernames and passwords to git
|
|
|
|
SYNOPSIS
|
|
--------
|
|
------------------
|
|
git config credential.https:example.com.username myusername
|
|
git config credential.helper "$helper $options"
|
|
------------------
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
|
|
Git will sometimes need credentials from the user in order to perform
|
|
operations; for example, it may need to ask for a username and password
|
|
in order to access a remote repository over HTTP. This manual describes
|
|
the mechanisms git uses to request these credentials, as well as some
|
|
features to avoid inputting these credentials repeatedly.
|
|
|
|
REQUESTING CREDENTIALS
|
|
----------------------
|
|
|
|
Without any credential helpers defined, git will try the following
|
|
strategies to ask the user for usernames and passwords:
|
|
|
|
1. If the `GIT_ASKPASS` environment variable is set, the program
|
|
specified by the variable is invoked. A suitable prompt is provided
|
|
to the program on the command line, and the user's input is read
|
|
from its standard output.
|
|
|
|
2. Otherwise, if the `core.askpass` configuration variable is set, its
|
|
value is used as above.
|
|
|
|
3. Otherwise, if the `SSH_ASKPASS` environment variable is set, its
|
|
value is used as above.
|
|
|
|
4. Otherwise, the user is prompted on the terminal.
|
|
|
|
AVOIDING REPETITION
|
|
-------------------
|
|
|
|
It can be cumbersome to input the same credentials over and over. Git
|
|
provides two methods to reduce this annoyance:
|
|
|
|
1. Static configuration of usernames for a given authentication context.
|
|
|
|
2. Credential helpers to cache or store passwords, or to interact with
|
|
a system password wallet or keychain.
|
|
|
|
STATIC CONFIGURATION
|
|
--------------------
|
|
|
|
Git can look for credential information in your git config files. Note
|
|
that it only makes sense to store usernames, not passwords, as git
|
|
config files are not encrypted or usually even protected by filesystem
|
|
permissions.
|
|
|
|
For a given credential request, git uses a unique token to represent the
|
|
context of a request. For example, a request to
|
|
`https://example.com/repo.git` would have the context
|
|
`https:example.com`. See `CONTEXT TOKENS` below for a full list.
|
|
|
|
To statically configure a username, set the configuration variable
|
|
`credential.$token.username`. For example, in this instance git will
|
|
prompt only for the password, not the username:
|
|
|
|
--------------------------------------------------------------
|
|
$ git config --global credential.https:example.com.username me
|
|
$ git push https://example.com/repo.git
|
|
Password:
|
|
--------------------------------------------------------------
|
|
|
|
CREDENTIAL HELPERS
|
|
------------------
|
|
|
|
Credential helpers are external programs from which git can request
|
|
usernames and passwords.
|
|
|
|
To use a helper, you must first select one to use. Git currently
|
|
includes the following helpers:
|
|
|
|
cache::
|
|
|
|
Cache credentials in memory for a short period of time. See
|
|
linkgit:git-credential-cache[1] for details.
|
|
|
|
store::
|
|
|
|
Store credentials indefinitely on disk. See
|
|
linkgit:git-credential-store[1] for details.
|
|
|
|
You may may also have third-party helpers installed; search for
|
|
`credential-*` in the output of `git help -a`, and consult the
|
|
documentation of individual helpers. Once you have selected a helper,
|
|
you can tell git to use it by putting its name into the
|
|
credential.helper variable.
|
|
|
|
1. Find a helper.
|
|
+
|
|
-------------------------------------------
|
|
$ git help -a | grep credential-
|
|
credential-foo
|
|
-------------------------------------------
|
|
|
|
2. Read its description.
|
|
+
|
|
-------------------------------------------
|
|
$ git help credential-foo
|
|
-------------------------------------------
|
|
|
|
3. Tell git to use it.
|
|
+
|
|
-------------------------------------------
|
|
$ git config --global credential.helper foo
|
|
-------------------------------------------
|
|
|
|
If there are multiple instances of the `credential.helper` configuration
|
|
variable, each helper will be tried in turn, and may provide a username,
|
|
password, or nothing. Once git has acquired both a username and a
|
|
password, no more helpers will be tried.
|
|
|
|
CUSTOM HELPERS
|
|
--------------
|
|
|
|
You can write your own custom helpers to interface with any system in
|
|
which you keep credentials. See the documentation for git's
|
|
link:technical/api-credentials.html[credentials API] for details.
|
|
|
|
CONTEXT TOKENS
|
|
--------------
|
|
|
|
The full set of unique context tokens provided by git to credential
|
|
helpers is:
|
|
|
|
`$protocol:$hostname`::
|
|
|
|
A network request to a specific host. `$protocol` is
|
|
either `http` or `https`, and `$hostname` is the hostname
|
|
provided to git (which may not be fully qualified).
|
|
|
|
`cert:$filename`::
|
|
|
|
A password to decrypt a certificate on disk.
|
|
|
|
GIT
|
|
---
|
|
Part of the linkgit:git[1] suite
|