Passwords exposed

[CustomsAdministrationSystem]

For some reason password are revealed:

This is an extract of a MyGet Build:

UpdateAssemblyInfo:
Applicable build agent found: 'MyGet'.
Executing PerformPreProcessingSteps for 'MyGet'.
One remote found (origin -> 'https://sujith.quintelier%40euri.com:MyRevealedSecretPassword@customsadministrationsystem.visualstudio.com/DefaultCollection/_git/CAS').
Fetching from remote 'origin' using the following refspecs: +refs/heads/:refs/remotes/origin/.
Skipping local branch creation since it already exists 'refs/remotes/origin/dev'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/completenessMonitoring'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/myget'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/shipmentOnePage'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/shipmentview'.
Creating local branch from remote tracking 'refs/remotes/origin/master'.
HEAD points at branch 'refs/heads/dev'.
Version not in cache. Calculating version.
Running against branch: dev
GitHubFlow version strategy will be used
Applicable build agent found: 'MyGet'.
Executing GenerateSetVersionMessage for 'MyGet'.

Executing GenerateBuildLogOutput for 'MyGet'.
##myget[setParameter name='GitVersion.Major' value='1']
##myget[setParameter name='GitVersion.Minor' value='1']
##myget[setParameter name='GitVersion.Patch' value='6']
##myget[setParameter name='GitVersion.PreReleaseTag' value='dev']
##myget[setParameter name='GitVersion.PreReleaseTagWithDash' value='-dev']
##myget[setParameter name='GitVersion.BuildMetaData' value='2']
##myget[setParameter name='GitVersion.FullBuildMetaData' value='2.Branch.dev.Sha.f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.MajorMinorPatch' value='1.1.6']
##myget[setParameter name='GitVersion.SemVer' value='1.1.6-dev']
##myget[setParameter name='GitVersion.LegacySemVer' value='1.1.6-dev']
##myget[setParameter name='GitVersion.LegacySemVerPadded' value='1.1.6-dev']
##myget[buildNumber '1.1.6-dev']
##myget[setParameter name='GitVersion.AssemblySemVer' value='1.1.6.0']
##myget[setParameter name='GitVersion.AssemblyFileSemVer' value='1.1.6.0']
##myget[setParameter name='GitVersion.FullSemVer' value='1.1.6-dev+2']
##myget[setParameter name='GitVersion.InformationalVersion' value='1.1.6-dev+2.Branch.dev.Sha.f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.ClassicVersion' value='1.1.6.2']
##myget[setParameter name='GitVersion.ClassicVersionWithTag' value='1.1.6.2-dev']
##myget[setParameter name='GitVersion.BranchName' value='dev']
##myget[setParameter name='GitVersion.Sha' value='f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.NuGetVersionV2' value='1.1.6-dev']
##myget[setParameter name='GitVersion.NuGetVersion' value='1.1.6-dev']

[JakeGinnivan]

If you type 'git remote -v' on the command line does the password show there?

It looks like the password is in the remote URL? If that is the case then the is bit much GitVersion can do.

Sent from my Windows Phone

---

From: CustomsAdministrationSystemmailto:notifications@github.com
Sent: ý26/ý02/ý2015 03:26
To: ParticularLabs/GitVersionmailto:GitVersion@noreply.github.com
Subject: [GitVersion] Passwords exposed (#378)

For some reason password are revealed:

This is an extract of a MyGet Build:

UpdateAssemblyInfo:
Applicable build agent found: 'MyGet'.
Executing PerformPreProcessingSteps for 'MyGet'.
One remote found (origin -> 'https://sujith.quintelier%40euri.com:MyRevealedSecretPassword@customsadministrationsystem.visualstudio.com/DefaultCollection/_git/CAS').
Fetching from remote 'origin' using the following refspecs: +refs/heads/:refs/remotes/origin/.
Skipping local branch creation since it already exists 'refs/remotes/origin/dev'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/completenessMonitoring'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/myget'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/shipmentOnePage'.
Creating local branch from remote tracking 'refs/remotes/origin/feature/shipmentview'.
Creating local branch from remote tracking 'refs/remotes/origin/master'.
HEAD points at branch 'refs/heads/dev'.
Version not in cache. Calculating version.
Running against branch: dev
GitHubFlow version strategy will be used
Applicable build agent found: 'MyGet'.
Executing GenerateSetVersionMessage for 'MyGet'.

Executing GenerateBuildLogOutput for 'MyGet'.
##myget[setParameter name='GitVersion.Major' value='1']
##myget[setParameter name='GitVersion.Minor' value='1']
##myget[setParameter name='GitVersion.Patch' value='6']
##myget[setParameter name='GitVersion.PreReleaseTag' value='dev']
##myget[setParameter name='GitVersion.PreReleaseTagWithDash' value='-dev']
##myget[setParameter name='GitVersion.BuildMetaData' value='2']
##myget[setParameter name='GitVersion.FullBuildMetaData' value='2.Branch.dev.Sha.f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.MajorMinorPatch' value='1.1.6']
##myget[setParameter name='GitVersion.SemVer' value='1.1.6-dev']
##myget[setParameter name='GitVersion.LegacySemVer' value='1.1.6-dev']
##myget[setParameter name='GitVersion.LegacySemVerPadded' value='1.1.6-dev']
##myget[buildNumber '1.1.6-dev']
##myget[setParameter name='GitVersion.AssemblySemVer' value='1.1.6.0']
##myget[setParameter name='GitVersion.AssemblyFileSemVer' value='1.1.6.0']
##myget[setParameter name='GitVersion.FullSemVer' value='1.1.6-dev+2']
##myget[setParameter name='GitVersion.InformationalVersion' value='1.1.6-dev+2.Branch.dev.Sha.f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.ClassicVersion' value='1.1.6.2']
##myget[setParameter name='GitVersion.ClassicVersionWithTag' value='1.1.6.2-dev']
##myget[setParameter name='GitVersion.BranchName' value='dev']
##myget[setParameter name='GitVersion.Sha' value='f254893fd6a4c93a29b80ae832fac1a99997e858']
##myget[setParameter name='GitVersion.NuGetVersionV2' value='1.1.6-dev']
##myget[setParameter name='GitVersion.NuGetVersion' value='1.1.6-dev']

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/378.

[JakeGinnivan]

If git remote has a password in it, we should obscure it in the logs. Marked as up for grabs if anyone wants to jump in

[RaphHaddad]

Hello,

I will jump in and send a PR soon.

[RaphHaddad]

My apologies for this spam (will give this one more go)

[RaphHaddad]

OK Someone else can take this. It keeps on breaking on the build server even though it's compiling fine.

[JakeGinnivan]

I will have a look at the build :) will get back to you later today

Sent from my Windows Phone

---

From: Raphael Haddadmailto:notifications@github.com
Sent: ‎13/‎07/‎2015 3:07 PM
To: GitTools/GitVersionmailto:GitVersion@noreply.github.com
Cc: Jake Ginnivanmailto:jake@ginnivan.net
Subject: Re: [GitVersion] Passwords exposed (#378)

OK Someone else can take this. It keeps on breaking on the build server even though it's compiling fine.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/378#issuecomment-120833942.

[JakeGinnivan]

@RaphHaddad having a look at the failing build, that is quite strange and not related to your PR. It could even be a bug. The PR looked fine from my standpoint, if you resubmit a PR I can investigate the build and merge manually.

[RaphHaddad]

Thanks @JakeGinnivan (for both the check and for reaffirming my sanity).

What I will do is send the PR again. But I will do it from a feature branch (currently I've been committing on the master branch. I know it sounds crazy, but that's the only thing that seems to be different from other PRs).

[JakeGinnivan]

It was blowing up trying to create a local ref for the gh-pages branch.. really odd. Could be a legit issue