Skip to content

Commit 786ef50

Browse files
lmmarsanogitster
lmmarsano
authored and
gitster
committed
git-credential-netrc: accept gpg option
git-credential-netrc was hardcoded to decrypt with 'gpg' regardless of the gpg.program option. This is a problem on distributions like Debian that call modern GnuPG something else, like 'gpg2'. Set the command according to these settings in descending precedence 1. the git-credential-netrc command -g|--gpg option 2. the git gpg.program configuration option 3. the default: 'gpg' For conformance with Documentation/CodingGuidelines - use Git.pm for repository and global option queries - document -g|--gpg command option in command usage - test repository & command options - write documentation placeholders according to main standards Signed-off-by: Luis Marsano <luis.marsano@gmail.com> Acked-by: Ted Zlatanov <tzz@lifelogs.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent f07eeed commit 786ef50

File tree

6 files changed

+62
-24
lines changed

6 files changed

+62
-24
lines changed

‎contrib/credential/netrc/git-credential-netrc‎

Lines changed: 38 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@
22

33
use strict;
44
use warnings;
5+
use autodie;
56

67
use Getopt::Long;
78
use File::Basename;
9+
use Git;
810

9-
my $VERSION = "0.1";
11+
my $VERSION = "0.2";
1012

1113
my %options = (
1214
help => 0,
@@ -54,6 +56,7 @@ GetOptions(\%options,
5456
"insecure|k",
5557
"verbose|v",
5658
"file|f=s@",
59+
'gpg|g:s',
5760
);
5861

5962
if ($options{help}) {
@@ -62,27 +65,31 @@ if ($options{help}) {
6265

6366
print <<EOHIPPUS;
6467
65-
$0 [-f AUTHFILE1] [-f AUTHFILEN] [-d] [-v] [-k] get
68+
$0 [(-f <authfile>)...] [-g <program>] [-d] [-v] [-k] get
6669
6770
Version $VERSION by tzz\@lifelogs.com. License: BSD.
6871
6972
Options:
7073
71-
-f|--file AUTHFILE : specify netrc-style files. Files with the .gpg extension
72-
will be decrypted by GPG before parsing. Multiple -f
73-
arguments are OK. They are processed in order, and the
74-
first matching entry found is returned via the credential
75-
helper protocol (see below).
74+
-f|--file <authfile>: specify netrc-style files. Files with the .gpg
75+
extension will be decrypted by GPG before parsing.
76+
Multiple -f arguments are OK. They are processed in
77+
order, and the first matching entry found is returned
78+
via the credential helper protocol (see below).
7679
77-
When no -f option is given, .authinfo.gpg, .netrc.gpg,
78-
.authinfo, and .netrc files in your home directory are used
79-
in this order.
80+
When no -f option is given, .authinfo.gpg, .netrc.gpg,
81+
.authinfo, and .netrc files in your home directory are
82+
used in this order.
8083
81-
-k|--insecure : ignore bad file ownership or permissions
84+
-g|--gpg <program> : specify the program for GPG. By default, this is the
85+
value of gpg.program in the git repository or global
86+
option or gpg.
8287
83-
-d|--debug : turn on debugging (developer info)
88+
-k|--insecure : ignore bad file ownership or permissions
8489
85-
-v|--verbose : be more verbose (show files and information found)
90+
-d|--debug : turn on debugging (developer info)
91+
92+
-v|--verbose : be more verbose (show files and information found)
8693
8794
To enable this credential helper:
8895
@@ -99,8 +106,9 @@ in the path.)
99106
100107
git config credential.helper '$shortname -f AUTHFILE -v'
101108
102-
Only "get" mode is supported by this credential helper. It opens every AUTHFILE
103-
and looks for the first entry that matches the requested search criteria:
109+
Only "get" mode is supported by this credential helper. It opens every
110+
<authfile> and looks for the first entry that matches the requested search
111+
criteria:
104112
105113
'port|protocol':
106114
The protocol that will be used (e.g., https). (protocol=X)
@@ -120,7 +128,7 @@ host=github.com
120128
protocol=https
121129
username=tzz
122130
123-
this credential helper will look for the first entry in every AUTHFILE that
131+
this credential helper will look for the first entry in every <authfile> that
124132
matches
125133
126134
machine github.com port https login tzz
@@ -137,8 +145,8 @@ Then, the helper will print out whatever tokens it got from the entry, including
137145
back to "protocol". Any redundant entry tokens (part of the original query) are
138146
skipped.
139147
140-
Again, note that only the first matching entry from all the AUTHFILEs, processed
141-
in the sequence given on the command line, is used.
148+
Again, note that only the first matching entry from all the <authfile>s,
149+
processed in the sequence given on the command line, is used.
142150
143151
Netrc/authinfo tokens can be quoted as 'STRING' or "STRING".
144152
@@ -152,7 +160,7 @@ EOHIPPUS
152160
my $mode = shift @ARGV;
153161

154162
# Credentials must get a parameter, so die if it's missing.
155-
die "Syntax: $0 [-f AUTHFILE1] [-f AUTHFILEN] [-d] get" unless defined $mode;
163+
die "Syntax: $0 [(-f <authfile>)...] [-d] get" unless defined $mode;
156164

157165
# Only support 'get' mode; with any other unsupported ones we just exit.
158166
exit 0 unless $mode eq 'get';
@@ -172,6 +180,8 @@ unless (scalar @$files) {
172180
$files = $options{file} = [ map { glob $_ } @candidates ];
173181
}
174182

183+
load_config(\%options);
184+
175185
my $query = read_credential_data_from_stdin();
176186

177187
FILE:
@@ -233,7 +243,7 @@ sub load_netrc {
233243

234244
my $io;
235245
if ($gpgmode) {
236-
my @cmd = (qw(gpg --decrypt), $file);
246+
my @cmd = ($options{'gpg'}, qw(--decrypt), $file);
237247
log_verbose("Using GPG to open $file: [@cmd]");
238248
open $io, "-|", @cmd;
239249
} else {
@@ -410,6 +420,14 @@ sub print_credential_data {
410420
printf "%s=%s\n", $git_token, $entry->{$git_token};
411421
}
412422
}
423+
sub load_config {
424+
# load settings from git config
425+
my $options = shift;
426+
# set from command argument, gpg.program option, or default to gpg
427+
$options->{'gpg'} //= Git->repository()->config('gpg.program')
428+
// 'gpg';
429+
log_verbose("using $options{'gpg'} for GPG operations");
430+
}
413431
sub log_verbose {
414432
return unless $options{verbose};
415433
printf STDERR @_;

‎contrib/credential/netrc/t-git-credential-netrc.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
test_expect_success \
2020
'set up test repository' \
21-
:
21+
'git config --add gpg.program test.git-config-gpg'
2222

2323
# The external test will outputs its own plan
2424
test_external_has_tap=1

‎contrib/credential/netrc/test.command-option-gpg‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/sh
2+
echo machine command-option-gpg login username password password

‎contrib/credential/netrc/test.git-config-gpg‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/sh
2+
echo machine git-config-gpg login username password password

‎contrib/credential/netrc/test.netrc.gpg‎

Whitespace-only changes.

‎contrib/credential/netrc/test.pl‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,18 @@
99
use IPC::Open2;
1010

1111
BEGIN {
12-
# t-git-credential-netrc.sh kicks off our testing, so we have to go from there.
12+
# t-git-credential-netrc.sh kicks off our testing, so we have to go
13+
# from there.
1314
Test::More->builder->current_test(1);
1415
Test::More->builder->no_ending(1);
1516
}
1617

1718
my @global_credential_args = @ARGV;
1819
my $scriptDir = dirname rel2abs $0;
19-
my $netrc = catfile $scriptDir, 'test.netrc';
20-
my $gcNetrc = catfile $scriptDir, 'git-credential-netrc';
20+
my ($netrc, $netrcGpg, $gcNetrc) = map { catfile $scriptDir, $_; }
21+
qw(test.netrc
22+
test.netrc.gpg
23+
git-credential-netrc);
2124
local $ENV{PATH} = join ':'
2225
, $scriptDir
2326
, $ENV{PATH}
@@ -87,6 +90,19 @@ BEGIN
8790
is($cred->{password}, 'bobwillknow', "Got correct 'host:port kills host' password");
8891
is($cred->{username}, 'bob', "Got correct 'host:port kills host' username");
8992

93+
diag 'Testing netrc file decryption by git config gpg.program setting\n';
94+
$cred = run_credential( ['-f', $netrcGpg, 'get']
95+
, { host => 'git-config-gpg' }
96+
);
97+
98+
ok(scalar keys %$cred == 2, 'Got keys decrypted by git config option');
99+
100+
diag 'Testing netrc file decryption by gpg option\n';
101+
$cred = run_credential( ['-f', $netrcGpg, '-g', 'test.command-option-gpg', 'get']
102+
, { host => 'command-option-gpg' }
103+
);
104+
105+
ok(scalar keys %$cred == 2, 'Got keys decrypted by command option');
90106

91107
sub run_credential
92108
{

0 commit comments

Comments
 (0)