Repository navigation
Keep clone tokens out of operator credential helpers and traces - #2078
Merged
Merged
Conversation
Every platform git command that carries a clone token in its URL - the workspace clone with its soft-ref probe and pin fetches, the publish push, LFS upload and readback, the launch-base ls-remote, the integration clone and push, the grader's base clone, and a pack clone from a pasted URL - still honoured system and global git config. On success git's transport hands the URL's username and password to every configured credential helper to store (git lfs push too: it runs that transport against the URL itself), so an operator's store or cache helper, or a system keychain, kept each run's token at rest. git also writes every command's argv, and each child's, to the trace2 targets that config names, and git 2.33 writes the URL's password verbatim. A tokened command now runs with `-c credential.<scheme>://<host>.helper=`. An empty value scoped to the tokened remote clears the helper list git builds for that remote - global helpers and ones scoped to its URL, path, user or an included file alike - and a command-line value is read last, so nothing is stored and nothing is asked: the token is already in the URL. The reset is scoped rather than global because git asks the same helpers for other hosts' credentials; an authenticating proxy named with only a user, or an LFS endpoint on another host, still gets the operator's password. A tokened command also runs with GIT_TRACE2, GIT_TRACE2_EVENT and GIT_TRACE2_PERF set to 0, which wins over the trace2 targets in config; a -c cannot, because git reads those first. TokenedGitCommand is the one place that decides a command is tokened - its git transport can reach a remote whose URL embeds a password - and applies both. Untokened commands keep the operator's helpers and tracing, which may be how they reach a private mirror. A checkout, reset or apply in a clone whose origin is tokened stays untokened: it reaches origin only for LFS objects, and git-lfs authenticates those from the URL without asking or telling a helper. Verified against git 2.33.0, 2.50.1 and 2.56.0 with git-lfs 3.7.1. The remote fixture's port retry reused an HttpListener that a failed Start had already closed; each attempt now gets a fresh listener.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TokenedGitCommand(backend/src/CodeSpace.Core/Services/Agents/Workspace/TokenedGitCommand.cs). That covers:lfs push,pushand readbackls-remotels-remote-c credential.<scheme>://<authority>.helper=ahead of its argv. Before this, git's transport handed the URL's password to every helper in system and global config on success, so an operator'sstore,cacheor keychain helper kept each run's token at rest.GIT_TRACE2,GIT_TRACE2_EVENTandGIT_TRACE2_PERFset to0. Operator trace2 targets record every command's argv and each child's; git 2.33 writes the password verbatim, and-ccannot override this because git reads trace2 config first.credential.helper=. git asks the same helper list for an authenticating proxy's password (http.proxy=http://user@hostorhttp_proxy) and for an LFS endpoint on another host. A global reset made every tokened command fail there withcould not read Password … terminal prompts disabled.Test plan
TokenedGitCommandTestspins the scoped reset and the trace2 environment literally. Call-site pins cover the provider, publish, resolver, integrator, grader and pack clone (TokenedGitSpecs).TokenedGitCredentialHelperFlowTestsuses real git, git-lfs andLocalProcessRunner, a scratch HOME/GIT_CONFIG_GLOBAL and a loopback smart-HTTP remote. It passed 20/20 on git 2.33.0, 2.50.1 and 2.56.0 with git-lfs 3.7.1. Rows: