Gix doesn't call the credentials helper properly about gitoxide

[Byron]

Thanks so much for reporting - I could reproduce the issue.

It boils down to the following: When detecting that a script should be executed, it applies a 'trick' to pass arguments. With that, it ends up invoking /bin/sh -c 'echo "$@" >&2 "$@"' -- store even though it should invoke /bin/sh -c 'echo "$@" >&2' $@ -- store.

Somehow, the $@ which is part of the 'trick' ends up as part of the script itself, not as a separate argument.

I'd expect to have a fix for that soon.

[Byron]

I have merged the PR and you could try it out for a spin on main if you want.

The following should do the trick.

cargo build --bin gix --no-default-features --features max-pure
./target/debug/gix …

Your particular usecase is handled now, and if it's not working you can get more information using gix --trace -v ….

Thanks for helping with validating the change 🙏.

[Byron]

Thanks for this gem!

When using GIT_TRACE=1 I see trace: run_command: 'echo "$@" "$@" >&2 store' and 'echo "$@" "$@" >&2 && exit 1 store' respectively. This explains why it prints a single store - the script has no arguments, and all it does is to add store to the end of the script itself.

gitoxide now says this, which I believe is consistent and provides the expected results.

 07:27:54 tracing DEBUG    │     ┝━ gix_protocol::handshake() [ 524ms | 70.96% ] service: UploadPack | extra_parameters: []
 07:27:54 tracing DEBUG    │     │  ┝━ 🐛 [debug]: launching credential helper | cmd: "git" "credential-osxkeychain" "get"
 07:27:54 tracing DEBUG    │     │  ┝━ 🐛 [debug]: launching credential helper | cmd: "git" "credential-osxkeychain" "store"
 07:27:54 tracing DEBUG    │     │  ┝━ 🐛 [debug]: Will not add '$@' to '"echo \"$@\" \"$@\" >&2 && exit 1"' as it seems to contain it already
 07:27:54 tracing DEBUG    │     │  ┝━ 🐛 [debug]: launching credential helper | cmd: "/bin/sh" "-c" "echo \"$@\" \"$@\" >&2 && exit 1" "--" "store"
 07:27:54 tracing DEBUG    │     │  ┝━ 🐛 [debug]: Will not add '$@' to '"echo \"$@\" \"$@\" >&2 && exit 1"' as it seems to contain it already
 07:27:54 tracing DEBUG    │     │  ┕━ 🐛 [debug]: launching credential helper | cmd: "/bin/sh" "-c" "echo \"$@\" \"$@\" >&2 && exit 1" "--" "store"

It always runs the helper in a shell, which is why that usually works. I do not know where the $@ suggestion in pass-git-helper is coming from though, as it should not be required at all even for Git.

From all I can tell, gitoxide is consistent here as it uses the same engine for invoking commands as it always does, which should support typical Git use-cases, while being more open overall.

In any case, I think this concludes this interesting exploration into the depth of Git interactions with credential helper, and documentation some of these have :).

[jalil-salame]

Actually, this seems to be cause by the "$@" being expanded and get being provided, if I remove the "$@" (git config credential.helper '!echo >&2'), both git and gix work the same way.

It is still desirable to match git's behavior as pass-git-helper suggests this.

The way git handles this is weird: !echo $@ $@ prints get thrice in gix, but only once in git.

[jalil-salame]

Without looking at the git credential's implementation. My guess is that git just adds a get at the end of the command (i.e. echo $@ $@ -> echo $@ $@ get) while gix both adds a get at the end and calls it with get (i.e. echo $@ $@ -> sh -c 'echo $@ $@ get' -- get). Which would explain the difference in behavior.

Another clue is !echo $@ >&2 exit 1 will print get then fail with too many arguments for exit when using gix and it prints nothing before failing the same way when using git.

[Byron]

I have made a symptomatic fix in #1286 that you could try, even though I think that there is more going on here.
From what I can tell, running credential helpers works fine, and it's the doubling of arguments in this specific case has nothing to do with its correct functioning.

Thus, I don't know what else I can do as I don't actually understand the problem. Admittedly, I also don't understand how Git manages to not double the arguments given its code - maybe it doesn't run into this code at all which is also the reason that they suggest to add $@ in the end of the script even though that's not needed with the way gitoxide is currently functioning.

After having written this, I do believe I understand the issue, which is to get credential helpers to work that use $@ like described in pass-git-helper, and I do think that's the case now.

[jalil-salame]

I have made a symptomatic fix in #1286 that you could try, even though I think that there is more going on here.
From what I can tell, running credential helpers works fine, and it's the doubling of arguments in this specific case has nothing to do with its correct functioning.

Thus, I don't know what else I can do as I don't actually understand the problem. Admittedly, I also don't understand how Git manages to not double the arguments given its code - maybe it doesn't run into this code at all which is also the reason that they suggest to add $@ in the end of the script even though that's not needed with the way gitoxide is currently functioning.

After having written this, I do believe I understand the issue, which is to get credential helpers to work that use $@ like described in pass-git-helper, and I do think that's the case now.

I feel like git has legacy behavior which the helpers work around by using $@. I'll take a look at the code and see what I can figure out.

[jalil-salame]

So this fixes the common case credential.helper '!pass-git-helper "$@"', which is all I (and hopefully everyone) will need, but it still has differences with git:

$ git config credential.helper '!echo "$@" "$@" >&2'
$ gix-v0.33.0 fetch
get get get
...
^C
$ gix-main fetch
get get
...
^C
$ git fetch
get
...
^C

Why git does that? I can't tell. As far as I understand from the linked git code it should behave like gix-v0.33.0 and print get get get.

Do you have an issue to track known differences to git? This feels like it should not impact anyone, but it should be documented somewhere.

[jalil-salame]

Another example of gix-main and git handling things differently:

$ git config credential.helper '!echo "$@" "$@" >&2 && exit 1'
$ gix-v0.33.0 fetch
get get
--: line 1: exit: too many arguments
Cannot run askpass program: "" with error: No such file or directory (os error 2)

$ gix-main fetch
get get
Cannot run askpass program: "" with error: No such file or directory (os error 2)

$ git fetch

echo "$@" "$@" >&2 && exit 1 get: line 1: exit: too many arguments
Password for 'https://[email protected]':

This suggests that the commands are:

• gix-v0.33.0: sh -c 'echo "$@" "$@" >&2 && exit 1 get' -- get.
• gix-main: sh -c 'echo "$@" "$@" >&2 && exit 1' -- get
• git: sh -c 'echo "$@" "$@" >&2 && exit 1 get'

I feel like gix-main does the right thing and git has a bug.