Support freedesktop.secrets (e.g., GNOME Keyring)

[jluttine]

I'm using GNOME Keyring to store my GitHub credentials. When I run git pull for a private GitHub repository, git uses the credentials from the keyring. I have the following configuration in ~/.gitconfig to make git use freedesktop.secrets:

[credential]
        helper = /run/current-system/sw/bin/git-credential-libsecret

However, when I run something hub-specific like hub pr list for the same private repository, my username and password are asked on the command-line. If needed, they should be asked by my keyring app and re-used from there. Why is hub working differently than git in this matter?

[mislav]

Hub authentication is for GitHub API and sometimes uses different credentials (especially if you have 2FA enabled on your account) than git credentials, so the two are kept separate, for now. #1644 (comment) #1217

I realize that this is poor user experience, sorry about that! 🙇

[jluttine]

@mislav Thanks for the quick response! However, a few comments:

• Keeping two credentials separate doesn't make my request of supporting freedesktop.secrets (e.g., GNOME Keyring) obsolete. So I don't see a reason to close this issue. Or did I miss something?

• How can I change which tool is used to ask for the credentials? Is there any integration to any such tools? Quite often, one can set things like SSH_ASKPASS or SSH_AUTH_SOCK or add some configuration options to choose which tool is used to ask for username and password.

• Or what kind of secure credential management Hub supports?

[mislav]

• So I don't see a reason to close this issue. Or did I miss something?

I've referenced an existing open issue #1217 which proposes a feature that hub implements storing of credentials using a git credential helper. I've closed this one as duplicate.

• Or what kind of secure credential management Hub supports?

Unfortunately, hub doesn't support any secure credential management. It asks you for your GitHub username & password, immediately uses those to exchange them for a Personal Access Token, then stores that token in ~/.config/hub.

Alternatively, you may provide GITHUB_TOKEN via environment variable. You can populate that variable by reading from some secure credential store.

[jluttine]

Ok, thanks!