Git abuses qt4-ssh-askpass

Git abuses qt4-ssh-askpass

[Chris “Kwpolska” Warrick]

Hello,

when I’m using the HTTPS protocol to access repositories, a window
from /usr/bin/qt4-ssh-askpass comes up.  It asks for my “SSH pass
phrase”, twice.  Sadly, it’s wrong.  The actual things it wants is the
username in the first case, and the password used to access the remote
repository (eg. my GitHub password) in the second question.  This is a
bug, and very misleading behavior.

-- 
Chris “Kwpolska” Warrick <http://kwpolska.tk>
PGP: 5EAAEA16
stop html mail | always bottom-post | only UTF-8 makes sense

RE: Git abuses qt4-ssh-askpass

[Felipe Contreras]

Chris “Kwpolska” Warrick wrote:
> when I’m using the HTTPS protocol to access repositories, a window
> from /usr/bin/qt4-ssh-askpass comes up.  It asks for my “SSH pass
> phrase”, twice.  Sadly, it’s wrong.  The actual things it wants is the
> username in the first case, and the password used to access the remote
> repository (eg. my GitHub password) in the second question.  This is a
> bug, and very misleading behavior.

Same in seahorse (two password prompts).

-- 
Felipe Contreras

Re: Git abuses qt4-ssh-askpass

[Jeff King]

On Sat, May 10, 2014 at 10:41:28AM +0200, Chris “Kwpolska” Warrick wrote:

> when I’m using the HTTPS protocol to access repositories, a window
> from /usr/bin/qt4-ssh-askpass comes up.  It asks for my “SSH pass
> phrase”, twice.  Sadly, it’s wrong.  The actual things it wants is the
> username in the first case, and the password used to access the remote
> repository (eg. my GitHub password) in the second question.  This is a
> bug, and very misleading behavior.

If you have GIT_ASKPASS or SSH_ASKPASS set and git needs to prompt for a
username or password, it will call that program rather than prompting on
the terminal. It does pass a meaningful label to the askpass program,
but it sounds like your askpass program does not actually display it.

E.g., try setting GIT_TRACE=1. I get:

  $ GIT_TRACE=1 SSH_ASKPASS=ssh-askpass-fullscreen git fetch
  trace: built-in: git 'fetch'
  trace: run_command: 'git-remote-https' 'origin' 'https://github.com/peff/test'
  trace: run_command: 'ssh-askpass-fullscreen' 'Username for '\''https://github.com'\'': '
  trace: run_command: 'ssh-askpass-fullscreen' 'Password for '\''https://peff@github.com'\'': '

and the askpass program shows me those prompts. You may want to file a
bug report with qt4-ssh-askpass, as most other askpass programs
(including the original ssh-askpass that comes with ssh) respects the
prompt arguments.

That being said, we may be able to improve git, depending on what you
actually wanted to happen. For example, I don't think there is a way to
tell git "even though I have SSH_ASKPASS set, still prompt me on the
terminal". It's been generally assumed that you would only set that
variable if you preferred an external prompt to a terminal prompt.

You may also want to look into git's credential support (see "git help
credential"), which can let you store the username and password in
secure system-provided storage (however from the qt4 above, I guess you
might be using KDE, and I do not know of a KDE Wallet helper; there is
one for GNOME keyring).

-Peff