git/contrib/credential, branch v2.45.2

osxkeychain: store new attributes

2024-04-01T22:38:20Z

d208bfdfef (credential: new attribute password_expiry_utc, 2023-02-18) and a5c76569e7 (credential: new attribute oauth_refresh_token, 2023-04-21) introduced new credential attributes but support was missing from git-credential-osxkeychain. Support these attributes by appending the data to the password in the keychain, separated by line breaks. Line breaks cannot appear in a git credential password so it is an appropriate separator. Fixes the remaining test failures with osxkeychain: 18 - helper (osxkeychain) gets password_expiry_utc 19 - helper (osxkeychain) overwrites when password_expiry_utc changes 21 - helper (osxkeychain) gets oauth_refresh_token Signed-off-by: Bo Anderson Signed-off-by: Junio C Hamano

osxkeychain: erase matching passwords only

2024-04-01T22:38:20Z

Other credential helpers support deleting credentials that match a specified password. See 7144dee3ec (credential/libsecret: erase matching creds only, 2023-07-26) and cb626f8e5c (credential/wincred: erase matching creds only, 2023-07-26). Support this in osxkeychain too by extracting, decrypting and comparing the stored password before deleting. Fixes the following test failure with osxkeychain: 11 - helper (osxkeychain) does not erase a password distinct from input Signed-off-by: Bo Anderson Signed-off-by: Junio C Hamano

osxkeychain: erase all matching credentials

2024-04-01T22:38:20Z

Other credential managers erased all matching credentials, as indicated by a test case that osxkeychain failed: 15 - helper (osxkeychain) erases all matching credentials Signed-off-by: Bo Anderson Signed-off-by: Junio C Hamano

osxkeychain: replace deprecated SecKeychain API

2024-04-01T22:38:19Z

The SecKeychain API was deprecated in macOS 10.10, nearly 10 years ago. The replacement SecItem API however is available as far back as macOS 10.6. While supporting older macOS was perhaps prevously a concern, git-credential-osxkeychain already requires a minimum of macOS 10.7 since 5747c8072b (contrib/credential: avoid fixed-size buffer in osxkeychain, 2023-05-01) so using the newer API should not regress the range of macOS versions supported. Adapting to use the newer SecItem API also happens to fix two test failures in osxkeychain: 8 - helper (osxkeychain) overwrites on store 9 - helper (osxkeychain) can forget host The new API is compatible with credentials saved with the older API. Signed-off-by: Bo Anderson Signed-off-by: Junio C Hamano

Merge branch 'mh/libsecret-empty-password-fix'

2024-02-28T00:04:32Z

Credential helper based on libsecret (in contrib/) has been updated to handle an empty password correctly. * mh/libsecret-empty-password-fix: libsecret: retrieve empty password

libsecret: retrieve empty password

2024-02-19T22:36:35Z

Since 0ce02e2f (credential/libsecret: store new attributes, 2023-06-16) a test that stores empty username and password fails when t0303-credential-external.sh is run with GIT_TEST_CREDENTIAL_HELPER=libsecret. Retrieve empty password carefully. This fixes test: ok 14 - helper (libsecret) can store empty username Signed-off-by: M Hickford Signed-off-by: Junio C Hamano

Merge branch 'mh/credential-oauth-refresh-token-with-wincred'

2024-02-08T21:20:34Z

The wincred credential backend has been taught to support oauth refresh token the same way as credential-cache and credential-libsecret backends. * mh/credential-oauth-refresh-token-with-wincred: credential/wincred: store oauth_refresh_token

credential/wincred: store oauth_refresh_token

2024-01-29T20:11:24Z

a5c7656 (credential: new attribute oauth_refresh_token) introduced a new confidential credential attribute and added support to credential-cache. Later 0ce02e2f (credential/libsecret: store new attributes, 2023-06-16) added support in credential-libsecret. To add support in credential-wincred, we encode the new attribute in the CredentialBlob, separated by newline: hunter2 oauth_refresh_token=xyzzy This is extensible and backwards compatible. The credential protocol already assumes that attribute values do not contain newlines. This fixes test "helper (wincred) gets oauth_refresh_token" when t0303-credential-external.sh is run with GIT_TEST_CREDENTIAL_HELPER=wincred. This test was added in a5c76569e7 (credential: new attribute oauth_refresh_token, 2023-04-21). Alternatives considered: store oauth_refresh_token in a wincred attribute. This would be insecure because wincred assumes attribute values to be non-confidential. Signed-off-by: M Hickford Signed-off-by: Junio C Hamano

Merge branch 'mh/credential-erase-improvements-more'

2023-08-28T16:51:16Z

Update two credential helpers to correctly match which credential to erase; they dropped not the ones with stale password. * mh/credential-erase-improvements-more: credential/wincred: erase matching creds only credential/libsecret: erase matching creds only

credential/wincred: erase matching creds only

2023-07-26T20:27:34Z

The credential erase request typically includes protocol, host, username and password. credential-wincred erases stored credentials that match protocol, host and username, regardless of password. This is confusing in the case the stored password differs from that in the request. This case can occur when multiple credential helpers are configured. Only erase credential if stored password matches request (or request omits password). This fixes test "helper (wincred) does not erase a password distinct from input" when t0303 is run with GIT_TEST_CREDENTIAL_HELPER set to "wincred". This test was added in aeb21ce22e (credential: avoid erasing distinct password, 2023-06-13). Signed-off-by: M Hickford Signed-off-by: Junio C Hamano