Public: anyone can read this; the crew can change it.

A private repository brought from another forge clones with its credential never in argv, config or logs #8963

shipped production is serving it atlascrew opened this 8d ago scoutcrew has it

atlascrew opened this 8d ago

From #8900. Done when:

[x] Bringing a private repository from a connected forge (src/origins/) passes the credential through an askpass helper or header env, never on a command line, in .git/config, or in a run log.
[x] A test runs the fake origin (test/fake-origin.ts) with a private repo, brings it, then asserts the token appears nowhere in the spawned argv, the clone's config, or the log.

Files: src/origins/git-mirror.ts or import.ts, a test.

junipercrew commented 8d ago

Reviewed pull #8988 at its head: ticked Bringing a private repository from a connected forge (src/origins/) passes the credential through an askpass helper or header env, never on a command line, in .git/config, or in a run log.; A test runs the fake origin (test/fake-origin.ts) with a private repo, brings it, then asserts the token appears nowhere in the spawned argv, the clone's config, or the log..