7

Because the trick with my .netrc file doesn't work (even though it has correct filepermissions), I modified my local .git/config to like like so:

[remote "origin"]
    fetch = +refs/heads/*:refs/remotes/origin/*
    url = https://<username>:<password>@code.google.com/p/<project>/

I immediately cloned the repo to check if the password would be still included, and it isn't.

I also have a mirror hosted at github, if it matters at all.

So is it in any way dangerous?

ThinkingStiff
  • 64,767
  • 30
  • 146
  • 239
hiobs
  • 618
  • 1
  • 6
  • 20

1 Answers1

5

So is it in any way dangerous?

Files in your .git directory are strictly part of your local repository; they don't get pushed to your remote repositories. So you're safe in the sense that you're not publishing your password on the network.

On the other hand, any system that requires you to cache your password on your local filesystem means that someone with access to your filesystem can potentially recover your password. Unfortunately, since Google doesn't support repository access over ssh, there's not much you can do about this (well, you can decide to use Github exclusively, which gets you public/private key authentication which is a substantial step up in security).

Regarding the use of the .netrc file, the Google Git FAQ says:

I put my credentials in .netrc, so why does git still ask me for a password?

The C git client always asks for a password if you have a username in the URL. Check your command line and .git/config file and make sure that your code.google.com URLs do not include your username (the part up to the @).

larsks
  • 277,717
  • 41
  • 399
  • 399
  • I know that part from the FAQ - and hilariously enough, git asks me for my username and password if I remove my username (and password) from the `url` line. Who knows what's going on! – hiobs Sep 23 '11 at 01:22
  • For what it's worth, I just converted one of my old Google Code projects to git and set up the `.netrc` as described and it works just fine. This is using git version 1.7.6 under Linux. – larsks Sep 23 '11 at 01:50
  • I've got git version 1.7.4. Maybe that's the reason? Somehow i'd find that hard to believe, but I seriously have no clue... – hiobs Sep 23 '11 at 02:00