Git credentials helpers

• Gitlab docs: OAuth credential helpers
• Git book: Credential Storage
• Storing Git Credentials with Git Credential Helper

Cache daemon running in background:

git credential-cache--daemon /home/varac/.cache/git/credential/socket

git-credential-oauth

• GitHub
• Golang
• How it works
• Downsides
  • Each repo needs to get allowed with OAuth, because for each repo an own secret is stores in the git credential store. That's why it doesn't scale well with tools like gitlabber i.e.

Install:

pamac install git-credential-oauth

Configure:

git config --global --unset-all credential.helper
git config --global --add credential.helper "cache --timeout 21600" # six hours
git config --global --add credential.helper oauth

Custom Gitlab host

• Custom Gitlab hosts need to get registered manually, until Preconfigure Git Credential Manager as instance-wide OAuth application is solved.
• Docs: Custom hosts

Edit ~/.config/git/config or:

export GITLAB_URL=https://0xacab.org
git config --global credential.${GITLAB_URL}.oauthClientId $(gopass show --password mnt/ndr/token/0xacab.org/varac/application/git-credential-oauth/id
git config --global credential.${GITLAB_URL}.oauthScopes read_repository write_repository
git config --global credential.${GITLAB_URL}.oauthAuthURL /oauth/authorize
git config --global credential.${GITLAB_URL}.oauthTokenURL /oauth/token
git config --global credential.${GITLAB_URL}.oauthDeviceAuthURL /oauth/authorize_device

Test/Debug

export GIT_TRACE=1
echo url=https://gitlab.com | git credential fill

Configure custom Gitlab hosts

Custom GitLab instance support

Issues

• FR: Allow all repos of an instance

git-credential-manager

• GitHub
• dot.net, huge
• AUR packages
  • git-credential-manager-bin
  • git-credential-manager-extras
• Docs
  • Multiple users
  • Gitlab

Setup

• Install instructions
• Credential stores:

  GCM comes without a default store on Linux distributions.

  • reedesktop.org Secret Service APIo
    • Uses libsecret library to interact with the Secret Service.

Configure:

git config --global credential.helper manager
git config --global credential.credentialStore secretservice
git config --global credential.https://gitlab.com.provider gitlab
git config --global credential.gitlabAuthMpdes browser  # OAuth

Gitlab

• GCM only supports gitlab.com out the box. To use with another instance requires manual setup on GitLab to register an OAuth application
  • Preconfigure Git Credential Manager as instance-wide OAuth application

Usage

Show cached credentials in libsecret store:

lssecret

Gopasspw git-credential-gopass

• Website
• Warning: Credentials might end up in the repo to be cloned

Install:

pamac install git-credential-gopass
git help -a | grep gopass

Setup:

git config --global credential.helper gopass

Setup for specific store/mount:

git config --global credential.helper "gopass --store=work"