fix(git): write a per-repo plaintext token only with recorded consent #611
No reviewers
Labels
No labels
breaking
bug
documentation
enhancement
epic
good first issue
help wanted
refactoring
resolution/duplicate
resolution/invalid
resolution/wontfix
security
severity/critical
severity/high
severity/low
severity/medium
status/abandoned
status/blocked
status/needs-decision
status/needs-info
status/needs-verification
testing
upstream
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
sixfold-space/madtea!611
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/repo-token-needs-consent"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
With no secure backend, clone, init, and remote add wrote the token in plaintext into the repo's
.git/config, even when it came fromMADTEA_TOKENand the user never passed--insecure-storage.WriteRepoCredentialsnow writes the plaintext token only when a plaintextmadtea.tokenexists in the global scope, which onlyauth login --insecure-storagewrites. Without that consent it writes the URL and user only, and prints a notice that names the fix. madtea readsMADTEA_TOKENon every run, so env setups keep working. A secure backend is unchanged.New tests prove that no token reaches
.git/configwithout consent for clone, remote add, and init. Each one fails with the check removed. The existing plaintext tests now record consent first.ADR 0042 records the rule and refines ADR 0013.
Closes #610
Closes #610