40

I am cloning a git repository in a script like this:

git clone https://user:password@host.com/name/.git

This works, but my username and my password! are now stored in the origin url in .git/config.

How can I prevent this, but still do this in a script (so no manual password input)?

  • You could probably update the origin afterwards: git remote set-url origin https://host.com/name/.git – ceejayoz Nov 15 '16 at 15:37
  • @ceejayoz Yes, thats possible. Thanks for the Idea. I am still hopening for a solution, that does not even temporary store the credentials. – Nathan Nov 15 '16 at 15:39
  • 4
    Sure - use SSH-based auth with a key. – ceejayoz Nov 15 '16 at 16:13
  • 2
    Is there a reason you use https instead of SSH? SSH supports keys. – mzhaase Nov 15 '16 at 16:17
  • 1
    @MartijnCourteaux The password is actually given to the script through an enviornment variable. So I actually do: git clone username:$PASSWORD@... – Nathan Nov 16 '16 at 7:12
24

The method that I use is to actually use a git pull instead of a clone. The script would look like:

mkdir repo
cd repo
git init
git config user.email "email"
git config user.name "user"
git pull https://user:password@github.com/name/repo.git master

This will not store your username or password in .git/config. However, unless other steps are taken, the plaintext username and password will be visible while the process is running from commands that show current processes (e.g. ps).

As brought up in the comments, since this method is using HTTPS you must URL-encode any special characters that may appear in your password as well.

One further suggestion I would make (if you can't use ssh) is to actually use an OAuth token instead of plaintext username/password as it is slightly more secure. You can generate an OAuth token from your profile settings: https://github.com/settings/tokens.

Then using that token the pull command would be

git pull https://$OAUTH_TOKEN:x-oauth-basic@github.com/name/repo.git master
| improve this answer | |
  • Unofrtantly I cannot use auth tokens. I am not using github but a private server. – Nathan Nov 16 '16 at 7:20
  • 3
    Should also be noted that the username and password will be visible in, e.g., ps while the pull runs (at least unless you've prevented users from seeing each others' processes) – derobert Nov 21 '16 at 17:30
  • Points for oath usage. It's exactly what I needed in production/staging/dev. – RobotHumans Sep 11 '18 at 14:39
  • a million thanks to you buddy. wasted hours n hours n finally your answer came to resue. :thumbsup – JasdeepSingh Feb 28 '19 at 15:07
  • Note that in this solution reserved characters need to be escaped. e.g. myp@ssword should be provided as: myp%40ssword – Marinos An Jan 7 at 13:12
21

IMO the best solution is using a custom GIT_ASKPASS helper and deliver the password as another environment variable. So for example, create a file git-askpass-helper.sh as:

#!/bin/sh
exec echo "$GIT_PASSWORD"

and then run git clone https://username@hostname/repo with environment variables GIT_ASKPASS=/path/to/git-askpass-helper.sh and GIT_PASSWORD=nuclearlaunchcodes.

This has the advantage that the password won't be visible in the process list too.

| improve this answer | |
  • +1 for creative solution. This would be a little more secure than the git pull solution and allow you to store the plaintext password as a secret in your automated deploy tool of choice. – FGreg Jun 14 '18 at 17:43
  • 1
    Did not work. Still asks for a password on git clone – Marinos An Dec 18 '19 at 15:13
  • Any way to make it work in windows? I think i saw the solution to replace the .sh file with exe, but i do not want to (Cannot stress enough) commit an exe into my repo – Pranav Raj Feb 4 at 21:26
  • @PranavRaj I think you should be able to port it to a .bat or .cmd file as well but I'm not familiar with that syntax. – intgr Feb 5 at 13:56
  • For anyone else looking for a cross platform solution: I used the github.com/libgit2/libgit2sharp/wiki nuget package and I was able to build a .net core app which worked on both windows and linux :) Instead of storing the password in my code, I stored it in the key vault and inside the code accessed the secret - so not saving git password as a plain text anywhere :) – Pranav Raj Feb 5 at 20:16
15

You can enter your connection creds in your ~/.netrc file. Something along the lines of:

machine host.example.net
login bart
password eatmyshorts

Just make sure to chmod that file to 600. If you're using windows, the following link may be useful: https://stackoverflow.com/questions/6031214/git-how-to-use-netrc-file-on-windows-to-save-user-and-password

Personally, I have a tendency to use SSH keys for auth purposes (if you are allowed, of course).

| improve this answer | |
  • Well, this would leave my password inside ~/.netrc. I Also do not want that. – Nathan Nov 16 '16 at 7:14
  • this worked for me, when GIT_ASKPASS suggestion above failed; thanks. – Paul M Mar 25 at 23:50
10

After going over dozens of SO posts, blogs, etc, I tried out every method, and this is what I came up with. It covers EVERYTHING.

See The Git Credentials & Private Packages Cheatsheet

These are all the ways and tools by which you can securely authenticate git to clone a repository without an interactive password prompt.

  • SSH Public Keys
    • SSH_ASKPASS
  • API Access Tokens
    • GIT_ASKPASS
    • .gitconfig insteadOf
    • .gitconfig [credential]
    • .git-credentials
    • .netrc
  • Bonus: Works with Private Packages
    • node / npm package.json
    • python / pip / eggs requirements.txt
    • ruby gems Gemfile
    • golang go.mod

Best options for no plaintext storage

From what's asked here either SSH Keys, GIT_ASKPASS, or git credential store using the OS Keychain manager might be the best choice.

Since GIT_ASKPASS is probably the least understood of the 3, I'll detail that here - and the others are in the cheatsheet.

GIT_ASKPASS

How to create an GIT_ASKPASS script:

echo 'echo $MY_GIT_TOKEN' > $HOME/.git-askpass

How to use it:

export MY_GIT_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
export GIT_ASKPASS=$HOME/.git-askpass
git clone https://token@code.example.com/project.git

The script receives stdin in the form of:

Password for 'scheme://host.tld':

The script receives Git ENVs such as:

GIT_DIR=/Users/me/project/.git
GIT_EXEC_PATH=/usr/local/Cellar/git/2.19.0_1/libexec/git-core
GIT_PREFIX=

More details in the cheatsheet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.