Git LFS does not respect level of config files for credential.helper

Question

Running a Git LFS command such as

GIT_TRACE=1 git lfs locks

reveals that the system credential.helper is used, even though it is overwritten by the local config.

Running

git config --system -l

lists 'credential.helper=manager'

whereas

git config --local -l

only lists 'credential.helper=other'

Running the Git LFS locks command with the tracer enabled shows this line

run-command.c:663       trace: run_command: 'git credential-manager get'

Removing the system wide manager with

git config --system --unset credential.helper

fixes the issue and my local helper 'other' is used correctly. According to the git configuration documentation, each level trumps the previous level, hence Git LFS is not respecting the git standard. Is there any smart way to make this work without unsetting the system wide helper and by that potentially breaking authentication for other repositories?

Answer 1

Actually, Git LFS is doing the right thing here. It uses Git's git credential command and therefore inherits exactly the behavior that Git itself has.

While you are correct that when a Git option takes a single value, more specific configuration files override more general files, in the case of credential.helper, it's possible to specify multiple values. This can be helpful if you have a custom credential helper for one set of sites (e.g., those in one set of domains) and then a regular helper for other sites. All the credential helpers in this case will be asked for credentials until one is found that provides the required credentials.

If you want to override this for just one repository, you can write something like this in .git/config to first clear the existing list (with the empty entry) and then add a new credential helper:

[credential]
    helper =
    helper = other

This is pretty tricky to set correctly from git config, so I recommend editing the file by hand.