71

Currently, whenever I git pull or git push to a http(s) repository, I get the following:

$ git pull
Username for 'https://gitrepos.reposdomain.com': [email protected]
Password for 'https://[email protected]@gitrepos.reposdomain.com': 

This is ok for infrequent use, but starts to become really annoying very quickly. Unfortunately, switching to ssh is not an option in this case.

I've read that earlier versions of git provided a credential "store" and "cache", but that this wasn't advised because it stored the password in plaintext.

BUT

Newer versions of git apparently store git credentials in the gnome-keyring, but it has to be set up correctly.

I've tried following other (non-Ubuntu) answers on SO to get this to work (namely this one), but I'm still presented with the username and password prompt.

What is the correct and safest way to store git credentials for http(s) repos and how does one make them work on Ubuntu?

3
  • 1
    You should mention which methods you did try. Otherwise you might find answers suggesting exactly those.
    – muru
    May 17, 2016 at 0:23
  • 2
    An entire sentence bolded and italicised is hardly readable.
    – muru
    May 17, 2016 at 0:27
  • Upstream Debian issue to package git-credential-libsecret bugs.debian.org/cgi-bin/bugreport.cgi?bug=878599 May 28, 2023 at 7:02

4 Answers 4

114

git-credential-gnome-keyring is now deprecated.

Instead, use libsecret. If it's not already pre-installed on your machine, use the following procedure:

  1. Make sure libsecret and its development libraries are installed:

    sudo apt install libsecret-1-0 libsecret-1-dev
    
  2. Then build the credential helper from the sources shipped with libsecret's development libraries:

    sudo make --directory=/usr/share/doc/git/contrib/credential/libsecret
    
  3. Finally, register the freshly compiled binary as a Git credential helper:

    git config --global credential.helper \
       /usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret
    

More details on https://stackoverflow.com/a/40312117/2017781

19
  • 2
    You might want to note that this solution only applies to git versions >= 2.11 (where the libsecret dir may then be found) Oct 2, 2017 at 23:04
  • 2
    Is this safe? Where are the secrets stored? Is both the transmission and the storage safe? Is there any official documentation? Apparently, as per this page and this page, it’s in “Main” and maintained by Debian/Ubuntu. And: “It communicates with the 'Secret Service' using DBus.”
    – caw
    Jan 23, 2018 at 6:14
  • 1
    @caw: In GNOME, "Secret Service" is the same gnome-keyring-daemon, just through a different API. (The libsecret plan was to allow other DEs to build their own backends supporting the same API, e.g. KDE planned to implement this in kwalletd.)
    – user1686
    Feb 24, 2018 at 15:15
  • 5
    Updating my preferred answer as I can verify this works on 18.04. :) May 9, 2018 at 1:02
  • 3
    This appears to still be Plan A in Feb 2020. Worked on Ubuntu 19.10.
    – ericP
    Feb 4, 2020 at 17:50
46
+50

You need to setup the git credential helper with Gnome Keyring:

Install and compile the Gnome Keyring devel:

sudo apt-get install libgnome-keyring-dev
sudo make --directory=/usr/share/doc/git/contrib/credential/gnome-keyring

And setup the credential:

git config --global credential.helper /usr/share/doc/git/contrib/credential/gnome-keyring/git-credential-gnome-keyring
6
  • That's really weird. Semantically, there should be no difference between the answer in the link and this answer. But for some reason this answer works where the other doesn't. May 25, 2016 at 13:03
  • Then run git push or git pull as normal and the first time it will ask ansd store, and every time after that it will get it from the keyring. To verify it, run seahorse. It should be listed under "Passwords" ->"Login". May 25, 2016 at 13:06
  • @tudor That's strange, I don't see any "conceptual" difference between my answer and the link one. Glad that it helps.
    – user98829
    May 25, 2016 at 20:10
  • Seems weird to me that you still have to run the "make" command, but these steps work great. Thanks! Feb 10, 2017 at 20:21
  • Works on Ubuntu 16.04 etc., but for Ubuntu 20.04+, you may want to use libsecret
    – caw
    Aug 16, 2021 at 21:59
3

This simple approach appears to be sufficient on my Ubuntu 18.04.1 with git 2.17.1:

git config --global credential.helper cache

You can specify a one hour (=3600 seconds) timeout like this:

git config --global credential.helper 'cache --timeout=3600'

Further reading in the fine manual.

1
0

Try git-credential-oauth, available in Ubuntu lunar and later.

No more passwords! No more personal access tokens! No more SSH keys!

git-credential-oauth is a Git credential helper that securely authenticates to GitHub, GitLab, BitBucket and Gerrit using OAuth.

The first time you push, the helper will open a browser window to authenticate. Subsequent pushes within storage lifetime require no interaction.

Installation:

sudo apt-get install git-credential-oauth

Configuration:

git config --global --unset-all credential.helper
git config --global --add credential.helper "cache --timeout 7200" # two hours
git config --global --add credential.helper oauth

If you have it installed, you can also use git-credential-libsecret as a storage alternative to git-credential-cache.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .