git: move credential helpers to exec path#347515
Merged
khaneliman merged 1 commit intoNixOS:stagingfrom Apr 21, 2025
Merged
Conversation
ofborg
bot
added
10.rebuild-darwin: 501+
wegank
added
the
2.status: merge conflict
joshheinrichs-shopify
force-pushed
the
git-creds-on-exec-path-2
branch
from
ffbb090 to
94a8a84
Compare
ofborg
bot
removed
the
2.status: merge conflict
wegank
added
the
2.status: merge conflict
Currently if the credential helpers packaged with git aren't on your PATH, git will fail to locate them. This most notably affects git maintanence[1] which generates systemd units / launchd agents that invoke git directly without setting PATH. Home Manager is also able to generate maintanence units for systemd and does not set PATH[2], meaning credential helpers will not work without additional configuration. Moving the credential helpers to git's exec path[3] allows git to locate them regardless of how PATH is set, and matches the packaging of Fedora[4] and Homebrew[5]. Typically credential helpers are not added to PATH unless they are provided by another package separate from git (e.g. git-credential-gcloud). I opted to create symlinks at the old bin paths in case some users were relying on invoking them directly. In practice I doubt this is done much. If we want to slim down git's bin dir I think the symlinks could be removed, and in doing so we'd better match the packaging done in other distributions. [1]: https://git-scm.com/docs/git-maintenance/2.47.1 [2]: https://github.com/nix-community/home-manager/blob/b6fd653ef8fbeccfd4958650757e91767a65506d/modules/programs/git.nix#L619 [3]: https://git-scm.com/docs/git/2.47.1#Documentation/git.txt---exec-pathltpathgt [4]: https://src.fedoraproject.org/rpms/git/blob/rawhide/f/git.spec#_651 [5]: https://github.com/Homebrew/homebrew-core/blob/12120ff79ce009489b958d8271af686d74403859/Formula/g/git.rb#L112
joshheinrichs-shopify
force-pushed
the
git-creds-on-exec-path-2
branch
from
94a8a84 to
74e7f97
Compare
ofborg
bot
removed
the
2.status: merge conflict
joshheinrichs-shopify
added a commit
to joshheinrichs-shopify/home-manager
that referenced
this pull request
Apr 21, 2025
This doesn't yet work for folks using git-credential-osxkeychain as it isn't placed on git's exec path[1]. I mostly attempted to mimic the agents that git maintanence generates for itself. The settings differ slightly because git configures calandar intervals incorrectly[2], and git started injecting some additional config settings recently[3] which would be good to mimic in another PR. [1] NixOS/nixpkgs#347515 [2] https://lore.kernel.org/git/[email protected] [3] git/git@4f55519
joshheinrichs-shopify
added a commit
to joshheinrichs-shopify/home-manager
that referenced
this pull request
Apr 21, 2025
This doesn't yet work for folks using git-credential-osxkeychain as it isn't placed on git's exec path[1]. I mostly attempted to mimic the agents that git maintanence generates for itself. The settings differ slightly because git configures calandar intervals incorrectly[2], and git started injecting some additional config settings recently[3] which would be good to mimic in another PR. [1] NixOS/nixpkgs#347515 [2] https://lore.kernel.org/git/[email protected] [3] git/git@4f55519
joshheinrichs-shopify
added a commit
to joshheinrichs-shopify/home-manager
that referenced
this pull request
Apr 21, 2025
This doesn't yet work for folks using git-credential-osxkeychain as it isn't placed on git's exec path[1]. I mostly attempted to mimic the agents that git maintanence generates for itself. The settings differ slightly because git configures calendar intervals incorrectly[2], and git started injecting some additional config settings recently[3] which would be good to mimic in another PR. [1] NixOS/nixpkgs#347515 [2] https://lore.kernel.org/git/[email protected] [3] git/git@4f55519
joshheinrichs-shopify
added a commit
to joshheinrichs-shopify/home-manager
that referenced
this pull request
Apr 21, 2025
This doesn't yet work for folks using git-credential-osxkeychain as it isn't placed on git's exec path[1]. I mostly attempted to mimic the agents that git maintenance generates for itself. The settings differ slightly because git configures calendar intervals incorrectly[2], and git started injecting some additional config settings recently[3] which would be good to mimic in another PR. [1] NixOS/nixpkgs#347515 [2] https://lore.kernel.org/git/[email protected] [3] git/git@4f55519
6 tasks
joshheinrichs-shopify
added a commit
to joshheinrichs-shopify/home-manager
that referenced
this pull request
Apr 21, 2025
This doesn't yet work for folks using git-credential-osxkeychain as it isn't placed on git's exec path[1]. I mostly attempted to mimic the agents that git maintenance generates for itself. The settings differ slightly because git configures calendar intervals incorrectly[2], and git started injecting some additional config settings recently[3] which would be good to mimic in another PR. [1] NixOS/nixpkgs#347515 [2] https://lore.kernel.org/git/[email protected] [3] git/git@4f55519
Contributor
|
Can merge as-is with the backwards compat, if someone has the appetite for removing the old binary location links and/or deprecating them. They can do it in a follow up PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently if the credential helpers packaged with git aren't on your PATH, git will fail to locate them. This most notably affects git maintanence1 which generates systemd units / launchd agents that invoke git directly without setting PATH. Home Manager is also able to generate maintanence units for systemd and does not set PATH2, meaning credential helpers will not work without additional configuration.
Moving the credential helpers to git's exec path3 allows git to locate them regardless of how PATH is set, and matches the packaging of Fedora4 and Homebrew5. Typically credential helpers are not added to PATH unless they are provided by another package separate from git (e.g. git-credential-gcloud).
I opted to create symlinks at the old bin paths in case some users were relying on invoking them directly. In practice I doubt this is done much. If we want to slim down git's bin dir I think the symlinks could be removed, and in doing so we'd better match the packaging done in other distributions.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.
Footnotes
https://git-scm.com/docs/git-maintenance/2.47.1 ↩
https://github.com/nix-community/home-manager/blob/b6fd653ef8fbeccfd4958650757e91767a65506d/modules/programs/git.nix#L619 ↩
https://git-scm.com/docs/git/2.47.1#Documentation/git.txt---exec-pathltpathgt ↩
https://src.fedoraproject.org/rpms/git/blob/rawhide/f/git.spec#_651 ↩
https://github.com/Homebrew/homebrew-core/blob/12120ff79ce009489b958d8271af686d74403859/Formula/g/git.rb#L112 ↩