Re: Git abuses qt4-ssh-askpass

[Jeff King <peff@peff.net>]

On Sat, May 10, 2014 at 10:41:28AM +0200, Chris “Kwpolska” Warrick wrote:

> when I’m using the HTTPS protocol to access repositories, a window
> from /usr/bin/qt4-ssh-askpass comes up.  It asks for my “SSH pass
> phrase”, twice.  Sadly, it’s wrong.  The actual things it wants is the
> username in the first case, and the password used to access the remote
> repository (eg. my GitHub password) in the second question.  This is a
> bug, and very misleading behavior.

If you have GIT_ASKPASS or SSH_ASKPASS set and git needs to prompt for a
username or password, it will call that program rather than prompting on
the terminal. It does pass a meaningful label to the askpass program,
but it sounds like your askpass program does not actually display it.

E.g., try setting GIT_TRACE=1. I get:

  $ GIT_TRACE=1 SSH_ASKPASS=ssh-askpass-fullscreen git fetch
  trace: built-in: git 'fetch'
  trace: run_command: 'git-remote-https' 'origin' 'https://github.com/peff/test'
  trace: run_command: 'ssh-askpass-fullscreen' 'Username for '\''https://github.com'\'': '
  trace: run_command: 'ssh-askpass-fullscreen' 'Password for '\''https://peff@github.com'\'': '

and the askpass program shows me those prompts. You may want to file a
bug report with qt4-ssh-askpass, as most other askpass programs
(including the original ssh-askpass that comes with ssh) respects the
prompt arguments.

That being said, we may be able to improve git, depending on what you
actually wanted to happen. For example, I don't think there is a way to
tell git "even though I have SSH_ASKPASS set, still prompt me on the
terminal". It's been generally assumed that you would only set that
variable if you preferred an external prompt to a terminal prompt.

You may also want to look into git's credential support (see "git help
credential"), which can let you store the username and password in
secure system-provided storage (however from the qt4 above, I guess you
might be using KDE, and I do not know of a KDE Wallet helper; there is
one for GNOME keyring).

-Peff