Supplying a password to Git in a Bash script

Question

From a Bash script I would like to supply a password. I have tried the following:

echo 'mypass' | git pull

git pull < 'mypass'

git pull < echo 'mypass'

None seem to work.

@TheGeorgeous it is for an automatic deploy script for the app tester. There is a lot more in the script than simply pulling code from the repo. — jax, Jul 04 '15 at 09:06
[This answer](https://stackoverflow.com/a/68602613/1803897) contains a sample bash script that works with git's credential API. — Roland Puntaier, Aug 06 '21 at 17:43

score 12 · Answer 1 · answered Mar 29 '19 at 13:09

12

Create file git_password.sh with content:
```
#!/bin/sh
exec echo "$GIT_PASSWORD"
```
Assign your password to the GIT_PASSWORD environment variable
```
$ GIT_PASSWORD=your_password
```
Execute git command with GIT_ASKPASS environment variable. It will force password prompt and execute git_password.sh as callback:
```
$ GIT_ASKPASS=./git_password.sh git clone $REPO
```

answered Mar 29 '19 at 13:09

Sergey Bezugliy

580
6
22

It is only simple solution when you need to clone repository from shell script, because you have no git environment in the current folder yet. – Sergey Bezugliy Mar 29 '19 at 13:31
1

You can also use parameter `-c "core.askPass=/path/askpass.sh"`. – akostadinov Jul 24 '20 at 17:35

score 8 · Answer 2 · edited Jun 20 '20 at 09:12

gitcredentials is the answer:

DESCRIPTION

Git will sometimes need credentials from the user in order to perform operations; for example, it may need to ask for a username and password in order to access a remote repository over HTTP. This manual describes the mechanisms Git uses to request these credentials, as well as some features to avoid inputting these credentials repeatedly.

[...]

REQUESTING CREDENTIALS

Without any credential helpers defined, Git will try the following strategies to ask the user for usernames and passwords:

If the GIT_ASKPASS environment variable is set, the program specified by the variable is invoked. A suitable prompt is provided to the program on the command line, and the user’s input is read from its standard output.

Otherwise, if the core.askPass configuration variable is set, its value is used as above.

Otherwise, if the SSH_ASKPASS environment variable is set, its value is used as above.

Otherwise, the user is prompted on the terminal.

[...]

Credential helpers, on the other hand, are external programs from which Git can request both usernames and passwords; they typically interface with secure storage provided by the OS or other programs.

You may also have third-party helpers installed; search for credential-* in the output of git help -a, and consult the documentation of individual helpers. Once you have selected a helper, you can tell Git to use it by putting its name into the credential.helper variable.

git help -a | grep credential-* shows the following helper:

  credential                remote
  credential-cache          remote-ext
  credential-cache--daemon  remote-fd
  credential-osxkeychain    remote-ftp
  credential-store          remote-ftps

`git help -a | grep credentials-*` should be `git help -a | grep credential-*` — Cpt. Senkfuss, Feb 03 '17 at 14:58
To set `core.askPass` use `git config --global core.askPass "new-value"`. To view the config value use `git config --global core.askPass` (without new value). Note that instead of `--global`, there is also `--system` scope (and `--local` scope, but only after a repo has been cloned). — mihca, Sep 22 '21 at 14:12

score 6 · Answer 3 · edited Jun 12 '19 at 10:42

6

It is possible to include the password in the definition of your remote like so:

https://user:password@server

Like this you do not need to provide it for each pull.

(Much like the solution suggested in How do I provide a username and password when running “git clone git@remote.git”?.)

Warning: A better approach would be to use SSH instead of HTTPS and store your public key with GitHub. Because credentials in the remote url might land in the command history, scripts or configuration files and can then be seen by others.

edited Jun 12 '19 at 10:42

Boris Däppen

1,156
7
20

answered Jul 04 '15 at 08:33

Sebastian P.

704
7
18

1

should this be dangerous? password saved in git log? – Dee Feb 18 '20 at 10:17
The URL (incl. password) will be stored in plain text in `.git/config` as remote URL. Thus, everyone with access to the cloned repo will be able to see the password. Furthermore, this URL is likely to be sent over the network again to initiate connection with the remote. Overall, this approach is the least secure. – mihca Sep 22 '21 at 14:03

score 2 · Answer 4 · edited Feb 03 '19 at 13:52

2

The main techniques for feeding an input to a Bash scripts are at "Automatically enter input in command line":

echo 'mypass' | git pull
# or
printf 'mypass\n' | git pull

Since Git 1.8.3, I prefer using a Git credential netrc helper which will fetch and feed the right password for me.

edited Feb 03 '19 at 13:52

Peter Mortensen

30,030
21
100
124

answered Jul 04 '15 at 08:40

VonC

1,129,465
480
4,036
4,755

I think think the `\n` may be what I was missing. The password may have entered but the enter key was never pressed, thus is never executed. I will need to try this on Monday. – jax Jul 04 '15 at 09:16
1

Using `printf 'mypass\n' | git pull` didn't work after all. – jax Jul 06 '15 at 06:20
@jax What OS, bash and git version are you using? – VonC Jul 06 '15 at 06:31
Fedora 20 with default bash – jax Jul 06 '15 at 09:28
Not sure what git version but probably the latest available from the repo – jax Jul 06 '15 at 09:30
@jax What git version do you have on this fedora? Type git --version – VonC Jul 06 '15 at 09:30
I will have to tell you tomorrow of the exact versions – jax Jul 06 '15 at 09:31
I will try that out tomorrow, I don't have access to the PC right now. – jax Jul 06 '15 at 09:34

Supplying a password to Git in a Bash script

4 Answers4