Re: git credential cache and sudo

On Fri, Mar 12, 2021 at 06:51:53PM -0800, Jonathan Nieder wrote:

quoted

Note that it's a little funky to be accessing the cache as a different user than
the one who created it. This should work reliably when the cache was created by
your normal user, but then accessed as root, because root has permissions to
access the socket. But if you spawn a cache daemon as root (because the _first_
operation you perform is as root, which automatically starts a daemon to store
the cached credential), then it's likely you won't be able to access it as your
regular user.

I wonder if this suggests a missing feature in
git-credential-cache(1): if the manpage advertised a way to launch the
daemon through an explicit command, similar to 'ssh-agent', then a
user could run that as themselves before running other commands that
communicate with it as another user.

Perhaps. The daemon side of the credential-cache helper does not work
quite like ssh-agent, though, in that it tries to be ephemeral. So after
starting, you have 30 seconds to give it some data to cache before it
will exit. Normally this is fine since it's started by the client side
of the helper, which will then immediately supply it with data.

So after starting it, you'd need to immediately prime it with data,
either manually or by running a Git command. And then hope that command,
including time to talk to the other side on the network and for you to
type your password, does not exceed the timeout.

-Peff