[ { "path": ".azure-pipelines/release.yml", "content": "name: $(Date:yyyyMMdd)$(Rev:.r)\ntrigger: none\npr: none\n\nresources:\n repositories:\n - repository: 1ESPipelines\n type: git\n name: 1ESPipelineTemplates/1ESPipelineTemplates\n ref: refs/tags/release\n\nparameters:\n - name: 'esrp'\n type: boolean\n default: true\n displayName: 'Enable ESRP code signing'\n - name: 'github'\n type: boolean\n default: true\n displayName: 'Enable GitHub release publishing'\n - name: 'nuget'\n type: boolean\n default: true\n displayName: 'Enable NuGet package publishing'\n\n#\n# 1ES Pipeline Templates do not allow using a matrix strategy so we create\n# a YAML object parameter with and foreach to create jobs for each entry.\n# Each OS has its own matrix object since their build steps differ.\n#\n - name: windows_matrix\n type: object\n default:\n - id: windows_x86\n jobName: 'Windows (x86)'\n runtime: win-x86\n pool: GitClientPME-1ESHostedPool-intel-pc\n image: win-x86_64-ado1es\n os: windows\n - id: windows_x64\n jobName: 'Windows (x64)'\n runtime: win-x64\n pool: GitClientPME-1ESHostedPool-intel-pc\n image: win-x86_64-ado1es\n os: windows\n - id: windows_arm64\n jobName: 'Windows (ARM64)'\n runtime: win-arm64\n pool: GitClientPME-1ESHostedPool-arm64-pc\n image: win-arm64-ado1es\n os: windows\n\n - name: macos_matrix\n type: object\n default:\n - id: macos_x64\n jobName: 'macOS (x64)'\n runtime: osx-x64\n pool: 'Azure Pipelines'\n image: macOS-latest\n os: macos\n - id: macos_arm64\n jobName: 'macOS (ARM64)'\n runtime: osx-arm64\n pool: 'Azure Pipelines'\n image: macOS-latest\n os: macos\n\n - name: linux_matrix\n type: object\n default:\n - id: linux_x64\n jobName: 'Linux (x64)'\n runtime: linux-x64\n pool: GitClientPME-1ESHostedPool-intel-pc\n image: ubuntu-x86_64-ado1es\n os: linux\n - id: linux_arm64\n jobName: 'Linux (ARM64)'\n runtime: linux-arm64\n pool: GitClientPME-1ESHostedPool-arm64-pc\n image: ubuntu-arm64-ado1es\n os: linux\n\nvariables:\n - name: 'esrpAppConnectionName'\n value: '1ESGitClient-ESRP-App'\n - name: 'esrpMIConnectionName'\n value: '1ESGitClient-ESRP-MI'\n - name: 'githubConnectionName'\n value: 'GitHub-GitCredentialManager'\n - name: 'nugetConnectionName'\n value: '1ESGitClient-NuGet'\n # ESRP signing variables set in the pipeline settings:\n # - esrpEndpointUrl\n # - esrpClientId\n # - esrpTenantId\n # - esrpKeyVaultName\n # - esrpSignReqCertName\n\nextends:\n template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelines\n parameters:\n sdl:\n # SDL source analysis tasks only run on Windows images\n sourceAnalysisPool:\n name: GitClientPME-1ESHostedPool-intel-pc\n image: win-x86_64-ado1es\n os: windows\n stages:\n - stage: build\n displayName: 'Build and Sign'\n jobs:\n #\n # Windows build jobs\n #\n - ${{ each dim in parameters.windows_matrix }}:\n - job: ${{ dim.id }}\n displayName: ${{ dim.jobName }}\n pool:\n name: ${{ dim.pool }}\n image: ${{ dim.image }}\n os: ${{ dim.os }}\n templateContext:\n outputs:\n - output: pipelineArtifact\n targetPath: '$(Build.ArtifactStagingDirectory)\\_final'\n artifactName: '${{ dim.runtime }}'\n steps:\n - checkout: self\n - task: PowerShell@2\n displayName: 'Read version file'\n inputs:\n targetType: inline\n script: |\n $version = (Get-Content .\\VERSION) -replace '\\.\\d+$', ''\n Write-Host \"##vso[task.setvariable variable=version;isReadOnly=true]$version\"\n - task: UseDotNet@2\n displayName: 'Use .NET 8 SDK'\n inputs:\n packageType: sdk\n version: '8.x'\n - task: PowerShell@2\n displayName: 'Build payload'\n inputs:\n targetType: filePath\n filePath: '.\\src\\windows\\Installer.Windows\\layout.ps1'\n arguments: |\n -Configuration Release `\n -Output $(Build.ArtifactStagingDirectory)\\payload `\n -SymbolOutput $(Build.ArtifactStagingDirectory)\\symbols_raw `\n -RuntimeIdentifier ${{ dim.runtime }}\n - task: ArchiveFiles@2\n displayName: 'Archive symbols'\n inputs:\n rootFolderOrFile: '$(Build.ArtifactStagingDirectory)\\symbols_raw'\n includeRootFolder: false\n archiveType: zip\n archiveFile: '$(Build.ArtifactStagingDirectory)\\symbols\\gcm-${{ dim.runtime }}-$(version)-symbols.zip'\n - ${{ if eq(parameters.esrp, true) }}:\n - task: EsrpCodeSigning@5\n displayName: 'Sign payload'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)\\payload'\n pattern: |\n **/*.exe\n **/*.dll\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"OpusName\": \"Microsoft\",\n \"OpusInfo\": \"https://www.microsoft.com\",\n \"FileDigest\": \"/fd SHA256\",\n \"PageHash\": \"/NPH\",\n \"TimeStamp\": \"/tr \\\"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\\\" /td sha256\"\n }\n },\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolVerify\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {}\n }\n ]\n - task: PowerShell@2\n displayName: 'Clean up code signing artifacts'\n inputs:\n targetType: inline\n script: |\n Remove-Item \"$(Build.ArtifactStagingDirectory)\\payload\\CodeSignSummary-*.md\"\n - task: PowerShell@2\n displayName: 'Build installers'\n inputs:\n targetType: inline\n script: |\n dotnet build '.\\src\\windows\\Installer.Windows\\Installer.Windows.csproj' `\n --configuration Release `\n --no-dependencies `\n -p:NoLayout=true `\n -p:PayloadPath=\"$(Build.ArtifactStagingDirectory)\\payload\" `\n -p:OutputPath=\"$(Build.ArtifactStagingDirectory)\\installers\" `\n -p:RuntimeIdentifier=\"${{ dim.runtime }}\"\n - ${{ if eq(parameters.esrp, true) }}:\n - task: EsrpCodeSigning@5\n condition: and(succeeded(), eq('${{ parameters.esrp }}', true))\n displayName: 'Sign installers'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)\\installers'\n pattern: '**/*.exe'\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"OpusName\": \"Microsoft\",\n \"OpusInfo\": \"https://www.microsoft.com\",\n \"FileDigest\": \"/fd SHA256\",\n \"PageHash\": \"/NPH\",\n \"TimeStamp\": \"/tr \\\"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\\\" /td sha256\"\n }\n },\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolVerify\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {}\n }\n ]\n - task: ArchiveFiles@2\n displayName: 'Archive payload'\n inputs:\n rootFolderOrFile: '$(Build.ArtifactStagingDirectory)\\payload'\n includeRootFolder: false\n archiveType: zip\n archiveFile: '$(Build.ArtifactStagingDirectory)\\installers\\gcm-${{ dim.runtime }}-$(version).zip'\n - task: PowerShell@2\n displayName: 'Collect artifacts for publishing'\n inputs:\n targetType: inline\n script: |\n New-Item -Path \"$(Build.ArtifactStagingDirectory)\\_final\" -ItemType Directory -Force\n Copy-Item \"$(Build.ArtifactStagingDirectory)\\installers\\*.exe\" -Destination \"$(Build.ArtifactStagingDirectory)\\_final\"\n Copy-Item \"$(Build.ArtifactStagingDirectory)\\installers\\*.zip\" -Destination \"$(Build.ArtifactStagingDirectory)\\_final\"\n Copy-Item \"$(Build.ArtifactStagingDirectory)\\symbols\\*.zip\" -Destination \"$(Build.ArtifactStagingDirectory)\\_final\"\n Copy-Item \"$(Build.ArtifactStagingDirectory)\\payload\" -Destination \"$(Build.ArtifactStagingDirectory)\\_final\" -Recurse\n\n #\n # macOS build jobs\n #\n - ${{ each dim in parameters.macos_matrix }}:\n - job: ${{ dim.id }}\n displayName: ${{ dim.jobName }}\n pool:\n name: ${{ dim.pool }}\n image: ${{ dim.image }}\n os: ${{ dim.os }}\n templateContext:\n outputs:\n - output: pipelineArtifact\n targetPath: '$(Build.ArtifactStagingDirectory)/_final'\n artifactName: '${{ dim.runtime }}'\n steps:\n - checkout: self\n - task: Bash@3\n displayName: 'Read version file'\n inputs:\n targetType: inline\n script: |\n echo \"##vso[task.setvariable variable=version;isReadOnly=true]$(cat ./VERSION | sed -E 's/.[0-9]+$//')\"\n - task: UseDotNet@2\n displayName: 'Use .NET 8 SDK'\n inputs:\n packageType: sdk\n version: '8.x'\n - task: Bash@3\n displayName: 'Build payload'\n inputs:\n targetType: filePath\n filePath: './src/osx/Installer.Mac/layout.sh'\n arguments: |\n --runtime=\"${{ dim.runtime }}\" \\\n --configuration=\"Release\" \\\n --output=\"$(Build.ArtifactStagingDirectory)/payload\" \\\n --symbol-output=\"$(Build.ArtifactStagingDirectory)/symbols_raw\"\n - task: ArchiveFiles@2\n displayName: 'Archive symbols'\n inputs:\n rootFolderOrFile: '$(Build.ArtifactStagingDirectory)/symbols_raw'\n includeRootFolder: false\n archiveType: tar\n tarCompression: gz\n archiveFile: '$(Build.ArtifactStagingDirectory)/symbols/gcm-${{ dim.runtime }}-$(version)-symbols.tar.gz'\n - ${{ if eq(parameters.esrp, true) }}:\n - task: AzureKeyVault@2\n displayName: 'Download developer certificate'\n inputs:\n azureSubscription: '$(esrpMIConnectionName)'\n keyVaultName: '$(esrpKeyVaultName)'\n secretsFilter: 'mac-developer-certificate,mac-developer-certificate-password,mac-developer-certificate-identity'\n - task: Bash@3\n displayName: 'Import developer certificate'\n inputs:\n targetType: inline\n script: |\n # Create and unlock a keychain for the developer certificate\n security create-keychain -p pwd $(Agent.TempDirectory)/buildagent.keychain\n security default-keychain -s $(Agent.TempDirectory)/buildagent.keychain\n security unlock-keychain -p pwd $(Agent.TempDirectory)/buildagent.keychain\n\n echo $(mac-developer-certificate) | base64 -D > $(Agent.TempDirectory)/cert.p12\n echo $(mac-developer-certificate-password) > $(Agent.TempDirectory)/cert.password\n\n # Import the developer certificate\n security import $(Agent.TempDirectory)/cert.p12 \\\n -k $(Agent.TempDirectory)/buildagent.keychain \\\n -P \"$(mac-developer-certificate-password)\" \\\n -T /usr/bin/codesign\n\n # Clean up the cert file immediately after import\n rm $(Agent.TempDirectory)/cert.p12\n\n # Set ACLs to allow codesign to access the private key\n security set-key-partition-list \\\n -S apple-tool:,apple:,codesign: \\\n -s -k pwd \\\n $(Agent.TempDirectory)/buildagent.keychain\n - task: Bash@3\n displayName: 'Developer sign payload files'\n inputs:\n targetType: inline\n script: |\n mkdir -p $(Build.ArtifactStagingDirectory)/tosign/payload\n\n # Copy the files that need signing (Mach-o executables and dylibs)\n pushd $(Build.ArtifactStagingDirectory)/payload\n find . -type f -exec file --mime {} + \\\n | sed -n '/mach/s/: .*//p' \\\n | while IFS= read -r f; do\n rel=\"${f#./}\"\n tgt=\"$(Build.ArtifactStagingDirectory)/tosign/payload/$rel\"\n mkdir -p \"$(dirname \"$tgt\")\"\n cp -- \"$f\" \"$tgt\"\n done\n popd\n\n # Developer sign the files\n ./src/osx/Installer.Mac/codesign.sh \\\n \"$(Build.ArtifactStagingDirectory)/tosign/payload\" \\\n \"$(mac-developer-certificate-identity)\" \\\n \"$PWD/src/osx/Installer.Mac/entitlements.xml\"\n # ESRP code signing for macOS requires the files be packaged in a zip file for submission\n - task: ArchiveFiles@2\n displayName: 'Archive files for signing'\n inputs:\n rootFolderOrFile: '$(Build.ArtifactStagingDirectory)/tosign/payload'\n includeRootFolder: false\n archiveType: zip\n archiveFile: '$(Build.ArtifactStagingDirectory)/tosign/payload.zip'\n - task: EsrpCodeSigning@5\n displayName: 'Sign payload'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/tosign'\n pattern: 'payload.zip'\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-401337-Apple\",\n \"OperationCode\": \"MacAppDeveloperSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"Hardening\": \"Enable\"\n }\n }\n ]\n # Extract signed files, overwriting the unsigned files, ready for packaging\n - task: Bash@3\n displayName: 'Extract signed payload files'\n inputs:\n targetType: inline\n script: |\n unzip -uo $(Build.ArtifactStagingDirectory)/tosign/payload.zip -d $(Build.ArtifactStagingDirectory)/payload\n - task: Bash@3\n displayName: 'Build component package'\n inputs:\n targetType: filePath\n filePath: './src/osx/Installer.Mac/pack.sh'\n arguments: |\n --version=\"$(version)\" \\\n --payload=\"$(Build.ArtifactStagingDirectory)/payload\" \\\n --output=\"$(Build.ArtifactStagingDirectory)/pkg/com.microsoft.gitcredentialmanager.component.pkg\"\n - task: Bash@3\n displayName: 'Build installer package'\n inputs:\n targetType: filePath\n filePath: './src/osx/Installer.Mac/dist.sh'\n arguments: |\n --version=\"$(version)\" \\\n --runtime=\"${{ dim.runtime }}\" \\\n --package-path=\"$(Build.ArtifactStagingDirectory)/pkg\" \\\n --output=\"$(Build.ArtifactStagingDirectory)/installers/gcm-${{ dim.runtime }}-$(version).pkg\"\n - ${{ if eq(parameters.esrp, true) }}:\n # ESRP code signing for macOS requires the files be packaged in a zip file first\n - task: Bash@3\n displayName: 'Prepare installer package for signing'\n inputs:\n targetType: inline\n script: |\n mkdir -p $(Build.ArtifactStagingDirectory)/tosign\n cd $(Build.ArtifactStagingDirectory)/installers\n zip -rX $(Build.ArtifactStagingDirectory)/tosign/installers.zip *.pkg\n - task: EsrpCodeSigning@5\n displayName: 'Sign installer package'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/tosign'\n pattern: 'installers.zip'\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-401337-Apple\",\n \"OperationCode\": \"MacAppDeveloperSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"Hardening\": \"Enable\"\n }\n }\n ]\n # Extract signed installer, overwriting the unsigned installer\n - task: Bash@3\n displayName: 'Extract signed installer package'\n inputs:\n targetType: inline\n script: |\n unzip -uo $(Build.ArtifactStagingDirectory)/tosign/installers.zip -d $(Build.ArtifactStagingDirectory)/installers\n - task: Bash@3\n displayName: 'Prepare installer package for notarization'\n inputs:\n targetType: inline\n script: |\n mkdir -p $(Build.ArtifactStagingDirectory)/tosign\n cd $(Build.ArtifactStagingDirectory)/installers\n # Remove previous installers.zip to avoid any confusion\n rm -f $(Build.ArtifactStagingDirectory)/tosign/installers.zip\n zip -rX $(Build.ArtifactStagingDirectory)/tosign/installers.zip *.pkg\n - task: EsrpCodeSigning@5\n displayName: 'Notarize installer package'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/tosign'\n pattern: 'installers.zip'\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-401337-Apple\",\n \"OperationCode\": \"MacAppNotarize\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"BundleId\": \"com.microsoft.gitcredentialmanager\"\n }\n }\n ]\n # Extract signed and notarized installer pkg files, overwriting the unsigned files, ready for upload\n - task: Bash@3\n displayName: 'Extract signed and notarized installer package'\n inputs:\n targetType: inline\n script: |\n unzip -uo $(Build.ArtifactStagingDirectory)/tosign/installers.zip -d $(Build.ArtifactStagingDirectory)/installers\n - task: ArchiveFiles@2\n displayName: 'Archive payload'\n inputs:\n rootFolderOrFile: '$(Build.ArtifactStagingDirectory)/payload'\n includeRootFolder: false\n archiveType: tar\n tarCompression: gz\n archiveFile: '$(Build.ArtifactStagingDirectory)/installers/gcm-${{ dim.runtime }}-$(version).tar.gz'\n - task: Bash@3\n displayName: 'Collect artifacts for publishing'\n inputs:\n targetType: inline\n script: |\n mkdir -p $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/installers/*.pkg $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/installers/*.tar.gz $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/symbols/*.tar.gz $(Build.ArtifactStagingDirectory)/_final\n cp -r $(Build.ArtifactStagingDirectory)/payload $(Build.ArtifactStagingDirectory)/_final\n\n #\n # Linux build jobs\n #\n - ${{ each dim in parameters.linux_matrix }}:\n - job: ${{ dim.id }}\n displayName: ${{ dim.jobName }}\n pool:\n name: ${{ dim.pool }}\n image: ${{ dim.image }}\n os: ${{ dim.os }}\n templateContext:\n outputs:\n - output: pipelineArtifact\n targetPath: '$(Build.ArtifactStagingDirectory)/_final'\n artifactName: '${{ dim.runtime }}'\n steps:\n - checkout: self\n - task: Bash@3\n displayName: 'Read version file'\n inputs:\n targetType: inline\n script: |\n echo \"##vso[task.setvariable variable=version;isReadOnly=true]$(cat ./VERSION | sed -E 's/.[0-9]+$//')\"\n - task: UseDotNet@2\n displayName: 'Use .NET 8 SDK'\n inputs:\n packageType: sdk\n version: '8.x'\n - task: Bash@3\n displayName: 'Build payload'\n inputs:\n targetType: filePath\n filePath: './src/linux/Packaging.Linux/layout.sh'\n arguments: |\n --runtime=\"${{ dim.runtime }}\" \\\n --configuration=\"Release\" \\\n --output=\"$(Build.ArtifactStagingDirectory)/payload\" \\\n --symbol-output=\"$(Build.ArtifactStagingDirectory)/symbols_raw\"\n - task: Bash@3\n displayName: 'Build packages'\n inputs:\n targetType: filePath\n filePath: './src/linux/Packaging.Linux/pack.sh'\n arguments: |\n --version=\"$(version)\" \\\n --runtime=\"${{ dim.runtime }}\" \\\n --payload=\"$(Build.ArtifactStagingDirectory)/payload\" \\\n --symbols=\"$(Build.ArtifactStagingDirectory)/symbols_raw\" \\\n --output=\"$(Build.ArtifactStagingDirectory)/pkg\"\n - task: Bash@3\n displayName: 'Move packages'\n inputs:\n targetType: inline\n script: |\n # Move symbols\n mkdir -p $(Build.ArtifactStagingDirectory)/symbols\n mv $(Build.ArtifactStagingDirectory)/pkg/tar/gcm-*-symbols.tar.gz $(Build.ArtifactStagingDirectory)/symbols\n\n # Move binary packages\n mkdir -p $(Build.ArtifactStagingDirectory)/installers\n mv $(Build.ArtifactStagingDirectory)/pkg/tar/*.tar.gz $(Build.ArtifactStagingDirectory)/installers\n mv $(Build.ArtifactStagingDirectory)/pkg/deb/*.deb $(Build.ArtifactStagingDirectory)/installers\n - ${{ if eq(parameters.esrp, true) }}:\n - task: EsrpCodeSigning@5\n displayName: 'Sign Debian package'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/installers'\n pattern: |\n **/*.deb\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-453387-Pgp\",\n \"OperationCode\": \"LinuxSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {}\n }\n ]\n - task: Bash@3\n displayName: 'Collect artifacts for publishing'\n inputs:\n targetType: inline\n script: |\n mkdir -p $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/installers/*.deb $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/installers/*.tar.gz $(Build.ArtifactStagingDirectory)/_final\n cp $(Build.ArtifactStagingDirectory)/symbols/*.tar.gz $(Build.ArtifactStagingDirectory)/_final\n cp -r $(Build.ArtifactStagingDirectory)/payload $(Build.ArtifactStagingDirectory)/_final\n\n #\n # .NET Tool build job\n #\n - job: dotnet_tool\n displayName: '.NET Tool NuGet Package'\n pool:\n name: GitClientPME-1ESHostedPool-intel-pc\n image: win-x86_64-ado1es\n os: windows\n templateContext:\n outputs:\n - output: pipelineArtifact\n targetPath: '$(Build.ArtifactStagingDirectory)/packages'\n artifactName: 'dotnet-tool'\n steps:\n - checkout: self\n - task: PowerShell@2\n displayName: 'Read version file'\n inputs:\n targetType: inline\n script: |\n $version = (Get-Content .\\VERSION) -replace '\\.\\d+$', ''\n Write-Host \"##vso[task.setvariable variable=version;isReadOnly=true]$version\"\n - task: UseDotNet@2\n displayName: 'Use .NET 8 SDK'\n inputs:\n packageType: sdk\n version: '8.x'\n - task: NuGetToolInstaller@1\n displayName: 'Install NuGet CLI'\n inputs:\n versionSpec: '>= 6.0'\n - task: PowerShell@2\n displayName: 'Build payload'\n inputs:\n targetType: filePath\n filePath: './src/shared/DotnetTool/layout.ps1'\n arguments: |\n -Configuration Release `\n -Output \"$(Build.ArtifactStagingDirectory)/nupkg\"\n - ${{ if eq(parameters.esrp, true) }}:\n - task: EsrpCodeSigning@5\n condition: and(succeeded(), eq('${{ parameters.esrp }}', true))\n displayName: 'Sign payload'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/nupkg'\n pattern: |\n **/*.exe\n **/*.dll\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {\n \"OpusName\": \"Microsoft\",\n \"OpusInfo\": \"https://www.microsoft.com\",\n \"FileDigest\": \"/fd SHA256\",\n \"PageHash\": \"/NPH\",\n \"TimeStamp\": \"/tr \\\"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\\\" /td sha256\"\n }\n },\n {\n \"KeyCode\": \"CP-230012\",\n \"OperationCode\": \"SigntoolVerify\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {}\n }\n ]\n - task: PowerShell@2\n displayName: 'Create NuGet packages'\n inputs:\n targetType: filePath\n filePath: './src/shared/DotnetTool/pack.ps1'\n arguments: |\n -Configuration Release `\n -Version \"$(version)\" `\n -PackageRoot \"$(Build.ArtifactStagingDirectory)/nupkg\" `\n -Output \"$(Build.ArtifactStagingDirectory)/packages\"\n - ${{ if eq(parameters.esrp, true) }}:\n - task: EsrpCodeSigning@5\n condition: and(succeeded(), eq('${{ parameters.esrp }}', true))\n displayName: 'Sign NuGet packages'\n inputs:\n connectedServiceName: '$(esrpAppConnectionName)'\n useMSIAuthentication: true\n appRegistrationClientId: '$(esrpClientId)'\n appRegistrationTenantId: '$(esrpTenantId)'\n authAkvName: '$(esrpKeyVaultName)'\n authSignCertName: '$(esrpSignReqCertName)'\n serviceEndpointUrl: '$(esrpEndpointUrl)'\n folderPath: '$(Build.ArtifactStagingDirectory)/packages'\n pattern: |\n **/*.nupkg\n **/*.snupkg\n useMinimatch: true\n signConfigType: inlineSignParams\n inlineOperation: |\n [\n {\n \"KeyCode\": \"CP-401405\",\n \"OperationCode\": \"NuGetSign\",\n \"ToolName\": \"sign\",\n \"ToolVersion\": \"1.0\",\n \"Parameters\": {}\n }\n ]\n\n - stage: release\n displayName: 'Release'\n dependsOn: [build]\n condition: and(succeeded(), or(eq('${{ parameters.github }}', true), eq('${{ parameters.nuget }}', true)))\n jobs:\n - job: release_validation\n displayName: 'Release validation'\n pool:\n name: GitClientPME-1ESHostedPool-intel-pc\n image: ubuntu-x86_64-ado1es\n os: linux\n steps:\n - task: Bash@3\n displayName: 'Read version file'\n name: version\n inputs:\n targetType: inline\n script: |\n echo \"##vso[task.setvariable variable=value;isOutput=true;isReadOnly=true]$(cat ./VERSION | sed -E 's/.[0-9]+$//')\"\n\n - job: github\n displayName: 'Publish GitHub release'\n dependsOn: release_validation\n condition: and(succeeded(), eq('${{ parameters.github }}', true))\n pool:\n name: GitClientPME-1ESHostedPool-intel-pc\n image: ubuntu-x86_64-ado1es\n os: linux\n variables:\n version: $[dependencies.release_validation.outputs['version.value']]\n templateContext:\n type: releaseJob\n isProduction: true\n inputs:\n # Installers and packages\n - input: pipelineArtifact\n artifactName: 'win-x86'\n targetPath: $(Pipeline.Workspace)/assets/win-x86\n - input: pipelineArtifact\n artifactName: 'win-x64'\n targetPath: $(Pipeline.Workspace)/assets/win-x64\n - input: pipelineArtifact\n artifactName: 'win-arm64'\n targetPath: $(Pipeline.Workspace)/assets/win-arm64\n - input: pipelineArtifact\n artifactName: 'osx-x64'\n targetPath: $(Pipeline.Workspace)/assets/osx-x64\n - input: pipelineArtifact\n artifactName: 'osx-arm64'\n targetPath: $(Pipeline.Workspace)/assets/osx-arm64\n - input: pipelineArtifact\n artifactName: 'linux-x64'\n targetPath: $(Pipeline.Workspace)/assets/linux-x64\n - input: pipelineArtifact\n artifactName: 'linux-arm64'\n targetPath: $(Pipeline.Workspace)/assets/linux-arm64\n - input: pipelineArtifact\n artifactName: 'dotnet-tool'\n targetPath: $(Pipeline.Workspace)/assets/dotnet-tool\n steps:\n - task: GitHubRelease@1\n displayName: 'Create Draft GitHub Release'\n condition: and(succeeded(), eq('${{ parameters.github }}', true))\n inputs:\n gitHubConnection: $(githubConnectionName)\n repositoryName: git-ecosystem/git-credential-manager\n tag: 'v$(version)'\n tagSource: userSpecifiedTag\n target: release\n title: 'GCM $(version)'\n isDraft: true\n addChangeLog: false\n assets: |\n $(Pipeline.Workspace)/assets/win-x86/*.exe\n $(Pipeline.Workspace)/assets/win-x86/*.zip\n $(Pipeline.Workspace)/assets/win-x64/*.exe\n $(Pipeline.Workspace)/assets/win-x64/*.zip\n $(Pipeline.Workspace)/assets/win-arm64/*.exe\n $(Pipeline.Workspace)/assets/win-arm64/*.zip\n $(Pipeline.Workspace)/assets/osx-x64/*.pkg\n $(Pipeline.Workspace)/assets/osx-x64/*.tar.gz\n $(Pipeline.Workspace)/assets/osx-arm64/*.pkg\n $(Pipeline.Workspace)/assets/osx-arm64/*.tar.gz\n $(Pipeline.Workspace)/assets/linux-x64/*.deb\n $(Pipeline.Workspace)/assets/linux-x64/*.tar.gz\n $(Pipeline.Workspace)/assets/linux-arm64/*.deb\n $(Pipeline.Workspace)/assets/linux-arm64/*.tar.gz\n $(Pipeline.Workspace)/assets/dotnet-tool/*.nupkg\n $(Pipeline.Workspace)/assets/dotnet-tool/*.snupkg\n\n - job: nuget\n displayName: 'Publish NuGet package'\n dependsOn: release_validation\n condition: and(succeeded(), eq('${{ parameters.nuget }}', true))\n pool:\n name: GitClientPME-1ESHostedPool-intel-pc\n image: ubuntu-x86_64-ado1es\n os: linux\n variables:\n version: $[dependencies.release_validation.outputs['version.value']]\n templateContext:\n inputs:\n - input: pipelineArtifact\n artifactName: 'dotnet-tool'\n targetPath: $(Pipeline.Workspace)/assets/dotnet-tool\n outputs:\n - output: nuget\n condition: and(succeeded(), eq('${{ parameters.nuget }}', true))\n displayName: 'Publish .NET Tool NuGet package'\n packagesToPush: '$(Pipeline.Workspace)/assets/dotnet-tool/*.nupkg;$(Pipeline.Workspace)/assets/dotnet-tool/*.snupkg'\n packageParentPath: $(Pipeline.Workspace)/assets/dotnet-tool\n nuGetFeedType: external\n publishPackageMetadata: true\n publishFeedCredentials: $(nugetConnectionName)\n" }, { "path": ".code-coverage/coverlet.settings.xml", "content": "\n\n \n \n \n \n cobertura,lcov\n \n \n \n \n" }, { "path": ".github/ISSUE_TEMPLATE/auth-issue.yml", "content": "name: Authentication issue\ndescription: An authentication problem occurred when running a Git command.\nlabels: [\"auth-issue\"]\nbody:\n - type: markdown\n attributes:\n value: |\n Thanks for taking the time to fill out this issue!\n\n Please answer as many of the below questions as you can - this helps us better understand what the problem is, and consequently how to resolve your problem.\n - type: input\n id: version\n attributes:\n label: Version\n description: |\n What version of Git Credential Manager are you using?\n\n Run `git credential-manager --version` from a terminal to see the current version.\n\n If you are on an older version of GCM please try updating before creating an issue as the problem you are experiencing may have already been fixed.\n placeholder: |\n ex: 2.0.8-beta+e1f8492d04\n validations:\n required: true\n - type: dropdown\n id: os\n attributes:\n label: Operating system\n description: What operating system are you using?\n options:\n - Windows\n - macOS\n - Linux\n - Other - please describe below\n validations:\n required: true\n - type: input\n id: os-version\n attributes:\n label: OS version or distribution\n description: Please describe the version, CPU architecture (x64, ARM, etc), or Linux distribution you are using.\n placeholder: |\n ex: Windows 11 Pro, Monterey 12.5, Ubuntu 22.04\n validations:\n required: true\n - type: dropdown\n id: provider\n attributes:\n label: Git hosting provider(s)\n description: What Git host provider are you trying to connect to?\n multiple: true\n options:\n - Azure DevOps\n - Azure DevOps Server (TFS/on-prem)\n - Bitbucket Cloud\n - Bitbucket Server/DC\n - GitHub\n - GitHub Enterprise Server\n - GitLab\n - Other - please describe below\n validations:\n required: true\n - type: input\n id: provider-other\n attributes:\n label: Other hosting provider\n description: If you selected \"Other\" above, please describe the Git host you are using.\n - type: dropdown\n id: azdo-urlformat\n attributes:\n label: |\n (Azure DevOps only) What format is your remote URL?\n description: |\n Tip: to see your remote URL run `git remote -v` from a terminal.\n options:\n - https://dev.azure.com/{org}\n - https://{org}@dev.azure.com/{org}\n - https://{org}.visualstudio.com\n - type: dropdown\n id: web-access\n attributes:\n label: Can you access the remote repository directly in the browser?\n description: |\n If you are unable to access the repository via a web browser then it is likely GCM will also be unable to access the repository with your user account.\n options:\n - Yes, I can access the repository\n - No, I get a permission error\n - No, for a different reason - please describe behavior below\n validations:\n required: true\n - type: textarea\n id: expected\n attributes:\n label: Expected behavior\n description: A clear and concise description of what your expectation are.\n placeholder: |\n ex: I am authenticated and my Git operation completes successfully.\n validations:\n required: true\n - type: textarea\n id: actual\n attributes:\n label: Actual behavior\n description: |\n A clear and concise description of what actually happens.\n Feel free to include screenshots of dialogs or errors here, but remember to **redact any sensitive information**!\n placeholder: |\n ex: An exception \"FooException\" is thrown, UI freezes, etc.\n validations:\n required: true\n - type: textarea\n id: logs\n attributes:\n label: Logs\n description: |\n To capture trace logs, set the environment variables `GCM_TRACE=1` and `GIT_TRACE=1` and re-run your Git command.\n If you are running inside of Windows Subsystem for Linux (WSL), you must also set an additional environment variable to enable tracing: `WSLENV=$WSLENV:GCM_TRACE`. For example:\n\n ```shell\n WSLENV=$WSLENV:GCM_TRACE:GIT_TRACE GCM_TRACE=1 GIT_TRACE=1 git fetch\n ```\n\n If you are using GCM version 2.0.567 onwards you can also run `git credential-manager diagnose` to collect useful diagnostic information that can be attached here.\n\n :warning: **Please review and redact any private information before attaching logs and files!**\n" }, { "path": ".github/ISSUE_TEMPLATE/feature-req.yml", "content": "name: Feature request\ndescription: A suggestion for a new feature in Git Credential Manager.\nlabels: [\"enhancement\"]\nbody:\n - type: markdown\n attributes:\n value: |\n Thanks for taking the time to fill out this feature request!\n\n Please be as detailed as possible describing your idea; how it fixes a problem or makes something easier.\n\n Although we cannot guarentee we will accept all requests, we will still take time to consider your ideas. Whilst we may be supportive of an idea in principal, as maintainers we may not always be able to dedicate time to implementing them. We always welcome community support and contributions however! :heart:\n - type: textarea\n id: description\n attributes:\n label: Feature description\n description: |\n A clear and concise description of the new feature.\n placeholder: |\n ex: Add spline reticulation option to widget authentication mechanism.\n validations:\n required: true\n" }, { "path": ".github/dependabot.yml", "content": "version: 2\n\nupdates:\n\n # Enable version updates for GitHub ecosystem\n - package-ecosystem: \"github-actions\"\n directory: \"/\"\n schedule:\n interval: \"daily\"\n" }, { "path": ".github/workflows/codeql-analysis.yml", "content": "name: \"CodeQL\"\n\non:\n push:\n branches: [ main, release ]\n pull_request:\n # The branches below must be a subset of the branches above\n branches: [ main ]\n\njobs:\n analyze:\n name: Analyze\n runs-on: ubuntu-latest\n permissions:\n actions: read\n contents: read\n security-events: write\n\n strategy:\n fail-fast: false\n matrix:\n language: [ 'csharp' ]\n\n steps:\n - uses: actions/checkout@v6\n\n - name: Setup .NET\n uses: actions/setup-dotnet@v5.1.0\n with:\n dotnet-version: 8.0.x\n\n # Initializes the CodeQL tools for scanning.\n - name: Initialize CodeQL\n uses: github/codeql-action/init@v4\n with:\n languages: ${{ matrix.language }}\n\n - run: |\n dotnet build\n\n - name: Perform CodeQL Analysis\n uses: github/codeql-action/analyze@v4\n" }, { "path": ".github/workflows/continuous-integration.yml", "content": "name: ci\r\n\r\non:\r\n workflow_dispatch:\r\n push:\r\n branches: [ main ]\r\n pull_request:\r\n branches: [ main ]\r\n\r\njobs:\r\n# ================================\r\n# Windows\r\n# ================================\r\n windows:\r\n name: Windows\r\n runs-on: ${{ matrix.os }}\r\n strategy:\r\n matrix:\r\n include:\r\n - runtime: win-x86\r\n os: windows-latest\r\n - runtime: win-x64\r\n os: windows-latest\r\n - runtime: win-arm64\r\n os: windows-11-arm\r\n\r\n steps:\r\n - uses: actions/checkout@v6\r\n\r\n - name: Setup .NET\r\n uses: actions/setup-dotnet@v5.1.0\r\n with:\r\n dotnet-version: 8.0.x\r\n\r\n - name: Install dependencies\r\n run: dotnet restore\r\n\r\n - name: Build\r\n run: |\r\n dotnet build src/windows/Installer.Windows/Installer.Windows.csproj `\r\n --configuration=Release `\r\n --runtime=${{ matrix.runtime }}\r\n\r\n - name: Test\r\n run: |\r\n dotnet test --verbosity normal `\r\n --configuration=WindowsRelease `\r\n --runtime=${{ matrix.runtime }}\r\n\r\n - name: Prepare artifacts\r\n shell: bash\r\n run: |\r\n mkdir -p artifacts/bin\r\n mv out/windows/Installer.Windows/bin/Release/net472/gcm*.exe artifacts/\r\n mv out/windows/Installer.Windows/bin/Release/net472/${{ matrix.runtime }} artifacts/bin/\r\n cp out/windows/Installer.Windows/bin/Release/net472/${{ matrix.runtime }}.sym/* artifacts/bin/${{ matrix.runtime }}/\r\n\r\n - name: Upload artifacts\r\n uses: actions/upload-artifact@v7\r\n with:\r\n name: ${{ matrix.runtime }}\r\n path: |\r\n artifacts\r\n\r\n# ================================\r\n# Linux\r\n# ================================\r\n linux:\r\n name: Linux\r\n runs-on: ubuntu-latest\r\n strategy:\r\n matrix:\r\n runtime: [ linux-x64, linux-arm64, linux-arm ]\r\n\r\n steps:\r\n - uses: actions/checkout@v6\r\n\r\n - name: Setup .NET\r\n uses: actions/setup-dotnet@v5.1.0\r\n with:\r\n dotnet-version: 8.0.x\r\n\r\n - name: Install dependencies\r\n run: dotnet restore\r\n\r\n - name: Build\r\n run: |\r\n dotnet build src/linux/Packaging.Linux/*.csproj \\\r\n --configuration=Release --no-self-contained \\\r\n --runtime=${{ matrix.runtime }}\r\n\r\n - name: Test\r\n run: |\r\n dotnet test --verbosity normal --configuration=LinuxRelease\r\n\r\n - name: Prepare artifacts\r\n run: |\r\n mkdir -p artifacts\r\n mv out/linux/Packaging.Linux/Release/deb/*.deb artifacts/\r\n mv out/linux/Packaging.Linux/Release/tar/*.tar.gz artifacts/\r\n\r\n - name: Upload artifacts\r\n uses: actions/upload-artifact@v7\r\n with:\r\n name: ${{ matrix.runtime }}\r\n path: |\r\n artifacts\r\n\r\n# ================================\r\n# macOS\r\n# ================================\r\n osx:\r\n name: macOS\r\n runs-on: macos-latest\r\n strategy:\r\n matrix:\r\n runtime: [ osx-x64, osx-arm64 ]\r\n\r\n steps:\r\n - uses: actions/checkout@v6\r\n\r\n - name: Setup .NET\r\n uses: actions/setup-dotnet@v5.1.0\r\n with:\r\n dotnet-version: 8.0.x\r\n\r\n - name: Install dependencies\r\n run: dotnet restore\r\n\r\n - name: Build\r\n run: |\r\n dotnet build src/osx/Installer.Mac/*.csproj \\\r\n --configuration=Release --no-self-contained \\\r\n --runtime=${{ matrix.runtime }}\r\n\r\n - name: Test\r\n run: |\r\n dotnet test --verbosity normal --configuration=MacRelease\r\n\r\n - name: Prepare artifacts\r\n run: |\r\n mkdir -p artifacts/bin\r\n mv out/osx/Installer.Mac/pkg/Release/payload \"artifacts/bin/${{ matrix.runtime }}\"\r\n cp out/osx/Installer.Mac/pkg/Release/payload.sym/* \"artifacts/bin/${{ matrix.runtime }}/\"\r\n mv out/osx/Installer.Mac/pkg/Release/gcm*.pkg artifacts/\r\n\r\n - name: Upload artifacts\r\n uses: actions/upload-artifact@v7\r\n with:\r\n name: ${{ matrix.runtime }}\r\n path: |\r\n artifacts\r\n" }, { "path": ".github/workflows/lint-docs.yml", "content": "name: \"Lint documentation\"\n\non:\n workflow_dispatch:\n push:\n branches: [ main, linux ]\n paths:\n - '**.md'\n - '.github/workflows/lint-docs.yml'\n pull_request:\n branches: [ main, linux ]\n paths:\n - '**.md'\n - '.github/workflows/lint-docs.yml'\n\njobs:\n lint-markdown:\n name: Lint markdown files\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v6\n\n - uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101\n with:\n globs: |\n \"**/*.md\"\n \"!.github/ISSUE_TEMPLATE\"\n\n check-links:\n name: Check for broken links\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v6\n\n - name: Run link checker\n # For any troubleshooting, see:\n # https://github.com/lycheeverse/lychee/blob/master/docs/TROUBLESHOOTING.md\n uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411\n with:\n # user-agent: if a user agent is not specified, some websites (e.g.\n # GitHub Docs) return HTTP errors which Lychee will interpret as\n # a broken link.\n # no-progress: do not show progress bar. Recommended for\n # non-interactive shells (e.g. for CI)\n # inputs: by default (.), this action checks files matching the\n # patterns: './**/*.md' './**/*.html'\n args: >-\n --user-agent \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36\"\n --no-progress .\n fail: true\n env:\n # A token is used to avoid GitHub rate limiting. A personal token with\n # no extra permissions is enough to be able to check public repos\n # See: https://github.com/lycheeverse/lychee#github-token\n GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}\n" }, { "path": ".github/workflows/maintainer-absence.yml", "content": "name: maintainer-absence\n\non:\n workflow_dispatch:\n inputs:\n startDate:\n description: 'First day of maintainer absence [mm-dd-yyyy]'\n required: true\n endDate:\n description: 'Last day of maintainer absence [mm-dd-yyyy]'\n required: true\n\npermissions:\n issues: write\n\njobs:\n create-issue:\n name: create-issue\n runs-on: ubuntu-latest\n steps:\n - uses: actions/github-script@v8\n with:\n script: |\n const startDate = new Date('${{ github.event.inputs.startDate }}');\n const endDate = new Date('${{ github.event.inputs.endDate }}');\n\n if (startDate > endDate) {\n throw 'Start date cannot be later than end date.';\n }\n\n // Calculate total days of absence\n const differenceInDays = endDate.getTime() - startDate.getTime();\n const lengthOfAbsence = differenceInDays/(1000 * 3600 * 24);\n\n // Create issue\n issue = await github.rest.issues.create({\n owner: context.repo.owner,\n repo: context.repo.repo,\n // Use the briefer input date format in title (instead of JavaScript's full date string)\n title: `Maintainer(s) will be away from ${{ github.event.inputs.startDate }} until ${{ github.event.inputs.endDate }}`,\n body: `The ${context.repo.repo} maintainer(s) will be away for ${lengthOfAbsence} day${lengthOfAbsence > 1 ? 's' : ''} beginning on\n ${startDate.toDateString()} and ending on ${endDate.toDateString()}. During this time, the maintainer(s)\n will not be actively monitoring PRs, discussions, etc. Please report any issues\n requiring immediate attention to [@GitCredManager](https://twitter.com/GitCredManager) on Twitter.`\n });\n\n // Pin issue - we use GraphQL since there is no GitHub API available for this\n const mutation = `mutation($issueId: ID!) {\n pinIssue(input: { issueId: $issueId }) {\n issue {\n repository {\n id\n }\n }\n }\n }`;\n const variables = {\n issueId: issue.data.node_id\n }\n const result = await github.graphql(mutation, variables)" }, { "path": ".github/workflows/validate-install-from-source.yml", "content": "name: validate-install-from-source\n\non:\n workflow_dispatch:\n push:\n branches:\n - main\n\njobs:\n docker:\n name: ${{matrix.vector.image}}\n runs-on: ubuntu-latest\n strategy:\n fail-fast: false\n matrix:\n vector:\n - image: ubuntu\n - image: debian:bullseye\n - image: fedora\n # Centos no longer officially maintains images on Docker Hub. However,\n # tgagor is a contributor who pushes updated images weekly, which should\n # be sufficient for our validation needs.\n - image: tgagor/centos\n - image: redhat/ubi8\n - image: alpine\n - image: alpine:3.19.8\n - image: opensuse/leap\n - image: opensuse/tumbleweed\n - image: registry.suse.com/suse/sle15:15.4.27.11.31\n - image: archlinux\n - image: mcr.microsoft.com/cbl-mariner/base/core:2.0\n - image: mcr.microsoft.com/azurelinux/base/core:3.0\n container: ${{matrix.vector.image}}\n steps:\n - run: |\n if [[ ${{matrix.vector.image}} == *\"suse\"* ]]; then\n zypper -n install tar gzip\n elif [[ ${{matrix.vector.image}} == *\"centos\"* ]]; then\n dnf install which -y\n elif [[ ${{matrix.vector.image}} == *\"mariner\"* || ${{matrix.vector.image}} == *\"azurelinux\"* ]]; then\n GNUPGHOME=/root/.gnupg tdnf update -y &&\n GNUPGHOME=/root/.gnupg tdnf install tar -y # needed for `actions/checkout`\n fi\n\n - uses: actions/checkout@v6\n\n - run: |\n sh \"${GITHUB_WORKSPACE}/src/linux/Packaging.Linux/install-from-source.sh\" -y\n git-credential-manager --help || exit 1\n" }, { "path": ".gitignore", "content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n\n# Visual Studio 2015/2017 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# Visual Studio 2017 auto generated files\nGenerated\\ Files/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUNIT\n*.VisualState.xml\nTestResult.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# Benchmark Results\nBenchmarkDotNet.Artifacts/\n\n# .NET\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n**/Properties/launchSettings.json\n\n# StyleCop\nStyleCopReport.xml\n\n# Files built by Visual Studio\n*_i.c\n*_p.c\n*_i.h\n*.ilk\n*.meta\n*.obj\n*.iobj\n*.pch\n*.pdb\n*.ipdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# Visual Studio Trace Files\n*.e2e\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# AxoCover is a Code Coverage Tool\n.axoCover/*\n!.axoCover/settings.json\n\n# Visual Studio code coverage results\n*.coverage\n*.coveragexml\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# Note: Comment the next line if you want to checkin your web deploy settings,\n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# The packages folder can be ignored because of Package Restore\n**/[Pp]ackages/*\n# except build/, which is used as an MSBuild target.\n!**/[Pp]ackages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/[Pp]ackages/repositories.config\n# NuGet v3's project.json files produces more ignorable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n*.appx\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.jfm\n*.pfx\n*.publishsettings\norleans.codegen.cs\n\n# Including strong name files can present a security risk \n# (https://github.com/github/gitignore/pull/2483#issue-259490424)\n#*.snk\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\nServiceFabricBackup/\n*.rptproj.bak\n\n# SQL Server files\n*.mdf\n*.ldf\n*.ndf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n*.rptproj.rsuser\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\nnode_modules/\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)\n*.vbw\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# JetBrains Rider\n.idea/\n*.sln.iml\n\n# CodeRush\n.cr/\n\n# Python Tools for Visual Studio (PTVS)\n__pycache__/\n*.pyc\n\n# Cake - Uncomment if you are using it\n# tools/**\n# !tools/packages.config\n\n# Tabs Studio\n*.tss\n\n# Telerik's JustMock configuration file\n*.jmconfig\n\n# BizTalk build output\n*.btp.cs\n*.btm.cs\n*.odx.cs\n*.xsd.cs\n\n# OpenCover UI analysis results\nOpenCover/\n\n# Azure Stream Analytics local run output \nASALocalRun/\n\n# MSBuild Binary and Structured Log\n*.binlog\n\n# NVidia Nsight GPU debugger configuration file\n*.nvuser\n\n# MFractors (Xamarin productivity tool) working folder \n.mfractor/\n\n# macOS Finder files\n.DS_Store\n\n# GCM build output\nout/\n\n# Temporary build directory\n.tmp/\n\n# dotnet local tools\n.tools/\n\n# Signing generated Files\nauth.json\ninput.json" }, { "path": ".lycheeignore", "content": "godaddy\\.com[\\\\/]?$\ngitlab\\.com/-/profile/applications\nfile:[\\\\/][\\\\/][\\\\/].*\n" }, { "path": ".markdownlint.jsonc", "content": "// For information on writing markdownlint configuration see:\n// https://github.com/DavidAnson/markdownlint/blob/main/README.md#optionsconfig\n{\n \"MD013\": {\n \"line_length\": 80,\n \"code_blocks\": false,\n \"headings\": false,\n \"tables\": false\n },\n \"MD024\": false // The format for some files require repeated headings, e.g. \"Example\"\n}\n" }, { "path": ".vscode/launch.json", "content": "{\n // Use IntelliSense to find out which attributes exist for C# debugging\n // Use hover for the description of the existing attributes\n // For further information visit https://github.com/OmniSharp/omnisharp-vscode/blob/master/debugger-launchjson.md\n \"version\": \"0.2.0\",\n \"configurations\": [\n {\n \"name\": \"Git Credential Manager (get)\",\n \"type\": \"coreclr\",\n \"request\": \"launch\",\n \"preLaunchTask\": \"build\",\n // If you have changed target frameworks, make sure to update the program path.\n \"program\": \"${workspaceFolder}/out/shared/Git-Credential-Manager/bin/Debug/net8.0/git-credential-manager.dll\",\n \"args\": [\"get\"],\n \"cwd\": \"${workspaceFolder}/out/shared/Git-Credential-Manager\",\n \"console\": \"integratedTerminal\",\n \"stopAtEntry\": false,\n },\n {\n \"name\": \"Git Credential Manager (store)\",\n \"type\": \"coreclr\",\n \"request\": \"launch\",\n \"preLaunchTask\": \"build\",\n // If you have changed target frameworks, make sure to update the program path.\n \"program\": \"${workspaceFolder}/out/shared/Git-Credential-Manager/bin/Debug/net8.0/git-credential-manager.dll\",\n \"args\": [\"store\"],\n \"cwd\": \"${workspaceFolder}/out/shared/Git-Credential-Manager\",\n \"console\": \"integratedTerminal\",\n \"stopAtEntry\": false,\n },\n {\n \"name\": \".NET Attach\",\n \"type\": \"coreclr\",\n \"request\": \"attach\",\n \"processId\": \"${command:pickProcess}\"\n }\n ]\n}\n" }, { "path": ".vscode/tasks.json", "content": "{\n \"version\": \"2.0.0\",\n \"tasks\": [\n {\n \"label\": \"build\",\n \"command\": \"dotnet\",\n \"type\": \"process\",\n \"group\":{\n \"kind\": \"build\",\n \"isDefault\": true\n },\n \"args\": [\n \"build\",\n \"${workspaceFolder}/Git-Credential-Manager.sln\",\n ],\n \"problemMatcher\": \"$msCompile\"\n },\n {\n \"label\": \"test\",\n \"command\": \"dotnet\",\n \"type\": \"shell\",\n \"group\":{\n \"kind\": \"test\",\n \"isDefault\": true\n },\n \"args\": [\n \"test\",\n \"${workspaceFolder}/Git-Credential-Manager.sln\"\n ],\n \"presentation\": {\n \"reveal\": \"always\",\n \"panel\": \"dedicated\"\n }\n },\n {\n \"label\": \"test with coverage\",\n \"command\": \"dotnet\",\n \"type\": \"shell\",\n \"group\": \"test\",\n \"args\": [\n \"test\",\n \"${workspaceFolder}/Git-Credential-Manager.sln\",\n \"--collect\",\n \"'XPlat Code Coverage'\",\n \"--settings\",\n \"${workspaceFolder}/.code-coverage/coverlet.settings.xml\"\n ],\n \"presentation\": {\n \"reveal\": \"always\",\n \"panel\": \"dedicated\"\n }\n },\n {\n \"label\": \"report coverage - nix\",\n \"command\": \"dotnet\",\n \"type\": \"shell\",\n \"group\": \"test\",\n \"args\": [\n \"~/.nuget/packages/reportgenerator/*/*/net8.0/ReportGenerator.dll\",\n \"-reports:${workspaceFolder}/**/TestResults/**/coverage.cobertura.xml\",\n \"-targetdir:${workspaceFolder}/out/code-coverage\"\n ],\n \"presentation\": {\n \"reveal\": \"always\",\n \"panel\": \"dedicated\"\n }\n },\n {\n \"label\": \"report coverage - win\",\n \"command\": \"dotnet\",\n \"type\": \"shell\",\n \"group\": \"test\",\n \"args\": [\n \"${env:USERROFILE}/.nuget/packages/reportgenerator/*/*/net8.0/ReportGenerator.dll\",\n \"-reports:${workspaceFolder}/**/TestResults/**/coverage.cobertura.xml\",\n \"-targetdir:${workspaceFolder}/out/code-coverage\"\n ],\n \"presentation\": {\n \"reveal\": \"always\",\n \"panel\": \"dedicated\"\n }\n }\n ]\n}" }, { "path": "CODEOWNERS", "content": "*\t@git-ecosystem/git-client\n/src/shared/Microsoft.AzureRepos/\t@git-ecosystem/git-client @git-ecosystem/gcm-azure-maintainers\n/src/shared/Microsoft.AzureRepos.Tests/\t@git-ecosystem/git-client @git-ecosystem/gcm-azure-maintainers\n/src/shared/GitHub/\t@git-ecosystem/git-client @git-ecosystem/hubbers\n/src/shared/GitHub.Tests/\t@git-ecosystem/git-client @git-ecosystem/hubbers\n" }, { "path": "CODE_OF_CONDUCT.md", "content": "# Contributor Covenant Code of Conduct\n\n## Our Pledge\n\nIn the interest of fostering an open and welcoming environment, we as\ncontributors and maintainers pledge to make participation in our project and\nour community a harassment-free experience for everyone, regardless of age, body\nsize, disability, ethnicity, sex characteristics, gender identity and expression,\nlevel of experience, education, socio-economic status, nationality, personal\nappearance, race, religion, or sexual identity and orientation.\n\n## Our Standards\n\nExamples of behavior that contributes to creating a positive environment\ninclude:\n\n* Using welcoming and inclusive language\n* Being respectful of differing viewpoints and experiences\n* Gracefully accepting constructive criticism\n* Focusing on what is best for the community\n* Showing empathy towards other community members\n\nExamples of unacceptable behavior by participants include:\n\n* The use of sexualized language or imagery and unwelcome sexual attention or\n advances\n* Trolling, insulting/derogatory comments, and personal or political attacks\n* Public or private harassment\n* Publishing others' private information, such as a physical or electronic\n address, without explicit permission\n* Other conduct which could reasonably be considered inappropriate in a\n professional setting\n\n## Our Responsibilities\n\nProject maintainers are responsible for clarifying the standards of acceptable\nbehavior and are expected to take appropriate and fair corrective action in\nresponse to any instances of unacceptable behavior.\n\nProject maintainers have the right and responsibility to remove, edit, or\nreject comments, commits, code, wiki edits, issues, and other contributions\nthat are not aligned to this Code of Conduct, or to ban temporarily or\npermanently any contributor for other behaviors that they deem inappropriate,\nthreatening, offensive, or harmful.\n\n## Scope\n\nThis Code of Conduct applies within all project spaces, and it also applies when\nan individual is representing the project or its community in public spaces.\nExamples of representing a project or community include using an official\nproject e-mail address, posting via an official social media account, or acting\nas an appointed representative at an online or offline event. Representation of\na project may be further defined and clarified by project maintainers.\n\n## Enforcement\n\nInstances of abusive, harassing, or otherwise unacceptable behavior may be\nreported by contacting the project team at opensource@github.com. All\ncomplaints will be reviewed and investigated and will result in a response that\nis deemed necessary and appropriate to the circumstances. The project team is\nobligated to maintain confidentiality with regard to the reporter of an incident.\nFurther details of specific enforcement policies may be posted separately.\n\nProject maintainers who do not follow or enforce the Code of Conduct in good\nfaith may face temporary or permanent repercussions as determined by other\nmembers of the project's leadership.\n\n## Attribution\n\nThis Code of Conduct is adapted from the [Contributor Covenant][cc-homepage],\nversion 1.4, available at [Contributor Covenant Code of Conduct][cc-coc].\n\nFor answers to common questions about this code of conduct, see the\n[Contributor Covenant FAQ][cc-faq]\n\n[cc-coc]: https://www.contributor-covenant.org/version/1/4/code-of-conduct.html\n[cc-faq]: https://www.contributor-covenant.org/faq\n[cc-homepage]: https://www.contributor-covenant.org\n" }, { "path": "CONTRIBUTING.md", "content": "# Contributing\n\nHi there! We're thrilled that you'd like to contribute to GCM :tada:. Your help\nis essential for keeping it great.\n\nContributions to GCM are [released][contribute-under-repo-license] to the public\nunder the [project's open source license][license].\n\nPlease note that this project is released with a\n[Contributor Code of Conduct][code-of-conduct]. By participating in this project\nyou agree to abide by its terms.\n\n## Start with an issue\n\n1. Open an [issue][issue] to discuss the change you want to see.\n This helps us coordinate and reduce duplication.\n1. Once we've had some discussion, you're ready to code!\n\n## Submitting a pull request\n\n1. [Fork][fork] and clone the repository\n1. Configure and install the dependencies: `dotnet restore`\n1. Make sure the tests pass on your machine: `dotnet test`\n1. Create a new branch: `git switch -c my-branch-name`\n1. Make your change, add tests, and make sure the tests still pass\n1. For UI updates, test your changes by executing a `dotnet run` in applicable\n UI-related project directories:\n - `Atlassian.Bitbucket.UI.Avalonia`\n - `GitHub.UI.Avalonia`\n - `Atlassian.Bitbucket.UI.Windows`\n - `GitHub.UI.Windows`\n1. Organize your changes into one or more [logical, descriptive commits][commits].\n1. Push to your fork and [submit a pull request][pr]\n1. Pat your self on the back and wait for your pull request to be reviewed and\n merged.\n\nHere are a few things you can do that will increase the likelihood of your pull\nrequest being accepted:\n\n- Match existing code style.\n- Write tests.\n- Keep your change as focused as possible. If there are multiple changes you\n would like to make that are not dependent upon each other, consider\n submitting them as separate pull requests.\n\n## Resources\n\n- [How to Contribute to Open Source][how-to-contribute]\n- [Using Pull Requests][prs]\n- [GitHub Help][github-help]\n\n[code-of-conduct]: CODE_OF_CONDUCT.md\n[commits]: https://www.youtube.com/watch?v=4qLtKx9S9a8\n[contribute-under-repo-license]: https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license\n[fork]: https://github.com/git-ecosystem/git-credential-manager/fork\n[github-help]: https://help.github.com\n[how-to-contribute]: https://opensource.guide/how-to-contribute/\n[issue]: https://github.com/git-ecosystem/git-credential-manager/issues/new/choose\n[license]: LICENSE\n[pr]: https://github.com/git-ecosystem/git-credential-manager/compare\n[prs]: https://help.github.com/articles/about-pull-requests/\n" }, { "path": "Directory.Build.props", "content": "\n\n \n\n \n \n windows\n osx\n linux\n true\n false\n\n \n $(MSBuildThisFileDirectory)\n $(RepoPath)src\\\n $(RepoPath)out\\\n $(RepoPath)assets\\\n\n \n <_IsExeProject Condition=\"'$(OutputType)' == 'Exe' OR '$(OutputType)' == 'WinExe'\">true\n\n \n true\n \n\n \n \n 8.0.5\n \n \n\n\n" }, { "path": "Directory.Build.targets", "content": "\n\n \n\n \n \n\n \n \n \n \n \n \n \n \n\n \n \n $(IntermediateOutputPath)app.manifest\n \n\n \n \n \n \n \n \n \n\n\n" }, { "path": "Git-Credential-Manager.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.29927.169\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"src\", \"src\", \"{A7FC1234-95E3-4496-B5F7-4306F41E6A0E}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Git-Credential-Manager\", \"src\\shared\\Git-Credential-Manager\\Git-Credential-Manager.csproj\", \"{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Core\", \"src\\shared\\Core\\Core.csproj\", \"{31BCFC70-B767-4274-873F-1A076D422FC3}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Core.Tests\", \"src\\shared\\Core.Tests\\Core.Tests.csproj\", \"{AD41FA1E-51F5-4E4F-B7DA-32F921491313}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Microsoft.AzureRepos\", \"src\\shared\\Microsoft.AzureRepos\\Microsoft.AzureRepos.csproj\", \"{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Microsoft.AzureRepos.Tests\", \"src\\shared\\Microsoft.AzureRepos.Tests\\Microsoft.AzureRepos.Tests.csproj\", \"{97DC6241-1240-4A85-8035-F8404A983A82}\"\nEndProject\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"windows\", \"windows\", \"{66722747-1B61-40E4-A89B-1AC8E6D62EA9}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"TestInfrastructure\", \"src\\shared\\TestInfrastructure\\TestInfrastructure.csproj\", \"{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"GitHub\", \"src\\shared\\GitHub\\GitHub.csproj\", \"{3C840B06-A595-4FD9-9A76-56CD45B14780}\"\nEndProject\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"shared\", \"shared\", \"{D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"GitHub.Tests\", \"src\\shared\\GitHub.Tests\\GitHub.Tests.csproj\", \"{3E524EA8-D31A-4394-997C-14B522E3D6FD}\"\nEndProject\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"osx\", \"osx\", \"{3D279E2D-E011-45CF-8EA8-3D71D1300443}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Installer.Mac\", \"src\\osx\\Installer.Mac\\Installer.Mac.csproj\", \"{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}\"\nEndProject\nProject(\"{9A19103F-16F7-4668-BE54-9A1E7A4F7556}\") = \"Installer.Windows\", \"src\\windows\\Installer.Windows\\Installer.Windows.csproj\", \"{85903170-9E52-4B53-A6E4-3F416F684FAE}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Atlassian.Bitbucket\", \"src\\shared\\Atlassian.Bitbucket\\Atlassian.Bitbucket.csproj\", \"{B49881A6-E734-490E-8EA7-FB0D9E296CFB}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Atlassian.Bitbucket.Tests\", \"src\\shared\\Atlassian.Bitbucket.Tests\\Atlassian.Bitbucket.Tests.csproj\", \"{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Packaging.Linux\", \"src\\linux\\Packaging.Linux\\Packaging.Linux.csproj\", \"{AD2A935F-3720-4802-8119-6A9B35B254DF}\"\nEndProject\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"linux\", \"linux\", \"{8F9D7E67-7DD7-4E32-9134-423281AF00E9}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"GitLab\", \"src\\shared\\GitLab\\GitLab.csproj\", \"{570897DC-A85C-4598-B793-9A00CF710119}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"GitLab.Tests\", \"src\\shared\\GitLab.Tests\\GitLab.Tests.csproj\", \"{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tMacDebug|Any CPU = MacDebug|Any CPU\n\t\tMacRelease|Any CPU = MacRelease|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\t\tWindowsDebug|Any CPU = WindowsDebug|Any CPU\n\t\tWindowsRelease|Any CPU = WindowsRelease|Any CPU\n\t\tLinuxDebug|Any CPU = LinuxDebug|Any CPU\n\t\tLinuxRelease|Any CPU = LinuxRelease|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{570897DC-A85C-4598-B793-9A00CF710119}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.MacDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.MacDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.WindowsDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.WindowsDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.LinuxDebug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.LinuxDebug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.LinuxRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.LinuxRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.MacRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.MacRelease|Any CPU.Build.0 = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.WindowsRelease|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393}.WindowsRelease|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(NestedProjects) = preSolution\n\t\t{28F06D44-AB25-4CF5-93F9-978C23FAA9D6} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{31BCFC70-B767-4274-873F-1A076D422FC3} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{AD41FA1E-51F5-4E4F-B7DA-32F921491313} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{714AF9EB-44E6-4058-BD3E-9039F29F4D7A} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{97DC6241-1240-4A85-8035-F8404A983A82} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{66722747-1B61-40E4-A89B-1AC8E6D62EA9} = {A7FC1234-95E3-4496-B5F7-4306F41E6A0E}\n\t\t{5A7D9E8B-C1D2-4C5C-BE98-648C41D1F8BD} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{3C840B06-A595-4FD9-9A76-56CD45B14780} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{D5277A0E-997E-453A-8CB9-4EFCC8B16A29} = {A7FC1234-95E3-4496-B5F7-4306F41E6A0E}\n\t\t{3E524EA8-D31A-4394-997C-14B522E3D6FD} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{3D279E2D-E011-45CF-8EA8-3D71D1300443} = {A7FC1234-95E3-4496-B5F7-4306F41E6A0E}\n\t\t{74FA0AA4-B5C1-4F3B-B182-277FC2D50715} = {3D279E2D-E011-45CF-8EA8-3D71D1300443}\n\t\t{85903170-9E52-4B53-A6E4-3F416F684FAE} = {66722747-1B61-40E4-A89B-1AC8E6D62EA9}\n\t\t{B49881A6-E734-490E-8EA7-FB0D9E296CFB} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{025E5329-A0B1-4BA9-9203-B70B44A5F9E0} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{8F9D7E67-7DD7-4E32-9134-423281AF00E9} = {A7FC1234-95E3-4496-B5F7-4306F41E6A0E}\n\t\t{AD2A935F-3720-4802-8119-6A9B35B254DF} = {8F9D7E67-7DD7-4E32-9134-423281AF00E9}\n\t\t{570897DC-A85C-4598-B793-9A00CF710119} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\t\t{1AF9F7C5-FA2E-48F1-B216-4D5E9A27F393} = {D5277A0E-997E-453A-8CB9-4EFCC8B16A29}\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {0EF9FC65-E6BA-45D4-A455-262A9EA4366B}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Git-Credential-Manager.sln.DotSettings", "content": "\n\tOS\n\tNo\n\tTrue\n\tTrue\n" }, { "path": "LICENSE", "content": "Git Credential Manager\nCopyright © GitHub, Inc. and contributors\n\nMIT License\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE\n" }, { "path": "NOTICE", "content": "NOTICES AND INFORMATION\nDo Not Translate or Localize\n\nThis repository for Git Credential Manager includes material from the\nprojects listed below.\n\n--------------------------------------------------------------------------------\n1. GitHub/VisualStudio (https://github.com/github/VisualStudio)\n\nCopyright (c) GitHub Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n--------------------------------------------------------------------------------\n2. dotnet/runtime (https://github.com/dotnet/runtime)\n\nThe MIT License (MIT)\n\nCopyright (c) .NET Foundation and Contributors\n\nAll rights reserved.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" }, { "path": "README.md", "content": "# Git Credential Manager\n\n[![Build Status][build-status-badge]][workflow-status]\n\n---\n\n[Git Credential Manager][gcm] (GCM) is a secure\n[Git credential helper][git-credential-helper] built on [.NET][dotnet] that runs\non Windows, macOS, and Linux. It aims to provide a consistent and secure\nauthentication experience, including multi-factor auth, to every major source\ncontrol hosting service and platform.\n\nGCM supports (in alphabetical order) [Azure DevOps][azure-devops], Azure DevOps\nServer (formerly Team Foundation Server), Bitbucket, GitHub, and GitLab.\nCompare to Git's [built-in credential helpers][git-tools-credential-storage]\n(Windows: wincred, macOS: osxkeychain, Linux: gnome-keyring/libsecret), which\nprovide single-factor authentication support for username/password only.\n\nGCM replaces both the .NET Framework-based\n[Git Credential Manager for Windows][gcm-for-windows] and the Java-based\n[Git Credential Manager for Mac and Linux][gcm-for-mac-and-linux].\n\n## Install\n\nSee the [installation instructions][install] for the current version of GCM for\ninstall options for your operating system.\n\n## Current status\n\nGit Credential Manager is currently available for Windows, macOS, and Linux\\*.\nGCM only works with HTTP(S) remotes; you can still use Git with SSH:\n\n- [Azure DevOps SSH][azure-devops-ssh]\n- [GitHub SSH][github-ssh]\n- [Bitbucket SSH][bitbucket-ssh]\n\nFeature|Windows|macOS|Linux\\*\n-|:-:|:-:|:-:\nInstaller/uninstaller|✓|✓|✓\nSecure platform credential storage [(see more)][gcm-credstores]|✓|✓|✓\nMulti-factor authentication support for Azure DevOps|✓|✓|✓\nTwo-factor authentication support for GitHub|✓|✓|✓\nTwo-factor authentication support for Bitbucket|✓|✓|✓\nTwo-factor authentication support for GitLab|✓|✓|✓\nWindows Integrated Authentication (NTLM/Kerberos) support|✓|_N/A_|_N/A_\nBasic HTTP authentication support|✓|✓|✓\nProxy support|✓|✓|✓\n`amd64` support|✓|✓|✓\n`x86` support|✓|_N/A_|✗\n`arm64` support|best effort|✓|✓\n`armhf` support|_N/A_|_N/A_|✓\n\n(\\*) GCM guarantees support only for [the Linux distributions that are officially\nsupported by dotnet][dotnet-distributions].\n\n## Supported Git versions\n\nGit Credential Manager tries to be compatible with the broadest set of Git\nversions (within reason). However there are some known problematic releases of\nGit that are not compatible.\n\n- Git 1.x\n\n The initial major version of Git is not supported or tested with GCM.\n\n- Git 2.26.2\n\n This version of Git introduced a breaking change with parsing credential\n configuration that GCM relies on. This issue was fixed in commit\n [`12294990`][gcm-commit-12294990] of the Git project, and released in Git\n 2.27.0.\n\n## How to use\n\nOnce it's installed and configured, Git Credential Manager is called implicitly\nby Git. You don't have to do anything special, and GCM isn't intended to be\ncalled directly by the user. For example, when pushing (`git push`) to\n[Azure DevOps][azure-devops], [Bitbucket][bitbucket], or [GitHub][github], a\nwindow will automatically open and walk you through the sign-in process. (This\nprocess will look slightly different for each Git host, and even in some cases,\nwhether you've connected to an on-premises or cloud-hosted Git host.) Later Git\ncommands in the same repository will re-use existing credentials or tokens that\nGCM has stored for as long as they're valid.\n\nRead full command line usage [here][gcm-usage].\n\n### Configuring a proxy\n\nSee detailed information [here][gcm-http-proxy].\n\n## Additional Resources\n\nSee the [documentation index][docs-index] for links to additional resources.\n\n## Experimental Features\n\n- [Windows broker (experimental)][gcm-windows-broker]\n\n## Future features\n\nCurious about what's coming next in the GCM project? Take a look at the [project\nroadmap][roadmap]! You can find more details about the construction of the\nroadmap and how to interpret it [here][roadmap-announcement].\n\n## Contributing\n\nThis project welcomes contributions and suggestions.\nSee the [contributing guide][gcm-contributing] to get started.\n\nThis project follows [GitHub's Open Source Code of Conduct][gcm-coc].\n\n## License\n\nWe're [MIT][gcm-license] licensed.\nWhen using GitHub logos, please be sure to follow the\n[GitHub logo guidelines][github-logos].\n\n[azure-devops]: https://azure.microsoft.com/en-us/products/devops\n[azure-devops-ssh]: https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops\n[bitbucket]: https://bitbucket.org\n[bitbucket-ssh]: https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html\n[build-status-badge]: https://github.com/git-ecosystem/git-credential-manager/actions/workflows/continuous-integration.yml/badge.svg\n[docs-index]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/README.md\n[dotnet]: https://dotnet.microsoft.com\n[dotnet-distributions]: https://learn.microsoft.com/en-us/dotnet/core/install/linux\n[git-credential-helper]: https://git-scm.com/docs/gitcredentials\n[gcm]: https://github.com/git-ecosystem/git-credential-manager\n[gcm-coc]: CODE_OF_CONDUCT.md\n[gcm-commit-12294990]: https://github.com/git/git/commit/12294990c90e043862be9eb7eb22c3784b526340\n[gcm-contributing]: CONTRIBUTING.md\n[gcm-credstores]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/credstores.md\n[gcm-for-mac-and-linux]: https://github.com/microsoft/Git-Credential-Manager-for-Mac-and-Linux\n[gcm-for-windows]: https://github.com/microsoft/Git-Credential-Manager-for-Windows\n[gcm-http-proxy]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/netconfig.md#http-proxy\n[gcm-license]: LICENSE\n[gcm-usage]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/usage.md\n[gcm-windows-broker]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/windows-broker.md\n[git-tools-credential-storage]: https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage\n[github]: https://github.com\n[github-ssh]: https://help.github.com/en/articles/connecting-to-github-with-ssh\n[github-logos]: https://github.com/logos\n[install]: https://github.com/git-ecosystem/git-credential-manager/blob/release/docs/install.md\n[ms-package-repos]: https://packages.microsoft.com/repos/\n[roadmap]: https://github.com/git-ecosystem/git-credential-manager/milestones?direction=desc&sort=due_date&state=open\n[roadmap-announcement]: https://github.com/git-ecosystem/git-credential-manager/discussions/1203\n[workflow-status]: https://github.com/git-ecosystem/git-credential-manager/actions/workflows/continuous-integration.yml\n" }, { "path": "SECURITY.md", "content": "Thanks for helping make GitHub safe for everyone.\n\n## Security\n\nGitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).\n\nEven though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation. \n\n## Reporting Security Issues\n\nIf you believe you have found a security vulnerability in any GitHub-owned repository, please report it to us through coordinated disclosure.\n\n**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**\n\nInstead, please send an email to opensource-security[@]github.com.\n\nPlease include as much of the information listed below as you can to help us better understand and resolve the issue:\n\n * The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)\n * Full paths of source file(s) related to the manifestation of the issue\n * The location of the affected source code (tag/branch/commit or direct URL)\n * Any special configuration required to reproduce the issue\n * Step-by-step instructions to reproduce the issue\n * Proof-of-concept or exploit code (if possible)\n * Impact of the issue, including how an attacker might exploit the issue\n\nThis information will help us triage your report more quickly.\n\n## Policy\n\nSee [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor)\n\n" }, { "path": "VERSION", "content": "2.7.3.0\n" }, { "path": "assets/gcm.xaml", "content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "build/GCM.MSBuild.csproj", "content": "\n\n \n net8.0\n false\n \n\n \n \n \n \n\n\n" }, { "path": "build/GCM.tasks", "content": "\n \n <_TaskAssembly>$(MSBuildToolsPath)\\Microsoft.Build.Tasks.v4.0.dll\n <_TaskFactory>CodeTaskFactory\n \n \n <_TaskAssembly>$(MSBuildToolsPath)\\Microsoft.Build.Tasks.Core.dll\n <_TaskFactory>RoslynCodeTaskFactory\n \n\n \n \n \n \n \n\n \n \n \n \n \n\n" }, { "path": "build/GenerateWindowsAppManifest.cs", "content": "using Microsoft.Build.Framework;\nusing Microsoft.Build.Utilities;\nusing System.IO;\n\nnamespace GitCredentialManager.MSBuild\n{\n public class GenerateWindowsAppManifest : Task\n {\n [Required]\n public string Version { get; set; }\n\n [Required]\n public string ApplicationName { get; set; }\n\n [Required]\n public string OutputFile { get; set; }\n\n public override bool Execute()\n {\n Log.LogMessage(MessageImportance.Normal, \"Creating application manifest file for '{0}'...\", ApplicationName);\n\n string manifestDirectory = Path.GetDirectoryName(OutputFile);\n if (!Directory.Exists(manifestDirectory))\n {\n Directory.CreateDirectory(manifestDirectory);\n }\n\n File.WriteAllText(\n OutputFile,\n $@\"\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\");\n\n return true;\n }\n }\n}\n" }, { "path": "build/GetVersion.cs", "content": "using Microsoft.Build.Framework;\nusing Microsoft.Build.Utilities;\nusing System.IO;\n\nnamespace GitCredentialManager.MSBuild\n{\n public class GetVersion : Task\n {\n [Required]\n public string VersionFile { get; set; }\n\n [Output]\n public string Version { get; set; }\n\n [Output]\n public string AssemblyVersion { get; set; }\n\n [Output]\n public string FileVersion { get; set; }\n\n public override bool Execute()\n {\n Log.LogMessage(MessageImportance.Normal, \"Reading VERSION file...\");\n string textVersion = File.ReadAllText(VersionFile);\n\n if (!System.Version.TryParse(textVersion, out System.Version fullVersion))\n {\n Log.LogError(\"Invalid version '{0}' specified.\", textVersion);\n return false;\n }\n\n // System.Version names its version components as follows:\n // major.minor[.build[.revision]]\n // The main version number we use for GCM contains the first three\n // components.\n // The assembly and file version numbers contain all components, as\n // omitting the revision portion from these properties causes\n // runtime failures on Windows.\n Version = $\"{fullVersion.Major}.{fullVersion.Minor}.{fullVersion.Build}\";\n AssemblyVersion = FileVersion = fullVersion.ToString();\n\n return true;\n }\n }\n}\n" }, { "path": "docs/README.md", "content": "# User documentation\n\nThe following are links to GCM user support documentation:\n\n- [Frequently asked questions][gcm-faq]\n- [Command-line usage][gcm-usage]\n- [Configuration options][gcm-config]\n- [Environment variables][gcm-env]\n- [Enterprise configuration][gcm-enterprise-config]\n- [Network and HTTP configuration][gcm-net-config]\n- [Credential stores][gcm-credstores]\n- [Host provider specification][gcm-host-provider]\n- [Azure Repos OAuth tokens][gcm-azure-tokens]\n- [Azure Managed Identities and Service Principals][gcm-misp]\n- [GitLab support][gcm-gitlab]\n- [Generic OAuth support][gcm-oauth]\n- [NTLM and Kerberos authentication][gcm-ntlm-kerberos]\n\n[gcm-azure-tokens]: azrepos-users-and-tokens.md\n[gcm-config]: configuration.md\n[gcm-credstores]: credstores.md\n[gcm-enterprise-config]: enterprise-config.md\n[gcm-env]: environment.md\n[gcm-faq]: faq.md\n[gcm-gitlab]: gitlab.md\n[gcm-host-provider]: hostprovider.md\n[gcm-misp]: azrepos-misp.md\n[gcm-net-config]: netconfig.md\n[gcm-oauth]: generic-oauth.md\n[gcm-usage]: usage.md\n[gcm-ntlm-kerberos]: ntlm-kerberos.md\n" }, { "path": "docs/architecture.md", "content": "# Architecture\n\n## Overview\n\n```text\n+------------------------------------------------------------------------------+\n| |\n| Git-Credential-Manager |\n| |\n+-+-------------+--------------+-----+---------------------+-----------------+-+\n | | | | | |\n | | | | Windows | Windows |\n | | | | | |\n | +-----------v-----------+ | | +----------------v---------------+ |\n | | | | | | | |\n | | GitHub <-------------+ GitHub.UI.Windows | |\n | | | | | | | |\n | +-+---------------------+ | | +-+------------------------------+ |\n | | | | | |\n | | +---------------------v-+ | | +------------------------------v-+\n | | | | | | | |\n | | | Atlassian.Bitbucket <------------+ Atlassian.Bitbucket.UI.Windows |\n | | | | | | | |\n | | +-+---------------------+ | | +---------------+----------------+\n | | | | | |\n | | | +----------------------v-+ | |\n | | | | | | |\n | | | | Microsoft.AzureRepos | | |\n | | | | | | |\n | | | +-----------+------------+ | |\n | | | | | |\n+-v---v----v--------------v------------+ +-v-----------------v----------------+\n| | | |\n| Core <--+ Core.UI |\n| | | |\n+--------------------------------------+ +------------------------------------+\n```\n\nGit Credential Manager (GCM) is built to be Git host and platform/OS\nagnostic. Most of the shared logic (command execution, the abstract platform\nsubsystems, etc) can be found in the `Core` class\nlibrary (C#). The library targets .NET Standard as well as .NET Framework.\n\n> **Note**\n>\n> The reason for also targeting .NET Framework directly is that the\n> `Microsoft.Identity.Client` ([MSAL.NET][msal])\n> library requires a .NET Framework target to be able to show the embedded web\n> browser auth pop-up on Windows platforms.\n>\n> There are extension points that now exist in MSAL.NET meaning we can plug-in\n> our own browser pop-up handling code on .NET meaning both Windows and\n> Mac. We haven't yet gotten around to exploring this.\n>\n> See [GCM issue 113][issue-113] for more information.\n\nThe entry-point for GCM can be found in the `Git-Credential-Manager`\nproject, a console application that targets both .NET and .NET Framework.\nThis project emits the `git-credential-manager(.exe)` executable, and\ncontains very little code - registration of all supported host providers and\nrunning the `Application` object found in `Core`.\n\nProviders have their own projects/assemblies that take dependencies on the\n`Core` core assembly, and are dependents of the main\nentry point application `Git-Credential-Manager`. Code in these binaries is\nexpected to run on all supported platforms and typically (see MSAL.NET note\nabove) does not include any graphical user interface; they use terminal prompts\nonly.\n\nWhere a provider needs some platform-specific interaction or graphical user\ninterface, the recommended model is to have a separate 'helper' executable that\nthe shared, core binaries shell out to. Currently the Bitbucket and GitHub\nproviders each have a WPF (Windows only) helper executable that shows\nauthentication prompts and messages.\n\nThe `Core.UI` project is a WPF (Windows only) assembly\nthat contains common WPF components and styles that are shared between provider\nhelpers on Windows.\n\n### Cross-platform UI\n\nWe hope to be able to migrate the WPF/Windows only helpers to [Avalonia][avalonia]\nin order to gain cross-platform graphical user interface support. See\n[GCM issue 136][issue-136] for up-to-date progress on this effort.\n\n### Microsoft authentication\n\nFor authentication using Microsoft Accounts or Azure Active Directory, things\nare a little different. The `MicrosoftAuthentication` component is present in\nthe `Core` core assembly, rather than bundled with a\nspecific host provider. This was done to allow any service that may wish to in\nthe future integrate with Microsoft Accounts or Azure Active Directory can make\nuse of this reusable authentication component.\n\n## Asynchronous programming\n\nGCM makes use of the `async`/`await` model of .NET and C# in almost all\nparts of the codebase where appropriate as usually requests end up going to the\nnetwork at some point.\n\n## Command execution\n\n```text\n +---------------+\n | |\n | Git |\n | |\n +---+-------^---+\n | |\n +---v---+---+---+\n | stdin | stdout|\n +---+---+---^---+\n | |\n (2) | | (7)\n Select | | Serialize\n Command | | Result\n | |\n (3) | |\n Select | |\n+---------------+ Provider +---v-------+---+\n| Host Provider | | |\n| Registry <------------+ Command |\n| | | |\n+-------^-------+ +----+------^---+\n | | |\n | (4) | | (6)\n | Execute | | Return\n | Operation | | Result\n | (1) | |\n | Register +----v------+---+\n | | |\n +--------------------+ Host Provider |\n | |\n +-------^-------+\n |\n (5) Use services |\n |\n +-------v-------+\n | Command |\n | Context |\n +---------------+\n```\n\nGit Credential Manager maintains a set of known commands including\n`Get|Store|EraseCommand`, as well as commands for install and help/usage.\n\nGCM also maintains a set of known, registered host providers that implement\nthe `IHostProvider` interface. Providers register themselves by adding an\ninstance of the provider to the `Application` object via the `RegisterProvider`\nmethod in [`Core.Program`][core-program].\nThe `GenericHostProvider` is registered last so that it can handle all other\nHTTP-based remotes as a catch-all, and provide basic username/password auth and\ndetect the presence of Windows Integrated Authentication (Kerberos, NTLM,\nNegotiate) support (1).\n\nFor each invocation of GCM, the first argument on the command-line is\nmatched against the known commands and if there is a successful match, the input\nfrom Git (over standard input) is deserialized and the command is executed (2).\n\nThe `Get|Store|EraseCommand`s consult the host provider registry for the most\nappropriate host provider. The default registry implementation select the a host\nprovider by asking each registered provider in turn if they understand the\nrequest. The provider selection can be overridden by the user via the\n[`credential.provider`][credential-provider] or [`GCM_PROVIDER`][gcm-provider]\nconfiguration and environment variable respectively (3).\n\nThe `Get|Store|EraseCommand`s call the corresponding\n`Get|Store|EraseCredentialAsync` methods on the `IHostProvider`, passing the\nrequest from Git together with an instance of the `ICommandContext` (4). The\nhost provider can then make use of various services available on the command\ncontext to complete the requested operation (5).\n\nOnce a credential has been created, retrieved, stored or erased, the host\nprovider returns the credential (for `get` operations only) to the calling\ncommand (6). The credential is then serialized and returned to Git over standard\noutput (7) and GCM terminates with a successful exit code.\n\n## Host provider\n\nHost providers implement the `IHostProvider` interface. They can choose to\ndirectly implement the interface they can also derive from the `HostProvider`\nabstract class (which itself implements the `IHostProvider` interface).\n\nThe `HostProvider` abstract class implements the\n`Get|Store|EraseCredentialAsync` methods and instead has the\n`GenerateCredentialAsync` abstract method, and the `GetServiceName` virtual\nmethod. Calls to `get`, `store`, or `erase` result in first a call to\n`GetServiceName` which should return a stable and unique value for the provider\nand request. This value forms part of the attributes associated with any stored\ncredential in the credential store. During a `get` operation the\ncredential store is queried for an existing credential with such service name.\nIf a credential is found it is returned immediately. Similarly, calls to `store`\nand `erase` are handles automatically to store credentials against, and erase\ncredentials matching the service name. Methods are implemented as `virtual`\nmeaning you can always override this behaviour, for example to clear other\ncustom caches on an `erase` request, without having to reimplement the\nlookup/store credential logic.\n\nThe default implementation of `GetServiceName` is usually sufficient for most\nproviders. It returns the computed remote URL (without a trailing slash) from\nthe input arguments from Git - `://[/]` - no username is\nincluded even if present.\n\nHost providers are queried in turn, by priority (then registration order) via\nthe `IHostProvider.IsSupported(InputArguments)` method and passed the input\nreceived from Git. If the provider recognises the request, for example by a\nmatching known host name, they can return `true`. If the provider wants to\ncancel and abort an authentication request, for example if this is a HTTP (not\nHTTPS) request for a known host, they should still return `true` and later\ncancel the request.\n\nHost providers can also be queried via the `IHostProvider.IsSupported(HttpResponseMessage)`\nmethod and passed the response message from a HEAD call made to the remote URI.\nThis is useful for detecting on-premises instances based on header values. GCM\nwill only query a provider via this method overload if no other provider at the\nsame registration priority has returned `true` to the `InputArguments` overload.\n\nDepending on the request from Git, one of `GetCredentialAsync` (for `get`\nrequests), `StoreCredentialAsync` (for `store` requests) or\n`EraseCredentialAsync` (for `erase` requests) will be called. The argument\n`InputArguments` contains the request information passed over standard input\nfrom Git/the caller; the same as was passed to `IsSupported`.\n\nThe return value for the `get` operation must be an `ICredential` that Git can\nuse to complete authentication.\n\n> **Note:**\n>\n> The credential can also be an instance where both username and password are\n> the empty string, to signal to Git it should let cURL use \"any auth\"\n> detection - typically to use Windows Integrated Authentication.\n\nThere are no return values for the `store` and `erase` operations as Git ignores\nany output or exit codes for these commands. Failures for these operations are\nbest communicated via writing to the Standard Error stream via\n`ICommandContext.Streams.Error`.\n\n## Command context\n\nThe `ICommandContext` which contains numerous services which are useful for\ninteracting with various platform subsystems, such as the file system or\nenvironment variables. All services on the command context are exposed as\ninterfaces for ease of testing and portability between different operating\nsystems and platforms.\n\nComponent|Description\n-|-\nCredentialStore|A secure operating system controlled location for storing and retrieving `ICredential` objects.\nSettings|Abstraction over all GCM settings.\nStreams|Abstraction over standard input, output and error streams connected to the parent process (typically Git).\nTerminal|Provides interactions with an attached terminal, if it exists.\nSessionManager|Provides information about the current user session.\nTrace|Provides tracing information that may be useful for debugging issues in the wild. Secret information MUST be filtered out completely or via the `Write___Secret` method(s).\nFileSystem|Abstraction over file system operations.\nHttpClientFactory|Factory for creating `HttpClient` instances that are configured with the correct user agent, headers, and proxy settings.\nGit|Provides interactions with Git and Git configuration.\nEnvironment|Abstraction over the current system/user environment variables.\nSystemPrompts|Provides services for showing system/OS native credential prompts.\n\n## Error handling and tracing\n\nGCM operates a 'fail fast' approach to unrecoverable errors. This usually\nmeans throwing an `Exception` which will propagate up to the entry-point and be\ncaught, a non-zero exit code returned, and the error message printed with the\n\"fatal:\" prefix. For errors originating from interop/native code, you should\nthrow an exception of the `InteropException` type. Error messages in exceptions\nshould be human readable. When there is a known or user-fixable issue,\ninstructions on how to self-remedy the issue, or links to relevant\ndocumentation should be given.\n\nWarnings can be emitted over the standard error stream\n(`ICommandContext.Streams.Error`) when you want to alert the user to a potential\nissue with their configuration that does not necessarily stop the\noperation/authentication.\n\nThe `ITrace` component can be found on the `ICommandContext` object or passed in\ndirectly to some constructors. Verbose and diagnostic information is be written\nto the trace object in most places of GCM.\n\n[avalonia]: https://avaloniaui.net/\n[core-program]: ../src/shared/Git-Credential-Manager/Program.cs\n[credential-provider]: configuration.md#credentialprovider\n[issue-113]: https://github.com/git-ecosystem/git-credential-manager/issues/113\n[issue-136]: https://github.com/git-ecosystem/git-credential-manager/issues/136\n[gcm-provider]: environment.md#GCM_PROVIDER\n[msal]: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet\n" }, { "path": "docs/autodetect.md", "content": "# Host provider auto-detection\n\nGit Credential Manager (GCM) supports authentication with multiple different Git\nhost providers including: GitHub, Bitbucket, and Azure Repos. As well as the\nhosted/cloud offerings, GCM can also work with the self-hosted or \"on-premises\"\nversions of these services: GitHub Enterprise Server, Bitbucket DC Server, and\nAzure DevOps Server (TFS).\n\nBy default, GCM will attempt to automatically detect which particular provider\nis behind the Git remote URL you're interacting with. For the cloud versions of\nthe supported providers this is done by matching the hostname of the remote URL\nto the well-known hostnames of the services. For example \"github.com\" or\n\"dev.azure.com\".\n\n## Self-hosted/on-prem detection\n\nIn order to detect which host provider to use for a self-hosted instance, each\nprovider can provide some heuristic matching of the hostname. For example any\nhostname that begins \"github.*\" will be matched to the GitHub host provider.\n\nIf a heuristic matches incorrectly, you can always\n[explicitly configure][explicit-config] GCM to use a particular provider.\n\n## Remote URL probing\n\nIn addition to heuristic matching, GCM will make a network call to the remote\nURL and inspect HTTP response headers to try and detect a self-hosted instance.\n\nThis network call is only performed if neither an exact nor fuzzy match by\nhostname can be made. Only one HTTP `HEAD` call is made per credential request\nreceived by Git. To avoid this network call, please\n[explicitly configure][explicit-config] the host provider for your self-hosted\ninstance.\n\nAfter a successful detection of the host provider, GCM will automatically set\nthe [`credential.provider`][credential-provider] configuration entry\nfor that remote to avoid needing to perform this expensive network call in\nfuture requests.\n\n### Timeout\n\nYou can control how long GCM will wait for a response to the remote network call\nby setting the [`GCM_AUTODETECT_TIMEOUT`][gcm-autodetect-timeout] environment\nvariable, or the [`credential.autoDetectTimeout`][credential-autoDetectTimeout]\nGit configuration setting to the maximum number of milliseconds to wait.\n\nThe default value is 2000 milliseconds (2 seconds). You can prevent the network\ncall altogether by setting a zero or negative value, for example -1.\n\n## Manual configuration\n\nIf the auto-detection mechanism fails to select the correct host provider, or\nif the remote probing network call is causing performance issues, you can\nconfigure GCM to always use a particular host provider, for a given remote URL.\n\nYou can either use the the [`GCM_PROVIDER`][gcm-provider] environment variable,\nor the [`credential.provider`][credential-provider] Git configuration setting\nfor this purpose.\n\nFor example to tell GCM to always use the GitHub host provider for the\n\"ghe.example.com\" hostname, you can run the following command:\n\n```shell\ngit config --global credential.ghe.example.com.provider github\n```\n\n[credential-autoDetectTimeout]: configuration.md#credentialautodetecttimeout\n[credential-provider]: configuration.md#credentialprovider\n[explicit-config]: #manual-configuration\n[gcm-autodetect-timeout]: environment.md#GCM_AUTODETECT_TIMEOUT\n[gcm-provider]: environment.md#GCM_PROVIDER\n" }, { "path": "docs/azrepos-misp.md", "content": "# Azure Managed Identities and Service Principals\n\nGit Credential Manager supports Managed Identities and Service Principals for\nauthentication with Azure Repos. This document provides an overview of Managed\nIdentities and Service Principals and how to use them with GCM.\n\n## Managed Identities\n\nAzure Managed Identities can be used to authenticate and authorize applications\nand services to access Azure resources. Managed Identities are a secure way to\naccess Azure resources without needing to store credentials in code or\nconfiguration files.\n\nThere are two types of Managed Identities:\n\n**System-assigned**\n\nSystem-assigned Managed Identities are tied to a specific Azure resource, such\nas a Virtual Machine or App Service. When a system-assigned Managed Identity is\nenabled, Azure creates an identity for the resource in the Azure AD tenant\nthat's trusted by the subscription. The lifecycle of the identity is tied to the\nresource to which it's assigned.\n\n**User-assigned**\n\nUser-assigned Managed Identities are created as standalone Azure resources and\ncan be assigned to one or more Azure resources. This allows you to use the same\nManaged Identity across multiple resources.\n\nYou can read more about Managed Identities in the\n[Azure documentation][az-mi].\n\n### How to configure Managed Identities\n\nIn order to use a Managed Identity with GCM, you need to ensure that the Managed\nIdentity has the necessary permissions to access the Azure Repos repository.\n\nYou can read more about how to configure Managed Identities in the\n[Azure Repos documentation][azdo-misp].\n\nOnce you have configured the Managed Identity, you can use it with GCM by simply\nsetting one of the following environment variables or Git configuration options:\n\n**Git configuration:** [`credential.azreposManagedIdentity`][gcm-mi-config]\n\n**Environment variable:** [`GCM_AZREPOS_MANAGEDIDENTITY`][gcm-mi-env]\n\nValue|Description\n-|-\n`system`|System-Assigned Managed Identity\n`[guid]`|User-Assigned Managed Identity with the specified client ID\n`id://[guid]` **|User-Assigned Managed Identity with the specified client ID\n`resource://[guid]` **|User-Assigned Managed Identity for the associated resource\n\nYou can obtain the `[guid]` from the Azure Portal or by using the Azure CLI\nto inspect the Managed Identity or resource.\n\n** Note there is an open issue that prevents successfull authentication when\nusing these formats: https://github.com/git-ecosystem/git-credential-manager/issues/1570\n\n## Service Principals\n\nAzure Service Principals are used to authenticate and authorize applications and\nservices to access Azure resources. Service Principals are similar in many ways\nto Managed Identities (in fact Service Principals are used under the hood to\nimplement Managed Identities), but they have expliclty defined credentials that\nare not managed by Azure.\n\nThere are a number of different ways to create and configure Service Principals,\nincluding using the Azure Portal or Azure CLI. You can read more about Service\nPrincipals in the [Azure documentation][az-sp].\n\n### How to configure Service Principals\n\nMuch like with Managed Identities, to use a Service Principal with GCM you first\nneed to ensure that the principal has the necessary permissions to access the\nAzure Repos repository.\n\nYou can read more about how to configure Service Principals in the\n[Azure Repos documentation][azdo-misp].\n\nOnce you have configured the Service Principal, you can use it with GCM by\nsetting one of the following environment variables or Git configuration options:\n\n**Git configuration:** [`credential.azreposServicePrincipal`][gcm-sp-config]\n\n**Environment variable:** [`GCM_AZREPOS_SERVICE_PRINCIPAL`][gcm-sp-env]\n\nThe format of the value for these options must be in the format:\n\n```text\n{tenantId}/{clientId}\n```\n\nWhere `{tenantId}` is the Azure tenant ID and `{clientId}` is the client ID of\nthe Service Principal. These values can be found in the Azure Portal or by using\nthe Azure CLI to inspect the Service Principal.\n\n#### Authentication with Service Principals\n\nWhen using a Service Principal with GCM, you will also need to provide the\nclient secret or certificate that is associated with the Service Principal.\n\nYou can provide the client secret or certificate to GCM by setting one of the\nfollowing environment variables or Git configuration options.\n\nType|Git Configuration|Environment Variable\n-|-|-\nClient Secret|[`credential.azreposServicePrincipalSecret`][gcm-sp-secret-config]|[`GCM_AZREPOS_SP_SECRET`][gcm-sp-secret-env]\nCertificate|[`credential.azreposServicePrincipalCertificateThumbprint`][gcm-sp-cert-config]|[`GCM_AZREPOS_SP_CERT_THUMBPRINT`][gcm-sp-cert-env]\nSend X5C|[`credential.azreposServicePrincipalCertificateSendX5C`][gcm-sp-cert-x5c-config]|[`GCM_AZREPOS_SP_CERT_SEND_X5C`][gcm-sp-cert-x5c-env]\n\nThe value for these options should be the client secret or the thumbrint of the\ncertificate that is associated with the Service Principal.\n\nThe certificate itself should be installed on the machine where GCM is running\nand should be installed in personal store the certificate store for either the\ncurrent user or the local machine.\n\n[az-mi]: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview\n[az-sp]: https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser\n[azdo-misp]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops\n[gcm-mi-config]: https://gh.io/gcm/config#credentialazreposmanagedidentity\n[gcm-mi-env]: https://gh.io/gcm/env#GCM_AZREPOS_MANAGEDIDENTITY\n[gcm-sp-config]: https://gh.io/gcm/config#credentialazreposserviceprincipal\n[gcm-sp-env]: https://gh.io/gcm/env#GCM_AZREPOS_SERVICE_PRINCIPAL\n[gcm-sp-secret-config]: https://gh.io/gcm/config#credentialazreposserviceprincipalsecret\n[gcm-sp-secret-env]: https://gh.io/gcm/env#GCM_AZREPOS_SP_SECRET\n[gcm-sp-cert-config]: https://gh.io/gcm/config#credentialazreposserviceprincipalcertificatethumbprint\n[gcm-sp-cert-x5c-config]: https://gh.io/gcm/config#credentialazreposserviceprincipalcertificatesendx5c\n[gcm-sp-cert-env]: https://gh.io/gcm/env#GCM_AZREPOS_SP_CERT_THUMBPRINT\n[gcm-sp-cert-x5c-env]: https://gh.io/gcm/env#GCM_AZREPOS_SP_CERT_SEND_X5C\n" }, { "path": "docs/azrepos-users-and-tokens.md", "content": "# Azure Repos: Access tokens and Accounts\n\n## Different credential types\n\nThe Azure Repos host provider supports creating multiple types of credential:\n\n- Azure DevOps personal access tokens\n- Microsoft identity OAuth tokens\n\nTo select which type of credential the Azure Repos host provider will create\nand use, you can set the [`credential.azreposCredentialType`][credential-azreposCredentialType]\nconfiguration entry (or [`GCM_AZREPOS_CREDENTIALTYPE`][gcm-azrepos-credential-type]\nenvironment variable).\n\n### Azure DevOps personal access tokens\n\nHistorically, the only option supported by the Azure Repos host provider was\nAzure DevOps Personal Access Tokens (PATs).\n\nThese PATs are only used by Azure DevOps, and must be [managed through the Azure\nDevOps user settings page][azure-devops-pats] or [REST API][azure-devops-api].\n\nPATs have a limited lifetime and new tokens must be created once they expire. In\nGit Credential Manager, when a PAT expired (or was manually revoked) this\nresulted in a new authentication prompt.\n\n### Microsoft identity OAuth tokens\n\n\"Microsoft identity OAuth token\" is the generic term for OAuth-based access\ntokens issued by Azure Active Directory for either Work and School Accounts\n(AAD tokens) or Personal Accounts (Microsoft Account/MSA tokens).\n\nAzure DevOps supports Git authentication using Microsoft identity OAuth tokens\nas well as PATs. Microsoft identity OAuth tokens created by Git Credential\nManager are scoped to Azure DevOps only.\n\nUnlike PATs, Microsoft identity OAuth tokens get automatically refreshed and\nrenewed as long as you are actively using them to perform Git operations.\n\nThese tokens are also securely shared with other Microsoft developer tools\nincluding the Visual Studio IDE and Azure CLI. This means that as long as you're\nusing Git or one of these tools with the same account, you'll never need to\nre-authenticate due to expired tokens!\n\n#### User accounts\n\nIn versions of Git Credential Manager that support Microsoft identity OAuth\ntokens, the user account used to authenticate for a particular Azure DevOps\norganization will now be remembered.\n\nThe first time you clone, fetch or push from/to an Azure DevOps organization you\nwill be prompted to sign-in and select a user account. Git Credential Manager\nwill remember which account you used and continue to use that for all future\nremote Git operations (clone/fetch/push). An account is said to be \"bound\" to\nan Azure DevOps organization.\n\n---\n\n**Note:** If GCM is set to use PAT credentials, this account will **NOT** be\nused and you will continue to be prompted to select a user account to renew the\ncredential. This may change in the future.\n\n---\n\nNormally you won't need to worry about managing which user accounts Git\nCredential Manager is using as this is configured automatically when you first\nauthenticate for a particular Azure DevOps organization.\n\nIn advanced scenarios (such as using multiple accounts) you can interact with\nand manage remembered user accounts using the 'azure-repos' provider command:\n\n```shell\ngit-credential-manager azure-repos [ list | bind | unbind | ... ] \n```\n\n##### Listing remembered accounts\n\nYou can list all bound user accounts by Git Credential Manager for each Azure\nDevOps organization using the `list` command:\n\n```shell\n$ git-credential-manager azure-repos list\ncontoso:\n (global) -> alice@contoso.com\nfabrikam:\n (global) -> user42@fabrikam.com\n```\n\nIn the above example, the `contoso` Azure DevOps organization is associated with\nthe `alice@contoso.com` user account, while the `fabrikam` organization is\nassociated to the `user42@fabrikam.com` user account.\n\nGlobal \"bindings\" apply to all remote Git operations for the current computer\nuser profile and are stored in `~/.gitconfig` or `%USERPROFILE%\\.gitconfig`.\n\n##### Using different accounts within a repository\n\nIf you generally use one account for an Azure DevOps organization, the default\nglobal bindings will be sufficient. However, if you wish to use a different\nuser account for an organization in a particular repository you can use a local\nbinding.\n\nLocal account bindings only apply within a single repository and are stored in\nthe `.git/config` file. If there are local bindings in a repository you can show\nthem with the `list` command:\n\n```shell\n~/myrepo$ git-credential-manager azure-repos list\ncontoso:\n (global) -> alice@contoso.com\n (local) -> alice-alt@contoso.com\n```\n\nWithin the `~/myrepo` repository, the `alice-alt@contoso.com` account will be\nused by Git and GCM for the `contoso` Azure DevOps organization.\n\nTo create a local binding, use the `bind` command with the `--local` option when\ninside a repository:\n\n```shell\n~/myrepo$ git-credential-manager azure-repos bind --local contoso alice-alt@contso.com\n```\n\n```diff\n contoso:\n (global) -> alice@contoso.com\n+ (local) -> alice-alt@contoso.com\n```\n\n##### Forget an account\n\nTo have Git Credential Manager forget a user account, use the `unbind` command:\n\n```shell\ngit-credential-manager azure-repos unbind fabrikam\n```\n\n```diff\n contoso:\n (global) -> alice@contoso.com\n- fabrikam:\n- (global) -> user42@fabrikam.com\n```\n\nIn the above example, and global account binding for the `fabrikam` organization\nwill be forgotten. The next time you need to renew a PAT (if using PATs) or\nperform any remote Git operation (is using Azure tokens) you will be prompted\nto authenticate again.\n\nTo forget or remove a local binding, within the repository run the `unbind`\ncommand with the `--local` option:\n\n```shell\n~/myrepo$ git-credential-manager azure-repos unbind --local contoso\n```\n\n```diff\n contoso:\n (global) -> alice@contoso.com\n- (local) -> alice-alt@contoso.com\n```\n\n##### Using different accounts for specific Git remotes\n\nAs well as global and local user account bindings, you can instruct Git\nCredential Manager to use a specific user account for an individual Git remotes\nwithin the same local repository.\n\nTo show which accounts are being used for each Git remote in a repository use\nthe `list` command with the `--show-remotes` option:\n\n```shell\n~/myrepo$ git-credential-manager azure-repos list --show-remotes\ncontoso:\n (global) -> alice@contoso.com\n origin:\n (fetch) -> (inherit)\n (push) -> (inherit)\nfabrikam:\n (global) -> alice@fabrikam.com\n```\n\nIn the above example, the `~/myrepo` repository has a single Git remote named\n`origin` that points to the `contoso` Azure DevOps organization. There is no\nuser account specifically associated with the `origin` remote, so the global\nuser account binding for `contoso` will be used (the global binding is\ninherited).\n\nTo associate a user account with a particular Git remote you must manually edit\nthe remote URL using `git config` commands to include the username in the\n[user information][rfc3986-s321] part of the URL.\n\n```shell\ngit config --local remote.origin.url https://alice-alt%40contoso.com@contoso.visualstudio.com/project/_git/repo\n```\n\nIn the above example the `alice-alt@contoso.com` account is being set as the\naccount to use for the `origin` Git remote.\n\n---\n\n**Note:** All special characters must be URL encoded/escaped, for example `@`\nbecomes `%40`.\n\n---\n\nThe `list --show-remotes` command will show the user account specified in the\nremote URL:\n\n```shell\n~/myrepo$ git-credential-manager azure-repos list --show-remotes\ncontoso:\n (global) -> alice@contoso.com\n origin:\n (fetch) -> alice-alt@contoso.com\n (push) -> alice-alt@contoso.com\nfabrikam:\n (global) -> alice@fabrikam.com\n```\n\n[azure-devops-pats]: https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page\n[credential-azreposCredentialType]: configuration.md#credentialazreposcredentialtype\n[gcm-azrepos-credential-type]: environment.md#GCM_AZREPOS_CREDENTIALTYPE\n[azure-devops-api]: https://docs.microsoft.com/en-gb/rest/api/azure/devops/tokens/pats\n[rfc3986-s321]: https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1\n" }, { "path": "docs/bitbucket-authentication.md", "content": "# Bitbucket Authentication\n\nWhen GCM is triggered by Git, it will check the `host` parameter passed\nto it. If this parameter contains `bitbucket.org` it will trigger Bitbucket\nauthentication and prompt you for credentials. In this scenario, you have two\noptions for authentication: `OAuth` or `Password/Token`.\n\n### OAuth\n\nThe dialog GCM presents for authentication contains two tabs. The first tab\n(labeled `Browser`) will trigger OAuth Authentication. Clicking the `Sign in\nwith your browser` button opens a browser request to\n`_https://bitbucket.org/site/oauth2/authorize?response_type=code&client_id={consumerkey}&state=authenticated&scope={scopes}&redirect_uri=http://localhost:34106/_`. This triggers a flow on Bitbucket requiring you to log in\n(and potentially complete 2FA) to authorize GCM to access Bitbucket with the\nspecified scopes. GCM will then spawn a temporary local webserver, listening on\nport 34106, to handle the OAuth redirect/callback. Assuming you successfully\nlog into Bitbucket and authorize GCM, this callback will include the appropriate\ntokens for GCM to handle authencation. These tokens are then stored in your\nconfigured [credential store][credstores] and are returned to Git.\n\n### Password/Token\n\n**Note:** Bitbucket Data Center, also known as Bitbucket Server or Bitbucket On\nPremises, only supports Basic Authentication - please follow the below\ninstructions if you are using this product.\n\nThe dialog GCM presents for authentication contains two tabs. The second tab\n(labeled `Password/Token`) will trigger Basic Authentication. This tab contains\ntwo fields, one for your username and one for your password or token. If the\n`username` parameter was passed into GCM, that will pre-populate the username\nfield, although it can be overridden. Enter your username (if needed) and your\npassword or token (i.e. Bitbucket App Password) and click `Sign in`.\n\n:rotating_light: Requirements for App Passwords :rotating_light:\n\nIf you are planning to use an [App Password][app-password] for basic\nauthentication, it must at a minimum have _Account Read_ permissions (as shown\nbelow). If your App Password does not have these permissions, you will be\nre-prompted for credentials on every interaction with the server.\n\n![][app-password-example]\n\nWhen your username and password are submitted, GCM will attempt to retrieve a\nbasic authentication token for these credentials via the Bitbucket REST API. If\nthis is successful, the credentials, username, and password/token are stored in\nyour configured [credential store][credstores] and are returned to Git.\n\nIf the API request fails with a 401 return code, the entered username/password\ncombination is invalid; nothing is stored and nothing is returned to Git. In\nthis scenario, re-attempt authentication, ensuring your credentials are correct.\n\nIf the API request fails with a 403 (Forbidden) return code, the username and\npassword are valid, but 2FA is enabled on the corresponding Bitbucket Account.\nIn this scenario, you will be prompted to complete the OAuth authentication\nprocess. If this is successful, the credentials, username, and password/token\nare stored in your configured [credential store][credstores] and are returned to\nGit.\n\n[app-password]: https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/\n[app-password-example]: img/app-password.png\n[credstores]: ./credstores.md\n" }, { "path": "docs/bitbucket-development.md", "content": "# Bitbucket Authentication, 2FA and OAuth\n\nBy default for authenticating against private Git repositories Bitbucket\nsupports SSH and username/password Basic Auth over HTTPS. Username/password\nBasic Auth over HTTPS is also available for REST API access. Additionally\nBitbucket supports App-specific passwords which can be used via Basic Auth as\nusername/app-specific-password.\n\nTo enhance security Bitbucket offers optional Two-Factor Authentication (2FA).\nWhen 2FA is enabled username/password Basic Auth access to the REST APIs and to\nGit repositories is suspended. At that point users are left with the choice of\nusername/apps-specific-password Basic Auth for REST APIs and Git interactions,\nOAuth for REST APIs and Git/Hg interactions or SSH for Git/HG interactions and\none of the previous choices for REST APIs. SSH and REST API access are beyond\nthe scope of this document. Read about [Bitbucket's 2FA implementation][2fa-impl].\n\nApp-specific passwords are not particularly user friendly as once created\nBitbucket hides their value, even from the owner. They are intended for use\nwithin application that talk to Bitbucket where application can remember and use\nthe app-specific-password. [Additional information][additional-info].\n\nOAuth is the intended authentication method for user interactions with HTTPS\nremote URL for Git repositories when 2FA is active. Essentially once a client\napplication has an OAuth access token it can be used in place of a user's\npassword. Read more about information [Bitbucket's OAuth implementation][oauth-impl].\n\nBitbucket's OAuth implementation follows the standard specifications for OAuth\n2.0, which is out of scope for this document. However it implements a\ncomparatively rare part of OAuth 2.0 Refresh Tokens. Bitbucket's Access Token's\nexpire after 1 hour if not revoked, as opposed to GitHub's that expire after 1\nyear. When GitHub's Access Tokens expire the user must anticipate in the\nstandard OAuth authentication flow to get a new Access Token. Since this occurs,\nin theory, once per year this is not too onerous. Since Bitbucket's Access\nTokens expire every hour it is too much to expect a user to go through the OAuth\nauthentication flow every hour.Bitbucket implements refresh Tokens.\nRefresh Tokens are issued to the client application at the same time as Access\nTokens. They can only be used to request a new Access Token, and then only if\nthey have not been revoked. As such the support for Bitbucket and the use of its\nOAuth in the Git Credentials Manager differs significantly from how VSTS and\nGitHub are implemented. This is explained in more detail below.\n\n## Multiple User Accounts\n\nUnlike the GitHub implementation within the Git Credential Manager, the\nBitbucket implementation stores 'secrets', passwords, app-specific passwords, or\nOAuth tokens, with usernames in the [Windows Credential Manager][wincred-manager]\nvault.\n\nDepending on the circumstances this means either saving an explicit username in\nto the Windows Credential Manager/Vault or including the username in the URL\nused as the identifying key of entries in the Windows Credential Manager vault,\ni.e. using a key such as `git:https://mminns@bitbucket.org/` rather than\n`git:https://bitbucket.org`. This means that the Bitbucket implementation in the\nGCM can support multiple accounts, and usernames, for a single user against\nBitbucket, e.g. a personal account and a work account.\n\n## On-Premise Bitbucket\n\nOn-premise Bitbucket, more correctly known as Bitbucket Server or Bitbucket DC,\nhas a number of differences compared to the cloud instance of Bitbucket,\n[bitbucket.org][bitbucket].\n\nIt is possible to test with Bitbucket Server by running it locally using the\nfollowing command from the Atlassian SDK:\n\n ❯ atlas-run-standalone --product bitbucket\n\nSee the developer documentation for [atlas-run-standalone][atlas-run-standalone].\n\nThis will download and run a standalone instance of Bitbucket Server which can\nbe accessed using the credentials `admin`/`admin` at\n\n https://localhost:7990/bitbucket\n\nAtlassian has [documentation][atlassian-sdk] on how to download and install\ntheir SDK.\n\n## OAuth2 Configuration\n\nBitbucket DC [7.20](https://confluence.atlassian.com/bitbucketserver/bitbucket-data-center-and-server-7-20-release-notes-1101934428.html)\nadded support for OAuth2 Incoming Application Links and this can be used to\nsupport OAuth2 authentication for Git. This is especially useful in environments\nwhere Bitbucket uses SSO as it removes the requirement for users to manage\n[SSH keys](https://confluence.atlassian.com/display/BITBUCKETSERVER0717/Using+SSH+keys+to+secure+Git+operations)\nor manual [HTTP access tokens](https://confluence.atlassian.com/display/BITBUCKETSERVER0717/Personal+access+tokens).\n\n### Host Configuration\n\nFor more details see\n[Bitbucket's documentation on Data Center and Server Application Links to other Applications](https://confluence.atlassian.com/bitbucketserver/link-to-other-applications-1018764620.html)\n\nCreate Incoming OAuth 2 Application Link:\n\n1. Navigate to Administration/Application Links\n1. Create Link\n 1. Screen 1\n - External Application [check]\n - Incoming Application [check]\n 1. Screen 2\n - Name : GCM\n - Redirect URL : `http://localhost:34106/`\n - Application Permissions : Repositories.Read [check], Repositories.Write [check]\n 1. Save\n \n 1. Copy the `ClientId` and `ClientSecret` to configure GCM\n\n### Client Configuration\n\nSet the OAuth2 configuration use the `ClientId` and `ClientSecret` copied above,\n(for details see [credential.bitbucketDataCenterOAuthClientId](configuration.md#credential.bitbucketDataCenterOAuthClientId)\nand [credential.bitbucketDataCenterOAuthClientSecret](configuration.md#credential.bitbucketDataCenterOAuthClientSecret))\n\n ❯ git config --global credential.bitbucketDataCenterOAuthClientId {`Copied ClientId`}\n\n ❯ git config --global credential.bitbucketDataCenterOAuthClientSecret {`Copied ClientSecret`}\n\nAs described in [Configuration options](configuration.md#Configuration%20options)\nthe settings can be made more specific to apply only to a specific Bitbucket DC\nhost by specifying the host url, e.g. https://bitbucket.example.com/\n\n\n ❯ git config --global credential.https://bitbucket.example.com.bitbucketDataCenterOAuthClientId {`Copied ClientId`}\n\n ❯ git config --global credential.https://bitbucket.example.com.bitbucketDataCenterOAuthClientSecret {`Copied ClientSecret`}\n\nDue to the way GCM resolves hosts and determines REST API urls, if the Bitbucket\nDC instance is hosted under a relative url (e.g. https://example.com/bitbucket)\nit is necessary to configure Git to send the full path to GCM. This is done\nusing the [credential.useHttpPath](configuration.md#credential.useHttpPath)\nsetting.\n ❯ git config --global credential.https://example.com/bitbucket.usehttppath true\n\n\nIf a port number is used in the url of the Bitbucket DC instance the Git\nconfiguration needs to reflect this. However, due to [Issue 608](https://github.com/git-ecosystem/git-credential-manager/issues/608)\nthe port is ignored when resolving [credential.bitbucketDataCenterOAuthClientId](configuration.md#credential.bitbucketDataCenterOAuthClientId)\nand [credential.bitbucketDataCenterOAuthClientSecret](configuration.md#credential.bitbucketDataCenterOAuthClientSecret).\n\nFor example, a Bitbucket DC host at https://example.com:7990/bitbucket would\nrequire configuration in the form:\n\n ❯ git config --global credential.https://example.com/bitbucket.bitbucketDataCenterOAuthClientId {`Copied ClientId`}\n\n ❯ git config --global credential.https://example.com/bitbucket.bitbucketDataCenterOAuthClientSecret {`Copied ClientSecret`}\n\n ❯ git config --global credential.https://example.com:7990/bitbucket.usehttppath true\n\n[additional-info]:https://confluence.atlassian.com/display/BITBUCKET/App+passwords\n[atlas-run-standalone]: https://developer.atlassian.com/server/framework/atlassian-sdk/atlas-run-standalone/\n[bitbucket]: https://bitbucket.org\n[2fa-impl]: https://confluence.atlassian.com/bitbucket/two-step-verification-777023203.html\n[oauth-impl]: https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html\n[atlassian-sdk]: https://developer.atlassian.com/server/framework/atlassian-sdk/\n[wincred-manager]: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374792(v=vs.85).aspx\n" }, { "path": "docs/configuration.md", "content": "# Configuration options\n\n[Git Credential Manager][usage] works out of the box for most users.\n\nGit Credential Manager (GCM) can be configured using Git's configuration files,\nand follows all of the same rules Git does when consuming the files.\n\nGlobal configuration settings override system configuration settings, and local\nconfiguration settings override global settings; and because the configuration\ndetails exist within Git's configuration files you can use Git's `git config`\nutility to set, unset, and alter the setting values. All of GCM's configuration\nsettings begin with the term `credential`.\n\nGCM honors several levels of settings, in addition to the standard local\n\\> global \\> system tiering Git uses. URL-specific settings or overrides can be\napplied to any value in the `credential` namespace with the syntax below.\n\nAdditionally, GCM respects several GCM-specific [environment variables][envars]\n**which take precedence over configuration options**. System administrators may\nalso configure [default values][enterprise-config] for many settings used by GCM.\n\nGCM will only be used by Git if it is installed and configured. Use\n`git config --global credential.helper manager` to assign GCM as your\ncredential helper. Use `git config credential.helper` to see the current\nconfiguration.\n\n**Example:**\n\n> `credential.microsoft.visualstudio.com.namespace` is more specific than\n> `credential.visualstudio.com.namespace`, which is more specific than\n> `credential.namespace`.\n\nIn the examples above, the `credential.namespace` setting would affect any\nremote repository; the `credential.visualstudio.com.namespace` would affect any\nremote repository in the domain, and/or any subdomain (including `www.`) of,\n'visualstudio.com'; where as the\n`credential.microsoft.visualstudio.com.namespace` setting would only be applied\nto remote repositories hosted at 'microsoft.visualstudio.com'.\n\nFor the complete list of settings GCM understands, see the list below.\n\n## Available settings\n\n### credential.interactive\n\nPermit or disable GCM from interacting with the user (showing GUI or TTY\nprompts). If interaction is required but has been disabled, an error is returned.\n\nThis can be helpful when using GCM in headless and unattended environments, such\nas build servers, where it would be preferable to fail than to hang indefinitely\nwaiting for a non-existent user.\n\nTo disable interactivity set this to `false` or `0`.\n\n#### Compatibility\n\nIn previous versions of GCM this setting had a different behavior and accepted\nother values. The following table summarizes the change in behavior and the\nmapping of older values such as `never`:\n\nValue(s)|Old meaning|New meaning\n-|-|-\n`auto`|Prompt if required – use cached credentials if possible|_(unchanged)_\n`never`, `false`| Never prompt – fail if interaction is required|_(unchanged)_\n`always`, `force`, `true`|Always prompt – don't use cached credentials|Prompt if required (same as the old `auto` value)\n\n#### Example\n\n```shell\ngit config --global credential.interactive false\n```\n\nDefaults to enabled.\n\n**Also see: [GCM_INTERACTIVE][gcm-interactive]**\n\n---\n\n### credential.trace\n\nEnables trace logging of all activities.\nConfiguring Git and GCM to trace to the same location is often desirable, and\nGCM is compatible and cooperative with `GIT_TRACE`.\n\n#### Example\n\n```shell\ngit config --global credential.trace /tmp/git.log\n```\n\nIf the value of `credential.trace` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `credential.trace` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [GCM_TRACE][gcm-trace]**\n\n---\n\n### credential.traceSecrets\n\nEnables tracing of secret and sensitive information, which is by default masked\nin trace output. Requires that `credential.trace` is also enabled.\n\n#### Example\n\n```shell\ngit config --global credential.traceSecrets true\n```\n\nIf the value of `credential.traceSecrets` is `true` or `1`, trace logs will include\nsecret information.\n\nDefaults to disabled.\n\n**Also see: [GCM_TRACE_SECRETS][gcm-trace-secrets]**\n\n---\n\n### credential.traceMsAuth\n\nEnables inclusion of Microsoft Authentication library (MSAL) logs in GCM trace\noutput. Requires that `credential.trace` is also enabled.\n\n#### Example\n\n```shell\ngit config --global credential.traceMsAuth true\n```\n\nIf the value of `credential.traceMsAuth` is `true` or `1`, trace logs will\ninclude verbose MSAL logs.\n\nDefaults to disabled.\n\n**Also see: [GCM_TRACE_MSAUTH][gcm-trace-msauth]**\n\n---\n\n### credential.debug\n\nPauses execution of GCM at launch to wait for a debugger to be attached.\n\n#### Example\n\n```shell\ngit config --global credential.debug true\n```\n\nDefaults to disabled.\n\n**Also see: [GCM_DEBUG][gcm-debug]**\n\n---\n\n### credential.provider\n\nDefine the host provider to use when authenticating.\n\nID|Provider\n-|-\n`auto` _(default)_|_\\[automatic\\]_ ([learn more][autodetect])\n`azure-repos`|Azure Repos\n`github`|GitHub\n`bitbucket`|Bitbucket\n`gitlab`|GitLab _(supports OAuth in browser, personal access token and Basic Authentication)_\n`generic`|Generic (any other provider not listed above)\n\nAutomatic provider selection is based on the remote URL.\n\nThis setting is typically used with a scoped URL to map a particular set of\nremote URLs to providers, for example to mark a host as a GitHub Enterprise\ninstance.\n\n#### Example\n\n```shell\ngit config --global credential.ghe.contoso.com.provider github\n```\n\n**Also see: [GCM_PROVIDER][gcm-provider]**\n\n---\n\n### credential.authority _(deprecated)_\n\n> This setting is deprecated and should be replaced by `credential.provider`\n> with the corresponding provider ID value.\n>\n> See the [migration guide][provider-migrate] for more information.\n\nSelect the host provider to use when authenticating by which authority is\nsupported by the providers.\n\nAuthority|Provider(s)\n-|-\n`auto` _(default)_|_\\[automatic\\]_\n`msa`, `microsoft`, `microsoftaccount`, `aad`, `azure`, `azuredirectory`, `live`, `liveconnect`, `liveid`|Azure Repos _(supports Microsoft Authentication)_\n`github`|GitHub _(supports GitHub Authentication)_\n`bitbucket`|Bitbucket.org _(supports Basic Authentication and OAuth)_, Bitbucket Server _(supports Basic Authentication)_\n`gitlab`|GitLab _(supports OAuth in browser, personal access token and Basic Authentication)_\n`basic`, `integrated`, `windows`, `kerberos`, `ntlm`, `tfs`, `sso`|Generic _(supports Basic and Windows Integrated Authentication)_\n\n#### Example\n\n```shell\ngit config --global credential.ghe.contoso.com.authority github\n```\n\n**Also see: [GCM_AUTHORITY][gcm-authority]**\n\n---\n\n### credential.guiPrompt\n\nPermit or disable GCM from presenting GUI prompts. If an equivalent terminal/\ntext-based prompt is available, that will be shown instead.\n\nTo disable all interactivity see [credential.interactive][credential-interactive].\n\n#### Example\n\n```shell\ngit config --global credential.guiPrompt false\n```\n\nDefaults to enabled.\n\n**Also see: [GCM_GUI_PROMPT][gcm-gui-prompt]**\n\n---\n\n### credential.guiSoftwareRendering\n\nForce the use of software rendering for GUI prompts.\n\nThis is currently only applicable on Windows.\n\n#### Example\n\n```shell\ngit config --global credential.guiSoftwareRendering true\n```\n\nDefaults to false (use hardware acceleration where available).\n\n> [!NOTE]\n> Windows on ARM devices defaults to using software rendering to work around a\n> known Avalonia issue: \n\n**Also see: [GCM_GUI_SOFTWARE_RENDERING][gcm-gui-software-rendering]**\n\n---\n\n### credential.allowUnsafeRemotes\n\nAllow transmitting credentials to unsafe remote URLs such as unencrypted HTTP\nURLs. This setting is not recommended for general use and should only be used\nwhen necessary.\n\nDefaults false (disallow unsafe remote URLs).\n\n#### Example\n\n```shell\ngit config --global credential.allowUnsafeRemotes true\n```\n\n**Also see: [GCM_ALLOW_UNSAFE_REMOTES][gcm-allow-unsafe-remotes]**\n\n---\n\n### credential.autoDetectTimeout\n\nSet the maximum length of time, in milliseconds, that GCM should wait for a\nnetwork response during host provider auto-detection probing.\n\nSee [auto-detection][auto-detection] for more information.\n\n**Note:** Use a negative or zero value to disable probing altogether.\n\nDefaults to 2000 milliseconds (2 seconds).\n\n#### Example\n\n```shell\ngit config --global credential.autoDetectTimeout -1\n```\n\n**Also see: [GCM_AUTODETECT_TIMEOUT][gcm-autodetect-timeout]**\n\n---\n\n### credential.allowWindowsAuth\n\nAllow detection of Windows Integrated Authentication (WIA) support for generic\nhost providers. Setting this value to `false` will prevent the use of WIA and\nforce a basic authentication prompt when using the Generic host provider.\n\n**Note:** WIA is only supported on Windows.\n\n**Note:** WIA is an umbrella term for NTLM and Kerberos (and Negotiate).\n\nValue|WIA detection\n-|-\n`true` _(default)_|Permitted\n`false`|Not permitted\n\n#### Example\n\n```shell\ngit config --global credential.tfsonprem123.allowWindowsAuth false\n```\n\n**Also see: [GCM_ALLOW_WINDOWSAUTH][gcm-allow-windowsauth]**\n\n---\n\n### credential.httpProxy _(deprecated)_\n\n> This setting is deprecated and should be replaced by the\n> [standard `http.proxy` Git configuration option][git-config-http-proxy].\n>\n> See [HTTP Proxy][http-proxy] for more information.\n\nConfigure GCM to use the a proxy for network operations.\n\n**Note:** Git itself does _not_ respect this setting; this affects GCM _only_.\n\n#### Example\n\n```shell\ngit config --global credential.httpsProxy http://john.doe:password@proxy.contoso.com\n```\n\n**Also see: [GCM_HTTP_PROXY][gcm-http-proxy]**\n\n---\n\n### credential.bitbucketAuthModes\n\nOverride the available authentication modes presented during Bitbucket\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting only applies to Bitbucket.org, and not Server or DC\ninstances.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`oauth`|OAuth-based authentication\n`basic`|Basic/PAT-based authentication\n\n#### Example\n\n```shell\ngit config --global credential.bitbucketAuthModes \"oauth,basic\"\n```\n\n**Also see: [GCM_BITBUCKET_AUTHMODES][gcm-bitbucket-authmodes]**\n\n---\n\n### credential.bitbucketAlwaysRefreshCredentials\n\nForces GCM to ignore any existing stored Basic Auth or OAuth access tokens and\nalways run through the process to refresh the credentials before returning them\nto Git.\n\nThis is especially relevant to OAuth credentials. Bitbucket.org access tokens\nexpire after 2 hours, after that the refresh token must be used to get a new\naccess token.\n\nEnabling this option will improve performance when using Oauth2 and interacting\nwith Bitbucket.org if, on average, commits are done less frequently than every\n2 hours.\n\nEnabling this option will decrease performance when using Basic Auth by\nrequiring the user the re-enter credentials every time.\n\nValue|Refresh Credentials Before Returning\n-|-\n`true`, `1`, `yes`, `on` |Always\n`false`, `0`, `no`, `off`_(default)_|Only when the credentials are found to be invalid\n\n#### Example\n\n```shell\ngit config --global credential.bitbucketAlwaysRefreshCredentials true\n```\n\nDefaults to false/disabled.\n\n**Also see: [GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS][gcm-bitbucket-always-refresh-credentials]**\n\n---\n\n### credential.bitbucketValidateStoredCredentials\n\nForces GCM to validate any stored credentials before returning them to Git. It\ndoes this by calling a REST API resource that requires authentication.\n\nDisabling this option reduces the HTTP traffic within GCM when it is retrieving\ncredentials. This may improve user performance, but will increase the number of\ntimes Git remote calls fail to authenticate with the host and therefore require\nthe user to re-try the Git remote call.\n\nEnabling this option helps ensure Git is always provided with valid credentials.\n\nValue|Validate credentials\n-|-\n`true`, `1`, `yes`, `on`_(default)_|Always\n`false`, `0`, `no`, `off`|Never\n\n#### Example\n\n```shell\ngit config --global credential.bitbucketValidateStoredCredentials true\n```\n\nDefaults to true/enabled.\n\n**Also see: [GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS](environment.md#GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS)**\n\n---\n\n### credential.bitbucketDataCenterOAuthClientId\n\nTo use OAuth with Bitbucket DC it is necessary to create an external, incoming\n[AppLink](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html).\n\nIt is then necessary to configure the local GCM installation with both the OAuth\n[ClientId](configuration.md#credential.bitbucketDataCenterOAuthClientId) and\n[ClientSecret](configuration.md#credential.bitbucketDataCenterOauthSecret) from\nthe AppLink.\n\n#### Example\n\n```shell\ngit config --global credential.bitbucketDataCenterOAuthClientId 1111111111111111111\n```\n\nDefaults to undefined.\n\n**Also see: [GCM_BITBUCKET_DATACENTER_CLIENTID](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTID)**\n\n---\n\n### credential.bitbucketDataCenterOAuthClientSecret\n\nTo use OAuth with Bitbucket DC it is necessary to create an external, incoming\n[AppLink](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html).\n\nIt is then necessary to configure the local GCM installation with both the OAuth\n[ClientId](configuration.md#credential.bitbucketDataCenterOAuthClientId) and\n[ClientSecret](configuration.md#credential.bitbucketDataCenterOauthSecret)\nfrom the AppLink.\n\n#### Example\n\n```shell\ngit config --global credential.bitbucketDataCenterOAuthClientSecret 222222222222222222222\n```\n\nDefaults to undefined.\n\n**Also see: [GCM_BITBUCKET_DATACENTER_CLIENTSECRET](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTSECRET)**\n\n---\n\n### credential.gitHubAccountFiltering\n\nEnable or disable automatic account filtering for GitHub based on server hints\nwhen there are multiple available accounts. This setting is only applicable to\nGitHub.com with [Enterprise Managed Users][github-emu].\n\nValue|Description\n-|-\n`true` _(default)_|Filter available accounts based on server hints.\n`false`|Show all available accounts.\n\n#### Example\n\n```shell\ngit config --global credential.gitHubAccountFiltering \"false\"\n```\n\n**Also see: [GCM_GITHUB_ACCOUNTFILTERING][gcm-github-accountfiltering]**\n\n---\n\n### credential.gitHubAuthModes\n\nOverride the available authentication modes presented during GitHub\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`oauth`|Expands to: `browser, device`\n`browser`|OAuth authentication via a web browser _(requires a GUI)_\n`device`|OAuth authentication with a device code\n`basic`|Basic authentication using username and password\n`pat`|Personal Access Token (pat)-based authentication\n\n#### Example\n\n```shell\ngit config --global credential.gitHubAuthModes \"oauth,basic\"\n```\n\n**Also see: [GCM_GITHUB_AUTHMODES][gcm-github-authmodes]**\n\n---\n\n### credential.gitLabAuthModes\n\nOverride the available authentication modes presented during GitLab\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`browser`|OAuth authentication via a web browser _(requires a GUI)_\n`basic`|Basic authentication using username and password\n`pat`|Personal Access Token (pat)-based authentication\n\n#### Example\n\n```shell\ngit config --global credential.gitLabAuthModes \"browser\"\n```\n\n**Also see: [GCM_GITLAB_AUTHMODES][gcm-gitlab-authmodes]**\n\n---\n\n### credential.namespace\n\nUse a custom namespace prefix for credentials read and written in the OS\ncredential store. Credentials will be stored in the format\n`{namespace}:{service}`.\n\nDefaults to the value `git`.\n\n#### Example\n\n```shell\ngit config --global credential.namespace \"my-namespace\"\n```\n\n**Also see: [GCM_NAMESPACE][gcm-namespace]**\n\n---\n\n### credential.credentialStore\n\nSelect the type of credential store to use on supported platforms.\n\nDefault value on Windows is `wincredman`, on macOS is `keychain`, and is unset\non Linux.\n\n**Note:** See more information about configuring secret stores in\n[cred-stores][cred-stores].\n\nValue|Credential Store|Platforms\n-|-|-\n_(unset)_|Windows: `wincredman`, macOS: `keychain`, Linux: _(none)_|-\n`wincredman`|Windows Credential Manager (not available over SSH).|Windows\n`dpapi`|DPAPI protected files. Customize the DPAPI store location with [credential.dpapiStorePath][credential-dpapistorepath]|Windows\n`keychain`|macOS Keychain.|macOS\n`secretservice`|[freedesktop.org Secret Service API][freedesktop-ss] via [libsecret][libsecret] (requires a graphical interface to unlock secret collections).|Linux\n`gpg`|Use GPG to store encrypted files that are compatible with the [pass][pass] (requires GPG and `pass` to initialize the store).|macOS, Linux\n`cache`|Git's built-in [credential cache][credential-cache].|macOS, Linux\n`plaintext`|Store credentials in plaintext files (**UNSECURE**). Customize the plaintext store location with [`credential.plaintextStorePath`][credential-plaintextstorepath].|Windows, macOS, Linux\n`none`|Do not store credentials via GCM.|Windows, macOS, Linux\n\n#### Example\n\n```bash\ngit config --global credential.credentialStore gpg\n```\n\n**Also see: [GCM_CREDENTIAL_STORE][gcm-credential-store]**\n\n---\n\n### credential.cacheOptions\n\nPass [options][cache-options] to the Git credential cache when\n[`credential.credentialStore`][credential-credentialstore]\nis set to `cache`. This allows you to select a different amount\nof time to cache credentials (the default is 900 seconds) by passing\n`\"--timeout \"`. Use of other options like `--socket` is untested\nand unsupported, but there's no reason it shouldn't work.\n\nDefaults to empty.\n\n#### Example\n\n```shell\ngit config --global credential.cacheOptions \"--timeout 300\"\n```\n\n**Also see: [GCM_CREDENTIAL_CACHE_OPTIONS][gcm-credential-cache-options]**\n\n---\n\n### credential.plaintextStorePath\n\nSpecify a custom directory to store plaintext credential files in when\n[`credential.credentialStore`][credential-credentialstore] is set to `plaintext`.\n\nDefaults to the value `~/.gcm/store` or `%USERPROFILE%\\.gcm\\store`.\n\n#### Example\n\n```shell\ngit config --global credential.plaintextStorePath /mnt/external-drive/credentials\n```\n\n**Also see: [GCM_PLAINTEXT_STORE_PATH][gcm-plaintext-store-path]**\n\n---\n\n### credential.dpapiStorePath\n\nSpecify a custom directory to store DPAPI protected credential files in when\n[`credential.credentialStore`][credential-credentialstore] is set to `dpapi`.\n\nDefaults to the value `%USERPROFILE%\\.gcm\\dpapi_store`.\n\n#### Example\n\n```batch\ngit config --global credential.dpapiStorePath D:\\credentials\n```\n\n**Also see: [GCM_DPAPI_STORE_PATH][gcm-dpapi-store-path]**\n\n---\n\n### credential.gpgPassStorePath\n\nSpecify a custom directory to store GPG-encrypted [pass][pass]-compatible credential files\nin when [`credential.credentialStore`][credential-credentialstore] is set to `gpg`.\n\nDefaults to the value `~/.password-store` or `%USERPROFILE%\\.password-store`.\n\n#### Example\n\n```shell\ngit config --global credential.gpgPassStorePath /mnt/external-drive/.password-store\n```\n\n**Note:** Location of the password store used by [pass][pass] can be overridden by the\n`PASSWORD_STORE_DIR` environment variable, see the [man page][pass-man] for details.\n\n---\n\n### credential.msauthFlow\n\nSpecify which authentication flow should be used when performing Microsoft\nauthentication and an interactive flow is required.\n\nDefaults to `auto`.\n\n**Note:** If [`credential.msauthUseBroker`][credential-msauthusebroker] is set\nto `true` and the operating system authentication broker is available, all flows\nwill be delegated to the broker. If both of those things are true, then the\nvalue of `credential.msauthFlow` has no effect.\n\nValue|Authentication Flow\n-|-\n`auto` _(default)_|Select the best option depending on the current environment and platform.\n`embedded`|Show a window with embedded web view control.\n`system`|Open the user's default web browser.\n`devicecode`|Show a device code.\n\n#### Example\n\n```shell\ngit config --global credential.msauthFlow devicecode\n```\n\n**Also see: [GCM_MSAUTH_FLOW][gcm-msauth-flow]**\n\n---\n\n### credential.msauthUseBroker _(experimental)_\n\nUse the operating system account manager where available.\n\nDefaults to `false`. In certain cloud hosted environments when using a work or\nschool account, such as [Microsoft DevBox][devbox], the default is `true`.\n\nThese defaults are subject to change in the future.\n\n_**Note:** before you enable this option on Windows, please review the\n[Windows Broker][wam] details for what this means to your local Windows user\naccount._\n\nValue|Description\n-|-\n`true`|Use the operating system account manager as an authentication broker.\n`false` _(default)_|Do not use the broker.\n\n#### Example\n\n```shell\ngit config --global credential.msauthUseBroker true\n```\n\n**Also see: [GCM_MSAUTH_USEBROKER][gcm-msauth-usebroker]**\n\n---\n\n### credential.msauthUseDefaultAccount _(experimental)_\n\nUse the current operating system account by default when the broker is enabled.\n\nDefaults to `false`. In certain cloud hosted environments when using a work or\nschool account, such as [Microsoft DevBox][devbox], the default is `true`.\n\nThese defaults are subject to change in the future.\n\nValue|Description\n-|-\n`true`|Use the current operating system account by default.\n`false` _(default)_|Do not assume any account to use by default.\n\n#### Example\n\n```shell\ngit config --global credential.msauthUseDefaultAccount true\n```\n\n**Also see: [GCM_MSAUTH_USEDEFAULTACCOUNT][gcm-msauth-usedefaultaccount]**\n\n---\n\n### credential.useHttpPath\n\nTells Git to pass the entire repository URL, rather than just the hostname, when\ncalling out to a credential provider. (This setting\n[comes from Git itself][use-http-path], not GCM.)\n\nDefaults to `false`.\n\n**Note:** GCM sets this value to `true` for `dev.azure.com` (Azure Repos) hosts\nafter installation by default.\n\nThis is because `dev.azure.com` alone is not enough information to determine the\ncorrect Azure authentication authority - we require a part of the path. The\nfallout of this is that for `dev.azure.com` remote URLs we do not support\nstoring credentials against the full-path. We always store against the\n`dev.azure.com/org-name` stub.\n\nIn order to use Azure Repos and store credentials against a full-path URL, you\nmust use the `org-name.visualstudio.com` remote URL format instead.\n\nValue|Git Behavior\n-|-\n`false` _(default)_|Git will use only `user` and `hostname` to look up credentials.\n`true`|Git will use the full repository URL to look up credentials.\n\n#### Example\n\nOn Windows using GitHub, for a user whose login is `alice`, and with\n`credential.useHttpPath` set to `false` (or not set), the following remote URLs\nwill use the same credentials:\n\n```text\nCredential: \"git:https://github.com\" (user = alice)\n\n https://github.com/foo/bar\n https://github.com/contoso/widgets\n https://alice@github.com/contoso/widgets\n```\n\n```text\nCredential: \"git:https://bob@github.com\" (user = bob)\n\n https://bob@github.com/foo/bar\n https://bob@github.com/example/myrepo\n```\n\nUnder the same user but with `credential.useHttpPath` set to `true`, these\ncredentials would be used:\n\n```text\nCredential: \"git:https://github.com/foo/bar\" (user = alice)\n\n https://github.com/foo/bar\n```\n\n```text\nCredential: \"git:https://github.com/contoso/widgets\" (user = alice)\n\n https://github.com/contoso/widgets\n https://alice@github.com/contoso/widgets\n```\n\n```text\nCredential: \"git:https://bob@github.com/foo/bar\" (user = bob)\n\n https://bob@github.com/foo/bar\n```\n\n```text\nCredential: \"git:https://bob@github.com/example/myrepo\" (user = bob)\n\n https://bob@github.com/example/myrepo\n```\n\n---\n\n### credential.azreposCredentialType\n\nSpecify the type of credential the Azure Repos host provider should return.\n\nDefaults to the value `pat`. In certain cloud hosted environments when using a\nwork or school account, such as [Microsoft DevBox][devbox], the default value is\n`oauth`.\n\nValue|Description\n-|-\n`pat`|Azure DevOps personal access tokens\n`oauth`|Microsoft identity OAuth tokens (AAD or MSA tokens)\n\nHere is more information about [Azure Access tokens][azure-tokens].\n\n#### Example\n\n```shell\ngit config --global credential.azreposCredentialType oauth\n```\n\n**Also see: [GCM_AZREPOS_CREDENTIALTYPE][gcm-azrepos-credentialtype]**\n\n---\n\n### credential.azreposManagedIdentity\n\nUse a [Managed Identity][managed-identity] to authenticate with Azure Repos.\n\nThe value `system` will tell GCM to use the system-assigned Managed Identity.\n\nTo specify a user-assigned Managed Identity, use the format `id://{clientId}`\nwhere `{clientId}` is the client ID of the Managed Identity. Alternatively any\nGUID-like value will also be interpreted as a user-assigned Managed Identity\nclient ID.\n\nTo specify a Managed Identity associated with an Azure resource, you can use the\nformat `resource://{resourceId}` where `{resourceId}` is the ID of the resource.\n\nFor more information about managed identities, see the Azure DevOps\n[documentation][azrepos-sp-mid].\n\nValue|Description\n-|-\n`system`|System-Assigned Managed Identity\n`[guid]`|User-Assigned Managed Identity with the specified client ID\n`id://[guid]`|User-Assigned Managed Identity with the specified client ID\n`resource://[guid]`|User-Assigned Managed Identity for the associated resource\n\n```shell\ngit config --global credential.azreposManagedIdentity \"id://11111111-1111-1111-1111-111111111111\"\n```\n\n**Also see: [GCM_AZREPOS_MANAGEDIDENTITY][gcm-azrepos-credentialmanagedidentity]**\n\n---\n\n### credential.azreposServicePrincipal\n\nSpecify the client and tenant IDs of a [service principal][service-principal]\nto use when performing Microsoft authentication for Azure Repos.\n\nThe value of this setting should be in the format: `{tenantId}/{clientId}`.\n\nYou must also set at least one authentication mechanism if you set this value:\n\n- [credential.azreposServicePrincipalSecret][credential-azrepos-sp-secret]\n- [credential.azreposServicePrincipalCertificateThumbprint][credential-azrepos-sp-cert-thumbprint]\n- [credential.azreposServicePrincipalCertificateSendX5C][credential-azrepos-sp-cert-x5c]\n\nFor more information about service principals, see the Azure DevOps\n[documentation][azrepos-sp-mid].\n\n#### Example\n\n```shell\ngit config --global credential.azreposServicePrincipal \"11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222\"\n```\n\n**Also see: [GCM_AZREPOS_SERVICE_PRINCIPAL][gcm-azrepos-service-principal]**\n\n---\n\n### credential.azreposServicePrincipalSecret\n\nSpecifies the client secret for the [service principal][service-principal] when\nperforming Microsoft authentication for Azure Repos with\n[credential.azreposServicePrincipalSecret][credential-azrepos-sp] set.\n\n#### Example\n\n```shell\ngit config --global credential.azreposServicePrincipalSecret \"da39a3ee5e6b4b0d3255bfef95601890afd80709\"\n```\n\n**Also see: [GCM_AZREPOS_SP_SECRET][gcm-azrepos-sp-secret]**\n\n---\n\n### credential.azreposServicePrincipalCertificateThumbprint\n\nSpecifies the thumbprint of a certificate to use when authenticating as a\n[service principal][service-principal] for Azure Repos when\n[GCM_AZREPOS_SERVICE_PRINCIPAL][credential-azrepos-sp] is set.\n\n#### Example\n\n```shell\ngit config --global credential.azreposServicePrincipalCertificateThumbprint \"9b6555292e4ea21cbc2ebd23e66e2f91ebbe92dc\"\n```\n\n**Also see: [GCM_AZREPOS_SP_CERT_THUMBPRINT][gcm-azrepos-sp-cert-thumbprint]**\n\n---\n\n### credential.azreposServicePrincipalCertificateSendX5C\n\nWhen using a certificate for [service principal][service-principal] authentication, this configuration\nspecifies whether the X5C claim should be should be sent to the STS. Sending the x5c\nenables application developers to achieve easy certificate rollover in Azure AD:\nthis method will send the public certificate to Azure AD along with the token request,\nso that Azure AD can use it to validate the subject name based on a trusted issuer\npolicy. This saves the application admin from the need to explicitly manage the\ncertificate rollover. For details see [https://aka.ms/msal-net-sni](https://aka.ms/msal-net-sni).\n\n#### Example\n\n```shell\ngit config --global credential.azreposServicePrincipalCertificateSendX5C true\n```\n**Also see: [GCM_AZREPOS_SP_CERT_SEND_X5C][gcm-azrepos-sp-cert-x5c]**\n\n---\n\n### trace2.normalTarget\n\nTurns on Trace2 Normal Format tracing - see [Git's Trace2 Normal Format\ndocumentation][trace2-normal-docs] for more details.\n\n#### Example\n\n```shell\ngit config --global trace2.normalTarget true\n```\n\nIf the value of `trace2.normalTarget` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `trace2.normalTarget` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [GIT_TRACE2][trace2-normal-env]**\n\n---\n\n### trace2.eventTarget\n\nTurns on Trace2 Event Format tracing - see [Git's Trace2 Event Format\ndocumentation][trace2-event-docs] for more details.\n\n#### Example\n\n```shell\ngit config --global trace2.eventTarget true\n```\n\nIf the value of `trace2.eventTarget` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `trace2.eventTarget` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [GIT_TRACE2_EVENT][trace2-event-env]**\n\n---\n\n### trace2.perfTarget\n\nTurns on Trace2 Performance Format tracing - see [Git's Trace2 Performance\nFormat documentation][trace2-performance-docs] for more details.\n\n#### Example\n\n```shell\ngit config --global trace2.perfTarget true\n```\n\nIf the value of `trace2.perfTarget` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `trace2.perfTarget` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [GIT_TRACE2_PERF][trace2-performance-env]**\n\n[auto-detection]: autodetect.md\n[azure-tokens]: azrepos-users-and-tokens.md\n[use-http-path]: https://git-scm.com/docs/gitcredentials/#Documentation/gitcredentials.txt-useHttpPath\n[credential-credentialstore]: #credentialcredentialstore\n[credential-dpapistorepath]: #credentialdpapistorepath\n[credential-interactive]: #credentialinteractive\n[credential-msauthusebroker]: #credentialmsauthusebroker-experimental\n[credential-plaintextstorepath]: #credentialplaintextstorepath\n[credential-cache]: https://git-scm.com/docs/git-credential-cache\n[cred-stores]: credstores.md\n[devbox]: https://azure.microsoft.com/en-us/products/dev-box\n[enterprise-config]: enterprise-config.md\n[envars]: environment.md\n[freedesktop-ss]: https://specifications.freedesktop.org/secret-service-spec/\n[gcm-allow-windowsauth]: environment.md#GCM_ALLOW_WINDOWSAUTH\n[gcm-allow-unsafe-remotes]: environment.md#GCM_ALLOW_UNSAFE_REMOTES\n[gcm-authority]: environment.md#GCM_AUTHORITY-deprecated\n[gcm-autodetect-timeout]: environment.md#GCM_AUTODETECT_TIMEOUT\n[gcm-azrepos-credentialtype]: environment.md#GCM_AZREPOS_CREDENTIALTYPE\n[gcm-azrepos-credentialmanagedidentity]: environment.md#GCM_AZREPOS_MANAGEDIDENTITY\n[gcm-bitbucket-always-refresh-credentials]: environment.md#GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS\n[gcm-bitbucket-authmodes]: environment.md#GCM_BITBUCKET_AUTHMODES\n[gcm-credential-cache-options]: environment.md#GCM_CREDENTIAL_CACHE_OPTIONS\n[gcm-credential-store]: environment.md#GCM_CREDENTIAL_STORE\n[gcm-debug]: environment.md#GCM_DEBUG\n[gcm-dpapi-store-path]: environment.md#GCM_DPAPI_STORE_PATH\n[gcm-github-accountfiltering]: environment.md#GCM_GITHUB_ACCOUNTFILTERING\n[gcm-github-authmodes]: environment.md#GCM_GITHUB_AUTHMODES\n[gcm-gitlab-authmodes]:environment.md#GCM_GITLAB_AUTHMODES\n[gcm-gui-prompt]: environment.md#GCM_GUI_PROMPT\n[gcm-gui-software-rendering]: environment.md#GCM_GUI_SOFTWARE_RENDERING\n[gcm-http-proxy]: environment.md#GCM_HTTP_PROXY-deprecated\n[gcm-interactive]: environment.md#GCM_INTERACTIVE\n[gcm-msauth-flow]: environment.md#GCM_MSAUTH_FLOW\n[gcm-msauth-usebroker]: environment.md#GCM_MSAUTH_USEBROKER-experimental\n[gcm-msauth-usedefaultaccount]: environment.md#GCM_MSAUTH_USEDEFAULTACCOUNT-experimental\n[gcm-namespace]: environment.md#GCM_NAMESPACE\n[gcm-plaintext-store-path]: environment.md#GCM_PLAINTEXT_STORE_PATH\n[gcm-provider]: environment.md#GCM_PROVIDER\n[gcm-trace]: environment.md#GCM_TRACE\n[gcm-trace-secrets]: environment.md#GCM_TRACE_SECRETS\n[gcm-trace-msauth]: environment.md#GCM_TRACE_MSAUTH\n[github-emu]: https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users\n[usage]: usage.md\n[git-config-http-proxy]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpproxy\n[http-proxy]: netconfig.md#http-proxy\n[autodetect]: autodetect.md\n[libsecret]: https://wiki.gnome.org/Projects/Libsecret\n[managed-identity]: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview\n[provider-migrate]: migration.md#gcm_authority\n[cache-options]: https://git-scm.com/docs/git-credential-cache#_options\n[pass]: https://www.passwordstore.org/\n[pass-man]: https://git.zx2c4.com/password-store/about/\n[trace2-normal-docs]: https://git-scm.com/docs/api-trace2#_the_normal_format_target\n[trace2-normal-env]: environment.md#GIT_TRACE2\n[trace2-event-docs]: https://git-scm.com/docs/api-trace2#_the_event_format_target\n[trace2-event-env]: environment.md#GIT_TRACE2_EVENT\n[trace2-performance-docs]: https://git-scm.com/docs/api-trace2#_the_performance_format_target\n[trace2-performance-env]: environment.md#GIT_TRACE2_PERF\n[wam]: windows-broker.md\n[service-principal]: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals\n[azrepos-sp-mid]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity\n[credential-azrepos-sp]: #credentialazreposserviceprincipal\n[credential-azrepos-sp-secret]: #credentialazreposserviceprincipalsecret\n[credential-azrepos-sp-cert-thumbprint]: #credentialazreposserviceprincipalcertificatethumbprint\n[credential-azrepos-sp-cert-x5c]: #credentialazreposserviceprincipalcertificatesendx5c\n[gcm-azrepos-service-principal]: environment.md#GCM_AZREPOS_SERVICE_PRINCIPAL\n[gcm-azrepos-sp-secret]: environment.md#GCM_AZREPOS_SP_SECRET\n[gcm-azrepos-sp-cert-thumbprint]: environment.md#GCM_AZREPOS_SP_CERT_THUMBPRINT\n[gcm-azrepos-sp-cert-x5c]: environment.md#GCM_AZREPOS_SP_CERT_SEND_X5C\n" }, { "path": "docs/credstores.md", "content": "# Credential stores\n\nThere are several options for storing credentials that GCM supports:\n\n- Windows Credential Manager\n- DPAPI protected files\n- macOS Keychain\n- [freedesktop.org Secret Service API][freedesktop-secret-service]\n- GPG/[`pass`][passwordstore] compatible files\n- Git's built-in [credential cache][credential-cache]\n- Plaintext files\n- Passthrough/no-op (no credential store)\n\nThe default credential stores on macOS and Windows are the macOS Keychain and\nthe Windows Credential Manager, respectively.\n\nGCM comes without a default store on Linux distributions.\n\nYou can select which credential store to use by setting the [`GCM_CREDENTIAL_STORE`][gcm-credential-store]\nenvironment variable, or the [`credential.credentialStore`][credential-store]\nGit configuration setting. For example:\n\n```shell\ngit config --global credential.credentialStore gpg\n```\n\nSome credential stores have limitations, or further configuration required\ndepending on your particular setup. See more detailed information below for each\ncredential store.\n\n## Windows Credential Manager\n\n**Available on:** _Windows_\n\n**This is the default store on Windows.**\n\n**:warning: Does not work over a network/SSH session.**\n\n```batch\nSET GCM_CREDENTIAL_STORE=\"wincredman\"\n```\n\nor\n\n```shell\ngit config --global credential.credentialStore wincredman\n```\n\nThis credential store uses the Windows Credential APIs (`wincred.h`) to store\ndata securely in the Windows Credential Manager (also known as the Windows\nCredential Vault in earlier versions of Windows).\n\nYou can [access and manage data in the credential manager][access-windows-credential-manager]\nfrom the control panel, or via the [`cmdkey` command-line tool][cmdkey].\n\nWhen connecting to a Windows machine over a network session (such as SSH), GCM\nis unable to persist credentials to the Windows Credential Manager due to\nlimitations in Windows. Connecting by Remote Desktop doesn't suffer from this\nlimitation.\n\n## DPAPI protected files\n\n**Available on:** _Windows_\n\n```batch\nSET GCM_CREDENTIAL_STORE=\"dpapi\"\n```\n\nor\n\n```shell\ngit config --global credential.credentialStore dpapi\n```\n\nThis credential store uses Windows DPAPI to encrypt credentials which are stored\nas files in your file system. The file structure is the same as the\n[plaintext files credential store][plaintext-files] except the first line (the\nsecret value) is protected by DPAPI.\n\nBy default files are stored in `%USERPROFILE%\\.gcm\\dpapi_store`. This can be\nconfigured using the environment variable `GCM_DPAPI_STORE_PATH` environment\nvariable.\n\nIf the directory doesn't exist it will be created.\n\n## macOS Keychain\n\n**Available on:** _macOS_\n\n**This is the default store on macOS.**\n\n```shell\nexport GCM_CREDENTIAL_STORE=keychain\n# or\ngit config --global credential.credentialStore keychain\n```\n\nThis credential store uses the default macOS Keychain, which is typically the\n`login` keychain.\n\nYou can [manage data stored in the keychain][mac-keychain-management]\nusing the Keychain Access application.\n\n## [freedesktop.org Secret Service API][freedesktop-secret-service]\n\n**Available on:** _Linux_\n\n**:warning: Requires a graphical user interface session.**\n\n```shell\nexport GCM_CREDENTIAL_STORE=secretservice\n# or\ngit config --global credential.credentialStore secretservice\n```\n\nThis credential store uses the `libsecret` library to interact with the Secret\nService. It stores credentials securely in 'collections', which can be viewed by\ntools such as `secret-tool` and `seahorse`.\n\nA graphical user interface is required in order to show a secure prompt to\nrequest a secret collection be unlocked.\n\n## GPG/[`pass`][passwordstore] compatible files\n\n**Available on:** _macOS, Linux_\n\n**:warning: Requires `gpg`, `pass`, and a GPG key pair.**\n\n```shell\nexport GCM_CREDENTIAL_STORE=gpg\n# or\ngit config --global credential.credentialStore gpg\n```\n\nThis credential store uses GPG to encrypt files containing credentials which are\nstored in your file system. The file structure is compatible with the popular\n[`pass`][passwordstore] tool. By default files are stored in\n`~/.password-store` but this can be configured using the `pass` environment\nvariable `PASSWORD_STORE_DIR`.\n\nBefore you can use this credential store, it must be initialized by the `pass`\nutility, which in-turn requires a valid GPG key pair. To initalize the store,\nrun:\n\n```shell\npass init \n```\n\n..where `` is the user ID of a GPG key pair on your system. To create a\nnew GPG key pair, run:\n\n```shell\ngpg --gen-key\n```\n\n..and follow the prompts.\n\n### Headless/TTY-only sessions\n\nIf you are using the `gpg` credential store in a headless/TTY-only environment,\nyou must ensure you have configured the GPG Agent (`gpg-agent`) with a suitable\npin-entry program for the terminal such as `pinentry-tty` or `pinentry-curses`.\n\nIf you are connecting to your system via SSH, then the `SSH_TTY` variable should\nautomatically be set. GCM will pass the value of `SSH_TTY` to GPG/GPG Agent\nas the TTY device to use for prompting for a passphrase.\n\nIf you are not connecting via SSH, or otherwise do not have the `SSH_TTY`\nenvironment variable set, you must set the `GPG_TTY` environment variable before\nrunning GCM. The easiest way to do this is by adding the following to your\nprofile (`~/.bashrc`, `~/.profile` etc):\n\n```shell\nexport GPG_TTY=$(tty)\n```\n\n**Note:** Using `/dev/tty` does not appear to work here - you must use the real\nTTY device path, as returned by the `tty` utility.\n\n## Git's built-in [credential cache][credential-cache]\n\n**Available on:** _macOS, Linux_\n\n```shell\nexport GCM_CREDENTIAL_STORE=cache\n# or\ngit config --global credential.credentialStore cache\n```\n\nThis credential store uses Git's built-in ephemeral\nin-memory [credential cache][credential-cache].\nThis helps you reduce the number of times you have to authenticate but\ndoesn't require storing credentials on persistent storage. It's good for\nscenarios like [Azure Cloud Shell][azure-cloudshell]\nor [AWS CloudShell][aws-cloudshell], where you don't want to\nleave credentials on disk but also don't want to re-authenticate on every Git\noperation.\n\nBy default, `git credential-cache` stores your credentials for 900 seconds.\nThat, and any other [options it accepts][git-credential-cache-options],\nmay be altered by setting them in the environment variable\n`GCM_CREDENTIAL_CACHE_OPTIONS` or the Git config value\n`credential.cacheOptions`. (Using the `--socket` option is untested\nand unsupported, but there's no reason it shouldn't work.)\n\n```shell\nexport GCM_CREDENTIAL_CACHE_OPTIONS=\"--timeout 300\"\n# or\ngit config --global credential.cacheOptions \"--timeout 300\"\n```\n\n## Plaintext files\n\n**Available on:** _Windows, macOS, Linux_\n\n**:warning: This is not a secure method of credential storage!**\n\n```shell\nexport GCM_CREDENTIAL_STORE=plaintext\n# or\ngit config --global credential.credentialStore plaintext\n```\n\nThis credential store saves credentials to plaintext files in your file system.\nBy default files are stored in `~/.gcm/store` or `%USERPROFILE%\\.gcm\\store`.\nThis can be configured using the environment variable `GCM_PLAINTEXT_STORE_PATH`\nenvironment variable.\n\nIf the directory doesn't exist it will be created.\n\nOn POSIX platforms the newly created store directory will have permissions set\nsuch that only the owner can `r`ead/`w`rite/e`x`ecute (`700` or `drwx---`).\nPermissions on existing directories will not be modified.\n\nNB. GCM's plaintext store is distinct from [git-credential-store][git-credential-store],\nthough the formats are similar. The default paths differ.\n\n---\n\n:warning: **WARNING** :warning:\n\n**This storage mechanism is NOT secure!**\n\n**Secrets and credentials are stored in plaintext files _without any security_!**\n\nIt is **HIGHLY RECOMMENDED** to always use one of the other credential store\noptions above. This option is only provided for compatibility and use in\nenvironments where no other secure option is available.\n\nIf you chose to use this credential store, it is recommended you set the\npermissions on this directory such that no other users or applications can\naccess files within. If possible, use a path that exists on an external volume\nthat you take with you and use full-disk encryption.\n\n## Passthrough/no-op (no credential store)\n\n**Available on:** _Windows, macOS, Linux_\n\n**:warning: .**\n\n```batch\nSET GCM_CREDENTIAL_STORE=\"none\"\n```\n\nor\n\n```shell\ngit config --global credential.credentialStore none\n```\n\nThis option disables the internal credential store. All operations to store or\nretrieve credentials will do nothing, and will return success. This is useful if\nyou want to use a different credential store, chained in sequence via Git\nconfiguration, and don't want GCM to store credentials.\n\nNote that you'll want to ensure that another credential helper is placed before\nGCM in the `credential.helper` Git configuration or else you will be prompted to\nenter your credentials every time you interact with a remote repository.\n\n[access-windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0\n[aws-cloudshell]: https://aws.amazon.com/cloudshell/\n[azure-cloudshell]: https://docs.microsoft.com/azure/cloud-shell/overview\n[cmdkey]: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey\n[credential-store]: configuration.md#credentialcredentialstore\n[credential-cache]: https://git-scm.com/docs/git-credential-cache\n[freedesktop-secret-service]: https://specifications.freedesktop.org/secret-service/\n[gcm-credential-store]: environment.md#GCM_CREDENTIAL_STORE\n[git-credential-store]: https://git-scm.com/docs/git-credential-store\n[mac-keychain-management]: https://support.apple.com/en-gb/guide/mac-help/mchlf375f392/mac\n[git-credential-cache-options]: https://git-scm.com/docs/git-credential-cache#_options\n[passwordstore]: https://www.passwordstore.org/\n[plaintext-files]: #plaintext-files\n" }, { "path": "docs/development.md", "content": "# Development and debugging\n\nStart by cloning this repository:\n\n```shell\ngit clone https://github.com/git-ecosystem/git-credential-manager\n```\n\nYou also need the latest version of the .NET SDK which can be downloaded and\ninstalled from the [.NET website][dotnet-web].\n\n## Building\n\nThe `Git-Credential-Manager.sln` solution can be opened and built in Visual\nStudio, Visual Studio for Mac, Visual Studio Code, or JetBrains Rider.\n\n### macOS\n\nTo build from inside an IDE, make sure to select the `MacDebug` or `MacRelease`\nsolution configurations.\n\nTo build from the command line, run:\n\n```shell\ndotnet build -c MacDebug\n```\n\nYou can find a copy of the installer .pkg file in `out/osx/Installer.Mac/pkg/Debug`.\n\nThe flat binaries can also be found in `out/osx/Installer.Mac/pkg/Debug/payload`.\n\n### Windows\n\nTo build from inside an IDE, make sure to select the `WindowsDebug` or\n`WindowsRelease` solution configurations.\n\nTo build from the command line, run:\n\n```powershell\ndotnet build -c WindowsDebug\n```\n\nYou can find a copy of the installer .exe file in `out\\windows\\Installer.Windows\\bin\\Debug\\net472`.\n\nThe flat binaries can also be found in `out\\windows\\Payload.Windows\\bin\\Debug\\net472\\win-x86`.\n\n### Linux\n\nThe two available solution configurations are `LinuxDebug` and `LinuxRelease`.\n\nTo build from the command line, run:\n\n```shell\ndotnet build -c LinuxDebug\n```\n\nIf you want to build for a specific architecture, you can provide `linux-x64` or `linux-arm64` or `linux-arm` as the runtime:\n\n```shell\ndotnet build -c LinuxDebug -r linux-arm64\n```\n\nYou can find a copy of the Debian package (.deb) file in `out/linux/Packaging.Linux/deb/Debug`.\n\nThe flat binaries can also be found in `out/linux/Packaging.Linux/payload/Debug`.\n\n## Debugging\n\nTo debug from inside an IDE you'll want to set `Git-Credential-Manager` as the\nstartup project, and specify one of `get`, `store`, or `erase` as a program\nargument.\n\nTo simulate Git interacting with GCM, when you start from your IDE of choice,\nyou'll need to enter the following [information over standard input][ioformat]:\n\n```text\nprotocol=http\nhost=\n\n\n```\n\n..where `` is a supported hostname such as `github.com`, and `` is\na line feed (or CRLF, we support both!).\n\nYou may also include the following optional fields, depending on your scenario:\n\n```text\nusername=\npassword=\n```\n\nFor more information about how Git interacts with credential helpers, please\nread Git's documentation on [custom helpers][custom-helpers].\n\n### Attaching to a running process\n\nIf you want to debug an already running GCM process, set the `GCM_DEBUG`\nenvironment variable to `1` or `true`. The process will wait on launch for a\ndebugger to attach before continuing.\n\nThis is useful when debugging interactions between GCM and Git, and you want\nGit to be the one launching us.\n\n### Collect trace output\n\nGCM has two tracing systems - one that is distinctly GCM's and one that\nimplements certain features of [Git's Trace2 API][trace2]. Below are\ninstructions for how to use each.\n\n#### `GCM_TRACE`\n\nIf you want to debug a release build or installation of GCM, you can set the\n`GCM_TRACE` environment variable to `1` to print trace information to standard\nerror, or to an absolute file path to write trace information to a file.\n\nFor example:\n\n```shell\n$ GCM_TRACE=1 git-credential-manager version\n> 18:47:56.526712 ...er/Application.cs:69 trace: [RunInternalAsync] Git Credential Manager version 2.0.124-beta+e1ebbe1517 (macOS, .NET 5.0) 'version'\n> Git Credential Manager version 2.0.124-beta+e1ebbe1517 (macOS, .NET 5.0)\n```\n\n#### Git's Trace2 API\n\nThis API can also be used to print debug, performance, and telemetry information\nto stderr or a file in various formats.\n\n##### Supported format targets\n\n1. The Normal Format Target: Similar to `GCM_TRACE`, this target writes\nhuman-readable output and is best suited for debugging. It can be enabled via\nenvironment variable or config, for example:\n\n ```shell\n export GIT_TRACE2=1\n ```\n\n or\n\n ```shell\n git config --global trace2.normalTarget ~/log.normal\n ```\n\n0. The Performance Format Target: This format is column-based and geared toward\nanalyzing performance during development and testing. It can be enabled via\nenvironment variable or config, for example:\n\n ```shell\n export GIT_TRACE2_PERF=1\n ```\n\n or\n\n ```shell\n git config --global trace2.perfTarget ~/log.perf\n ```\n\n0. The Event Format Target: This format is json-based and is geared toward\ncollection of large quantities of data for advanced analysis. It can be enabled\nvia environment variable or config, for example:\n\n ```shell\n export GIT_TRACE2_EVENT=1\n ```\n\n or\n\n ```shell\n git config --global trace2.eventTarget ~/log.event\n ```\n\nYou can read more about each of these format targets in the [corresponding\nsection][trace2-targets] of Git's Trace2 API documentation.\n\n##### Supported events\n\nThe below describes, at a high level, the Trace2 API events that are currently\nsupported in GCM and the information they provide:\n\n1. `version`: contains the version of the current executable (e.g. GCM or a\nhelper exe)\n0. `start`: contains the complete argv received by current executable's `Main()`\nmethod\n0. `exit`: contains current executable's exit code\n0. `child_start`: describes a child process that is about to be spawned\n0. `child_exit`: describes a child process at exit\n0. `region_enter`: describes a region (e.g. a timer for a section of code that\nis interesting) on entry\n0. `region_leave`: describes a region on leaving\n\nYou can read more about each of these format targets in the [corresponding\nsection][trace2-events] of Git's Trace2 API documentation.\n\nWant to see more events? Consider contributing! We'd :love: to see your\nawesome work in support of building out this API.\n\n### Code coverage metrics\n\nIf you want code coverage metrics these can be generated either from the command\nline:\n\n```shell\ndotnet test --collect:\"XPlat Code Coverage\" --settings=./.code-coverage/coverlet.settings.xml\n```\n\nOr via the VSCode Terminal/Run Task:\n\n```console\ntest with coverage\n```\n\nHTML reports can be generated using ReportGenerator, this should be installed\nduring the build process, from the command line:\n\n```shell\ndotnet ~/.nuget/packages/reportgenerator/*/*/net8.0/ReportGenerator.dll -reports:./**/TestResults/**/coverage.cobertura.xml -targetdir:./out/code-coverage\n```\n\nor\n\n```shell\ndotnet {$env:USERPROFILE}/.nuget/packages/reportgenerator/*/*/net8.0/ReportGenerator.dll -reports:./**/TestResults/**/coverage.cobertura.xml -targetdir:./out/code-coverage\n```\n\nOr via VSCode Terminal/Run Task:\n\n```console\nreport coverage - nix\n```\n\nor\n\n```console\nreport coverage - win\n```\n\n## Linting Documentation\n\nDocuments are linted using [markdownlint][markdownlint] which can be installed\nas a CLI tool via NPM or as an [extension in VSCode][vscode-markdownlint]. See\nthe [documentation on GitHub][markdownlint]. The configuration used for\nmarkdownlint is in [.markdownlint.jsonc][markdownlint-config].\n\nDocuments are checked for link validity using [lychee][lychee]. Lychee can be\ninstalled in a variety of ways depending on your platform, see the [docs on GitHub][lychee-docs].\nSome URLs are ignored by lychee, per the [lycheeignore][lycheeignore].\n\n[dotnet-web]: https://dotnet.microsoft.com/\n[custom-helpers]: https://git-scm.com/docs/gitcredentials#_custom_helpers\n[ioformat]: https://git-scm.com/docs/git-credential#IOFMT\n[lychee]: https://lychee.cli.rs/\n[lychee-docs]: https://github.com/lycheeverse/lychee\n[lycheeignore]: ../.lycheeignore\n[markdownlint]: https://github.com/DavidAnson/markdownlint-cli2\n[markdownlint-config]: ../.markdownlint.jsonc\n[trace2]: https://git-scm.com/docs/api-trace2\n[trace2-events]: https://git-scm.com/docs/api-trace2#_event_specific_keyvalue_pairs\n[trace2-targets]: https://git-scm.com/docs/api-trace2#_trace2_targets\n[vscode-markdownlint]: https://github.com/DavidAnson/vscode-markdownlint\n" }, { "path": "docs/enterprise-config.md", "content": "# Enterprise configuration defaults\n\nGit Credential Manager (GCM) can be configured using multiple\ndifferent mechanisms. In order of preference, those mechanisms are:\n\n1. [Environment variables][environment]\n1. Standard [Git configuration][config] files\n 1. Repository/local configuration (`.git/config`)\n 1. User/global configuration (`$HOME/.gitconfig` or `%HOME%\\.gitconfig`)\n 1. Installation/system configuration (`etc/gitconfig`)\n1. Enterprise system administrator defaults\n1. Compiled default values\n\nThis model largely matches what Git itself supports, namely environment\nvariables that take precedence over Git configuration files.\n\nThe addition of the enterprise system administrator defaults enables those\nadministrators to configure many GCM settings using familiar MDM tooling, rather\nthan having to modify the Git installation configuration files.\n\n## User Freedom\n\nWe believe the user should _always_ be at liberty to configure\nGit and GCM exactly as they wish. By preferring environment variables and Git\nconfiguration files over system admin values, these only act as _default values_\nthat can always be overridden by the user in the usual ways.\n\n## Windows\n\nDefault setting values come from the Windows Registry, specifically the\nfollowing keys:\n\n```text\nHKEY_LOCAL_MACHINE\\SOFTWARE\\GitCredentialManager\\Configuration\n```\n\nBy using the Windows Registry, system administrators can use Group Policy to\neasily set defaults for GCM's settings.\n\nThe names and possible values of all settings under this key are the same as\nthose of the [Git configuration][config] settings.\n\nThe type of each registry key can be either `REG_SZ` (string) or `REG_DWORD`\n(integer).\n\n### 32-bit / x86\n\nWhen running the 32-bit (x86) version of GCM on a 64-bit (x64 or ARM64)\ninstallation of Windows, the registry access is transparently redirected to\nthe `WOW6432Node` node.\n\n```text\nHKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\GitCredentialManager\\Configuration\n```\n\n## macOS\n\nDefault settings values come from macOS's preferences system. Configuration\nprofiles can be deployed to devices using a compatible Mobile Device Management\n(MDM) solution.\n\nConfiguration for Git Credential Manager must take the form of a dictionary, set\nfor the domain `git-credential-manager` under the key `configuration`. For\nexample:\n\n```shell\ndefaults write git-credential-manager configuration -dict-add \n```\n\n..where `` is the name of the settings from the [Git configuration][config]\nreference, and `` is the desired value.\n\nAll values in the `configuration` dictionary must be strings. For boolean values\nuse `true` or `false`, and for integer values use the number in string form.\n\nTo read the current configuration:\n\n```console\n$ defaults read git-credential-manager configuration\n{\n = ;\n ...\n = ;\n}\n```\n\n## Linux\n\nDefault settings values come from the `/etc/git-credential-manager/config.d`\ndirectory. Each file in this directory represents a single settings dictionary.\n\nAll files in this directory are read at runtime and merged into a single\ncollection of settings, in the order they are read from the file system.\nTo provide a stable ordering, it is recommended to prefix each filename with a\nnumber, e.g. `42-my-settings`.\n\nThe format of each file is a simple set of key/value pairs, separated by an\n`=` sign, and each line separated by a line-feed (`\\n`, LF) character.\nComments are identified by a `#` character at the beginning of a line.\n\nFor example:\n\n```text\n# /etc/git-credential-manager/config.d/00-example1\ncredential.noguiprompt=0\n```\n\n```text\n# /etc/git-credential-manager/config.d/01-example2\ncredential.trace=true\ncredential.traceMsAuth=true\n```\n\nAll settings names and values are the same as the [Git configuration][config]\nreference.\n\n> Note: These files are read once at startup. If changes are made to these files\nthey will not be reflected in an already running process.\n\n[environment]: environment.md\n[config]: configuration.md\n" }, { "path": "docs/environment.md", "content": "# Environment variables\n\n[Git Credential Manager][gcm] works out of the box for most users. Configuration\noptions are available to customize or tweak behavior.\n\nGit Credential Manager (GCM) can be configured using environment variables.\n**Environment variables take precedence over [configuration][configuration]\noptions and enterprise system administrator [default values][default-values]**.\n\nFor the complete list of environment variables GCM understands, see the list\nbelow.\n\n## Available settings\n\n### GCM_TRACE\n\nEnables trace logging of all activities.\nConfiguring Git and GCM to trace to the same location is often desirable, and\nGCM is compatible and cooperative with `GIT_TRACE`.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GIT_TRACE=%UserProfile%\\git.log\nSET GCM_TRACE=%UserProfile%\\git.log\n```\n\n##### macOS/Linux\n\n```bash\nexport GIT_TRACE=$HOME/git.log\nexport GCM_TRACE=$HOME/git.log\n```\n\nIf the value of `GCM_TRACE` is a full path to a file in an existing directory,\nlogs are appended to the file.\n\nIf the value of `GCM_TRACE` is `true` or `1`, logs are written to standard error.\n\nDefaults to disabled.\n\n**Also see: [credential.trace][credential-trace]**\n\n---\n\n### GCM_TRACE_SECRETS\n\nEnables tracing of secret and sensitive information, which is by default masked\nin trace output. Requires that `GCM_TRACE` is also enabled.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_TRACE=%UserProfile%\\gcm.log\nSET GCM_TRACE_SECRETS=1\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_TRACE=$HOME/gcm.log\nexport GCM_TRACE_SECRETS=1\n```\n\nIf the value of `GCM_TRACE_SECRETS` is `true` or `1`, trace logs will include\nsecret information.\n\nDefaults to disabled.\n\n**Also see: [credential.traceSecrets][credential-trace-secrets]**\n\n---\n\n### GCM_TRACE_MSAUTH\n\nEnables inclusion of Microsoft Authentication library (MSAL) logs in GCM trace\noutput. Requires that `GCM_TRACE` is also enabled.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_TRACE=%UserProfile%\\gcm.log\nSET GCM_TRACE_MSAUTH=1\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_TRACE=$HOME/gcm.log\nexport GCM_TRACE_MSAUTH=1\n```\n\nIf the value of `GCM_TRACE_MSAUTH` is `true` or `1`, trace logs will include\nverbose MSAL logs.\n\nDefaults to disabled.\n\n**Also see: [credential.traceMsAuth][credential-trace-msauth]**\n\n---\n\n### GCM_DEBUG\n\nPauses execution of GCM at launch to wait for a debugger to be attached.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_DEBUG=1\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_DEBUG=1\n```\n\nDefaults to disabled.\n\n**Also see: [credential.debug][credential-debug]**\n\n---\n\n### GCM_INTERACTIVE\n\nPermit or disable GCM from interacting with the user (showing GUI or TTY\nprompts). If interaction is required but has been disabled, an error is\nreturned.\n\nThis can be helpful when using GCM in headless and unattended environments, such\nas build servers, where it would be preferable to fail than to hang indefinitely\nwaiting for a non-existent user.\n\nTo disable interactivity set this to `false` or `0`.\n\n#### Compatibility\n\nIn previous versions of GCM this setting had a different behavior and accepted\nother values. The following table summarizes the change in behavior and the\nmapping of older values such as `never`:\n\nValue(s)|Old meaning|New meaning\n-|-|-\n`auto`|Prompt if required – use cached credentials if possible|_(unchanged)_\n`never`, `false`| Never prompt – fail if interaction is required|_(unchanged)_\n`always`, `force`, `true`|Always prompt – don't use cached credentials|Prompt if required (same as the old `auto` value)\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_INTERACTIVE=0\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_INTERACTIVE=0\n```\n\nDefaults to enabled.\n\n**Also see: [credential.interactive][credential-interactive]**\n\n---\n\n### GCM_PROVIDER\n\nDefine the host provider to use when authenticating.\n\nID|Provider\n-|-\n`auto` _(default)_|_\\[automatic\\]_ ([learn more][autodetect])\n`azure-repos`|Azure Repos\n`github`|GitHub\n`gitlab`|GitLab _(supports OAuth in browser, personal access token and Basic Authentication)_\n`generic`|Generic (any other provider not listed above)\n\nAutomatic provider selection is based on the remote URL.\n\nThis setting is typically used with a scoped URL to map a particular set of\nremote URLs to providers, for example to mark a host as a GitHub Enterprise\ninstance.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_PROVIDER=github\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_PROVIDER=github\n```\n\n**Also see: [credential.provider][credential-provider]**\n\n---\n\n### GCM_AUTHORITY _(deprecated)_\n\n> This setting is deprecated and should be replaced by `GCM_PROVIDER` with the\n> corresponding provider ID value.\n>\n> See the [migration guide][migration-guide] for more information.\n\nSelect the host provider to use when authenticating by which authority is\nsupported by the providers.\n\nAuthority|Provider(s)\n-|-\n`auto` _(default)_|_\\[automatic\\]_\n`msa`, `microsoft`, `microsoftaccount`, `aad`, `azure`, `azuredirectory`, `live`, `liveconnect`, `liveid`|Azure Repos _(supports Microsoft Authentication)_\n`github`|GitHub _(supports GitHub Authentication)_\n`gitlab`|GitLab _(supports OAuth in browser, personal access token and Basic Authentication)_\n`basic`, `integrated`, `windows`, `kerberos`, `ntlm`, `tfs`, `sso`|Generic _(supports Basic and Windows Integrated Authentication)_\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_AUTHORITY=github\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_AUTHORITY=github\n```\n\n**Also see: [credential.authority][credential-authority]**\n\n---\n\n### GCM_GUI_PROMPT\n\nPermit or disable GCM from presenting GUI prompts. If an equivalent terminal/\ntext-based prompt is available, that will be shown instead.\n\nTo disable all interactivity see [GCM_INTERACTIVE][gcm-interactive].\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_GUI_PROMPT=0\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_GUI_PROMPT=0\n```\n\nDefaults to enabled.\n\n**Also see: [credential.guiPrompt][credential-guiprompt]**\n\n---\n\n### GCM_GUI_SOFTWARE_RENDERING\n\nForce the use of software rendering for GUI prompts.\n\nThis is currently only applicable on Windows.\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_GUI_SOFTWARE_RENDERING=1\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_GUI_SOFTWARE_RENDERING=1\n```\n\nDefaults to false (use hardware acceleration where available).\n\n> [!NOTE]\n> Windows on ARM devices defaults to using software rendering to work around a\n> known Avalonia issue: \n\n**Also see: [credential.guiSoftwareRendering][credential-guisoftwarerendering]**\n\n---\n\n### GCM_ALLOW_UNSAFE_REMOTES\n\nAllow transmitting credentials to unsafe remote URLs such as unencrypted HTTP\nURLs. This setting is not recommended for general use and should only be used\nwhen necessary.\n\nDefaults false (disallow unsafe remote URLs).\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_ALLOW_UNSAFE_REMOTES=true\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_ALLOW_UNSAFE_REMOTES=true\n```\n\n**Also see: [credential.allowUnsafeRemotes][credential-allowunsaferemotes]**\n\n---\n\n### GCM_AUTODETECT_TIMEOUT\n\nSet the maximum length of time, in milliseconds, that GCM should wait for a\nnetwork response during host provider auto-detection probing.\n\nSee [autodetection][autodetect] for more information.\n\n**Note:** Use a negative or zero value to disable probing altogether.\n\nDefaults to 2000 milliseconds (2 seconds).\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_AUTODETECT_TIMEOUT=-1\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_AUTODETECT_TIMEOUT=-1\n```\n\n**Also see: [credential.autoDetectTimeout][credential-autodetecttimeout]**\n\n---\n\n### GCM_ALLOW_WINDOWSAUTH\n\nAllow detection of Windows Integrated Authentication (WIA) support for generic\nhost providers. Setting this value to `false` will prevent the use of WIA and\nforce a basic authentication prompt when using the Generic host provider.\n\n**Note:** WIA is only supported on Windows.\n\n**Note:** WIA is an umbrella term for NTLM and Kerberos (and Negotiate).\n\nValue|WIA detection\n-|-\n`true`, `1`, `yes`, `on` _(default)_|Permitted\n`false`, `0`, `no`, `off`|Not permitted\n\n#### Example\n\n##### Windows\n\n```batch\nSET GCM_ALLOW_WINDOWSAUTH=0\n```\n\n##### macOS/Linux\n\n```bash\nexport GCM_ALLOW_WINDOWSAUTH=0\n```\n\n**Also see: [credential.allowWindowsAuth][credential-allowwindowsauth]**\n\n---\n\n### GCM_HTTP_PROXY _(deprecated)_\n\n> This setting is deprecated and should be replaced by the [standard `http.proxy`\n> Git configuration option][git-httpproxy].\n>\n> See the [HTTP proxy configuration][network-http-proxy] for more information.\n\nConfigure GCM to use the a proxy for network operations.\n\n**Note:** Git itself does _not_ respect this setting; this affects GCM _only_.\n\n#### Windows\n\n```batch\nSET GCM_HTTP_PROXY=http://john.doe:password@proxy.contoso.com\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_HTTP_PROXY=http://john.doe:password@proxy.contoso.com\n```\n\n**Also see: [credential.httpProxy][credential-httpproxy]**\n\n---\n\n### GCM_BITBUCKET_AUTHMODES\n\nOverride the available authentication modes presented during Bitbucket\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting only applies to Bitbucket.org, and not Server or DC\ninstances.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`oauth`|OAuth-based authentication\n`basic`|Basic/PAT-based authentication\n\n#### Windows\n\n```batch\nSET GCM_BITBUCKET_AUTHMODES=\"oauth,basic\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_BITBUCKET_AUTHMODES=\"oauth,basic\"\n```\n\n**Also see: [credential.bitbucketAuthModes][credential-bitbucketauthmodes]**\n\n---\n\n### GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS\n\nForces GCM to ignore any existing stored Basic Auth or OAuth access tokens and\nalways run through the process to refresh the credentials before returning them\nto Git.\n\nThis is especially relevant to OAuth credentials. Bitbucket.org access tokens\nexpire after 2 hours, after that the refresh token must be used to get a new\naccess token.\n\nEnabling this option will improve performance when using Oauth2 and interacting\nwith Bitbucket.org if, on average, commits are done less frequently than every 2\nhours.\n\nEnabling this option will decrease performance when using Basic Auth by\nrequiring the user the re-enter credentials every time.\n\nValue|Refresh Credentials Before Returning\n-|-\n`true`, `1`, `yes`, `on` |Always\n`false`, `0`, `no`, `off`_(default)_|Only when the credentials are found to be invalid\n\n#### Windows\n\n```batch\nSET GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS=1\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS=1\n```\n\nDefaults to false/disabled.\n\n**Also see: [credential.bitbucketAlwaysRefreshCredentials](configuration.md#credentialbitbucketAlwaysRefreshCredentials)**\n\n---\n\n### GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS\n\nForces GCM to validate any stored credentials before returning them to Git. It\ndoes this by calling a REST API resource that requires authentication.\n\nDisabling this option reduces the HTTP traffic within GCM when it is retrieving\ncredentials. This may improve user performance, but will increase the number of\ntimes Git remote calls fail to authenticate with the host and therefore require\nthe user to re-try the Git remote call.\n\nEnabling this option helps ensure Git is always provided with valid credentials.\n\nValue|Validate credentials\n-|-\n`true`, `1`, `yes`, `on`_(default)_|Always\n`false`, `0`, `no`, `off`|Never\n\n#### Windows\n\n```batch\nSET GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS=1\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS=1\n```\n\nDefaults to true/enabled.\n\n**Also see: [credential.bitbucketValidateStoredCredentials](configuration.md#credentialbitbucketValidateStoredCredentials)**\n\n---\n\n### GCM_BITBUCKET_DATACENTER_CLIENTID\n\nTo use OAuth with Bitbucket DC it is necessary to create an external, incoming\n[AppLink](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html).\n\nIt is then necessary to configure the local GCM installation with the OAuth\n[ClientId](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTID) and\n[ClientSecret](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTSECRET)\nfrom the AppLink.\n\n#### Windows\n\n```batch\nSET GCM_BITBUCKET_DATACENTER_CLIENTID=1111111111111111111\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_BITBUCKET_DATACENTER_CLIENTID=1111111111111111111\n```\n\nDefaults to undefined.\n\n**Also see: [credential.bitbucketDataCenterOAuthClientId](configuration.md#credentialbitbucketDataCenterOAuthClientId)**\n\n---\n\n### GCM_BITBUCKET_DATACENTER_CLIENTSECRET\n\nTo use OAuth with Bitbucket DC it is necessary to create an external, incoming\n[AppLink](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html).\n\nIt is then necessary to configure the local GCM installation with the OAuth\n[ClientId](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTID) and\n[ClientSecret](environment.md#GCM_BITBUCKET_DATACENTER_CLIENTSECRET)\nfrom the AppLink.\n\n#### Windows\n\n```batch\nSET GCM_BITBUCKET_DATACENTER_CLIENTSECRET=222222222222222222222\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_BITBUCKET_DATACENTER_CLIENTSECRET=222222222222222222222\n```\n\nDefaults to undefined.\n\n**Also see: [credential.bitbucketDataCenterOAuthClientSecret](configuration.md#credentialbitbucketDataCenterOAuthClientSecret)**\n\n---\n\n### GCM_GITHUB_ACCOUNTFILTERING\n\nEnable or disable automatic account filtering for GitHub based on server hints\nwhen there are multiple available accounts. This setting is only applicable to\nGitHub.com with [Enterprise Managed Users][github-emu].\n\nValue|Description\n-|-\n`true` _(default)_|Filter available accounts based on server hints.\n`false`|Show all available accounts.\n\n#### Windows\n\n```batch\nSET GCM_GITHUB_ACCOUNTFILTERING=false\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_GITHUB_ACCOUNTFILTERING=false\n```\n\n**Also see: [credential.gitHubAccountFiltering][credential-githubaccountfiltering]**\n\n---\n\n### GCM_GITHUB_AUTHMODES\n\nOverride the available authentication modes presented during GitHub\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`oauth`|Expands to: `browser, device`\n`browser`|OAuth authentication via a web browser _(requires a GUI)_\n`device`|OAuth authentication with a device code\n`basic`|Basic authentication using username and password\n`pat`|Personal Access Token (pat)-based authentication\n\n#### Windows\n\n```batch\nSET GCM_GITHUB_AUTHMODES=\"oauth,basic\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_GITHUB_AUTHMODES=\"oauth,basic\"\n```\n\n**Also see: [credential.gitHubAuthModes][credential-githubauthmodes]**\n\n---\n\n### GCM_GITLAB_AUTHMODES\n\nOverride the available authentication modes presented during GitLab\nauthentication. If this option is not set, then the available authentication\nmodes will be automatically detected.\n\n**Note:** This setting supports multiple values separated by commas.\n\nValue|Authentication Mode\n-|-\n_(unset)_|Automatically detect modes\n`browser`|OAuth authentication via a web browser _(requires a GUI)_\n`basic`|Basic authentication using username and password\n`pat`|Personal Access Token (pat)-based authentication\n\n#### Windows\n\n```batch\nSET GCM_GITLAB_AUTHMODES=\"browser\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_GITLAB_AUTHMODES=\"browser\"\n```\n\n**Also see: [credential.gitLabAuthModes][credential-gitlabauthmodes]**\n\n---\n\n### GCM_NAMESPACE\n\nUse a custom namespace prefix for credentials read and written in the OS\ncredential store. Credentials will be stored in the format\n`{namespace}:{service}`.\n\nDefaults to the value `git`.\n\n#### Windows\n\n```batch\nSET GCM_NAMESPACE=\"my-namespace\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_NAMESPACE=\"my-namespace\"\n```\n\n**Also see: [credential.namespace][credential-namespace]**\n\n---\n\n### GCM_CREDENTIAL_STORE\n\nSelect the type of credential store to use on supported platforms.\n\nDefault value on Windows is `wincredman`, on macOS is `keychain`, and is unset\non Linux.\n\n**Note:** For more information about configuring secret stores see the\n[credential stores documentation][credential-stores].\n\nValue|Credential Store|Platforms\n-|-|-\n_(unset)_|Windows: `wincredman`, macOS: `keychain`, Linux: _(none)_|-\n`wincredman`|Windows Credential Manager (not available over SSH).|Windows\n`dpapi`|DPAPI protected files. Customize the DPAPI store location with [`GCM_DPAPI_STORE_PATH`][gcm-dpapi-store-path]|Windows\n`keychain`|macOS Keychain.|macOS\n`secretservice`|[freedesktop.org Secret Service API][freedesktop-ss] via [libsecret][libsecret] (requires a graphical interface to unlock secret collections).|Linux\n`gpg`|Use GPG to store encrypted files that are compatible with the [`pass` utility][passwordstore] (requires GPG and `pass` to initialize the store).|macOS, Linux\n`cache`|Git's built-in [credential cache][git-credential-cache].|Windows, macOS, Linux\n`plaintext`|Store credentials in plaintext files (**UNSECURE**). Customize the plaintext store location with [`GCM_PLAINTEXT_STORE_PATH`][gcm-plaintext-store-path].|Windows, macOS, Linux\n`none`|Do not store credentials via GCM.|Windows, macOS, Linux\n\n#### Windows\n\n```batch\nSET GCM_CREDENTIAL_STORE=\"gpg\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_CREDENTIAL_STORE=\"gpg\"\n```\n\n**Also see: [credential.credentialStore][credential-credentialstore]**\n\n---\n\n### GCM_CREDENTIAL_CACHE_OPTIONS\n\nPass [options][git-cache-options]\nto the Git credential cache when [`GCM_CREDENTIAL_STORE`][gcm-credential-store]\nis set to `cache`. This allows you to select a different amount\nof time to cache credentials (the default is 900 seconds) by passing\n`\"--timeout \"`. Use of other options like `--socket` is untested\nand unsupported, but there's no reason it shouldn't work.\n\nDefaults to empty.\n\n#### Windows\n\n```batch\nSET GCM_CREDENTIAL_CACHE_OPTIONS=\"--timeout 300\"\n```\n\n#### macOS/Linux\n\n```shell\nexport GCM_CREDENTIAL_CACHE_OPTIONS=\"--timeout 300\"\n```\n\n**Also see: [credential.cacheOptions][credential-cacheoptions]**\n\n---\n\n### GCM_PLAINTEXT_STORE_PATH\n\nSpecify a custom directory to store plaintext credential files in when\n[`GCM_CREDENTIAL_STORE`][gcm-credential-store] is set to `plaintext`.\n\nDefaults to the value `~/.gcm/store` or `%USERPROFILE%\\.gcm\\store`.\n\n#### Windows\n\n```batch\nSETX GCM_PLAINTEXT_STORE_PATH=D:\\credentials\n```\n\n#### macOS/Linux\n\n```shell\nexport GCM_PLAINTEXT_STORE_PATH=/mnt/external-drive/credentials\n```\n\n**Also see: [credential.plaintextStorePath][credential-plain-text-store]**\n\n---\n\n### GCM_DPAPI_STORE_PATH\n\nSpecify a custom directory to store DPAPI protected credential files in when\n[`GCM_CREDENTIAL_STORE`][gcm-credential-store] is set to `dpapi`.\n\nDefaults to the value `%USERPROFILE%\\.gcm\\dpapi_store`.\n\n#### Windows\n\n```batch\nSETX GCM_DPAPI_STORE_PATH=D:\\credentials\n```\n\n**Also see: [credential.dpapiStorePath][credential-dpapi-store-path]**\n\n---\n\n### GCM_GPG_PATH\n\nSpecify the path (_including_ the executable name) to the version of `gpg` used\nby `pass` (`gpg2` if present, otherwise `gpg`). This is primarily meant to allow\nmanual resolution of the conflict that occurs on legacy Linux systems with\nparallel installs of `gpg` and `gpg2`.\n\nIf not specified, GCM defaults to using the version of `gpg2` on the `$PATH`,\nfalling back on `gpg` if `gpg2` is not found.\n\n#### macOS/Linux\n\n```bash\nexport GCM_GPG_PATH=\"/usr/local/bin/gpg2\"\n```\n\n_No configuration equivalent._\n\n---\n\n### GCM_MSAUTH_FLOW\n\nSpecify which authentication flow should be used when performing Microsoft\nauthentication and an interactive flow is required.\n\nDefaults to `auto`.\n\n**Note:** If [`GCM_MSAUTH_USEBROKER`][gcm-msauth-usebroker] is set to `true`\nand the operating system authentication broker is available, all flows will be\ndelegated to the broker. If both of those things are true, then the value of\n`GCM_MSAUTH_FLOW` has no effect.\n\nValue|Authentication Flow\n-|-\n`auto` _(default)_|Select the best option depending on the current environment and platform.\n`embedded`|Show a window with embedded web view control.\n`system`|Open the user's default web browser.\n`devicecode`|Show a device code.\n\n#### Windows\n\n```batch\nSET GCM_MSAUTH_FLOW=\"devicecode\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_MSAUTH_FLOW=\"devicecode\"\n```\n\n**Also see: [credential.msauthFlow][credential-msauth-flow]**\n\n---\n\n### GCM_MSAUTH_USEBROKER _(experimental)_\n\nUse the operating system account manager where available.\n\nDefaults to `false`. In certain cloud hosted environments when using a work or\nschool account, such as [Microsoft DevBox][devbox], the default is `true`.\n\nThese defaults are subject to change in the future.\n\n_**Note:** before you enable this option on Windows, please\n[review the details][windows-broker] about what this means to your local Windows\nuser account._\n\nValue|Description\n-|-\n`true`|Use the operating system account manager as an authentication broker.\n`false` _(default)_|Do not use the broker.\n\n#### Windows\n\n```batch\nSET GCM_MSAUTH_USEBROKER=\"true\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_MSAUTH_USEBROKER=\"false\"\n```\n\n**Also see: [credential.msauthUseBroker][credential-msauth-usebroker]**\n\n---\n\n### GCM_MSAUTH_USEDEFAULTACCOUNT _(experimental)_\n\nUse the current operating system account by default when the broker is enabled.\n\nDefaults to `false`. In certain cloud hosted environments when using a work or\nschool account, such as [Microsoft DevBox][devbox], the default is `true`.\n\nThese defaults are subject to change in the future.\n\nValue|Description\n-|-\n`true`|Use the current operating system account by default.\n`false` _(default)_|Do not assume any account to use by default.\n\n#### Windows\n\n```batch\nSET GCM_MSAUTH_USEDEFAULTACCOUNT=\"true\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_MSAUTH_USEDEFAULTACCOUNT=\"false\"\n```\n\n**Also see: [credential.msauthUseDefaultAccount][credential-msauth-usedefaultaccount]**\n\n---\n\n### GCM_AZREPOS_CREDENTIALTYPE\n\nSpecify the type of credential the Azure Repos host provider should return.\n\nDefaults to the value `pat`. In certain cloud hosted environments when using a\nwork or school account, such as [Microsoft DevBox][devbox], the default value is\n`oauth`.\n\nValue|Description\n-|-\n`pat`|Azure DevOps personal access tokens\n`oauth`|Microsoft identity OAuth tokens (AAD or MSA tokens)\n\nMore information about Azure Access tokens can be found [here][azure-access-tokens].\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_CREDENTIALTYPE=\"oauth\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_CREDENTIALTYPE=\"oauth\"\n```\n\n**Also see: [credential.azreposCredentialType][credential-azrepos-credential-type]**\n\n---\n\n### GCM_AZREPOS_MANAGEDIDENTITY\n\nUse a [Managed Identity][managed-identity] to authenticate with Azure Repos.\n\nThe value `system` will tell GCM to use the system-assigned Managed Identity.\n\nTo specify a user-assigned Managed Identity, use the format `id://{clientId}`\nwhere `{clientId}` is the client ID of the Managed Identity. Alternatively any\nGUID-like value will also be interpreted as a user-assigned Managed Identity\nclient ID.\n\nTo specify a Managed Identity associated with an Azure resource, you can use the\nformat `resource://{resourceId}` where `{resourceId}` is the ID of the resource.\n\nFor more information about managed identities, see the Azure DevOps\n[documentation][azrepos-sp-mid].\n\nValue|Description\n-|-\n`system`|System-Assigned Managed Identity\n`[guid]`|User-Assigned Managed Identity with the specified client ID\n`id://[guid]`|User-Assigned Managed Identity with the specified client ID\n`resource://[guid]`|User-Assigned Managed Identity for the associated resource\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_MANAGEDIDENTITY=\"id://11111111-1111-1111-1111-111111111111\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_MANAGEDIDENTITY=\"id://11111111-1111-1111-1111-111111111111\"\n```\n\n**Also see: [credential.azreposManagedIdentity][credential-azrepos-managedidentity]**\n\n---\n\n### GCM_AZREPOS_SERVICE_PRINCIPAL\n\nSpecify the client and tenant IDs of a [service principal][service-principal]\nto use when performing Microsoft authentication for Azure Repos.\n\nThe value of this setting should be in the format: `{tenantId}/{clientId}`.\n\nYou must also set at least one authentication mechanism if you set this value:\n\n- [GCM_AZREPOS_SP_SECRET][gcm-azrepos-sp-secret]\n- [GCM_AZREPOS_SP_CERT_THUMBPRINT][gcm-azrepos-sp-cert-thumbprint]\n\nFor more information about service principals, see the Azure DevOps\n[documentation][azrepos-sp-mid].\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_SERVICE_PRINCIPAL=\"11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_SERVICE_PRINCIPAL=\"11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222\"\n```\n\n**Also see: [credential.azreposServicePrincipal][credential-azrepos-sp]**\n\n---\n\n### GCM_AZREPOS_SP_SECRET\n\nSpecifies the client secret for the [service principal][service-principal] when\nperforming Microsoft authentication for Azure Repos with\n[GCM_AZREPOS_SERVICE_PRINCIPAL][gcm-azrepos-sp] set.\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_SP_SECRET=\"da39a3ee5e6b4b0d3255bfef95601890afd80709\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_SP_SECRET=\"da39a3ee5e6b4b0d3255bfef95601890afd80709\"\n```\n\n**Also see: [credential.azreposServicePrincipalSecret][credential-azrepos-sp-secret]**\n\n---\n\n### GCM_AZREPOS_SP_CERT_THUMBPRINT\n\nSpecifies the thumbprint of a certificate to use when authenticating as a\n[service principal][service-principal] for Azure Repos when\n[GCM_AZREPOS_SERVICE_PRINCIPAL][gcm-azrepos-sp] is set.\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_SP_CERT_THUMBPRINT=\"9b6555292e4ea21cbc2ebd23e66e2f91ebbe92dc\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_SP_CERT_THUMBPRINT=\"9b6555292e4ea21cbc2ebd23e66e2f91ebbe92dc\"\n```\n\n**Also see: [credential.azreposServicePrincipalCertificateThumbprint][credential-azrepos-sp-cert-thumbprint]**\n\n---\n\n### GCM_AZREPOS_SP_CERT_SEND_X5C\n\nWhen using a certificate for service principal authentication, this configuration\nspecifies whether the X5C claim should be should be sent to the STS. Sending the x5c\nenables application developers to achieve easy certificate rollover in Azure AD:\nthis method will send the public certificate to Azure AD along with the token request,\nso that Azure AD can use it to validate the subject name based on a trusted issuer\npolicy. This saves the application admin from the need to explicitly manage the\ncertificate rollover. For details see [https://aka.ms/msal-net-sni](https://aka.ms/msal-net-sni).\n\n#### Windows\n\n```batch\nSET GCM_AZREPOS_SP_CERT_SEND_X5C=\"true\"\n```\n\n#### macOS/Linux\n\n```bash\nexport GCM_AZREPOS_SP_CERT_SEND_X5C=\"true\"\n```\n\n**Also see: [credential.azreposServicePrincipalCertificateSendX5C][credential-azrepos-sp-cert-x5c]**\n\n---\n\n### GIT_TRACE2\n\nTurns on Trace2 Normal Format tracing - see [Git's Trace2 Normal Format\ndocumentation][trace2-normal-docs] for more details.\n\n#### Windows\n\n```batch\nSET GIT_TRACE2=%UserProfile%\\log.normal\n```\n\n#### macOS/Linux\n\n```bash\nexport GIT_TRACE2=~/log.normal\n```\n\nIf the value of `GIT_TRACE2` is a full path to a file in an existing directory,\nlogs are appended to the file.\n\nIf the value of `GIT_TRACE2` is `true` or `1`, logs are written to standard\nerror.\n\nDefaults to disabled.\n\n**Also see: [trace2.normalFormat][trace2-normal-config]**\n\n---\n\n### GIT_TRACE2_EVENT\n\nTurns on Trace2 Event Format tracing - see [Git's Trace2 Event Format\ndocumentation][trace2-event-docs] for more details.\n\n#### Windows\n\n```batch\nSET GIT_TRACE2_EVENT=%UserProfile%\\log.event\n```\n\n#### macOS/Linux\n\n```bash\nexport GIT_TRACE2_EVENT=~/log.event\n```\n\nIf the value of `GIT_TRACE2_EVENT` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `GIT_TRACE2_EVENT` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [trace2.eventFormat][trace2-event-config]**\n\n---\n\n### GIT_TRACE2_PERF\n\nTurns on Trace2 Performance Format tracing - see [Git's Trace2 Performance\nFormat documentation][trace2-performance-docs] for more details.\n\n#### Windows\n\n```batch\nSET GIT_TRACE2_PERF=%UserProfile%\\log.perf\n```\n\n#### macOS/Linux\n\n```bash\nexport GIT_TRACE2_PERF=~/log.perf\n```\n\nIf the value of `GIT_TRACE2_PERF` is a full path to a file in an existing\ndirectory, logs are appended to the file.\n\nIf the value of `GIT_TRACE2_PERF` is `true` or `1`, logs are written to\nstandard error.\n\nDefaults to disabled.\n\n**Also see: [trace2.perfFormat][trace2-performance-config]**\n\n[autodetect]: autodetect.md\n[azure-access-tokens]: azrepos-users-and-tokens.md\n[configuration]: configuration.md\n[credential-allowwindowsauth]: configuration.md#credentialallowwindowsauth\n[credential-allowunsaferemotes]: configuration.md#credentialallowunsaferemotes\n[credential-authority]: configuration.md#credentialauthority-deprecated\n[credential-autodetecttimeout]: configuration.md#credentialautodetecttimeout\n[credential-azrepos-credential-type]: configuration.md#credentialazreposcredentialtype\n[credential-azrepos-managedidentity]: configuration.md#credentialazreposmanagedidentity\n[credential-bitbucketauthmodes]: configuration.md#credentialbitbucketAuthModes\n[credential-cacheoptions]: configuration.md#credentialcacheoptions\n[credential-credentialstore]: configuration.md#credentialcredentialstore\n[credential-debug]: configuration.md#credentialdebug\n[credential-dpapi-store-path]: configuration.md#credentialdpapistorepath\n[credential-githubaccountfiltering]: configuration.md#credentialgitHubAccountFiltering\n[credential-githubauthmodes]: configuration.md#credentialgitHubAuthModes\n[credential-gitlabauthmodes]: configuration.md#credentialgitLabAuthModes\n[credential-guiprompt]: configuration.md#credentialguiprompt\n[credential-guisoftwarerendering]: configuration.md#credentialguisoftwarerendering\n[credential-httpproxy]: configuration.md#credentialhttpProxy-deprecated\n[credential-interactive]: configuration.md#credentialinteractive\n[credential-namespace]: configuration.md#credentialnamespace\n[credential-msauth-flow]: configuration.md#credentialmsauthflow\n[credential-msauth-usebroker]: configuration.md#credentialmsauthusebroker-experimental\n[credential-msauth-usedefaultaccount]: configuration.md#credentialmsauthusedefaultaccount-experimental\n[credential-plain-text-store]: configuration.md#credentialplaintextstorepath\n[credential-provider]: configuration.md#credentialprovider\n[credential-stores]: credstores.md\n[credential-trace]: configuration.md#credentialtrace\n[credential-trace-secrets]: configuration.md#credentialtracesecrets\n[credential-trace-msauth]: configuration.md#credentialtracemsauth\n[default-values]: enterprise-config.md\n[devbox]: https://azure.microsoft.com/en-us/products/dev-box\n[freedesktop-ss]: https://specifications.freedesktop.org/secret-service-spec/\n[gcm]: usage.md\n[gcm-interactive]: #gcm_interactive\n[gcm-credential-store]: #gcm_credential_store\n[gcm-dpapi-store-path]: #gcm_dpapi_store_path\n[gcm-plaintext-store-path]: #gcm_plaintext_store_path\n[gcm-msauth-usebroker]: #gcm_msauth_usebroker-experimental\n[git-cache-options]: https://git-scm.com/docs/git-credential-cache#_options\n[git-credential-cache]: https://git-scm.com/docs/git-credential-cache\n[git-httpproxy]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpproxy\n[github-emu]: https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users\n[network-http-proxy]: netconfig.md#http-proxy\n[libsecret]: https://wiki.gnome.org/Projects/Libsecret\n[managed-identity]: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview\n[migration-guide]: migration.md#gcm_authority\n[passwordstore]: https://www.passwordstore.org/\n[trace2-normal-docs]: https://git-scm.com/docs/api-trace2#_the_normal_format_target\n[trace2-normal-config]: configuration.md#trace2normalTarget\n[trace2-event-docs]: https://git-scm.com/docs/api-trace2#_the_event_format_target\n[trace2-event-config]: configuration.md#trace2eventTarget\n[trace2-performance-docs]: https://git-scm.com/docs/api-trace2#_the_performance_format_target\n[trace2-performance-config]: configuration.md#trace2perfTarget\n[windows-broker]: windows-broker.md\n[service-principal]: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals\n[azrepos-sp-mid]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity\n[gcm-azrepos-sp]: #gcm_azrepos_service_principal\n[gcm-azrepos-sp-secret]: #gcm_azrepos_sp_secret\n[gcm-azrepos-sp-cert-thumbprint]: #gcm_azrepos_sp_cert_thumbprint\n[gcm-azrepos-sp-cert-x5c]: #gcm_azrepos_sp_cert_send_x5c\n[credential-azrepos-sp]: configuration.md#credentialazreposserviceprincipal\n[credential-azrepos-sp-secret]: configuration.md#credentialazreposserviceprincipalsecret\n[credential-azrepos-sp-cert-thumbprint]: configuration.md#credentialazreposserviceprincipalcertificatethumbprint\n[credential-azrepos-sp-cert-x5c]: configuration.md#credentialazreposserviceprincipalcertificatesendx5c\n" }, { "path": "docs/faq.md", "content": "# Frequently asked questions\n\n## Authentication problems\n\n### Q: I got an error trying to push/pull/clone. What do I do now?\n\nPlease follow these steps to diagnose or resolve the problem:\n\n1. Check if you can access the remote repository in a web browser. If you\ncannot, this is probably a permission problem and you should follow up with the\nrepository administrator for access. Execute `git remote -v` from a terminal to\nshow the remote URL.\n\n1. If you are experiencing a Git authentication problem using an editor, IDE or\nother tool, try performing the same operation from the terminal. Does this still\nfail? If the operation succeeds from the terminal please include details of the\nspecific tool and version in any issue reports.\n\n1. Set the environment variable `GCM_TRACE` and run the Git operation again.\nFind instructions in the [environment doc][env-trace].\n\n1. If all else fails, create an issue [here][create-issue], making sure to\ninclude the trace log.\n\n### Q: I got an error saying unsecure HTTP is not supported\n\nTo keep your data secure, Git Credential Manager will not send credentials for\nAzure Repos, Azure DevOps Server (TFS), GitHub, and Bitbucket, over HTTP\nconnections that are not secured using TLS (HTTPS).\n\nPlease make sure your remote URLs use \"https://\" rather than \"http://\".\n\n### Q: I got an authentication error and I am behind a network proxy\n\nYou probably need to configure Git and GCM to use a proxy. Please see detailed\ninformation in the [network config doc][netconfig-http-proxy].\n\n### Q: I'm getting errors about picking a credential store on Linux\n\nOn Linux you must [select and configure a credential store][credstores], as due\nto the varied nature of distributions and installations, we cannot guarantee a\nsuitable storage solution is available.\n\n## About the project\n\n### Q: How does this project relate to [Git Credential Manager for Windows][gcm-windows] and [Git Credential Manager for Mac and Linux][gcm-linux]?\n\nGit Credential Manager for Windows (GCM Windows) is a .NET Framework-based Git\ncredential helper which runs on Windows. Likewise the Git Credential Manager for\nMac and Linux (Java GCM) is a Java-based Git credential helper that runs only on\nmacOS and Linux. Although both of these projects aim to solve the same problem\n(providing seamless multi-factor HTTPS authentication with Git), they are based\non different codebases and languages which is becoming hard to manage to ensure\nfeature parity.\n\nGit Credential Manager (GCM; this project) aims to replace both GCM Windows and\nJava GCM with a unified codebase which should be easier to maintain and enhance\nin the future.\n\n### Q: Does this mean GCM for Windows (.NET Framework-based) is deprecated?\n\nYes. Git Credential Manager for Windows (GCM Windows) is no longer receiving\nupdates and fixes. All development effort has now been directed to GCM. GCM is\navailable as an credential helper option in Git for Windows 2.28, and will be\nmade the default helper in 2.29.\n\n### Q: Does this mean the Java-based GCM for Mac/Linux is deprecated?\n\nYes. Usage of Git Credential Manager for Mac and Linux (Java GCM) should be\nreplaced with GCM or SSH keys. If you wish to install GCM on macOS or Linux,\nplease follow the [download and installation instructions][download-and-install].\n\n### Q: I want to use SSH\n\nGCM is only useful for HTTP(S)-based remotes. Git supports SSH out-of-the box so\nyou shouldn't need to install anything else.\n\nTo use SSH please follow the below links:\n\n- [Azure DevOps][azure-ssh]\n- [GitHub][github-ssh]\n- [Bitbucket][bitbucket-ssh]\n\n### Q: Are HTTP(S) remotes preferred over SSH?\n\nNo, neither are \"preferred\". SSH isn't going away, and is supported \"natively\"\nin Git.\n\n### Q: Why did you not just port the existing GCM Windows codebase from .NET Framework to .NET Core?\n\nGCM Windows was not designed with a cross-platform architecture.\n\n### What level of support does GCM have?\n\nSupport will be best-effort. We would really appreciate your feedback to make\nthis a great experience across each platform we support.\n\n### Q: Why does GCM not support operating system/distribution 'X', or Git hosting provider 'Y'?\n\nThe likely answer is we haven't gotten around to that yet! 🙂\n\nWe are working on ensuring support for the Windows, macOS, and Ubuntu operating\nsystem, as well as the following Git hosting providers: Azure Repos, Azure\nDevOps Server (TFS), GitHub, and Bitbucket.\n\nWe are happy to accept proposals and/or contributions to enable GCM to run on\nother platforms and Git host providers. Thank you!\n\n## Technical\n\n### Why is the `credential.useHttpPath` setting required for `dev.azure.com`?\n\nDue to the design of Git and credential helpers such as GCM, we need this\nsetting to make Git use the full remote URL (including the path component) when\ncommunicating with GCM. The new `dev.azure.com` format of Azure DevOps URLs\nmeans the account name is now part of the path component (for example:\n`https://dev.azure.com/contoso/...`). The Azure DevOps account name is required\nin order to resolve the correct authority for authentication (which Azure AD\ntenant backs this account, or if it is backed by Microsoft personal accounts).\n\nIn the older GCM for Windows product, the solution to the same problem was a\n\"hack\". GCM for Windows would walk the process tree looking for the\n`git-remote-https.exe` process, and attempt to read/parse the process\nenvironment block looking for the command line arguments (that contained the\nfull remote URL). This is fragile and not a cross-platform solution, hence the\nneed for the `credential.useHttpPath` setting with GCM.\n\n### Why does GCM take so long at startup the first time?\n\nGCM will [autodetect][autodetect] what kind of Git host it's talking to. GitHub,\nBitbucket, and Azure DevOps each have their own form(s) of authentication, plus\nthere's a \"generic\" username and password option.\n\nFor the hosted versions of these services, GCM can guess from the URL which\nservice to use. But for on-premises versions which would have unique URLs, GCM\nwill probe with a network call. GCM caches the results of the probe, so it\nshould be faster on the second and later invocations.\n\nIf you know which provider you're talking to and want to avoid the probe, that's\npossible. You can explicitly tell GCM which provider to use for a URL\n\"example.com\" like this:\n\nProvider|Command\n-|-\nGitHub|`git config --global credential.https://example.com.provider github`\nBitbucket|`git config --global credential.https://example.com.provider bitbucket`\nAzure DevOps|`git config --global credential.https://example.com.provider azure-repos`\nGeneric|`git config --global credential.https://example.com.provider generic`\n\n### How do I fix \"Could not create SSL/TLS secure channel\" errors on Windows 7?\n\nThis likely indicates that you don't have newer TLS versions available. Please\n[follow Microsoft's guide][enable-windows-ssh] for enabling TLS 1.1 and 1.2 on\nyour machine, specifically the **SChannel** instructions. You'll need to be on\nat least Windows 7 SP1, and in the end you should have a `TLS 1.2` key with\n`DisabledByDefault` set to `0`. You can also read\n[more from Microsoft][windows-server-tls] on this change.\n\n### How do I use GCM with Windows Subsystem for Linux (WSL)?\n\nFollow the instructions in [our WSL guide][wsl] carefully. Especially note the\nneed to run `git config --global credential.https://dev.azure.com.useHttpPath true`\n_within_ WSL if you're using Azure DevOps.\n\n### Does GCM work with multiple users? If so, how?\n\nThat's a fairly complicated question to answer, but in short, yes. See\n[our document on multiple users][multiple-users] for details.\n\n### How can I disable GUI dialogs and prompts?\n\nThere are various environment variables and configuration options available to\ncustomize how GCM will prompt you (or not) for input. Please see the following:\n\n- [`GCM_INTERACTIVE`][env-interactive] / [`credential.interactive`][config-interactive]\n- [`GCM_GUI_PROMPT`][env-gui-prompt] / [`credential.guiPrompt`][config-gui-prompt]\n- [`GIT_TERMINAL_PROMPT`][git-term-prompt] (note this is a _Git setting_ that\nwill affect Git as well as GCM)\n\n### How can I extend GUI prompts/integrate prompts with my application?\n\nApplication developers who use Git - think Visual Studio, GitKraken, etc. - may\nwant to replace the GCM default UI with prompts styled to look like their\napplication. This isn't complicated (though it is a bit of work).\n\nYou can replace the GUI prompts of the Bitbucket and GitHub host providers\nspecifically by using the `credential.gitHubHelper`/`credential.bitbucketHelper`\nsettings or `GCM_GITHUB_HELPER`/`GCM_BITBUCKET_HELPER` environment variables.\n\nSet these variables to the path of an external helper executable that responds\nto the requests as the bundled UI helpers do. See the current `--help` documents\nfor the bundled UI helpers (`GitHub.UI`/`Atlassian.Bitbucket.UI`) for more\ninformation.\n\nYou may also set these variables to the empty string `\"\"` to force terminal/\ntext-based prompts instead.\n\n### How do I revoke consent for GCM for GitHub.com?\n\nIn your GitHub user settings, navigate to\n[Integrations > Applications > Authorized OAuth Apps > Git Credential Manager][github-connected-apps]\nand pick \"Revoke access\".\n\n![Revoke GCM OAuth app access][github-oauthapp-revoke]\n\nAfter revoking access, any tokens created by GCM will be invalidated and can no\nlonger be used to access your repositories. The next time GCM attempts to access\nGitHub.com you will be prompted to consent again.\n\n### I used the install from source script to install GCM on my Linux distribution. Now how can I uninstall GCM and its dependencies?\n\nPlease see full instructions [here][linux-uninstall-from-src].\n\n### How do I revoke access for a GitLab OAuth application?\n\nThere are some scenarios (e.g. updated scopes) for which you will need to\nmanually revoke and re-authorize access for a GitLab OAuth application. You can\ndo so by:\n\n1. Navigating to [the **Applications** page within your **User Settings**][gitlab-apps].\n2. Scrolling to **Authorized applications**.\n3. Clicking the **Revoke** button next to the name of the application for which\nyou would like to revoke access (Git Credential Manager is used here for\ndemonstration purposes).\n\n ![Button to revoke GitLab OAuth Application access][gitlab-oauthapp-revoke]\n4. Waiting for a notification stating **The application was revoked access**.\n\n ![Notifaction of successful revocation][gitlab-oauthapp-revoked]\n5. Re-authorizing the application with the new scope (GCM should automatically\ninitiate this flow for you next time access is requested).\n\n### Q: What do the `configure` and `unconfigure` commands do?\n\n#### `configure`\n\nThe `configure` command will set up Git to use GCM exclusively as the credential\nhelper. The `configure` command is automatically called by the installers for\nWindows and macOS, but you can also run it manually.\n\nIt will also set Git to provide the full remote URL (including path) to\ncredential helpers for Azure Repos remotes using the `dev.azure.com` URL format.\nThis is required in order to be to able to correctly identify the correct\nauthority for that Azure DevOps organization.\n\nSpecifically, the `configure` command will modify your user Git configuration to\ninclude the following lines:\n\n```ini\n[credential]\n helper =\n helper = \n[credential \"https://dev.azure.com\"]\n useHttpPath = true\n```\n\n..where `` is the absolute path to the GCM executable.\n\nThe empty `helper =` line makes sure that existing credential helpers that may\nbe set in the system Git configuration are not used. For more details see the\n[credential.helper][helper-config-docs].\n\nIf you pass the `--system` option, the `configure` command will instead modify\nthe system Git configuration. This is useful if you want to set up GCM for all\nusers on a machine.\n\n#### `unconfigure`\n\nThis command essentially undoes what the `configure` command does. It will check\nyour Git configuration for the lines added by the `configure` command and remove\nthem. The `unconfigure` command is run by the uninstaller for Windows and the\nuninstall script on macOS.\n\nOn Windows, if run with the `--system` option, the `unconfigure` command will\nalso ensure that the `credential.helper` setting in the system Git configuration\nis not removed and is left as `manager`, the default set by Git for Windows.\n\n[autodetect]: autodetect.md\n[azure-ssh]: https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops\n[bitbucket-ssh]: https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html\n[config-gui-prompt]: configuration.md#credentialguiprompt\n[config-interactive]: configuration.md#credentialinteractive\n[create-issue]: https://github.com/git-ecosystem/git-credential-manager/issues/create\n[credstores]: credstores.md\n[download-and-install]: ../README.md#download-and-install\n[enable-windows-ssh]: https://support.microsoft.com/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392\n[env-gui-prompt]: environment.md#GCM_GUI_PROMPT\n[env-interactive]: environment.md#GCM_INTERACTIVE\n[env-trace]: environment.md#GCM_TRACE\n[gcm-linux]: https://github.com/Microsoft/Git-Credential-Manager-for-Mac-and-Linux\n[gcm-windows]: https://github.com/Microsoft/Git-Credential-Manager-for-Windows\n[git-term-prompt]: https://git-scm.com/docs/git#Documentation/git.txt-codeGITTERMINALPROMPTcode\n[github-connected-apps]: https://github.com/settings/connections/applications/0120e057bd645470c1ed\n[github-oauthapp-revoke]: img/github-oauthapp-revoke.png\n[github-ssh]: https://help.github.com/en/articles/connecting-to-github-with-ssh\n[gitlab-apps]: https://gitlab.com/-/profile/applications\n[gitlab-oauthapp-revoke]: ./img/gitlab-oauthapp-revoke.png\n[gitlab-oauthapp-revoked]: ./img/gitlab-oauthapp-revoked.png\n[helper-config-docs]: https://git-scm.com/docs/gitcredentials#Documentation/gitcredentials.txt-helper\n[multiple-users]: multiple-users.md\n[netconfig-http-proxy]: netconfig.md#http-proxy\n[linux-uninstall-from-src]: ./linux-fromsrc-uninstall.md\n[windows-server-tls]: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn786418(v=ws.11)#tls-12\n[wsl]: wsl.md\n" }, { "path": "docs/generic-oauth.md", "content": "# Generic Host Provider OAuth\n\nMany Git hosts use the popular standard OAuth2 or OpenID Connect (OIDC)\nauthentication mechanisms to secure repositories they host.\nGit Credential Manager supports any generic OAuth2-based Git host by simply\nsetting some configuration.\n\n## Registering an OAuth application\n\nIn order to use GCM with a Git host that supports OAuth you must first have\nregistered an OAuth application with your host. The instructions on how to do\nthis can be found with your Git host provider's documentation.\n\nWhen registering a new application, you should make sure to set an HTTP-based\nredirect URL that points to `localhost`; for example:\n\n```text\nhttp://localhost\nhttp://localhost:\nhttp://127.0.0.1\nhttp://127.0.0.1:\n```\n\nNote that you cannot use an HTTPS redirect URL. GCM does not require a specific\nport number be used; if your Git host requires you to specify a port number in\nthe redirect URL then GCM will use that. Otherwise an available port will be\nselected at the point authentication starts.\n\nYou must ensure that all scopes required to read and write to Git repositories\nhave been granted for the application or else credentials that are generated\nwill cause errors when pushing or fetching using Git.\n\nAs part of the registration process you should also be given a Client ID and,\noptionally, a Client Secret. You will need both of these to configure GCM.\n\n## Configure GCM\n\nIn order to configure GCM to use OAuth with your Git host you need to set the\nfollowing values in your Git configuration:\n\n- Client ID\n- Client Secret (optional)\n- Redirect URL (optional, defaults to `http://127.0.0.1`)\n- Scopes (optional)\n- OAuth Endpoints\n - Authorization Endpoint\n - Token Endpoint\n - Device Code Authorization Endpoint (optional)\n\nOAuth endpoints can be found by consulting your Git host's OAuth app development\ndocumentation. The URLs can be either absolute or relative to the host name;\nfor example: `https://example.com/oauth/authorize` or `/oauth/authorize`.\n\nIn order to set these values, you can run the following commands, where ``\nis the hostname of your Git host:\n\n```shell\ngit config --global credential..oauthClientId \ngit config --global credential..oauthClientSecret \ngit config --global credential..oauthRedirectUri \ngit config --global credential..oauthAuthorizeEndpoint \ngit config --global credential..oauthTokenEndpoint \ngit config --global credential..oauthScopes \ngit config --global credential..oauthDeviceEndpoint \n```\n\n**Example commands:**\n\n- `git config --global credential.https://example.com.oauthClientId C33F2751FB76`\n\n- `git config --global credential.https://example.com.oauthScopes \"code:write profile:read\"`\n\n**Example Git configuration**\n\n```ini\n[credential \"https://example.com\"]\n oauthClientId = 9d886e36-5771-4f2b-8c8b-420c68ad5baa\n oauthClientSecret = 4BC5BD4704EAE28FD832\n oauthRedirectUri = \"http://127.0.0.1\"\n oauthAuthorizeEndpoint = \"/login/oauth/authorize\"\n oauthTokenEndpoint = \"/login/oauth/token\"\n oauthDeviceEndpoint = \"/login/oauth/device\"\n oauthScopes = \"code:write profile:read\"\n oauthDefaultUserName = \"OAUTH\"\n oauthUseClientAuthHeader = false\n```\n\n### Additional configuration\n\nDepending on the specific implementation of OAuth with your Git host you may\nalso need to specify additional behavior.\n\n#### Token user name\n\nIf your Git host requires that you specify a username to use with OAuth tokens\nyou can either include the username in the Git remote URL, or specify a default\noption via Git configuration.\n\nExample Git remote with username: `https://username@example.com/repo.git`.\nIn order to use special characters you need to URL encode the values; for\nexample `@` becomes `%40`.\n\nBy default GCM uses the value `OAUTH-USER` unless specified in the remote URL,\nor overridden using the `credential..oauthDefaultUserName` configuration.\n\n#### Include client authentication in headers\n\nIf your Git host's OAuth implementation has specific requirements about whether\nthe client ID and secret should or should not be included in an `Authorization`\nheader during OAuth requests, you can control this using the following setting:\n\n```shell\ngit config --global credential..oauthUseClientAuthHeader \n```\n\nThe default behavior is to include these values; i.e., `true`.\n" }, { "path": "docs/github-apideprecation.md", "content": "# GitHub Authentication Deprecation\n\n## What's going on?\n\nGitHub now [requires token-based authentication][token-auth] to\ncall their APIs, and in the future, use Git itself.\n\nThis means Git credential helpers such as [Git Credential Manager (GCM) for\nWindows][gcm-windows], and old versions of [GCM][gcm] that offer\nusername/password flows **will not be able to create new access tokens** for\naccessing Git repositories.\n\nIf you already have tokens generated by Git credential helpers like GCM for\nWindows, they will continue to work until they expire or are revoked/deleted.\n\n## What should I do now?\n\n### Windows command-line users\n\nThe best thing to do right now is upgrade to the latest Git for Windows (at\nleast version 2.29), which includes a version of Git Credential Manager that\nuses supported OAuth token-based authentication.\n\n[Download the latest Git for Windows ⬇️][git-windows]\n\n### Visual Studio users\n\nPlease update to the latest supported release of Visual Studio, that includes\nGCM and support for OAuth token-based authentication.\n\n- [Visual Studio 2019 ⬇️][vs-2019]\n- [Visual Studio 2017 ⬇️][vs-2017]\n\n### SSH, macOS, and Linux users\n\nIf you are using SSH this change does **not** affect you.\n\nIf you are using an older version of Git Credential Manager (before\n2.0.124-beta) please upgrade to the latest version following [these\ninstructions][gcm-install].\n\n## What if I cannot upgrade Git for Windows?\n\nIf you are unable to upgrade Git for Windows, you can manually install Git\nCredential Manager as a standalone install. This will override the older,\nGCM for Windows bundled with the Git for Windows installation.\n\n[Download Git Credential Manager standalone ⬇️][gcm-latest]\n\n## What if I cannot use Git Credential Manager?\n\nIf you are unable to use Git Credential Manager due to a bug or\ncompatibility issue we'd [like to know why][gcm-new-issue]!\n\n## Help! I cannot make any changes to my Windows machine without an Administrator\n\nIf you do not have permission to change your installation (for example in a\ncorporate environment) you can use the per-user installer. Check out the [latest\nrelease][gcm-latest] and download the `gcmcoreuser-win-*.exe`\nexecutable.\n\n### Help! I still cannot or don't want to install anything\n\nThere is a workaround which should work and doesn't require installing anything.\n\n1. Tell your system administrator they should start planning to upgrade the\n installed version of Git for Windows to at least 2.29! 😁\n\n1. [Create a new personal access token][github-pat] (see official\n [documentation][github-pat-docs])\n\n1. Enter a name (\"note\") for the token and ensure the `repo`, `gist`, and\n `workflow` scopes are selected:\n ![image][github-pat-note-image]\n ...\n ![image][github-pat-repo-scope-image]\n ...\n ![image][github-pat-gist-scope-image]\n ...\n ![image][github-pat-workflow-scope-image]\n\n1. Click \"Generate Token\"\n\n ![image][github-generate-pat-image]\n\n1. **[IMPORTANT]** Keep the resulting page open as this contains your new token\n (this will only be displayed once!)\n\n ![image][github-display-pat-image]\n\n1. Save the generated PAT in the Windows Credential Manager:\n\n 1. If you prefer to use the command-line, open a command prompt (cmd.exe) and\n type the following:\n\n ```bash\n cmdkey /generic:git:https://github.com /user:PersonalAccessToken /pass\n ```\n\n You will be prompted to enter a password – copy the newly generated PAT in\n step 4 and paste it here, and press the `Enter` key\n\n ![image][windows-cli-save-pat-image]\n\n 1. If you do not wish to use the command-line, [open the Credential Manager\n via Control Panel][windows-credential-manager]\n and select the \"Windows Credentials\" tab.\n\n ![image][windows-gui-credentials-image]\n\n Click \"Add a generic credential\", and enter the following details:\n\n - Internet or network address: `git:https://github.com`\n - Username: `PersonalAccessToken`\n - Password: _(copy and paste the PAT generated in step 4 here)_\n\n ![image][windows-gui-add-pat-image]\n\n## What about GitHub Enterprise Server (GHES)?\n\nAs mentioned in [the blog post][github-token-authentication-requirements],\nthe new token-based authentication requirements **DO NOT** apply to GHES:\n\n> We have not announced any changes to GitHub Enterprise Server, which remains\n> unaffected at this time.\n\n[token-auth]: https://github.blog/2020-07-30-token-authentication-requirements-for-api-and-git-operations/\n[gcm]: https://aka.ms/gcm\n[gcm-install]: ../README.md#download-and-install\n[gcm-latest]: https://aka.ms/gcm/latest\n[gcm-new-issue]: https://github.com/git-ecosystem/git-credential-manager/issues/new/choose\n[gcm-windows]: https://github.com/microsoft/Git-Credential-Manager-for-Windows\n[git-windows]: https://git-scm.com/download/win\n[github-display-pat-image]: img/github-display-pat.png\n[github-generate-pat-image]: img/github-generate-pat.png\n[github-pat]: https://github.com/settings/tokens/new?scopes=repo,gist,workflow\n[github-pat-docs]: https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token\n[github-pat-gist-scope-image]: img/github-pat-gist-scope.png\n[github-pat-note-image]: img/github-pat-note.png\n[github-pat-repo-scope-image]: img/github-pat-repo-scope.png\n[github-pat-workflow-scope-image]: img/github-pat-workflow-scope.png\n[github-token-authentication-requirements]: https://github.blog/2020-07-30-token-authentication-requirements-for-api-and-git-operations/\n[windows-cli-save-pat-image]: img/windows-cli-save-pat.png\n[vs-2019]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2019\n[vs-2017]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2017\n[windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0\n[windows-gui-add-pat-image]: img/windows-gui-add-pat.png\n[windows-gui-credentials-image]: img/windows-gui-credentials.png\n" }, { "path": "docs/gitlab.md", "content": "# GitLab support\n\nGit Credential Manager supports [gitlab.com][gitlab] out the box.\n\n## Using on another instance\n\nTo use on another instance, eg. `https://gitlab.example.com` requires setup and\nconfiguration:\n\n1. [Create an OAuth application][gitlab-oauth]. This can be at the user, group\nor instance level. Specify a name and use a redirect URI of `http://127.0.0.1/`.\n_Unselect_ the 'Confidential' option. Set the 'read_repository' and\n'write_repository' scopes.\n1. Copy the application ID and configure\n`git config --global credential.https://gitlab.example.com.gitLabDevClientId `\n1. Copy the application secret and configure\n`git config --global credential.https://gitlab.example.com.gitLabDevClientSecret\n`\n1. Optional if you want to force browser auth:\n`git config --global credential.https://gitlab.example.com.gitLabAuthModes browser`\n1. For good measure, configure\n`git config --global credential.https://gitlab.example.com.provider gitlab`.\nThis may be necessary to recognise the domain as a GitLab instance.\n1. Verify the config is as expected\n`git config --global --get-urlmatch credential https://gitlab.example.com`\n\n### Clearing config\n\n```console\ngit config --global --unset-all credential.https://gitlab.example.com.gitLabDevClientId\ngit config --global --unset-all credential.https://gitlab.example.com.gitLabDevClientSecret\ngit config --global --unset-all credential.https://gitlab.example.com.provider\n```\n\n### Config for popular instances\n\nFor convenience, here are the config commands for several popular GitLab\ninstances, provided by community member [hickford](https://github.com/hickford/):\n\n```console\n# https://gitlab.freedesktop.org/\ngit config --global credential.https://gitlab.freedesktop.org.gitLabDevClientId 6503d8c5a27187628440d44e0352833a2b49bce540c546c22a3378c8f5b74d45\ngit config --global credential.https://gitlab.freedesktop.org.gitLabDevClientSecret 2ae9343a034ff1baadaef1e7ce3197776b00746a02ddf0323bb34aca8bff6dc1\n# https://gitlab.gnome.org/\ngit config --global credential.https://gitlab.gnome.org.gitLabDevClientId adf21361d32eddc87bf6baf8366f242dfe07a7d4335b46e8e101303364ccc470\ngit config --global credential.https://gitlab.gnome.org.gitLabDevClientSecret cdca4678f64e5b0be9febc0d5e7aab0d81d27696d7adb1cf8022ccefd0a58fc0\n# https://invent.kde.org/\ngit config --global credential.https://invent.kde.org.gitLabDevClientId cd7cb4342c7cd83d8c2fcc22c87320f88d0bde14984432ffca07ee24d0bf0699\ngit config --global credential.https://invent.kde.org.gitLabDevClientSecret 9cc8440b280c792ac429b3615ae1c8e0702e6b2479056f899d314f05afd94211\n# https://salsa.debian.org/\ngit config --global credential.https://salsa.debian.org.gitLabDevClientId 213f5fd32c6a14a0328048c0a77cc12c19138cc165ab957fb83d0add74656f89\ngit config --global credential.https://salsa.debian.org.gitLabDevClientSecret 3616b974b59451ecf553f951cb7b8e6e3c91c6d84dd3247dcb0183dac93c2a26\n# https://gitlab.haskell.org/\ngit config --global credential.https://gitlab.haskell.org.gitLabDevClientId 57de5eaab72b3dc447fca8c19cea39527a08e82da5377c2d10a8ebb30b08fa5f\ngit config --global credential.https://gitlab.haskell.org.gitLabDevClientSecret 5170a480da8fb7341e0daac94223d4fff549c702efb2f8873d950bb2b88e434f\n# https://code.videolan.org/\ngit config --global credential.https://code.videolan.org.gitLabDevClientId f35c379241cc20bf9dffecb47990491b62757db4fb96080cddf2461eacb40375\ngit config --global credential.https://code.videolan.org.gitLabDevClientSecret 631558ec973c5ef65b78db9f41103f8247dc68d979c86f051c0fe4389e1995e8\n```\n\nSee also [issue #677](https://github.com/git-ecosystem/git-credential-manager/issues/677).\n\n## Preferences\n\n```console\nSelect an authentication method for 'https://gitlab.com/':\n 1. Web browser (default)\n 2. Personal access token\n 3. Username/password\noption (enter for default):\n```\n\nIf you have a preferred authentication mode, you can specify\n[credential.gitLabAuthModes][config-gitlab-auth-modes]:\n\n```console\ngit config --global credential.gitLabAuthModes browser\n```\n\n## Caveats\n\nImproved support requires changes in GitLab. Please vote for these issues if\nthey affect you:\n\n1. No support for OAuth device authorization (necessary for machines without web\nbrowser): [GitLab issue 332682][gitlab-issue-332682]\n1. Preconfigure Git Credential Manager as instance-wide OAuth application:\n[GitLab issue 374172](gitlab-issue-374172)\n1. Username/password authentication is suggested even if disabled on server:\n[GitLab issue 349463][gitlab-issue-349463]\n\n[config-gitlab-auth-modes]: configuration.md#credential.gitLabAuthModes\n[gitlab]: https://gitlab.com\n[gitlab-issue-332682]: https://gitlab.com/gitlab-org/gitlab/-/issues/332682\n[gitlab-issue-374172]: https://gitlab.com/gitlab-org/gitlab/-/issues/374172\n[gitlab-issue-349463]: https://gitlab.com/gitlab-org/gitlab/-/issues/349463\n[gitlab-oauth]: https://docs.gitlab.com/ee/integration/oauth_provider.html\n" }, { "path": "docs/hostprovider.md", "content": "# Git Credential Manager Host Provider\n\n## Abstract\n\nGit Credential Manger, the cross-platform and cross-host Git credential\nhelper, can be extended to support any Git hosting service allowing seamless\nauthentication to secured Git repositories by implementing and registering a\n\"host provider\".\n\n## 1. Introduction\n\nGit Credential Manager (GCM) is a host and platform agnostic Git\ncredential helper application. Support for authenticating to any Git hosting\nservice can be added to GCM by creating a custom \"host provider\" and\nregistering it within the product. Host providers can be submitted via a pull\nrequest on [the Git Credential Manager repository on GitHub][gcm].\n\nThis document outlines the required and expected behaviour of a host provider,\nand what is required to implement and register one.\n\n### 1.1. Notational Conventions\n\nThe key words \"MUST\", \"MUST NOT\", \"REQUIRED\", \"SHALL\", \"SHALL NOT\",\n\"SHOULD\", \"SHOULD NOT\", \"RECOMMENDED\", \"MAY\", and \"OPTIONAL\" in this\nspecification are to be interpreted as described in\n[[RFC2119][rfc-2119]].\n\n### 1.2. Abbreviations\n\nThroughout this document you may see multiple abbreviations of product names and\nsecurity or credential objects.\n\n\"Git Credential Manager\" is abbreviated to \"GCM\". \"Git Credential\nManager for Windows\" is abbreviated to \"GCM for Windows\" or \"GCM Windows\".\n\"Git Credential Manager for Mac & Linux\" is abbreviated to \"GCM for\nMac/Linux\" or \"GCM Mac/Linux\".\n\nOAuth2 [[RFC6749][rfc-6749]] \"access tokens\" are\nabbreviated to \"ATs\" and \"refresh tokens\" to \"RTs\". \"Personal Access Tokens\" are\nabbreviated to \"PATs\".\n\n## 2. Implementation\n\nWriting and adding a host provider to GCM requires two main actions:\nimplementing the `IHostProvider` interface, and registering an instance of the\nprovider with the application via the host provider registry.\n\nHost providers MUST implement the `IHostProvider` interface. They can choose to\ndirectly implement the interface they MAY derive from the `HostProvider`\nabstract class (which itself implements the `IHostProvider` interface) - see\n[2.6][hostprovider-base-class].\n\nImplementors MUST implement all interface properties and abstract methods.\n\nThe `Id` and `Name` properties MUST be implemented and MUST NOT return default\nor empty values.\n\nThe `Id` field MUST be unique over the set of all providers, or\nelse an error will be thrown at registration time. The `Id` field MAY be a\nunique random string of characters and digits such as a UUID, but it is\nRECOMMENDED to use a human-readable value consisting of letter characters in the\nrange \\[a-z\\] only.\n\nThe `Name` property MUST be a human readable string and MUST identify the Git\nhosting service this provider supports.\n\nThe `SupportedAuthorityIds` property MUST return an instance of an object and\nNOT a `null` reference. Populating this collection with values is OPTIONAL but\nhighly RECOMMENDED. You should return a set of stable identifiers of all\nauthorities that the provider supports authentication against.\n\n### 2.1. Registration\n\nHost providers must provide an instance of their `IHostProvider` type to the\nGCM application host provider registry to be considered for handling\nrequests.\n\nThe main GCM `Application` object has one principal registry which you can\nregister providers with by calling the `RegisterProvider` method.\n\n#### 2.1.2. Ordering\n\nThe default host provider registry in GCM has multiple priority levels that\nhost providers can be registered at: High, Normal, and Low.\n\nFor each priority level (starting with High, then Normal, then Low), the\nregistry will call each host provider in the order they were registered in,\nunless the user has overridden the provider selection process.\n\nThere are no rules or restrictions on the ordering of host providers, except\nthat the `GenericHostProvider` MUST be registered last and at the Low priority.\nThe generic provider is a catch-all provider implementation that will handle any\nrequest in a standard way.\n\n### 2.2. Handling Requests\n\nThe `IsSupported(InputArguments)` method will be called on all registered host\nproviders in-turn on the invocation of a `get`, `store`, or `erase` request. The\nfirst host provider to return `true` will be called upon to handle the specific\nrequest. If the user has overridden the host provider selection process, a\nspecific host provider may be selected instead, and the\n`IsSupported(InputArguments)` method will NOT be called.\n\nThis method MUST return `true` if and only if the provider understands the\nrequest and can serve or handle the request. If the provider does not know how\nto handle the request it MUST return `false` instead.\n\nIf no host provider returns `true` to a call to the `IsSupported(InputArguments)`\nmethod for a each host provider priority level, then a HTTP HEAD request will be\nmade to the remote URL and each host provider will be be called via the\n`IsSupported(HttpResponseMessage)` method. A host provider SHOULD use this call\nto check for recognised on-premises instances (for example, by inspecting\nresponse headers) and return `true` if it wishes to be called upon to handle the\ncredential request, otherwise it MUST return `false`.\n\nHost providers SHOULD NOT make further network calls if possible during any of\nthe `IsSupported` method overloads to avoid degrading the performance of the\noverall application.\n\n#### 2.2.1. Rejecting Requests\n\nThe `IsSupported` methods MUST return `true` if the host provider would like to\ncancel the authentication operation based on the current context or input.\nFor example, if provider requires a secure protocol but the requested protocol\nfor a supported hostname is `http` and not `https`.\n\nHost providers MUST instead cancel the request from the `GetCredentialAsync`\nmethod by throwing an `Exception`. Implementors MUST provide detailed\ninformation regarding the reason why the authentication cannot continue, for\nexample \"HTTP is not secure, please use HTTPS\".\n\n### 2.3. Retrieving Credentials\n\nThe `GetCredentialAsync` method will be called when a `get` request is made.\nThe method MUST return an instance of an `ICredential` capable of fulfilling the\nspecific access request. The argument passed to `GetCredentialAsync` contains\nproperties indicating the required `protocol` and `host` for this request. The\n`username` and `path` properties are OPTIONAL, however if they are present, they\nMUST be considered and used to direct the authentication.\n\nThe host provider MAY attempt to locate any existing credential, stored by the\n`StoreCredentialAsync` method, before resorting to the creation a new one.\n\nThe host provider MAY choose to check if a stored credential is still valid\nby inspecting any stored metadata associated with the value. A host provider MAY\nalso choose to further validate a retrieved stored credential by making a web\nrequest. However, it is NOT RECOMMENDED to make any request that is known to be\nslow or that typically produces inconclusive validation results.\n\nIf a provider chooses to make a validation web request and that request fails or\nis inconclusive, it SHOULD assume the credential is still valid and return it\nanyway, letting Git (the caller) attempt to use it and validate it itself.\n\nThe returned `ICredential` MAY leave both the username and password values as\nthe empty string or `null`. This signals to Git (or rather cURL) that it should\nnegotiate the authentication mechanism with the remote itself. This is typically\nused for Windows Integrated Authentication.\n\n#### 2.3.1 Authentication Prompts\n\nWhen it is not possible to locate an existing credential suitable for the\ncurrent request, a host provider SHOULD prompt the user to complete an\nauthentication flow.\n\nThe method, modes, and interactions for performing authentication will vary\nwidely between Git hosting services and their supported authentication\nauthorities. A host provider SHOULD attempt to detect the best authentication\nexperience given the current environment or context, and select that one to\nattempt first.\n\nHost providers are RECOMMENDED to attempt authentication mechanisms that do not\nrequire user interaction if possible. If there are multiple authentication\nmechanisms that could be equally considered \"best\" they MAY prompt the user\nto make a selection. Host providers MAY wish to remember such a selection for\nfuture use, however they MUST make it clear how to clear this stored selection\nto the user.\n\nIf interaction is required to complete authentication a host provider MUST first\ncheck if interaction has been disabled (`ISettings.IsInteractionAllowed`), and\nan exception MUST be thrown if interaction has been disallowed.\n\nAuthentication prompts that display a graphical user interface such as a window\nare MUST be preferred when an interactive \"desktop\" session is available.\n\nIf an authentication prompt is required when an interactive session is not\navailable and a terminal/TTY is attached then a provider MUST first check if\nterminal prompts are enabled (`ISettings.IsTerminalPromptsEnabled`), and an\nexception MUST be thrown if interaction has been disallowed.\n\n### 2.4. Storing Credentials\n\nHost providers MAY store credentials at various stages of a typical\nauthentication flow, or when explicitly requested to do so in a call to\n`StoreCredentialAsync`.\n\nProviders SHOULD use the credential store (exposed as `ICredentialStore`) to\npersist secret values and credential entities such as passwords, PATs and OAuth\ntokens.\n\nThe typical Git credential helper call pattern is one call to `get`, followed by\neither a `store` request in case of a HTTP 200 (OK) response, or `erase` in case\nof HTTP 401 (Unauthorized) response. In some cases there is additional context\nthat is present as part of the `get` request or during the generation of a new\ncredential that is not present during the subsequent call to `store` (or\n`erase`). In these cases providers MAY store the credential during the `get`\nrather than, or as well as during the `store`.\n\nHost providers MAY store multiple credentials or tokens in the same request if\nit is required. One example where multiple credential storage is needed is with\nOAuth2 access tokens (AT) and refresh tokens (RT). Both the AT and RT SHOULD be\nstored in the same location using the credential store with complementary\ncredential service names.\n\n### 2.5. Erasing Credentials\n\nIf host providers have stored credentials in the credential store, they MUST\nrespond to requests to erase them in calls to `EraseCredentialAsync`.\n\nIf a host provider cannot locate a credential to erase it MUST NOT raise an\nerror and MUST exit successfully. A warning message MAY be emitted to the\ntracing system.\n\nHost providers MUST NOT perform their own repeated validation of credentials\nfor the purposes of ignoring the request to erase them. The ultimate authority\non the validity of a credential is the caller (Git).\n\nProviders MAY validate any additional or ancillary credentials (such as OAuth\nRTs) are still valid when a request to erase the primary credential (such as an\nOAuth AT) is made, and choose not to delete those additional credentials. The\nprimary credential MUST still always be erased in all cases.\n\n### 2.6 `HostProvider` base class\n\nThe `HostProvider` abstract base class is provided for the convenience of host\nprovider implementors. This base class implements most required methods of the\n`IHostProvider` interface with common credential recall and storage behaviour.\n\nThe `GetCredentialAsync`, `StoreCredentialAsync`, and `EraseCredentialAsync`\nmethods are implemented as `virtual` meaning they MAY be overridden by derived\nclasses to customise the behaviour of those operations. It is NOT RECOMMENDED\nto derive from the `HostProvider` base class if the implementor must override\nmost of the methods as implemented - implementors SHOULD implement the\n`IHostProvider` interface directly instead.\n\nImplementors that choose to derive from this base class MUST implement all\nabstract methods and properties. The primary abstract method to implement\nis `GenerateCredentialAsync`.\n\nThere is also an additional `virtual` method named `GetServiceName` that is used\nby the default implementations of the `Get|Store|EraseCredentialAsync` methods\nto locate and store credentials.\n\n#### 2.6.1 `GetServiceName`\n\nThe `GetServiceName` virtual method, if overriden, MUST return a string that\nidentifies the service/provider for this request, and is used for storing\ncredentials. The value returned MUST be stable - i.e, it MUST return the same\nvalue given the same or equivalent input arguments.\n\nBy default this method returns the full remote URI, without a trailing slash,\nincluding protocol/scheme, hostname, and path if present in the input arguments.\nAny username in the input arguments is never included in the URI.\n\n#### 2.6.2 `GenerateCredentialAsync`\n\nThe `GenerateCredentialAsync` method will be called if an existing credential\nwith a matching service (from `GetServiceName`) and account is not found in the\ncredential store.\n\nThis method MUST return a freshly created/generated credential and not any\nexisting or stored one. It MAY use existing or stored ancillary data or tokens,\nsuch as OAuth refresh tokens, to generate the new token (such as an OAuth AT).\n\n### 2.7. External Metadata\n\nHost providers MAY wish to store extra data about authentications or users\ncollected or produced during authentication operations. These SHOULD be stored\nin a per-user, local location such as the user's home or profile directory.\n\nSecrets, credentials or other sensitive data SHOULD be stored in the credential\nstore, or otherwise protected by some form of per-user, local encryption.\n\nIn the case of stored data caches, providers SHOULD invalidate relevant parts\nof, or the entire cache, when a call to `EraseCredentialAsync` is made.\n\n## 3. Helpers\n\nHost providers MAY wish to make use of platform or operating system specific\nfeatures such as native APIs and native graphical user interfaces, in order to\noffer a better authentication experience.\n\nHost providers MUST function without the presence of a helper, even if that\nfunction is to fail gracefully with a user-friendly error message, including\na remedy to correct their installation. Host providers SHOULD always offer a\nterminal/TTY or text-based authentication mechanism alongside any graphical\ninterface provided by a helper.\n\nIn order to achieve this host providers MUST introduce an out-of-process\n\"helper\" executable that can be invoked from the main GCM process. This\nallows the \"helper\" executable full implementation freedom of runtime, language,\netc.\n\nCommunications between the main and helper processes MAY use any IPC mechanism\navailable. It is RECOMMENDED implementors use standard input/output streams or\nfile descriptors to send and receive data as this is consistent with how Git and\nGCM communicate. UNIX sockets or Windows Named Pipes MAY also be used when\nan ongoing back-and-forth communication is required.\n\n### 3.1. Discovery\n\nIt is RECOMMENDED that helper discovery is achieved by simply checking for the\npresence of the expected executable file. The name and path of the helper\nexecutable SHOULD be configurable by the user via Git's configuration files.\n\n## 4. Error Handling\n\nIf an unrecoverable error occurs a host provider MUST throw an exception and\nMUST include detailed failure information in the error message. If the reason\nfor failure can be fixed by the user the error message MUST include instructions\nto fix the problem, or a link to online documentation.\n\nIn the case of a recoverable error, host providers SHOULD print a warning\nmessage to the standard error stream, and MUST include the error information and\nthe recovery steps take in the trace log.\n\nIn the case of an authentication error, providers SHOULD attempt to prompt the\nuser again with a message indicating the incorrect authentication details have\nbeen entered.\n\n## 5. Custom Commands\n\nIf a host provider wishes to surface custom commands the SHOULD implement the\n`ICommandProvider` interface.\n\nEach provider is given the opportunity to create a single `ProviderCommand`\ninstance to which further sub-commands can be parented to. Commanding is\nprovided by the `System.CommandLine` API library [[1][references]].\n\nThere are no limitations on what format sub-commands, arguments, or options must\ntake, but implementors SHOULD attempt to follow existing practices and styles.\n\n## References\n\n1. [`System.CommandLine` API][github-dotnet-cli]\n\n[gcm]: https://github.com/git-ecosystem/git-credential-manager\n[github-dotnet-cli]: https://github.com/dotnet/command-line-api\n[hostprovider-base-class]: #26-hostprovider-base-class\n[references]: #references\n[rfc-2119]: https://www.rfc-editor.org/rfc/rfc2119\n[rfc-6749]: https://www.rfc-editor.org/rfc/rfc6749\n" }, { "path": "docs/install.md", "content": "# Install instructions\n\nThere are multiple ways to install GCM on macOS, Windows, and Linux. Preferred\ninstallation methods for each OS are designated with a :star:.\n\n## macOS\n\n### Homebrew :star:\n\n**Note:** If you have an existing installation of the 'Java GCM' on macOS and\nyou have installed this using Homebrew, this installation will be unlinked\n(`brew unlink git-credential-manager`) when GCM is installed.\n\n#### Install\n\n```shell\nbrew install --cask git-credential-manager\n```\n\nAfter installing you can stay up-to-date with new releases by running:\n\n```shell\nbrew upgrade --cask git-credential-manager\n```\n\n#### Uninstall\n\nTo uninstall, run the following:\n\n```shell\nbrew uninstall --cask git-credential-manager\n```\n\n---\n\n### macOS Package\n\n#### Install\n\nDownload and double-click the [installation package][latest-release] and follow\nthe instructions presented.\n\n#### Uninstall\n\nTo uninstall, run the following:\n\n```shell\nsudo /usr/local/share/gcm-core/uninstall.sh\n```\n\n---\n\n\n\n\n\n## Linux\n\n**Note:** all Linux distributions\n[require additional configuration][gcm-credstores] to use GCM.\n\n---\n\n### .NET tool :star:\n\nSee the [.NET tool](#net-tool) section below for instructions on this\ninstallation method.\n\n---\n\n### Debian package\n\n#### Install\n\nDownload the latest [.deb package][latest-release]*, and run the following:\n\n```shell\nsudo dpkg -i \ngit-credential-manager configure\n```\n\n#### Uninstall\n\n```shell\ngit-credential-manager unconfigure\nsudo dpkg -r gcm\n```\n\n*If you'd like to validate the package's signature after downloading, check out\nthe instructions [here][linux-validate-gpg-debian].\n\n---\n\n### Tarball\n\n#### Install\n\nDownload the latest [tarball][latest-release]*, and run the following:\n\n```shell\ntar -xvf -C /usr/local/bin\ngit-credential-manager configure\n```\n\n#### Uninstall\n\n```shell\ngit-credential-manager unconfigure\nrm $(command -v git-credential-manager)\n```\n\n*If you would like to validate the tarball's signature after downloading, check\nout the instructions [here][linux-validate-gpg-tarball].\n\n---\n\n### Install from source helper script\n\n#### Install\n\nEnsure `curl` is installed:\n\n```shell\ncurl --version\n```\n\nIf `curl` is not installed, please use your distribution's package manager\nto install it.\n\nDownload and run the script:\n\n```shell\ncurl -L https://aka.ms/gcm/linux-install-source.sh | sh\ngit-credential-manager configure\n```\n\n**Note:** You will be prompted to enter your credentials so that the script\ncan download GCM's dependencies using your distribution's package\nmanager.\n\n#### Uninstall\n\n[Follow these instructions][linux-uninstall] for your distribution.\n\n---\n\n## Windows\n\n### Git for Windows :star:\n\nGCM is included with [Git for Windows][git-for-windows]. During installation\nyou will be asked to select a credential helper, with GCM listed as the default.\n\n![image][git-for-windows-gcm-screenshot]\n\n---\n\n### Standalone installation\n\nYou can also download the [latest installer][latest-release] for Windows to\ninstall GCM standalone.\n\n**:warning: Important :warning:**\n\nInstalling GCM as a standalone package on Windows will forcibly override the\nversion of GCM that is bundled with Git for Windows, **even if the version\nbundled with Git for Windows is a later version**.\n\nThere are two flavors of standalone installation on Windows:\n\n- User (`gcmuser-win*`):\n\n Does not require administrator rights. Will install only for the current user\n and updates only the current user's Git configuration.\n\n- System (`gcm-win*`):\n\n Requires administrator rights. Will install for all users on the system and\n update the system-wide Git configuration.\n\nTo install, double-click the desired installation package and follow the\ninstructions presented.\n\n### Uninstall (Windows 10)\n\nTo uninstall, open the Settings app and navigate to the Apps section. Select\n\"Git Credential Manager\" and click \"Uninstall\".\n\n### Uninstall (Windows 7-8.1)\n\nTo uninstall, open Control Panel and navigate to the Programs and Features\nscreen. Select \"Git Credential Manager\" and click \"Remove\".\n\n### Windows Subsystem for Linux (WSL)\n\nGit Credential Manager can be used with the [Windows Subsystem for Linux\n(WSL)][ms-wsl] to enable secure authentication of your remote Git\nrepositories from inside of WSL.\n\n[Please see the GCM on WSL docs][gcm-wsl] for more information.\n\n---\n\n## .NET tool\n\nGCM is available to install as a cross-platform [.NET\ntool][dotnet-tool]. This is\nthe preferred install method for Linux because you can use it to install on any\n[.NET-supported\ndistribution][dotnet-supported-distributions]. You\ncan also use this method on macOS if you so choose.\n\n**Note:** Make sure you have installed [version 8.0 of the .NET\nSDK][dotnet-install] before attempting to run the following `dotnet tool`\ncommands. After installing, you will also need to follow the output instructions\nto add the tools directory to your `PATH`.\n\n#### Install\n\n```shell\ndotnet tool install -g git-credential-manager\ngit-credential-manager configure\n```\n\n#### Update\n\n```shell\ndotnet tool update -g git-credential-manager\n```\n\n#### Uninstall\n\n```shell\ngit-credential-manager unconfigure\ndotnet tool uninstall -g git-credential-manager\n```\n\n[dotnet-install]: https://learn.microsoft.com/en-us/dotnet/core/install/linux#packages\n[dotnet-supported-distributions]: https://learn.microsoft.com/en-us/dotnet/core/install/linux\n[dotnet-tool]: https://learn.microsoft.com/en-us/dotnet/core/tools/global-tools\n[gcm-credstores]: credstores.md\n[gcm-wsl]: wsl.md\n[git-for-windows]: https://gitforwindows.org/\n[git-for-windows-gcm-screenshot]: img/git-for-windows-gcm-screenshot.png\n[latest-release]: https://github.com/git-ecosystem/git-credential-manager/releases/latest\n[linux-uninstall]: linux-fromsrc-uninstall.md\n[linux-validate-gpg-debian]: ./linux-validate-gpg.md#debian-package\n[linux-validate-gpg-tarball]: ./linux-validate-gpg.md#tarball\n[ms-wsl]: https://aka.ms/wsl#\n" }, { "path": "docs/linux-fromsrc-uninstall.md", "content": "# Uninstalling after installing from source\n\nThese instructions will guide you in removing GCM after running the\n[install from source script][install-from-source] on your Linux distribution.\n\n:rotating_light: PROCEED WITH CAUTION :rotating_light:\n\nFor completeness, we provide uninstall instructions for _the GCM application,\nthe GCM repo, and the maximum number of dependencies*_ for all distributions.\nThis repo and these dependencies may or may not have already been present on\nyour system when you ran the install from source script, and uninstalling them\ncould impact other programs and/or your normal workflows. Please keep this in\nmind when following the instructions below.\n\n*Certain distributions require some dependencies of the script to function as\nexpected, so we only include instructions to remove the non-required\ndependencies.\n\n## All distributions\n\n**Note:** If you ran the install from source script from a pre-existing clone of\nthe `git-credential-manager` repo or outside of your `$HOME` directory, you will\nneed to modify the final two commands below to point to the location of your\npre-existing clone or the directory from which you ran the install from source\nscript.\n\n```console\ngit-credential-manager unconfigure &&\nsudo rm $(command -v git-credential-manager) &&\nsudo rm -rf /usr/local/share/gcm-core &&\nsudo rm -rf ~/git-credential-manager &&\nsudo rm ~/install-from-source.sh\n```\n\n## Debian/Ubuntu\n\n**Note:** If you had a pre-existing installation of dotnet that was not\ninstalled via `apt` or `apt-get` when you ran the install from source script,\nyou will need to remove it using [these instructions][uninstall-dotnet] and\nremove `dotnet-*` from the below command.\n\n```console\nsudo apt remove dotnet-* dpkg-dev apt-transport-https git curl wget\n```\n\n## Linux Mint\n\n**Note:** If you had a pre-existing installation of dotnet when you ran the\ninstall from source script that was not located at `~/.dotnet`, you will need to\nmodify the first command below to point to the custom install location. If you\nwould like to remove the specific version of dotnet that the script installed\nand keep other versions, you can do so with [these instructions][uninstall-dotnet].\n\n```console\nsudo rm -rf ~/.dotnet &&\nsudo apt remove git curl\n```\n\n## Fedora/CentOS/RHEL\n\n**Note:** If you had a pre-existing installation of dotnet when you ran the\ninstall from source script that was not located at `~/.dotnet`, you will need to\nmodify the first command below to point to the custom install location. If you\nwould like to remove the specific version of dotnet that the script installed\nand keep other versions, you can do so with [these instructions][uninstall-dotnet].\n\n```console\nsudo rm -rf ~/.dotnet\n```\n\n## Alpine\n\n**Note:** If you had a pre-existing installation of dotnet when you ran the\ninstall from source script that was not located at `~/.dotnet`, you will need to\nmodify the first command below to point to the custom install location. If you\nwould like to remove the specific version of dotnet that the script installed\nand keep other versions, you can do so with [these instructions][uninstall-dotnet].\n\n```console\nsudo rm -rf ~/.dotnet &&\nsudo apk del icu-libs krb5-libs libgcc libintl libssl1.1 libstdc++ zlib which\nbash coreutils gcompat git curl\n```\n\n[install-from-source]: ../src/linux/Packaging.Linux/install-from-source.sh\n[uninstall-dotnet]: https://docs.microsoft.com/en-us/dotnet/core/install/remove-runtime-sdk-versions?pivots=os-linux#uninstall-net\n" }, { "path": "docs/linux-validate-gpg.md", "content": "# Validating GCM's GPG signature\n\nFollow the below instructions to import GCM's public key and use it to validate\nthe latest Debian package and/or tarball signature.\n\n## Debian package\n\n```shell\n# Install needed packages\napt-get install -y curl debsig-verify\n\n# Download public key signature file\ncurl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \\\n| grep -E 'browser_download_url.*gcm-public.asc' \\\n| cut -d : -f 2,3 \\\n| tr -d \\\" \\\n| xargs -I 'url' curl -L -o gcm-public.asc 'url'\n\n# De-armor public key signature file\ngpg --output gcm-public.gpg --dearmor gcm-public.asc\n\n# Note that the fingerprint of this key is \"3C853823978B07FA\", which you can\n# determine by running:\ngpg --show-keys gcm-public.asc | head -n 2 | tail -n 1 | tail -c 17\n\n# Copy de-armored public key to debsig keyring folder\nmkdir /usr/share/debsig/keyrings/3C853823978B07FA\nmv gcm-public.gpg /usr/share/debsig/keyrings/3C853823978B07FA/\n\n# Create an appropriate policy file\nmkdir /etc/debsig/policies/3C853823978B07FA\ncat > /etc/debsig/policies/3C853823978B07FA/generic.pol << EOL\n\n\n\n\n \n\n \n \n \n\n \n \n \n\n\nEOL\n\n# Download Debian package\ncurl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \\\n| grep \"browser_download_url.*deb\" \\\n| cut -d : -f 2,3 \\\n| tr -d \\\" \\\n| xargs -I 'url' curl -L -o gcm.deb 'url'\n\n# Verify\ndebsig-verify gcm.deb\n```\n\n## Tarball\n```shell\n# Download the public key signature file\ncurl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \\\n| grep -E 'browser_download_url.*gcm-public.asc' \\\n| cut -d : -f 2,3 \\\n| tr -d \\\" \\\n| xargs -I 'url' curl -L -o gcm-public.asc 'url'\n\n# Import the public key\ngpg --import gcm-public.asc\n\n# Download the tarball and its signature file\ncurl -s https://api.github.com/repos/ldennington/git-credential-manager/releases/latest \\\n| grep -E 'browser_download_url.*gcm-linux.*[0-9].[0-9].[0-9].tar.gz' \\\n| cut -d : -f 2,3 \\\n| tr -d \\\" \\\n| xargs -I 'url' curl -LO 'url'\n\n# Trust the public key\necho -e \"5\\ny\\n\" | gpg --command-fd 0 --expert --edit-key 3C853823978B07FA trust\n\n# Verify the signature\ngpg --verify gcm-linux_amd64*.tar.gz.asc gcm-linux*.tar.gz\n```\n" }, { "path": "docs/migration.md", "content": "# Migration Guide\n\n## Migrating from Git Credential Manager for Windows\n\n### GCM_AUTHORITY\n\nThis setting (and the corresponding `credential.authority` configuration) is\ndeprecated and should be replaced with the `GCM_PROVIDER` (or corresponding\n`credential.authority` configuration) setting.\n\nBecause both Basic HTTP authentication and Windows Integrated Authentication\n(WIA) are now handled by one provider, if you specified `basic` as your\nauthority you also need to disable WIA using `GCM_ALLOW_WINDOWSAUTH` /\n`credential.allowWindowsAuth`.\n\nThe following table shows the correct replacement for all legacy authorities\nvalues:\n\nGCM_AUTHORITY (credential.authority)|→|GCM_PROVIDER (credential.provider)|GCM_ALLOW_WINDOWSAUTH (credential.allowWindowsAuth)\n-|-|-|-\n`msa`, `microsoft`, `microsoftaccount`, `aad`, `azure`, `azuredirectory`, `live`, `liveconnect`, `liveid`|→|`azure-repos`|_N/A_\n`github`|→|`github`|_N/A_\n`basic`|→|`generic`|`false`\n`integrated`, `windows`, `kerberos`, `ntlm`, `tfs`, `sso`|→|`generic`|`true` _(default)_\n\nFor example if you had previous set the authority for the `example.com` host to\n`basic`..\n\n```shell\ngit config --global credential.example.com.authority basic\n```\n\n..then you can replace this with the following..\n\n```shell\ngit config --global --unset credential.example.com.authority\ngit config --global credential.example.com.provider generic\ngit config --global credential.example.com.allowWindowsAuth false\n```\n" }, { "path": "docs/multiple-users.md", "content": "# Multiple users\n\nIf you work with multiple different identities on a single Git hosting service,\nyou may be wondering if Git Credential Manager (GCM) supports this workflow. The\nanswer is yes, with a bit of complexity due to how it interoperates with Git.\n\n---\n\n**Prompted to select an account?**\n\nRead the [**TL;DR** section][tldr] below for a quick summary of how to make GCM\nremember which account to use for which repository.\n\n---\n\n## Foundations: Git and Git hosts\n\nGit itself doesn't have a single, strong concept of \"user\". There's the\n`user.name` and `user.email` which get embedded into commit headers/trailers,\nbut these are arbitrary strings. GCM doesn't interact with this notion of a user\nat all. You can put whatever you want into your `user.*` config, and nothing in\nGCM will change at all.\n\nSeparate from the user strings in commits, Git recognizes the \"user\" part of a\nremote URL or a credential. These are not often used, at least by default, in\nthe web UI of major Git hosts.\n\nGit hosting providers (like GitHub or Bitbucket) _do_ have a concept of \"user\".\nTypically it's an identity like a username or email address, plus a password or\nother credential to perform actions as that user. You may have guessed by now\nthat GCM (the Git **Credential** Manager) does work with this notion of a user.\n\n## People, identities, credentials, oh my\n\nYou (a physical person) may have one or more user accounts (identities) with one\nor more Git hosting providers. Since most Git hosts don't put a \"user\" part in\ntheir URLs, by default, Git will treat the user part for a remote as the empty\nstring. If you have multiple identities on one domain, you'll need to insert a\nunique user part per-identity yourself.\n\nThere are good reasons for having multiple identities on one domain. You might\nuse one GitHub identity for your personal work, another for your open source\nwork, and a third for your employer's work. You can ask Git to assign a\ndifferent credential to different repositories hosted on the same provider.\nHTTPS URLs include an optional \"name\" part before an `@` sign in the domain\nname, and you can use this to force Git to distinguish multiple users. This\nshould likely be your username on the Git hosting service, since there are\ncases where GCM will use it like a username.\n\n## Setting it up\n\nAs an example, let's say you're working on multiple repositories hosted at the\nsame domain name.\n\n| Repo URL | Identity |\n|----------|----------|\n| `https://example.com/open-source/library.git` | `contrib123` |\n| `https://example.com/more-open-source/app.git` | `contrib123` |\n| `https://example.com/big-company/secret-repo.git` | `employee9999` |\n\nWhen you clone these repos, include the identity and an `@` before the domain\nname in order to force Git and GCM to use different identities. If you've\nalready cloned the repos, you can update the remote URL to include the identity.\n\n### Example: fresh clones\n\n```shell\n# instead of `git clone https://example.com/open-source/library.git`, run:\ngit clone https://contrib123@example.com/open-source/library.git\n\n# instead of `git clone https://example.com/big-company/secret-repo.git`, run:\ngit clone https://employee9999@example.com/big-company/secret-repo.git\n```\n\n### Example: existing clones\n\n```shell\n# in the `library` repo, run:\ngit remote set-url origin https://contrib123@example.com/open-source/library.git\n\n# in the `secret-repo` repo, run:\ngit remote set-url origin https://employee9999@example.com/big-company/secret-repo.git\n```\n\n## Azure DevOps\n\n[Azure DevOps has some additional, optional complexity][azure-access-tokens]\nwhich you should also be aware of if you're using it.\n\n[azure-access-tokens]: azrepos-users-and-tokens.md\n\n## GitHub\n\nYou can use the `github [list | login | logout]` commands to manage your GitHub\naccounts. These commands are documented in the [command-line usage][cli-usage]\nor by running `git credential-manager github --help`.\n\n## TL;DR: Tell GCM to remember which account to use\n\nTo set a default account for a particular remote you can simply set the\nfollowing Git configuration:\n\n```shell\ngit config --global credential..username \n```\n\n..where `` is the remote URL and `` is the account you wish to\nhave as the default. For example, for `github.com` and the user `alice`:\n\n```shell\ngit config --global credential.https://github.com.username alice\n```\n\nIf you wish to set a user for a specific repository or remote URL, you can\ninclude the account name in the remote URL. If you're using HTTPS remotes, you\ncan include the account name in the URL by inserting it before the `@` sign\nin the domain name.\n\nFor example, if you want to always use the `alice` account for the `mona/test`\nGitHub repository, you can clone it using the `alice` account by running:\n\n```shell\ngit clone https://alice@github.com/mona/test\n```\n\nTo update an existing clone, you can run `git remote set-url` to update the URL:\n\n```shell\ngit remote set-url origin https://alice@github.com/mona/test\n```\n\nIf your account name includes an `@` then remember to escape this character\nusing `%40`: `https://alice%40contoso.com@example.com/test`.\n\n[tldr]: #tldr-tell-gcm-to-remember-which-account-to-use\n[cli-usage]: usage.md\n" }, { "path": "docs/netconfig.md", "content": "# Network and HTTP configuration\n\nGit Credential Manager's network and HTTP(S) behavior can be configured in a few\ndifferent ways via [environment variables][environment] and\n[configuration options][configuration].\n\n## HTTP Proxy\n\nIf your computer sits behind a network firewall that requires the use of a\nproxy server to reach repository remotes or the wider Internet, there are\nvarious methods for configuring GCM to use a proxy.\n\nThe simplest way to configure a proxy for _all_ HTTP(S) remotes is to\n[use the standard Git HTTP(S) proxy setting `http.proxy`][git-http-proxy].\n\nFor example to configure a proxy for all remotes for the current user:\n\n```shell\ngit config --global http.proxy http://proxy.example.com\n```\n\nTo specify a proxy for a particular remote you can\n[use the `remote..proxy` repository-level setting][git-remote-name-proxy],\nfor example:\n\n```shell\ngit config --local remote.origin.proxy http://proxy.example.com\n```\n\nThe advantage to using these standard configuration options is that in addition\nto GCM being configured to use the proxy, Git itself will be configured at the\nsame time. This is probably the most commonly desired case in environments\nbehind an Internet-blocking firewall.\n\n### Authenticated proxies\n\nSome proxy servers do not accept anonymous connections and require\nauthentication. In order to specify the credentials to be used with a proxy,\nyou can specify the username and password as part of the proxy URL setting.\n\nThe format follows [RFC 3986 section 3.2.1][rfc-3986-321] by including the\ncredentials in the 'user information' part of the URI. The password is optional.\n\n```text\nprotocol://username[:password]@hostname\n```\n\nFor example, to specify the username `john.doe` and the password `letmein123`\nfor the proxy server `proxy.example.com`:\n\n```text\nhttps://john.doe:letmein123@proxy.example.com\n```\n\nIf you have special characters (as defined by\n[RFC 3986 section 2.2][rfc-3986-22]) in your username or password such as `:`,\n`@`, or any other non-URL friendly character you can URL-encode them\n([section 2.1][rfc-3986-21]).\n\nFor example, a space character would be encoded with `%20`.\n\n### Other proxy options\n\nGCM supports other ways of configuring a proxy for convenience and compatibility.\n\n1. GCM-specific configuration options (_**only** respected by GCM; **deprecated**_):\n - `credential.httpProxy`\n - `credential.httpsProxy`\n1. cURL environment variables (_also respected by Git_):\n - `http_proxy`\n - `https_proxy`/`HTTPS_PROXY`\n - `all_proxy`/`ALL_PROXY`\n1. `GCM_HTTP_PROXY` environment variable (_**only** respected by GCM;\n**deprecated**_)\n\nNote that with the cURL environment variables there are both lowercase and\nuppercase variants.\n\n**_Lowercase variants take precedence over the uppercase form._** This is\nconsistent with how libcurl (and therefore Git) operates.\n\nThe `http_proxy` variable exists only in the lowercase variant and libcurl does\n_not_ consider any uppercase form. _GCM also reflects this behavior._\n\nSee [the curl docs][curl-proxy-env-vars] for more information.\n\n### Bypassing addresses\n\nIn some circumstances you may wish to bypass a configured proxy for specific\naddresses. GCM supports the cURL environment variable `no_proxy` (and\n`NO_PROXY`) for this scenario, as does Git itself.\n\nLike with the [other cURL proxy environment variables][other-proxy-options],\nthe lowercase variant will take precedence over the uppercase form.\n\nThis environment variable should contain a comma-separated or space-separated\nlist of host names that should not be proxied (should connect directly).\n\nGCM attempts to match [libcurl's behaviour][curlopt-noproxy],\nwhich is briefly summarized here:\n\n- a value of `*` disables proxying for all hosts;\n- other wildcard use is **not** supported;\n- each name in the list is matched as a domain which contains the hostname,\n or the hostname itself\n- a leading period/dot `.` matches against the provided hostname\n\nFor example, setting `NO_PROXY` to `example.com` results in the following:\n\nHostname|Matches?\n-|-\n`example.com`|:white_check_mark:\n`example.com:80`|:white_check_mark:\n`www.example.com`|:white_check_mark:\n`notanexample.com`|:x:\n`www.notanexample.com`|:x:\n`example.com.othertld`|:x:\n\n**Example:**\n\n```text\nno_proxy=\"contoso.com,www.fabrikam.com\"\n```\n\n## TLS Verification\n\nIf you are using self-signed TLS (SSL) certificates with a self-hosted host\nprovider such as GitHub Enterprise Server or Azure DevOps Server (previously\nTFS), you may see the following error message when attempting to connect using\nGit and/or GCM:\n\n```shell\n$ git clone https://ghe.example.com/john.doe/myrepo\nfatal: The remote certificate is invalid according to the validation procedure.\n```\n\nThe **recommended and safest option** is to acquire a TLS certificate signed by\na public trusted certificate authority (CA). There are multiple public CAs; here\nis a non-exhaustive list to consider: [Let's Encrypt][lets-encrypt],\n[Comodo][comodo], [Digicert][digicert], [GoDaddy][godaddy],\n[GlobalSign][globalsign].\n\nIf it is not possible to **obtain a TLS certificate from a trusted 3rd party**\nthen you should try to add the _specific_ self-signed certificate or one of the\nCA certificates in the verification chain to your operating system's trusted\ncertificate store ([macOS][mac-keychain-access], [Windows][install-cert-vista]).\n\nIf you are _unable_ to either **obtain a trusted certificate**, or trust the\nself-signed certificate you can disable certificate verification in Git and GCM.\n\n---\n**Security Warning** :warning:\n\nDisabling verification of TLS (SSL) certificates removes protection against a\n[man-in-the-middle (MITM) attack][mitm-attack].\n\nOnly disable certificate verification if you are sure you need to, are aware of\nall the risks, and are unable to trust specific self-signed certificates\n(as described above).\n\n---\n\nThe [environment variable `GIT_SSL_NO_VERIFY`][git-ssl-no-verify] and\n[Git configuration option `http.sslVerify`][git-http-ssl-verify] can be used to\ncontrol TLS (SSL) certificate verification.\n\nTo disable verification for a specific remote (for example `https://example.com`):\n\n```shell\ngit config --global http.https://example.com.sslVerify false\n```\n\nTo disable verification for the current user for **_all remotes_** (**not\nrecommended**):\n\n```shell\n# Environment variable (Windows)\nSET GIT_SSL_NO_VERIFY=1\n\n# Environment variable (macOS/Linux)\nexport GIT_SSL_NO_VERIFY=1\n\n# Git configuration (Windows/macOS/Linux)\ngit config --global http.sslVerify false\n```\n\n---\n\n**Note:** You may also experience similar verification errors if you are using a\nnetwork traffic inspection tool such as [Telerik Fiddler][telerik-fiddler]. If\nyou are using such tools please consult their documentation for trusting the\nproxy root certificates.\n\n---\n\n## Unsafe Remote URLs\n\nIf you are using a remote URL that is not considered safe, such as unencrypted\nHTTP (remote URLs that start with `http://`), host providers may prevent you\nfrom authenticating with your credentials.\n\nIn this case, you should consider using a HTTPS (starting with `https://`)\nremote URL to ensure your credentials are transmitted securely.\n\nIf you accept the risks associated with using an unsafe remote URL, you can\nconfigure GCM to allow the use of unsafe remote URLS by setting the environment\nvariable [`GCM_ALLOW_UNSAFE_REMOTES`][unsafe-envar], or by using the Git\nconfiguration option [`credential.allowUnsafeRemotes`][unsafe-config] to `true`.\n\n[environment]: environment.md\n[configuration]: configuration.md\n[git-http-proxy]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpproxy\n[git-remote-name-proxy]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-remoteltnamegtproxy\n[rfc-3986-321]: https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1\n[rfc-3986-22]: https://www.rfc-editor.org/rfc/rfc3986#section-2.2\n[rfc-3986-21]: https://www.rfc-editor.org/rfc/rfc3986#section-2.1\n[curl-proxy-env-vars]: https://everything.curl.dev/usingcurl/proxies#proxy-environment-variables\n[other-proxy-options]: #other-proxy-options\n[curlopt-noproxy]: https://curl.se/libcurl/c/CURLOPT_NOPROXY.html\n[lets-encrypt]: https://letsencrypt.org/\n[comodo]: https://www.comodoca.com/\n[digicert]: https://www.digicert.com/\n[godaddy]: https://www.godaddy.com/\n[globalsign]: https://www.globalsign.com\n[mac-keychain-access]: https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac\n[install-cert-vista]: https://blogs.technet.microsoft.com/sbs/2008/05/08/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista/\n[mitm-attack]: https://en.wikipedia.org/wiki/Man-in-the-middle_attack\n[git-ssl-no-verify]: https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables#_networking\n[git-http-ssl-verify]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpsslVerify\n[telerik-fiddler]: https://www.telerik.com/fiddler\n[unsafe-envar]: environment.md#gcm_allow_unsafe_remotes\n[unsafe-config]: configuration.md#credentialallowunsaferemotes\n" }, { "path": "docs/ntlm-kerberos.md", "content": "# NTLM and Kerberos Authentication\n\n## Background\n\nNTLM and Kerberos are two authentication protocols that are commonly used in\nWindows environments.\n\nIn Git Credential Manager (GCM), we refer to these protocols under the umbrella\nterm \"Windows Integrated Authentication\".\n\n### NTLM\n\n[NTLM (NT LAN Manager)][ntlm-wiki] is a challenge-response authentication\nprotocol used in various Microsoft network protocols, such as\n[SMB file sharing][smb-docs].\n\n> [!CAUTION]\n> NTLM is now considered _**insecure**_ due to weak cryptographic algorithms and\n> vulnerabilities to various attacks, such as pass-the-hash and relay attacks.\n> As such, it is not recommended for use in modern applications.\n>\n> There are several versions of NTLM, with NTLMv2 being the latest, however\n> **all versions** are considered weak by modern security standards.\n>\n> Microsoft lists [NTLM as a deprecated protocol][ntlm-deprecated] and has\n> removed NTLMv1 from Windows as of Windows 11 build 24H2 / Server 2025.\n\nNTLM is advertised by HTTP servers using the `WWW-Authenticate: NTLM` header.\nWhen a client receives this header, it can respond with an NTLM authentication\nmessage to prove its identity.\n\n### Kerberos\n\n[Kerberos][kerberos-wiki], on the other hand, is a more secure and robust\nauthentication protocol that uses tickets to authenticate users and services.\nIt is the recommended authentication protocol for Windows domains and is widely\nused in enterprise environments.\n\nUnlike NTLM, Kerberos is typically not directly advertised by HTTP servers, but\nis instead advertised using \"SPNEGO\" and the `WWW-Authenticate: Negotiate`\nheader.\n\n#### GSS-API Negotiate and SPNEGO\n\nKerberos (or NTLM) authentication is typically initially established using the\n[GSS-API][gssapi-wiki] ([RFC 2743][gssapi-rfc]) negotiation mechanism\n[\"SPNEGO\"][spnego-wiki] ([RFC 4178][spnego-rfc]). SPNEGO allows the client and\nserver to agree on which authentication protocol to use (Kerberos or NTLM) based\non their capabilities. Typically Kerberos is preferred if both the client and\nserver support it, with NTLM acting as a fallback.\n\n## Built-in Support in Git\n\nGit provides built-in support for NTLM and Kerberos authentication through the\nuse of [libcurl][libcurl], which is the underlying library used by Git for HTTP\nand HTTPS communications. When Git is compiled with libcurl support, it can\nleverage the authentication mechanisms provided by libcurl, including NTLM and\nKerberos.\n\nOn Windows, Git can use the native Windows [SSPI][sspi-wiki] (Security Support\nProvider Interface) to perform NTLM and Kerberos authentication. This allows Git\nto integrate seamlessly with the Windows authentication infrastructure.\n\n> [!NOTE]\n> As of Git for Windows version 2.XX.X, **NTLM support is disabled by default**.\n> Kerberos support _remains enabled_.\n\n### Re-enabling NTLM Support\n\nYou can re-enable NTLM support in Git for Windows for a particular remote by\nsetting Git config option [`http..allowNTLMAuth`][ntlm-config] to `true`.\nFor example, to enable NTLM authentication for `https://example.com`, you would\nrun the following command:\n\n```shell\ngit config --global http.https://example.com.allowNTLMAuth true\n```\n\n> [!WARNING]\n> Enabling NTLM authentication may expose you to security risks, as NTLM is\n> considered insecure. It is recommended to use Kerberos authentication where\n> possible, and to only use NTLM with trusted servers in secure environments.\n\n> [!WARNING]\n> Only ever use NTLM authentication over secure connections (i.e., HTTPS) to\n> protect against eavesdropping and man-in-the-middle attacks.\n\nWhen using GCM with a remote that supports NTLM authentication, GCM will warn\nyou if NTLM authentication is not enabled in Git but the remote server\nadvertises NTLM support.\n\n![GCM warning prompt that NTLM is disabled inside of Git][ntlm-warning-image]\n\n* Selecting \"Just this time\" will continue with NTLM authentication, but only\n for the current operation. The next time you interact with that remote, you\n will be prompted again.\n\n* Selecting \"Always for this remote\" will set the `http..allowNTLMAuth`\n configuration option to `true` for that remote, and continue with NTLM\n authentication.\n\n* Selecting \"No\" will prompt for a basic username/password credential, and Git's\n NTLM authentication support will remain disabled. If the remote server only\n supports NTLM then authentication will fail.\n\n### Seamless Authentication\n\nWhen using NTLM or Kerberos authentication with Git on Windows, it is possible\nto achieve seamless authentication without prompting for credentials. This is\nbecause Git can leverage the existing Windows user credentials to authenticate\nwith the server.\n\nThis means that if you are logged into your Windows account, Git can use those\ncredentials to authenticate with the remote server automatically, without\nprompting you for a username or password.\n\nThis feature is enabled by default in Git. To disable this behavior, you can set\nthe [`http..emptyAuth`][emptyauth] configuration option to `false`. For\nexample, to disable seamless authentication for `https://example.com`, you would\nrun the following command:\n\n```shell\ngit config --global http.https://example.com.emptyAuth false\n```\n\nIf you disable seamless authentication, Git will prompt you for credentials\nwhen accessing a remote that advertises NTLM or Kerberos support rather than\nusing the current Windows user's credentials.\n\n[ntlm-wiki]: https://en.wikipedia.org/wiki/NTLM\n[kerberos-wiki]: https://en.wikipedia.org/wiki/Kerberos_(protocol)\n[smb-docs]: https://learn.microsoft.com/en-gb/windows/win32/fileio/microsoft-smb-protocol-and-cifs-protocol-overview\n[ntlm-deprecated]: https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features\n[ntlm-config]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpallowNTLMAuth\n[gssapi-rfc]: https://datatracker.ietf.org/doc/html/rfc2743\n[gssapi-wiki]: https://en.wikipedia.org/wiki/GSSAPI\n[spnego-rfc]: https://datatracker.ietf.org/doc/html/rfc4178\n[spnego-wiki]: https://en.wikipedia.org/wiki/SPNEGO\n[libcurl]: https://curl.se/libcurl/\n[sspi-wiki]: https://en.wikipedia.org/wiki/Security_Support_Provider_Interface\n[emptyauth]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpemptyAuth\n[ntlm-warning-image]: img/ntlm-warning.png\n" }, { "path": "docs/rename.md", "content": "# Git Credential Manager Rename\n\nIn November 2021, _\"Git Credential Manager Core\"_ was [renamed][rename-pr] to\nsimply _\"Git Credential Manager\"_, dropping the \"Core\" moniker. We announced the\nnew name in a [GitHub blog post][rename-blog], along with the new home for the\nproject in its own [organization][gcm-org].\n\n![Git Credential Manager Core renamed](img/gcmcore-rename.png)\n\nAt the time, the actual exectuable name was not updated and continued to be\n`git-credential-manager-core`. As of [2.0.877][rename-ver], the executable has\nbeen renamed to `git-credential-manager`, matching the new project name.\n\n---\n\n:warning: **Update:** :warning:\n\nAs of [2.3.0][no-symlink-ver] the `git-credential-manager-core` symlinks have been\nremoved.\n\nIf you have not updated your configuration you will see error messages similar to:\n\n```console\ngit: 'credential-manager-core' is not a git command. See 'git --help'.\n```\n\nTo fix your configuration, please follow the [instructions][instructions] below.\n\n---\n\n## Rename transition\n\nIf you continue to use the `git-credential-manager-core` executable name you may\nsee warning messages like below:\n\n```console\nwarning: git-credential-manager-core was renamed to git-credential-manager\nwarning: see https://aka.ms/gcm/rename for more information\n```\n\nSince the executable was renamed in 2.0.877, GCM has also included symlinks\nusing the old name in order to ensure no one's setups would immediately break.\n\nThese links will remain until _two_ major Git versions are released after GCM\n2.0.877, _**at which point the symlinks will no longer be included**_.\n\nIt is recommended to update your Git configuration to use the new executable\nname as soon as possible to prevent any issues in the future.\n\n## How to update\n\n### Git for Windows\n\nIf you are using GCM bundled with Git for Windows (recommended), you should make\nsure you have updated to the latest version.\n\n[Download the latest Git for Windows ⬇️][git-windows]\n\n### Windows standalone installer\n\nIf you are using GCM installed either by the user (`gcmuser-*.exe`) or system\n(`gcm-*.exe`) installers on Windows, you should uninstall the current version\nfirst and then download and install the [latest version][gcm-latest].\n\nUninstall instructions for your Windows version can be found\n[here][win-standalone-instr].\n\n### macOS Homebrew\n\n> **Note:** As of October 2022 the old `git-credential-manager-core` cask name\n> is still used. In the future we plan to rename the package to drop the `-core`\n> suffix.\n\nIf you use Homebrew to install GCM on macOS you should use `brew upgrade` to\ninstall the latest version.\n\n```sh\nbrew upgrade git-credential-manager-core\n```\n\n### macOS package\n\nIf you use the .pkg file to install GCM on macOS, you should first uninstall the\ncurrent version, and then install the [latest package][gcm-latest].\n\n```sh\nsudo /usr/local/share/gcm-core/uninstall.sh\ninstaller -pkg -target /\n```\n\n### Linux Debian package\n\nIf you use the .deb Debian package to install GCM on Linux, you should first\n`unconfigure` the current version, uninstall the package, and then install and\n`configure` the [latest version][gcm-latest].\n\n```sh\ngit-credential-manager-core unconfigure\nsudo dpkg -r gcmcore\nsudo dpkg -i \ngit-credential-manager configure\n```\n\n### Linux tarball\n\nIf you are using the pre-built GCM binaries on Linux from our tarball, you\nshould first `unconfigure` the current version before extracting the [latest\nbinaries][gcm-latest].\n\n```sh\ngit-credential-manager-core unconfigure\nrm $(command -v git-credential-manager-core)\ntar -xvf -C /usr/local/bin\ngit-credential-manager configure\n```\n\n### Troubleshooting\n\nIf after updating your GCM installations if you are still seeing the\n[warning][warnings] messages you can try manually editing your Git configuration\nto point to the correct GCM executable name.\n\nStart by listing all Git configuration for `credential.helper`, including which\nfiles the particular config entries are located in, using the following command:\n\n```sh\ngit config --show-origin --get-all credential.helper\n```\n\nOn Mac or Linux you should see something like this:\n\n\n```shell-session\n$ git config --show-origin --get-all credential.helper\nfile:/opt/homebrew/etc/gitconfig\tcredential.helper=osxkeychain\nfile:/Users/jdoe/.gitconfig\tcredential.helper=\nfile:/Users/jdoe/.gitconfig\tcredential.helper=/usr/local/share/gcm-core/git-credential-manager-core\n```\n\nOn Windows you should see something like this:\n\n```shell-session\n> git config --show-origin --get-all credential.helper\nfile:C:/Program Files/Git/etc/gitconfig\tcredential.helper=manager-core\n```\n\n\nLook out for entries that include `git-credential-manager-core` or\n`manager-core`; these should be replaced and updated to `git-credential-manager`\nor `manager` respectively.\n\n> **Note:** When updating the Git configuration file in your home directory\n> (`$HOME/.gitconfig` or `%USERPROFILE%\\.gitconfig`) you should ensure there are\n> is an additional blank entry for `credential.helper` before the GCM entry.\n>\n> **Mac/Linux**\n>\n> ```ini\n> [credential]\n> helper =\n> helper = /usr/local/share/gcm-core/git-credential-manager\n> ```\n>\n> **Windows**\n>\n> ```ini\n> [credential]\n> helper =\n> helper = C:/Program\\\\ Files\\\\ \\\\(x86\\\\)/Git\\\\ Credential\\\\ Manager/git-credential-manager.exe\n> ```\n>\n> The blank entry is important as it makes sure GCM is the only credential\n> helper that is configured, and overrides any helpers configured at the system/\n> machine-wide level.\n\n[rename-pr]: https://github.com/git-ecosystem/git-credential-manager/pull/541\n[rename-blog]: https://github.blog/2022-04-07-git-credential-manager-authentication-for-everyone/#universal-git-authentication\n[gcm-org]: https://github.com/git-ecosystem\n[rename-ver]: https://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.0.877\n[git-windows]: https://git-scm.com/download/win\n[gcm-latest]: https://aka.ms/gcm/latest\n[warnings]: #rename-transition\n[win-standalone-instr]: ../README.md#standalone-installation\n[instructions]: #how-to-update\n[no-symlink-ver]: https://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.3.0\n" }, { "path": "docs/usage.md", "content": "# Command-line usage\n\nAfter installation, Git will use Git Credential Manager and you will only need\nto interact with any authentication dialogs asking for credentials.\nGCM stays invisible as much as possible, so ideally you’ll forget that you’re\ndepending on GCM at all.\n\nAssuming GCM has been installed, use your favorite terminal to execute the\nfollowing commands to interact directly with GCM.\n\n```shell\ngit credential-manager [ []]\n```\n\n## Commands\n\n### --help / -h / -?\n\nDisplays a list of available commands.\n\n### --version\n\nDisplays the current version.\n\n### get / store / erase\n\nCommands for interaction with Git. You shouldn't need to run these manually.\n\nRead the [Git manual][git-credentials-custom-helpers] about custom helpers for\nmore information.\n\n### configure/unconfigure\n\nSet your user-level Git configuration (`~/.gitconfig`) to use GCM. If you pass\n`--system` to these commands, they act on the system-level Git configuration\n(`/etc/gitconfig`) instead.\n\n### azure-repos\n\nInteract with the Azure Repos host provider to bind/unbind user accounts to\nAzure DevOps organizations or specific remote URLs, and manage the\nauthentication authority cache.\n\nFor more information about managing user account bindings see\n[here][azure-access-tokens-ua].\n\n[azure-access-tokens-ua]: azrepos-users-and-tokens.md#useraccounts\n[git-credentials-custom-helpers]: https://git-scm.com/docs/gitcredentials#_custom_helpers\n\n### github\n\nInteract with the GitHub host provider to manage your accounts on GitHub.com and\nGitHub Enterprise Server instances.\n" }, { "path": "docs/windows-broker.md", "content": "# Web Account Manager integration\n\nGit Credential Manager (GCM) knows how to integrate with the\n[Web Account Manager (WAM)][azure-refresh-token-terms] feature of Windows. GCM\nuses WAM to store credentials for Azure DevOps. Authentication requests are said\nto be \"brokered\" to the operating system. Currently, GCM will share\nauthentication state with a few other Microsoft developer tools like Visual\nStudio and the Azure CLI, meaning fewer authentication prompts. Enabling WAM\nintegration may also be required with certain\n[Conditional Access policies][azure-conditional-access], which enterprises use\nto help protect their assets, including source code.\n\nIntegration with the WAM broker offers convenience and other benefits, but may\nalso make unexpected other changes on your device. On a device owned and managed\nby your institution or employer, WAM is probably the right choice. On a personal\ndevice or a device owned by a different institution (e.g. if you're a contractor\nworking for Company A with access to resources at Company B), there are\nsurprising behaviors that you should be aware of before enabling WAM integration.\n\nNote that this only affects [Azure DevOps][azure-devops].\nIt doesn't impact authentication with GitHub, Bitbucket, or any other Git host.\n\n## How to enable\n\nYou can opt-in to WAM support by setting the environment variable\n[`GCM_MSAUTH_USEBROKER`][GCM_MSAUTH_USEBROKER] or setting the Git configuration\nvalue [`credential.msauthUseBroker`][credential.msauthUseBroker].\n\n## Features\n\nWhen you turn on WAM support, GCM can cooperate with Windows and with other\nWAM-enabled software on your machine. This means a more seamless experience,\nfewer multi-factor authentication prompts, and the ability to use additional\nauthentication technologies like smart cards and Windows Hello. These\nconvenience and security features make a good case for enabling WAM.\n\n## Using the current OS account by default\n\nEnabling WAM does not currently automatically use the current Windows account\nfor authentication. In order to opt-in to this behavior you can set the\n[`GCM_MSAUTH_USEDEFAULTACCOUNT`][GCM_MSAUTH_USEDEFAULTACCOUNT] environment\nvariable or set the\n[`credential.msauthUseDefaultAccount`][credential.msauthUseDefaultAccount] Git\nconfiguration value to `true`.\n\nIn certain cloud hosted environments when using a work or school account, such\nas [Microsoft Dev Box][devbox], this setting is **_automatically enabled_**.\n\nTo disable this behavior, set the environment variable\n[`GCM_MSAUTH_USEDEFAULTACCOUNT`][GCM_MSAUTH_USEDEFAULTACCOUNT] or the\n[`credential.msauthUseDefaultAccount`][credential.msauthUseDefaultAccount] Git\nconfiguration value explicitly to `false`.\n\n## Surprising behaviors\n\nThe WAM and Windows identity systems are complex, addressing a very broad range\nof customer use cases. What works for a solo home user may not be adequate for a\ncorporate-managed fleet of 100,000 devices and vice versa. The GCM team isn't\nresponsible for the user experience or choices made by WAM, but by integrating\nwith WAM, we inherit some of those choices. Therefore, we want you to be aware\nof some defaults and experiences if you choose to use WAM integration.\n\n### For work or school accounts (Azure AD-backed identities)\n\nWhen you sign into an Azure DevOps organization backed by Azure AD (often your\ncompany or school email), if your machine is already joined to Azure AD matching\nthat Azure DevOps organization, you'll get a seamless and easy-to-use experience.\n\nIf your machine isn't Azure AD-joined, or is Azure AD-joined to a different\ntenant, WAM will present you with a dialog box suggesting you stay signed in and\nallow the organization to manage your device. The dialog box has changed a bit\nin various versions of Windows; here are two examples from 2021:\n\n![Consent dialog pre-21H1][aad-questions]\n\n![Consent dialog post-21H1][aad-questions-21h1]\n\nDepending on what you click, one of three things can happen:\n\n- If you leave \"allow my organization to manage my device\" checked and click\n\"OK\", your computer will be registered with the Azure AD tenant backing the\norganization.\nIt may also be MDM-enrolled (\"Mobile Device Management\" -- think Intune,\nAirWatch, MobileIron, etc.), meaning an administrator can deploy policies to\nyour machine: requiring certain kinds of sign-in, turning on antivirus and\nfirewall software, and enabling BitLocker.\nYour identity will also be available to other apps on the computer for signing\nin, some of which may do so automatically.\n\n![Example of policies pushed to an Intune-enrolled device][aad-bitlocker]\n\n- If you uncheck \"allow my organization to manage my device\" and click \"OK\",\nyour computer will be registered with Azure AD but will not be MDM-enrolled.\nYour identity will be available to other apps on the computer for signing in.\nOther apps may log you in automatically or prompt you again to allow your\norganization to manage your device. Despite joining Azure AD, your\norganization's Conditional Access policies may still prevent you from accessing\nAzure DevOps.\nIf so, you'll be prompted with instructions on how to enroll in MDM.\n\n- If you instead click \"No, sign in to this app only\", your machine will not be\njoined to Azure AD or MDM-enrolled, so no policies can be enforced, and your\nidentity won't be made available to other apps on the computer.\nSimilar to the above, your organization's Conditional Access policies may\nprevent you from proceeding.\n\nIf Conditional Access is required to access your organization's Git repositories,\nyou can [enable WAM integration][GCM_MSAUTH_USEBROKER] (or follow other\ninstructions your organization provides).\n\n#### Removing device management\n\nIf you've allowed your computer to be managed and want to undo it, you can go\ninto **Settings**, **Accounts**, **Access work or school**.\nIn the section where you see your email address and organization name, click\n**Disconnect**.\n\n![Finding your work or school account][aad-work-school]\n\n![Disconnecting from Azure AD][aad-disconnect]\n\n### For Microsoft accounts\n\nWhen you sign into an Azure DevOps organization backed by Microsoft account\n(MSA) identities (email addresses like `@outlook.com` or `@gmail.com` fall into\nthis category), you may be prompted to select an existing \"work or school\naccount\" or use a different one.\n\nIn order to sign in with an MSA you should continue and select \"Use a different\n[work or school] account\", but enter your MSA credentials when prompted. This is\ndue to a configuration outside of our control. We expect this experience to\nimprove over time and a \"personal account\" option to be presented in the future.\n\n![Initial dialog to choose an existing or different account][ms-sign-in]\n\nIf you've connected your MSA to Windows or signed-in to other Microsoft\napplications such as Office, then you may see this account listed in the\nauthentication prompts when using GCM.\n\n---\n\n⚠️ **Important** ⚠️\n\nWhen adding a new MSA to Windows, you'll be asked to select whether to use this\naccount across all of your device (**option 1**), or only permit Microsoft-apps\nto access your identity (**option 2**). If you opt to use the account everywhere,\nthen your local Windows user account will be connected to that MSA.\nThis means you'll need to use your MSA credentials to sign in to Windows going\nforward.\n\nSelecting \"just this app\" or \"Microsoft apps only\" will still allow you to use\nthis MSA across apps in Windows, but will not require you to use your MSA\ncredentials to sign in to Windows.\n\n![Confirmation to connect your MSA to Windows][msa-confirm]\n\nTo disconnect an MSA added using option 1, you can go into **Settings**,\n**Accounts**, **Your info** and click **Stop signing in to all Microsoft apps\nautomatically**.\n\n![Remove your Microsoft account from Windows][msa-remove]\n\nFor MSAs added for \"Microsoft apps only\", you can modify whether or not these\naccounts are available to other applications, and also remove the accounts from\n **Settings**, **Accounts**, **Emails & accounts**:\n\n![Allow all Microsoft apps to access your identity][all-ms-apps]\n\n![Microsoft apps must ask to access your identity][apps-must-ask]\n\n## Running as administrator\n\n### GCM 2.1 and later\n\nFrom version 2.1 onwards, GCM uses a version of the [Microsoft Authentication\nLibrary (MSAL)][msal-dotnet] that supports use of the Windows\nbroker from an elevated process.\n\n### Previous versions\n\nThe Windows broker (\"WAM\") makes heavy use of [COM][ms-com], a remote procedure\ncall (RPC) technology built into Windows. In order to integrate with WAM, Git\nCredential Manager and the underlying\n[Microsoft Authentication Library (MSAL)][msal-dotnet] must use COM interfaces\nand RPCs. When you run Git Credential Manager as an elevated process, some of\nthe calls made between GCM and WAM may fail due to differing process security\nlevels. This can happen when you run `git` from an Administrator command-prompt\nor perform Git operations from Visual Studio running as Administrator.\n\nIf you've enabled using the broker, GCM will check whether it's running in an\nelevated process. If it is, GCM will automatically attempt to modify the COM\nsecurity settings for the running process so that GCM and WAM can work together.\nHowever, this automatic process security change is not guaranteed to succeed.\nVarious external factors like registry or system-wide COM settings may cause it\nto fail. If GCM can't modify the process's COM security settings, GCM prints a\nwarning message and won't be able to use the broker.\n\n```text\nwarning: broker initialization failed\nFailed to set COM process security to allow Windows broker from an elevated process (0x80010119).\nSee https://aka.ms/gcm/wamadmin for more information.\n```\n\n### Possible solutions\n\nIn order to fix the problem, there are a few options:\n\n1. Update to the [latest Git for Windows][git-for-windows-latest]\n **(recommended)**.\n2. Run Git or Git Credential Manager from non-elevated processes.\n3. Disable the broker by setting the\n [`GCM_MSAUTH_USEBROKER`][GCM_MSAUTH_USEBROKER]\n environment variable or the\n [`credential.msauthUseBroker`][credential.msauthUseBroker]\n Git configuration setting to `false`.\n\n[azure-refresh-token-terms]: https://docs.microsoft.com/azure/active-directory/devices/concept-primary-refresh-token#key-terminology-and-components\n[azure-conditional-access]: https://docs.microsoft.com/azure/active-directory/conditional-access/overview\n[azure-devops]: https://azure.microsoft.com/en-us/products/devops\n[GCM_MSAUTH_USEBROKER]: environment.md#GCM_MSAUTH_USEBROKER-experimental\n[GCM_MSAUTH_USEDEFAULTACCOUNT]: environment.md#GCM_MSAUTH_USEDEFAULTACCOUNT-experimental\n[credential.msauthUseBroker]: configuration.md#credentialmsauthusebroker-experimental\n[credential.msauthUseDefaultAccount]: configuration.md#credentialmsauthusedefaultaccount-experimental\n[aad-questions]: img/aad-questions.png\n[aad-questions-21h1]: img/aad-questions-21H1.png\n[aad-bitlocker]: img/aad-bitlocker.png\n[aad-work-school]: img/aad-work-school.png\n[aad-disconnect]: img/aad-disconnect.png\n[ms-sign-in]: img/get-signed-in.png\n[all-ms-apps]: img/all-microsoft.png\n[apps-must-ask]: img/apps-must-ask.png\n[ms-com]: https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model\n[msa-confirm]: img/msa-confirm.png\n[msa-remove]: img/msa-remove.png\n[msal-dotnet]: https://aka.ms/msal-net\n[devbox]: https://azure.microsoft.com/en-us/products/dev-box\n[git-for-windows-latest]: https://git-scm.com/download/win\n" }, { "path": "docs/wsl.md", "content": "# Windows Subsystem for Linux (WSL)\n\nGCM can be used with the\n[Windows Subsystem for Linux (WSL)][wsl], both WSL1 and WSL2, by\nfollowing these instructions.\n\nIn order to use GCM with WSL you must be on Windows 10 Version 1903 or later.\nThis is the first version of Windows that includes the required `wsl.exe` tool\nthat GCM uses to interoperate with Git in your WSL distributions.\n\nIt is highly recommended that you install Git for Windows to both install GCM\nand enable the best experience sharing credentials & settings between WSL and\nthe Windows host. Alternatively, you must be using GCM version 2.0.XXX or later\nand configure the `WSLENV` environment variable as\n[described below][configuring-wsl-without-git-for-windows].\n\n## Configuring WSL with Git for Windows (recommended)\n\nStart by installing the [latest Git for Windows ⬇️][latest-git-for-windows]\n\n_Inside your WSL installation_, run the following command to set GCM as the Git\ncredential helper:\n\n```shell\ngit config --global credential.helper \"/mnt/c/Program\\ Files/Git/mingw64/bin/git-credential-manager.exe\"\n```\n\n> **Note:** the location of git-credential-manager.exe may be different in your\ninstallation of Git for Windows.\n\nIf you intend to use Azure DevOps you must _also_ set the following Git\nconfiguration _inside of your WSL installation_.\n\n```shell\ngit config --global credential.https://dev.azure.com.useHttpPath true\n```\n\n## Configuring WSL without Git for Windows\n\nIf you wish to use GCM inside of WSL _without installing Git for Windows_\nyou must complete additional configuration so that GCM can callback to Git\ninside of your WSL installation.\n\nStart by installing the [latest GCM for Windows⬇️][latest-gcm]\n\n_Inside your WSL installation_, run the following command to set GCM as the Git\ncredential helper:\n\n```shell\ngit config --global credential.helper \"/mnt/c/Program\\ Files\\ \\(x86\\)/Git\\ Credential\\ Manager/git-credential-manager.exe\"\n\n# For Azure DevOps support only\ngit config --global credential.https://dev.azure.com.useHttpPath true\n```\n\nIn **_Windows_** you need to update the `WSLENV` environment variable to include\nthe value `GIT_EXEC_PATH/wp`. From an _Administrator_ Command Prompt run the\nfollowing:\n\n```batch\nSETX WSLENV %WSLENV%:GIT_EXEC_PATH/wp\n```\n\nAfter updating the `WSLENV` environment variable, restart your WSL installation.\n\n### Using the user-only GCM installer?\n\nIf you have installed GCM using the user-only installer (i.e, the `gcmuser-*.exe`\ninstaller and not the system-wide/admin required installer), you need to modify\nthe above instructions to point to\n`/mnt/c/Users//AppData/Local/Programs/Git\\ Credential\\ Manager/git-credential-manager.exe`\ninstead.\n\n## How it works\n\nGCM leverages the built-in interoperability between Windows and WSL, provided by\nMicrosoft. You can read more about Windows/WSL interop [here][wsl-interop].\n\nGit inside of a WSL installation can launch the GCM _Windows_ application\ntransparently to acquire credentials. Running GCM as a Windows application\nallows it to take full advantage of the host operating system for storing\ncredentials securely, and presenting GUI prompts for authentication.\n\nUsing the host operating system (Windows) to store credentials also means that\nyour Windows applications and WSL distributions can all share those credentials,\nremoving the need to sign-in multiple times.\n\n## Shared configuration\n\nUsing GCM as a credential helper for a WSL Git installation means that any\nconfiguration set in WSL Git is NOT respected by GCM (by default). This is\nbecause GCM is running as a Windows application, and therefore will use the Git\nfor Windows installation to query configuration.\n\nThis means things like proxy settings for GCM need to be set in Git for Windows\nas well as WSL Git as they are stored in different files\n(`%USERPROFILE%\\.gitconfig` vs `\\\\wsl$\\distro\\home\\$USER\\.gitconfig`).\n\nYou can configure WSL such that GCM will use the WSL Git configuration following\nthe [instructions above][configuring-wsl-without-git-for-windows]. However,\nthis then means that things like proxy settings are unique to the specific WSL\ninstallation, and not shared with others or the Windows host.\n\n## Can I install Git Credential Manager directly inside of WSL?\n\nYes. Rather than install GCM as a Windows application (and have WSL Git invoke\nthe Windows GCM), can you install GCM as a Linux application instead.\n\nTo do this, simply follow the\n[GCM installation instructions for Linux][linux-installation].\n\n**Note:** In this scenario, because GCM is running as a Linux application\nit cannot utilize authentication or credential storage features of the host\nWindows operating system.\n\n[wsl]: https://aka.ms/wsl\n[configuring-wsl-without-git-for-windows]: #configuring-wsl-without-git-for-windows\n[latest-git-for-windows]: https://github.com/git-for-windows/git/releases/latest\n[latest-gcm]: https://aka.ms/gcm/latest\n[wsl-interop]: https://docs.microsoft.com/en-us/windows/wsl/interop\n[linux-installation]: ../README.md#linux\n" }, { "path": "global.json", "content": "{\n \"sdk\": {\n \"rollForward\": \"latestMajor\",\n \"version\": \"8.0\"\n }\n}\n\n" }, { "path": "nuget.config", "content": "\r\n\r\n \r\n \r\n \r\n \r\n\r\n" }, { "path": "src/linux/Directory.Build.props", "content": "\n\n \n \n\n \n \n $(RepoOutPath)linux\\\n $(PlatformOutPath)$(MSBuildProjectName)\\\n $(ProjectOutPath)bin\\\n $(ProjectOutPath)obj\\\n \n\n" }, { "path": "src/linux/Packaging.Linux/Packaging.Linux.csproj", "content": "\n \n \n\n \n net8.0\n false\n \n\n \n false\n /usr/local\n \n\n \n \n \n\n \n \n \n\n \n \n\n \n \n \n \n\n \n \n \n\n \n\n\n" }, { "path": "src/linux/Packaging.Linux/build.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\necho \"Building Packaging.Linux...\"\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nINSTALLER_SRC=\"$SRC/linux/Packaging.Linux\"\nINSTALLER_OUT=\"$OUT/linux/Packaging.Linux\"\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --configuration=*)\n CONFIGURATION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --version=*)\n VERSION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --install-from-source=*)\n INSTALL_FROM_SOURCE=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift # past argument=value\n ;;\n --install-prefix=*)\n INSTALL_PREFIX=\"${i#*=}\"\n shift # past argument=value\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Ensure install prefix exists\nif [ ! -d \"$INSTALL_PREFIX\" ]; then\n mkdir -p \"$INSTALL_PREFIX\"\nfi\n\nif [ ! -z \"$RUNTIME\" ]; then\n echo \"Building for runtime ${RUNTIME}\"\nfi\n\n# Perform pre-execution checks\nCONFIGURATION=\"${CONFIGURATION:=Debug}\"\nif [ -z \"$VERSION\" ]; then\n die \"--version was not set\"\nfi\n\nOUTDIR=\"$INSTALLER_OUT/$CONFIGURATION\"\nPAYLOAD=\"$OUTDIR/payload\"\nSYMBOLS=\"$OUTDIR/payload.sym\"\n\n# Lay out payload\n\"$INSTALLER_SRC/layout.sh\" --configuration=\"$CONFIGURATION\" --runtime=\"$RUNTIME\" --output=\"$PAYLOAD\" --symbol-output=\"$SYMBOLS\" || exit 1\n\nif [ $INSTALL_FROM_SOURCE = true ]; then\n echo \"Installing to $INSTALL_PREFIX\"\n\n # Install directories\n INSTALL_TO=\"$INSTALL_PREFIX/share/gcm-core/\"\n LINK_TO=\"$INSTALL_PREFIX/bin/\"\n\n mkdir -p \"$INSTALL_TO\" \"$LINK_TO\"\n\n # Copy all binaries and shared libraries to target installation location\n cp -R \"$PAYLOAD\"/* \"$INSTALL_TO\" || exit 1\n\n # Create symlink\n if [ ! -f \"$LINK_TO/git-credential-manager\" ]; then\n ln -s -r \"$INSTALL_TO/git-credential-manager\" \\\n \"$LINK_TO/git-credential-manager\" || exit 1\n fi\n\n echo \"Install complete.\"\nelse\n # Pack\n \"$INSTALLER_SRC/pack.sh\" --configuration=\"$CONFIGURATION\" --runtime=\"$RUNTIME\" --payload=\"$PAYLOAD\" --symbols=\"$SYMBOLS\" --version=\"$VERSION\" || exit 1\nfi\n\necho \"Build of Packaging.Linux complete.\"\n" }, { "path": "src/linux/Packaging.Linux/install-from-source.sh", "content": "#!/bin/sh\n\n# Halt execution immediately on failure.\n# Note there are some scenarios in which this will not exit; see\n# https://www.gnu.org/software/bash/manual/html_node/The-Set-Builtin.html\n# for additional details.\nset -e\n\nis_ci=\nfor i in \"$@\"; do\n case \"$i\" in\n -y)\n is_ci=true\n shift # Past argument=value\n ;;\n --install-prefix=*)\n installPrefix=\"${i#*=}\"\n shift # past argument=value\n ;;\n esac\ndone\n\n# If install-prefix is not passed, use default value\nif [ -z \"$installPrefix\" ]; then\n installPrefix=/usr/local\nfi\n\n# Ensure install directory exists\nif [ ! -d \"$installPrefix\" ]; then\n echo \"The folder $installPrefix does not exist\"\n exit\nfi\n\n# In non-ci scenarios, advertise what we will be doing and\n# give user the option to exit.\nif [ -z $is_ci ]; then\n echo \"This script will download, compile, and install Git Credential Manager to:\n\n $installPrefix/bin\n\nGit Credential Manager is licensed under the MIT License: https://aka.ms/gcm/license\"\n\n\twhile true; do\n # Display prompt once before reading input\n printf \"Do you want to continue? [Y/n] \"\n\n # Prefer reading from the controlling terminal (TTY) when available,\n # so that input works even if the script is piped (e.g. curl URL | sh)\n if [ -r /dev/tty ]; then\n read yn < /dev/tty\n # If no TTY is available, attempt to read from standard input (stdin)\n elif ! read yn; then\n # If input is not possible via TTY or stdin, assume a non-interactive environment\n # and abort with guidance for automated usage\n echo \"Interactive prompt unavailable in this environment. Use 'sh -s -- -y' for automated install.\"\n exit 1\n fi\n\n case \"$yn\" in\n [Yy]*|\"\") break ;;\n [Nn]*) exit ;;\n *) echo \"Please answer yes or no.\" ;;\n esac\n done\nfi\n\ninstall_packages() {\n pkg_manager=$1\n install_verb=$2\n packages=$3\n\n for package in $packages; do\n # Ensure we don't stomp on existing installations.\n if type $package >/dev/null 2>&1; then\n continue\n fi\n\n if [ $pkg_manager = apk ]; then\n $sudo_cmd $pkg_manager $install_verb $package\n elif [ $pkg_manager = zypper ]; then\n $sudo_cmd $pkg_manager -n $install_verb $package\n elif [ $pkg_manager = pacman ]; then\n $sudo_cmd $pkg_manager --noconfirm $install_verb $package\n else\n $sudo_cmd $pkg_manager $install_verb $package -y\n fi\n done\n}\n\nensure_dotnet_installed() {\n if [ -z \"$(verify_existing_dotnet_installation)\" ]; then\n curl -LO https://dot.net/v1/dotnet-install.sh\n chmod +x ./dotnet-install.sh\n bash -c \"./dotnet-install.sh --channel 8.0\"\n\n # Since we have to run the dotnet install script with bash, dotnet isn't\n # added to the process PATH, so we manually add it here.\n cd ~\n export DOTNET_ROOT=$(pwd)/.dotnet\n add_to_PATH $DOTNET_ROOT\n fi\n}\n\nverify_existing_dotnet_installation() {\n # Get initial pieces of installed sdk version(s).\n sdks=$(dotnet --list-sdks | cut -c 1-3)\n\n # If we have a supported version installed, return.\n supported_dotnet_versions=\"8.0\"\n for v in $supported_dotnet_versions; do\n if [ $(echo $sdks | grep \"$v\") ]; then\n echo $sdks\n fi\n done\n}\n\nadd_to_PATH () {\n for directory; do\n if [ ! -d \"$directory\" ]; then\n continue; # Skip nonexistent directory.\n fi\n case \":$PATH:\" in\n *\":$directory:\"*)\n break\n ;;\n *)\n export PATH=$PATH:$directory\n ;;\n esac\n done\n}\n\napt_install() {\n pkg_name=$1\n\n $sudo_cmd apt update\n $sudo_cmd apt install $pkg_name -y 2>/dev/null\n}\n\nprint_unsupported_distro() {\n prefix=$1\n distro=$2\n\n echo \"$prefix: $distro is not officially supported by the GCM project.\"\n echo \"See https://gh.io/gcm/linux for details.\"\n}\n\nversion_at_least() {\n\t[ \"$(printf '%s\\n' \"$1\" \"$2\" | sort -V | head -n1)\" = \"$1\" ]\n}\n\nsudo_cmd=\n\n# If the user isn't root, we need to use `sudo` for certain commands\n# (e.g. installing packages).\nif [ -z \"$sudo_cmd\" ]; then\n if [ `id -u` != 0 ]; then\n sudo_cmd=sudo\n fi\nfi\n\neval \"$(sed -n 's/^ID=/distribution=/p' /etc/os-release)\"\neval \"$(sed -n 's/^VERSION_ID=/version=/p' /etc/os-release | tr -d '\"')\"\ncase \"$distribution\" in\n debian | ubuntu)\n $sudo_cmd apt update\n install_packages apt install \"curl git\"\n\n # Install dotnet packages and dependencies if needed.\n if [ -z \"$(verify_existing_dotnet_installation)\" ]; then\n # First try to use native feeds (Ubuntu 22.04 and later).\n if ! apt_install dotnet8; then\n # If the native feeds fail, we fall back to\n # packages.microsoft.com. We begin by adding the dotnet package\n # repository/signing key.\n $sudo_cmd apt update && $sudo_cmd apt install wget -y\n curl -LO https://packages.microsoft.com/config/\"$distribution\"/\"$version\"/packages-microsoft-prod.deb\n $sudo_cmd dpkg -i packages-microsoft-prod.deb\n rm packages-microsoft-prod.deb\n\n # Proactively install tzdata to prevent prompts.\n export DEBIAN_FRONTEND=noninteractive\n $sudo_cmd apt install -y --no-install-recommends tzdata\n\n $sudo_cmd apt update\n $sudo_cmd apt install apt-transport-https -y\n $sudo_cmd apt update\n $sudo_cmd apt install dotnet-sdk-8.0 dpkg-dev -y\n fi\n fi\n ;;\n fedora | centos | rhel | ol)\n $sudo_cmd dnf upgrade -y\n\n # Install dotnet/GCM dependencies.\n install_packages dnf install \"curl git krb5-libs libicu openssl-libs zlib findutils which bash\"\n\n ensure_dotnet_installed\n ;;\n alpine)\n $sudo_cmd apk update\n\n # Install dotnet/GCM dependencies.\n # Alpine 3.14 and earlier need libssl1.1, while later versions need libssl3.\n if ( version_at_least \"3.15\" $version ) then\n libssl_pkg=\"libssl3\"\n else\n libssl_pkg=\"libssl1.1\"\n fi\n\n install_packages apk add \"curl git icu-libs krb5-libs libgcc libintl $libssl_pkg libstdc++ zlib which bash coreutils gcompat\"\n\n ensure_dotnet_installed\n ;;\n sles | opensuse*)\n $sudo_cmd zypper -n update\n\n # Install dotnet/GCM dependencies.\n install_packages zypper install \"curl git find krb5 libicu\"\n\n ensure_dotnet_installed\n ;;\n arch)\n print_unsupported_distro \"WARNING\" \"$distribution\"\n\n # --noconfirm required when running from container\n $sudo_cmd pacman -Syu --noconfirm\n\n # Install dotnet/GCM dependencies.\n install_packages pacman -Sy \"curl git glibc gcc krb5 icu openssl libc++ zlib\"\n\n ensure_dotnet_installed\n ;;\n mariner | azurelinux*)\n print_unsupported_distro \"WARNING\" \"$distribution\"\n $sudo_cmd tdnf update -y\n\n # Install dotnet/GCM dependencies.\n install_packages tdnf install \"curl ca-certificates git krb5-libs libicu openssl-libs zlib findutils which bash awk\"\n\n ensure_dotnet_installed\n ;;\n *)\n print_unsupported_distro \"ERROR\" \"$distribution\"\n exit\n ;;\nesac\n\n# Detect if the script is part of a full source checkout or standalone instead.\nscript_path=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\ntoplevel_path=\"${script_path%/src/linux/Packaging.Linux}\"\nif [ \"z$script_path\" = \"z$toplevel_path\" ] || [ ! -f \"$toplevel_path/Git-Credential-Manager.sln\" ]; then\n toplevel_path=\"$PWD/git-credential-manager\"\n test -d \"$toplevel_path\" || git clone https://github.com/git-ecosystem/git-credential-manager\nfi\n\nif [ -z \"$DOTNET_ROOT\" ]; then\n DOTNET_ROOT=\"$(dirname $(which dotnet))\"\nfi\n\ncd \"$toplevel_path\"\n$sudo_cmd env \"PATH=$PATH\" $DOTNET_ROOT/dotnet build ./src/linux/Packaging.Linux/Packaging.Linux.csproj -c Release -p:InstallFromSource=true -p:installPrefix=$installPrefix\nadd_to_PATH \"$installPrefix/bin\"\n" }, { "path": "src/linux/Packaging.Linux/layout.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\nmake_absolute () {\n case \"$1\" in\n /*)\n echo \"$1\"\n ;;\n *)\n echo \"$PWD/$1\"\n ;;\n esac\n}\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --configuration=*)\n CONFIGURATION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --output=*)\n PAYLOAD=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift # past argument=value\n ;;\n --symbol-output=*)\n SYMBOLOUT=\"${i#*=}\"\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nGCM_SRC=\"$SRC/shared/Git-Credential-Manager\"\nPROJ_OUT=\"$OUT/linux/Packaging.Linux\"\n\n# Build parameters\nFRAMEWORK=net8.0\n\n# Perform pre-execution checks\nCONFIGURATION=\"${CONFIGURATION:=Debug}\"\nif [ -z \"$PAYLOAD\" ]; then\n die \"--output was not set\"\nfi\nif [ -z \"$SYMBOLOUT\" ]; then\n SYMBOLOUT=\"$PAYLOAD.sym\"\nfi\n\n# Cleanup payload directory\nif [ -d \"$PAYLOAD\" ]; then\n echo \"Cleaning existing payload directory '$PAYLOAD'...\"\n rm -rf \"$PAYLOAD\"\nfi\n\n# Cleanup symbol directory\nif [ -d \"$SYMBOLOUT\" ]; then\n echo \"Cleaning existing symbols directory '$SYMBOLOUT'...\"\n rm -rf \"$SYMBOLOUT\"\nfi\n\n# Ensure directories exists\nmkdir -p \"$PAYLOAD\" \"$SYMBOLOUT\"\n\nif [ -z \"$DOTNET_ROOT\" ]; then\n DOTNET_ROOT=\"$(dirname $(which dotnet))\"\nfi\n\n# Publish core application executables\necho \"Publishing core application...\"\nif [ -z \"$RUNTIME\" ]; then\n $DOTNET_ROOT/dotnet publish \"$GCM_SRC\" \\\n --configuration=\"$CONFIGURATION\" \\\n --framework=\"$FRAMEWORK\" \\\n --self-contained \\\n -p:PublishSingleFile=true \\\n --output=\"$(make_absolute \"$PAYLOAD\")\" || exit 1\nelse\n $DOTNET_ROOT/dotnet publish \"$GCM_SRC\" \\\n --configuration=\"$CONFIGURATION\" \\\n --framework=\"$FRAMEWORK\" \\\n --runtime=\"$RUNTIME\" \\\n --self-contained \\\n -p:PublishSingleFile=true \\\n --output=\"$(make_absolute \"$PAYLOAD\")\" || exit 1\nfi\n\n# Collect symbols\necho \"Collecting managed symbols...\"\nmv \"$PAYLOAD\"/*.pdb \"$SYMBOLOUT\" || exit 1\n\necho \"Build complete.\"\n" }, { "path": "src/linux/Packaging.Linux/pack.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nPROJ_OUT=\"$OUT/linux/Packaging.Linux\"\nINSTALLER_SRC=\"$SRC/osx/Installer.Mac\"\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --version=*)\n VERSION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --payload=*)\n PAYLOAD=\"${i#*=}\"\n shift # past argument=value\n ;;\n --symbols=*)\n SYMBOLS=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift # past argument=value\n ;;\n --configuration=*)\n CONFIGURATION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --output=*)\n OUTPUT_ROOT=\"${i#*=}\"\n shift # past argument=value\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Perform pre-execution checks\nCONFIGURATION=\"${CONFIGURATION:=Debug}\"\nif [ -z \"$VERSION\" ]; then\n die \"--version was not set\"\nfi\nif [ -z \"$PAYLOAD\" ]; then\n die \"--payload was not set\"\nelif [ ! -d \"$PAYLOAD\" ]; then\n die \"Could not find '$PAYLOAD'. Did you run layout.sh first?\"\nfi\nif [ -z \"$SYMBOLS\" ]; then\n die \"--symbols was not set\"\nfi\nif [ -z \"$OUTPUT_ROOT\" ]; then\n OUTPUT_ROOT=\"$PROJ_OUT/$CONFIGURATION\"\nfi\n\n# Fall back to host architecture if no explicit runtime is given.\nif test -z \"$RUNTIME\"; then\n HOST_ARCH=\"`uname -m`\"\n\n case $HOST_ARCH in\n x86_64|amd64)\n RUNTIME=\"linux-x64\"\n ;;\n aarch64|arm64)\n RUNTIME=\"linux-arm64\"\n ;;\n armhf)\n RUNTIME=\"linux-arm\"\n ;;\n *)\n die \"Could not determine host architecture! ($HOST_ARCH)\"\n ;;\n esac\nfi\n\nTAROUT=\"$OUTPUT_ROOT/tar\"\nTARBALL=\"$TAROUT/gcm-$RUNTIME-$VERSION.tar.gz\"\nSYMTARBALL=\"$TAROUT/gcm-$RUNTIME-$VERSION-symbols.tar.gz\"\n\nDEBOUT=\"$OUTPUT_ROOT/deb\"\nDEBROOT=\"$DEBOUT/root\"\nDEBPKG=\"$DEBOUT/gcm-$RUNTIME-$VERSION.deb\"\nmkdir -p \"$DEBROOT\"\n\n# Set full read, write, execute permissions for owner and just read and execute permissions for group and other\necho \"Setting file permissions...\"\n/bin/chmod -R 755 \"$PAYLOAD\" || exit 1\n\necho \"Packing Packaging.Linux...\"\n\n# Cleanup any old archive files\nif [ -e \"$TAROUT\" ]; then\n echo \"Deleting old archive '$TAROUT'...\"\n rm \"$TAROUT\"\nfi\n\n# Ensure the parent directory for the archive exists\nmkdir -p \"$TAROUT\" || exit 1\n\n# Build binaries tarball\necho \"Building binaries tarball...\"\npushd \"$PAYLOAD\"\ntar -czvf \"$TARBALL\" * || exit 1\npopd\n\n# Build symbols tarball\necho \"Building symbols tarball...\"\npushd \"$SYMBOLS\"\ntar -czvf \"$SYMTARBALL\" * || exit 1\npopd\n\n# Build .deb\nINSTALL_TO=\"$DEBROOT/usr/local/share/gcm-core/\"\nLINK_TO=\"$DEBROOT/usr/local/bin/\"\nmkdir -p \"$DEBROOT/DEBIAN\" \"$INSTALL_TO\" \"$LINK_TO\" || exit 1\n\n# Determine architecture for debian control file from the runtime architecture\ncase $RUNTIME in\n linux-x64)\n ARCH=\"amd64\"\n ;;\n linux-arm64)\n ARCH=\"arm64\"\n ;;\n linux-arm)\n ARCH=\"armhf\"\n ;;\n *)\n die \"Incompatible runtime architecture given for pack.sh\"\n ;;\nesac\n\n# make the debian control file\n# this is purposefully not indented, see\n# https://stackoverflow.com/questions/9349616/bash-eof-in-if-statement\n# for details\ncat >\"$DEBROOT/DEBIAN/control\" <\nDescription: Cross Platform Git Credential Manager command line utility.\n GCM supports authentication with a number of Git hosting providers\n including GitHub, BitBucket, and Azure DevOps.\n For more information see https://aka.ms/gcm\nEOF\n\n# Copy all binaries and shared libraries to target installation location\ncp -R \"$PAYLOAD\"/* \"$INSTALL_TO\" || exit 1\n\n# Create symlink\nif [ ! -f \"$LINK_TO/git-credential-manager\" ]; then\n ln -s -r \"$INSTALL_TO/git-credential-manager\" \\\n \"$LINK_TO/git-credential-manager\" || exit 1\nfi\n\ndpkg-deb -Zxz --root-owner-group --build \"$DEBROOT\" \"$DEBPKG\" || exit 1\n\necho $MESSAGE\n" }, { "path": "src/osx/.gitignore", "content": "# Xcode\n#\n# gitignore contributors: remember to update Global/Xcode.gitignore, Objective-C.gitignore & Swift.gitignore\n\n## Build generated\nbuild/\nDerivedData/\n\n## Various settings\n*.pbxuser\n!default.pbxuser\n*.mode1v3\n!default.mode1v3\n*.mode2v3\n!default.mode2v3\n*.perspectivev3\n!default.perspectivev3\nxcuserdata/\n\n## Other\n*.moved-aside\n*.xccheckout\n*.xcscmblueprint\n\n## Obj-C/Swift specific\n*.hmap\n*.ipa\n*.dSYM.zip\n*.dSYM\n\n# CocoaPods\n#\n# We recommend against adding the Pods directory to your .gitignore. However\n# you should judge for yourself, the pros and cons are mentioned at:\n# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control\n#\nPods/\n#\n# Add this line if you want to avoid checking in source code from the Xcode workspace\n# *.xcworkspace\n\n# Carthage\n#\n# Add this line if you want to avoid checking in source code from Carthage dependencies.\n# Carthage/Checkouts\n\nCarthage/Build\n\n# fastlane\n#\n# It is recommended to not store the screenshots in the git repo. Instead, use fastlane to re-generate the\n# screenshots whenever they are needed.\n# For more information about the recommended setup visit:\n# https://docs.fastlane.tools/best-practices/source-control/#source-control\n\nfastlane/report.xml\nfastlane/Preview.html\nfastlane/screenshots/**/*.png\nfastlane/test_output\n\n# Code Injection\n#\n# After new code Injection tools there's a generated folder /iOSInjectionProject\n# https://github.com/johnno1962/injectionforxcode\n\niOSInjectionProject/\n" }, { "path": "src/osx/Directory.Build.props", "content": "\n\n \n \n\n \n \n $(RepoOutPath)osx\\\n $(PlatformOutPath)$(MSBuildProjectName)\\\n $(ProjectOutPath)bin\\\n $(ProjectOutPath)obj\\\n \n\n" }, { "path": "src/osx/Installer.Mac/Installer.Mac.csproj", "content": "\n \n \n\n \n net8.0\n false\n \n\n \n \n \n\n \n \n \n\n \n \n\n \n \n \n \n\n \n \n \n\n \n\n\n" }, { "path": "src/osx/Installer.Mac/build.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\necho \"Building Installer.Mac...\"\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nINSTALLER_SRC=\"$SRC/osx/Installer.Mac\"\nINSTALLER_OUT=\"$OUT/osx/Installer.Mac\"\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --configuration=*)\n CONFIGURATION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift\n ;;\n --version=*)\n VERSION=\"${i#*=}\"\n shift # past argument=value\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Perform pre-execution checks\nCONFIGURATION=\"${CONFIGURATION:=Debug}\"\nif [ -z \"$VERSION\" ]; then\n die \"--version was not set\"\nfi\n\nif [ -z \"$RUNTIME\" ]; then\n TEST_RUNTIME=`uname -m`\n case $TEST_RUNTIME in\n \"x86_64\")\n RUNTIME=\"osx-x64\"\n ;;\n \"arm64\")\n RUNTIME=\"osx-arm64\"\n ;;\n *)\n die \"Unknown runtime '$TEST_RUNTIME'\"\n ;;\n esac\nfi\n\nOUTDIR=\"$INSTALLER_OUT/pkg/$CONFIGURATION\"\nPAYLOAD=\"$OUTDIR/payload\"\nCOMPONENTDIR=\"$OUTDIR/components\"\nCOMPONENTOUT=\"$COMPONENTDIR/com.microsoft.gitcredentialmanager.component.pkg\"\nDISTOUT=\"$OUTDIR/gcm-$RUNTIME-$VERSION.pkg\"\n\n# Layout and pack\n\"$INSTALLER_SRC/layout.sh\" --configuration=\"$CONFIGURATION\" --output=\"$PAYLOAD\" --runtime=\"$RUNTIME\" || exit 1\n\"$INSTALLER_SRC/pack.sh\" --payload=\"$PAYLOAD\" --version=\"$VERSION\" --output=\"$COMPONENTOUT\" || exit 1\n\"$INSTALLER_SRC/dist.sh\" --package-path=\"$COMPONENTDIR\" --version=\"$VERSION\" --output=\"$DISTOUT\" --runtime=\"$RUNTIME\" || exit 1\n\necho \"Build of Installer.Mac complete.\"\n" }, { "path": "src/osx/Installer.Mac/codesign.sh", "content": "#!/bin/bash\n\nSIGN_DIR=$1\nDEVELOPER_ID=$2\nENTITLEMENTS_FILE=$3\n\nif [ -z \"$SIGN_DIR\" ]; then\n echo \"error: missing directory argument\"\n exit 1\nelif [ -z \"$DEVELOPER_ID\" ]; then\n echo \"error: missing developer id argument\"\n exit 1\nelif [ -z \"$ENTITLEMENTS_FILE\" ]; then\n echo \"error: missing entitlements file argument\"\n exit 1\nfi\n\n# The codesign command needs the entitlements file to be given as an absolute\n# file path; relative paths can cause issues.\nif [[ \"${ENTITLEMENTS_FILE}\" != /* ]]; then\n echo \"error: entitlements file argument must be an absolute path\"\n exit 1\nfi\n\necho \"======== INPUTS ========\"\necho \"Directory: $SIGN_DIR\"\necho \"Developer ID: $DEVELOPER_ID\"\necho \"Entitlements: $ENTITLEMENTS_FILE\"\necho \"======== END INPUTS ========\"\necho\necho \"======== ENTITLEMENTS ========\"\ncat \"$ENTITLEMENTS_FILE\"\necho \"======== END ENTITLEMENTS ========\"\necho\n\ncd \"$SIGN_DIR\" || exit 1\nfor f in *\ndo\n macho=$(file --mime \"$f\" | grep mach)\n # Runtime sign dylibs and Mach-O binaries\n if [[ $f == *.dylib ]] || [ -n \"$macho\" ];\n then\n echo \"Signing with entitlements and hardening: $f\"\n codesign -s \"$DEVELOPER_ID\" \"$f\" --timestamp --force --options=runtime --entitlements \"$ENTITLEMENTS_FILE\"\n elif [ -d \"$f\" ];\n then\n echo \"Signing files in subdirectory: $f\"\n (\n cd \"$f\" || exit 1\n for i in *\n do\n codesign -s \"$DEVELOPER_ID\" \"$i\" --timestamp --force\n done\n )\n else\n echo \"Signing: $f\"\n codesign -s \"$DEVELOPER_ID\" \"$f\" --timestamp --force\n fi\ndone\n" }, { "path": "src/osx/Installer.Mac/dist.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nINSTALLER_SRC=\"$SRC/osx/Installer.Mac\"\nRESXPATH=\"$INSTALLER_SRC/resources\"\n\n# Product information\nIDENTIFIER=\"com.microsoft.gitcredentialmanager.dist\"\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --version=*)\n VERSION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --package-path=*)\n PACKAGEPATH=\"${i#*=}\"\n shift # past argument=value\n ;;\n --output=*)\n DISTOUT=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift\n ;;\n --identity=*)\n IDENTITY=\"${i#*=}\"\n shift\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Perform pre-execution checks\nif [ -z \"$VERSION\" ]; then\n die \"--version was not set\"\nfi\nif [ -z \"$PACKAGEPATH\" ]; then\n die \"--package-path was not set\"\nelif [ ! -d \"$PACKAGEPATH\" ]; then\n die \"Could not find '$PACKAGEPATH'. Did you run pack.sh first?\"\nfi\nif [ -z \"$DISTOUT\" ]; then\n die \"--output was not set\"\nfi\nif [ -z \"$RUNTIME\" ]; then\n TEST_RUNTIME=`uname -m`\n case $TEST_RUNTIME in\n \"x86_64\")\n RUNTIME=\"osx-x64\"\n ;;\n \"arm64\")\n RUNTIME=\"osx-arm64\"\n ;;\n *)\n die \"Unknown runtime '$TEST_RUNTIME'\"\n ;;\n esac\nfi\n\necho \"Building for runtime '$RUNTIME'\"\n\nif [ \"$RUNTIME\" == \"osx-x64\" ]; then\n DISTPATH=\"$INSTALLER_SRC/distribution.x64.xml\"\nelse\n DISTPATH=\"$INSTALLER_SRC/distribution.arm64.xml\"\nfi\n\n# Cleanup any old package\nif [ -e \"$DISTOUT\" ]; then\n echo \"Deleting old product package '$DISTOUT'...\"\n rm \"$DISTOUT\"\nfi\n\n# Ensure the parent directory for the package exists\nmkdir -p \"$(dirname \"$DISTOUT\")\"\n\n# Build product installer\necho \"Building product package...\"\n/usr/bin/productbuild \\\n --package-path \"$PACKAGEPATH\" \\\n --resources \"$RESXPATH\" \\\n --distribution \"$DISTPATH\" \\\n --identifier \"$IDENTIFIER\" \\\n --version \"$VERSION\" \\\n ${IDENTITY:+\"--sign\"} ${IDENTITY:+\"$IDENTITY\"} \\\n \"$DISTOUT\" || exit 1\n\necho \"Product build complete.\"\n" }, { "path": "src/osx/Installer.Mac/distribution.arm64.xml", "content": "\n\n Git Credential Manager\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n com.microsoft.gitcredentialmanager.component.pkg\n \n\n" }, { "path": "src/osx/Installer.Mac/distribution.x64.xml", "content": "\n\n Git Credential Manager\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n com.microsoft.gitcredentialmanager.component.pkg\n \n\n" }, { "path": "src/osx/Installer.Mac/entitlements.xml", "content": "\n\n\n\n com.apple.security.cs.allow-jit\n \n com.apple.security.cs.allow-unsigned-executable-memory\n \n com.apple.security.cs.disable-library-validation\n \n\n" }, { "path": "src/osx/Installer.Mac/layout.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\nmake_absolute () {\n case \"$1\" in\n /*)\n echo \"$1\"\n ;;\n *)\n echo \"$PWD/$1\"\n ;;\n esac\n}\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nINSTALLER_SRC=\"$SRC/osx/Installer.Mac\"\nGCM_SRC=\"$SRC/shared/Git-Credential-Manager\"\nGCM_UI_SRC=\"$SRC/shared/Git-Credential-Manager.UI.Avalonia\"\n\n# Build parameters\nFRAMEWORK=net8.0\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --configuration=*)\n CONFIGURATION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --output=*)\n PAYLOAD=\"${i#*=}\"\n shift # past argument=value\n ;;\n --runtime=*)\n RUNTIME=\"${i#*=}\"\n shift # past argument=value\n ;;\n --symbol-output=*)\n SYMBOLOUT=\"${i#*=}\"\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Determine a runtime if one was not provided\nif [ -z \"$RUNTIME\" ]; then\n TEST_RUNTIME=`uname -m`\n case $TEST_RUNTIME in\n \"x86_64\")\n RUNTIME=\"osx-x64\"\n ;;\n \"arm64\")\n RUNTIME=\"osx-arm64\"\n ;;\n *)\n die \"Unknown runtime '$TEST_RUNTIME'\"\n ;;\n esac\nfi\n\necho \"Building for runtime '$RUNTIME'\"\n\n# Perform pre-execution checks\nCONFIGURATION=\"${CONFIGURATION:=Debug}\"\nif [ -z \"$PAYLOAD\" ]; then\n\tdie \"--output was not set\"\nfi\nif [ -z \"$SYMBOLOUT\" ]; then\n SYMBOLOUT=\"$PAYLOAD.sym\"\nfi\n\n# Cleanup any old payload directory\nif [ -d \"$PAYLOAD\" ]; then\n echo \"Cleaning old payload directory '$PAYLOAD'...\"\n rm -rf \"$PAYLOAD\"\nfi\n\n# Ensure payload and symbol directories exists\nmkdir -p \"$PAYLOAD\" \"$SYMBOLOUT\"\n\n# Copy uninstaller script\necho \"Copying uninstall script...\"\ncp \"$INSTALLER_SRC/uninstall.sh\" \"$PAYLOAD\" || exit 1\n\n# Publish core application executables\necho \"Publishing core application...\"\ndotnet publish \"$GCM_SRC\" \\\n\t--configuration=\"$CONFIGURATION\" \\\n\t--framework=\"$FRAMEWORK\" \\\n\t--runtime=\"$RUNTIME\" \\\n\t--self-contained \\\n\t--output=\"$(make_absolute \"$PAYLOAD\")\" || exit 1\n\n# Collect symbols\necho \"Collecting managed symbols...\"\nmv \"$PAYLOAD\"/*.pdb \"$SYMBOLOUT\" || exit 1\n\n# Remove any unwanted .DS_Store files\necho \"Removing unnecessary files...\"\nfind \"$PAYLOAD\" -name '*.DS_Store' -type f -delete || exit 1\n\necho \"Layout complete.\"\n" }, { "path": "src/osx/Installer.Mac/notarize.sh", "content": "#!/bin/bash\n\nfor i in \"$@\"\ndo\ncase \"$i\" in\n\t--package=*)\n\tPACKAGE=\"${i#*=}\"\n\tshift # past argument=value\n\t;;\n\t--keychain-profile=*)\n\tKEYCHAIN_PROFILE=\"${i#*=}\"\n\tshift # past argument=value\n\t;;\n\t*)\n\tdie \"unknown option '$i'\"\n\t;;\nesac\ndone\n\nif [ -z \"$PACKAGE\" ]; then\n echo \"error: missing package argument\"\n exit 1\nelif [ -z \"$KEYCHAIN_PROFILE\" ]; then\n echo \"error: missing keychain profile argument\"\n exit 1\nfi\n\n# Exit as soon as any line fails\nset -e\n\n# Send the notarization request\nxcrun notarytool submit -v \"$PACKAGE\" -p \"$KEYCHAIN_PROFILE\" --wait\n\n# Staple the notarization ticket (to allow offline installation)\nxcrun stapler staple -v \"$PACKAGE\"\n" }, { "path": "src/osx/Installer.Mac/pack.sh", "content": "#!/bin/bash\ndie () {\n echo \"$*\" >&2\n exit 1\n}\n\n# Directories\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nROOT=\"$( cd \"$THISDIR\"/../../.. ; pwd -P )\"\nSRC=\"$ROOT/src\"\nOUT=\"$ROOT/out\"\nINSTALLER_SRC=\"$SRC/osx/Installer.Mac\"\n\n# Product information\nIDENTIFIER=\"com.microsoft.gitcredentialmanager\"\nINSTALL_LOCATION=\"/usr/local/share/gcm-core\"\n\n# Parse script arguments\nfor i in \"$@\"\ndo\ncase \"$i\" in\n --version=*)\n VERSION=\"${i#*=}\"\n shift # past argument=value\n ;;\n --payload=*)\n PAYLOAD=\"${i#*=}\"\n shift # past argument=value\n ;;\n --output=*)\n PKGOUT=\"${i#*=}\"\n shift # past argument=value\n ;;\n *)\n # unknown option\n ;;\nesac\ndone\n\n# Perform pre-execution checks\nif [ -z \"$VERSION\" ]; then\n die \"--version was not set\"\nfi\nif [ -z \"$PAYLOAD\" ]; then\n die \"--payload was not set\"\nelif [ ! -d \"$PAYLOAD\" ]; then\n die \"Could not find '$PAYLOAD'. Did you run layout.sh first?\"\nfi\nif [ -z \"$PKGOUT\" ]; then\n die \"--output was not set\"\nfi\n\n# Cleanup any old component\nif [ -e \"$PKGOUT\" ]; then\n echo \"Deleting old component '$PKGOUT'...\"\n rm \"$PKGOUT\"\nfi\n\n# Ensure the parent directory for the component exists\nmkdir -p \"$(dirname \"$PKGOUT\")\"\n\n# Set full read, write, execute permissions for owner and just read and execute permissions for group and other\necho \"Setting file permissions...\"\n/bin/chmod -R 755 \"$PAYLOAD\" || exit 1\n\n# Remove any extended attributes (ACEs)\necho \"Removing extended attributes...\"\n/usr/bin/xattr -rc \"$PAYLOAD\" || exit 1\n\n# Build component packages\necho \"Building core component package...\"\n/usr/bin/pkgbuild \\\n --root \"$PAYLOAD/\" \\\n --install-location \"$INSTALL_LOCATION\" \\\n --scripts \"$INSTALLER_SRC/scripts\" \\\n --identifier \"$IDENTIFIER\" \\\n --version \"$VERSION\" \\\n \"$PKGOUT\" || exit 1\n\necho \"Component pack complete.\"\n" }, { "path": "src/osx/Installer.Mac/resources/en.lproj/conclusion.html", "content": "\n\n \n \n \n \n \n
\n

Git Credential Manager was installed in /usr/local/share/gcm-core and configured for the current user.

\n
\n
\n

Other users

\n

\n GCM has already been automatically configured for use by the current user with Git.\n If other users wish to use GCM, have them run the following command to update their global Git configuration (~/.gitconfig):\n

\n

$ git-credential-manager configure

\n

\n To configure GCM for all users, run the following command to update the system Git configuration:\n

\n

$ git-credential-manager configure --system

\n
\n
\n

Uninstall

\n

If you wish to uninstall GCM, run the following script:

\n

$ /usr/local/share/gcm-core/uninstall.sh

\n
\n
\n

Resources

\n \n
\n \n\n" }, { "path": "src/osx/Installer.Mac/resources/en.lproj/welcome.html", "content": "\n\n \n \n \n \n \n
\n

Git Credential Manager

\n

\n Git Credential Manager is a secure, cross-platform Git credential helper with authentication support for GitHub, Azure Repos, and other popular Git hosting services.\n

\n
\n
\n

Installation notes

\n

\n If you have the old Java-based Git Credential Manager for Mac & Linux installed through Homebrew, it will be unlinked after installation.\n

\n

\n Git Credential Manager will be configured as the Git credential helper for the current user by updating the global Git configuration file (~/.gitconfig).\n

\n
\n
\n

Learn more

\n \n
\n \n\n" }, { "path": "src/osx/Installer.Mac/scripts/postinstall", "content": "#!/bin/bash\nset -e\n\nPACKAGE=$1\nINSTALL_DESTINATION=$2\n\nfunction IsBrewPkgInstalled\n{\n # Check if Homebrew is installed\n /usr/bin/which brew > /dev/null\n if [ $? -eq 0 ]\n then\n # Check if the package has been installed\n brew ls --versions \"$1\" > /dev/null\n if [ $? -eq 0 ]\n then\n return 0\n fi\n fi\n return 1\n}\n\n# Check if Java GCM is present on this system and unlink it should it exist\nif [ -L /usr/local/bin/git-credential-manager ] && IsBrewPkgInstalled \"git-credential-manager\";\nthen\n brew unlink git-credential-manager\nfi\n\n# Create symlink to GCM in /usr/local/bin\nmkdir -p /usr/local/bin\n/bin/ln -Fs \"$INSTALL_DESTINATION/git-credential-manager\" /usr/local/bin/git-credential-manager\n\n# Configure GCM for the current user (running as the current user to avoid root\n# from taking ownership of ~/.gitconfig)\nsudo -u ${USER} \"$INSTALL_DESTINATION/git-credential-manager\" configure\n\nexit 0\n" }, { "path": "src/osx/Installer.Mac/uninstall.sh", "content": "#!/bin/bash\n\nTHISDIR=\"$( cd \"$(dirname \"$0\")\" ; pwd -P )\"\nGCMBIN=\"$THISDIR/git-credential-manager\"\n\n# Ensure we're running as root\nif [ $(id -u) != \"0\" ]\nthen\n\tsudo \"$0\" \"$@\"\n\texit $?\nfi\n\n# Unconfigure (as the current user)\necho \"Unconfiguring credential helper...\"\nsudo -u `/usr/bin/logname` -E \"$GCMBIN\" unconfigure\n\n# Remove symlink\nif [ -L /usr/local/bin/git-credential-manager ]\nthen\n\techo \"Deleting symlink...\"\n\trm /usr/local/bin/git-credential-manager\nelse\n\techo \"No symlink found.\"\nfi\n\n# Remove legacy symlink\nif [ -L /usr/local/bin/git-credential-manager-core ]\nthen\n\techo \"Deleting legacy symlink...\"\n\trm /usr/local/bin/git-credential-manager-core\nelse\n\techo \"No legacy symlink found.\"\nfi\n\n# Forget package installation/delete receipt\necho \"Removing installation receipt...\"\npkgutil --forget com.microsoft.gitcredentialmanager\n\n# Remove application files\nif [ -d \"$THISDIR\" ]\nthen\n\techo \"Deleting application files...\"\n\trm -rf \"$THISDIR\"\nelse\n\techo \"No application files found.\"\nfi\n" }, { "path": "src/shared/Atlassian.Bitbucket/Atlassian.Bitbucket.csproj", "content": "\n\n \n net8.0\n net8.0;net472\n Atlassian.Bitbucket\n Atlassian.Bitbucket\n false\n latest\n \n\n \n \n \n\n \n \n \n\n \n \n \n\n\n" }, { "path": "src/shared/Atlassian.Bitbucket/AuthenticationMethod.cs", "content": "using System;\nnamespace Atlassian.Bitbucket\n{\n public enum AuthenticationMethod\n {\n BasicAuth,\n Sso\n }\n}\n\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketAuthentication.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Net.Http;\nusing System.Text;\nusing System.Threading;\nusing System.Threading.Tasks;\nusing Atlassian.Bitbucket.UI.ViewModels;\nusing Atlassian.Bitbucket.UI.Views;\nusing GitCredentialManager;\nusing GitCredentialManager.Authentication;\nusing GitCredentialManager.Authentication.OAuth;\nusing GitCredentialManager.UI;\n\nnamespace Atlassian.Bitbucket\n{\n\n [Flags]\n public enum AuthenticationModes\n {\n None = 0,\n Basic = 1,\n OAuth = 1 << 1,\n\n All = Basic | OAuth\n }\n public interface IBitbucketAuthentication : IDisposable\n {\n Task GetCredentialsAsync(Uri targetUri, string userName, AuthenticationModes modes);\n Task CreateOAuthCredentialsAsync(InputArguments input);\n Task RefreshOAuthCredentialsAsync(InputArguments input, string refreshToken);\n string GetRefreshTokenServiceName(InputArguments input);\n }\n\n public class CredentialsPromptResult\n {\n public CredentialsPromptResult(AuthenticationModes mode)\n {\n AuthenticationMode = mode;\n }\n\n public CredentialsPromptResult(AuthenticationModes mode, ICredential credential)\n : this(mode)\n {\n Credential = credential;\n }\n\n public AuthenticationModes AuthenticationMode { get; }\n\n public ICredential Credential { get; set; }\n }\n\n public class BitbucketAuthentication : AuthenticationBase, IBitbucketAuthentication\n {\n public static readonly string[] AuthorityIds =\n {\n BitbucketConstants.Id,\n };\n\n private readonly IRegistry _oauth2ClientRegistry;\n\n public BitbucketAuthentication(ICommandContext context)\n : this(context, new OAuth2ClientRegistry(context)) { }\n\n public BitbucketAuthentication(ICommandContext context, IRegistry oauth2ClientRegistry)\n : base(context)\n {\n EnsureArgument.NotNull(oauth2ClientRegistry, nameof(oauth2ClientRegistry));\n this._oauth2ClientRegistry = oauth2ClientRegistry;\n }\n\n public async Task GetCredentialsAsync(Uri targetUri, string userName, AuthenticationModes modes)\n {\n ThrowIfUserInteractionDisabled();\n\n // If we don't have a desktop session/GUI then we cannot offer OAuth since the only\n // supported grant is authcode (i.e, using a web browser; device code is not supported).\n if (!Context.SessionManager.IsDesktopSession)\n {\n modes = modes & ~AuthenticationModes.OAuth;\n }\n\n // If the only supported mode is OAuth then just return immediately\n if (modes == AuthenticationModes.OAuth)\n {\n return new CredentialsPromptResult(AuthenticationModes.OAuth);\n }\n\n // We need at least one mode!\n if (modes == AuthenticationModes.None)\n {\n throw new ArgumentException(@$\"Must specify at least one {nameof(AuthenticationModes)}\", nameof(modes));\n }\n\n // Shell out to the UI helper and show the Bitbucket u/p prompt\n if (Context.Settings.IsGuiPromptsEnabled && Context.SessionManager.IsDesktopSession)\n {\n if (TryFindHelperCommand(out string helperCommand, out string args))\n {\n return await GetCredentialsViaHelperAsync(targetUri, userName, modes, helperCommand, args);\n }\n\n return await GetCredentialsViaUiAsync(targetUri, userName, modes);\n }\n\n return GetCredentialsViaTty(targetUri, userName, modes);\n }\n\n private async Task GetCredentialsViaUiAsync(\n Uri targetUri, string userName, AuthenticationModes modes)\n {\n var viewModel = new CredentialsViewModel(Context.SessionManager)\n {\n ShowOAuth = (modes & AuthenticationModes.OAuth) != 0,\n ShowBasic = (modes & AuthenticationModes.Basic) != 0\n };\n\n if (!BitbucketHelper.IsBitbucketOrg(targetUri))\n {\n viewModel.Url = targetUri;\n }\n\n if (!string.IsNullOrWhiteSpace(userName))\n {\n viewModel.UserName = userName;\n }\n\n await AvaloniaUi.ShowViewAsync(viewModel, GetParentWindowHandle(), CancellationToken.None);\n\n ThrowIfWindowCancelled(viewModel);\n\n switch (viewModel.SelectedMode)\n {\n case AuthenticationModes.OAuth:\n return new CredentialsPromptResult(AuthenticationModes.OAuth);\n\n case AuthenticationModes.Basic:\n return new CredentialsPromptResult(\n AuthenticationModes.Basic,\n new GitCredential(viewModel.UserName, viewModel.Password)\n );\n\n default:\n throw new ArgumentOutOfRangeException(nameof(AuthenticationModes),\n \"Unknown authentication mode\", viewModel.SelectedMode.ToString());\n }\n }\n\n private CredentialsPromptResult GetCredentialsViaTty(Uri targetUri, string userName, AuthenticationModes modes)\n {\n ThrowIfTerminalPromptsDisabled();\n\n switch (modes)\n {\n case AuthenticationModes.Basic:\n Context.Terminal.WriteLine(\"Enter Bitbucket credentials for '{0}'...\", targetUri);\n\n if (!string.IsNullOrWhiteSpace(userName))\n {\n // Don't need to prompt for the username if it has been specified already\n Context.Terminal.WriteLine(\"Username: {0}\", userName);\n }\n else\n {\n // Prompt for username\n userName = Context.Terminal.Prompt(\"Username\");\n }\n\n // Prompt for password\n string password = Context.Terminal.PromptSecret(\"Password\");\n\n return new CredentialsPromptResult(\n AuthenticationModes.Basic,\n new GitCredential(userName, password));\n\n case AuthenticationModes.OAuth:\n return new CredentialsPromptResult(AuthenticationModes.OAuth);\n\n case AuthenticationModes.None:\n throw new ArgumentOutOfRangeException(nameof(modes),\n @$\"At least one {nameof(AuthenticationModes)} must be supplied\");\n\n default:\n var menuTitle = $\"Select an authentication method for '{targetUri}'\";\n var menu = new TerminalMenu(Context.Terminal, menuTitle);\n\n TerminalMenuItem oauthItem = null;\n TerminalMenuItem basicItem = null;\n\n if ((modes & AuthenticationModes.OAuth) != 0) oauthItem = menu.Add(\"OAuth\");\n if ((modes & AuthenticationModes.Basic) != 0) basicItem = menu.Add(\"Username/password\");\n\n // Default to the 'first' choice in the menu\n TerminalMenuItem choice = menu.Show(0);\n\n if (choice == oauthItem) goto case AuthenticationModes.OAuth;\n if (choice == basicItem) goto case AuthenticationModes.Basic;\n\n throw new Exception();\n }\n }\n\n private async Task GetCredentialsViaHelperAsync(\n Uri targetUri, string userName, AuthenticationModes modes, string helperCommand, string args)\n {\n var promptArgs = new StringBuilder(args);\n promptArgs.Append(\"prompt\");\n if (!BitbucketHelper.IsBitbucketOrg(targetUri))\n {\n promptArgs.AppendFormat(\" --url {0}\", QuoteCmdArg(targetUri.ToString()));\n }\n\n if (!string.IsNullOrWhiteSpace(userName))\n {\n promptArgs.AppendFormat(\" --username {0}\", QuoteCmdArg(userName));\n }\n\n if ((modes & AuthenticationModes.Basic) != 0)\n {\n promptArgs.Append(\" --show-basic\");\n }\n\n if ((modes & AuthenticationModes.OAuth) != 0)\n {\n promptArgs.Append(\" --show-oauth\");\n }\n\n IDictionary output = await InvokeHelperAsync(helperCommand, promptArgs.ToString());\n\n if (output.TryGetValue(\"mode\", out string mode) &&\n StringComparer.OrdinalIgnoreCase.Equals(mode, \"oauth\"))\n {\n return new CredentialsPromptResult(AuthenticationModes.OAuth);\n }\n else\n {\n if (!output.TryGetValue(\"username\", out userName))\n {\n throw new Trace2Exception(Context.Trace2, \"Missing username in response\");\n }\n\n if (!output.TryGetValue(\"password\", out string password))\n {\n throw new Trace2Exception(Context.Trace2, \"Missing password in response\");\n }\n\n return new CredentialsPromptResult(\n AuthenticationModes.Basic,\n new GitCredential(userName, password));\n }\n }\n\n public async Task CreateOAuthCredentialsAsync(InputArguments input)\n {\n ThrowIfUserInteractionDisabled();\n\n var browserOptions = new OAuth2WebBrowserOptions\n {\n SuccessResponseHtml = BitbucketResources.AuthenticationResponseSuccessHtml,\n FailureResponseHtmlFormat = BitbucketResources.AuthenticationResponseFailureHtmlFormat\n };\n\n var browser = new OAuth2SystemWebBrowser(Context.SessionManager, browserOptions);\n var oauth2Client = _oauth2ClientRegistry.Get(input);\n\n var authCodeResult = await oauth2Client.GetAuthorizationCodeAsync(browser, CancellationToken.None);\n return await oauth2Client.GetTokenByAuthorizationCodeAsync(authCodeResult, CancellationToken.None);\n }\n\n public async Task RefreshOAuthCredentialsAsync(InputArguments input, string refreshToken)\n {\n var client = _oauth2ClientRegistry.Get(input);\n return await client.GetTokenByRefreshTokenAsync(refreshToken, CancellationToken.None);\n }\n\n public string GetRefreshTokenServiceName(InputArguments input)\n {\n var client = _oauth2ClientRegistry.Get(input);\n return client.GetRefreshTokenServiceName(input);\n }\n\n protected internal virtual bool TryFindHelperCommand(out string command, out string args)\n {\n return TryFindHelperCommand(\n BitbucketConstants.EnvironmentVariables.AuthenticationHelper,\n BitbucketConstants.GitConfiguration.Credential.AuthenticationHelper,\n BitbucketConstants.DefaultAuthenticationHelper,\n out command,\n out args);\n }\n\n private HttpClient _httpClient;\n private HttpClient HttpClient => _httpClient ??= Context.HttpClientFactory.CreateClient();\n\n public void Dispose()\n {\n _httpClient?.Dispose();\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketConstants.cs", "content": "using System;\n\nnamespace Atlassian.Bitbucket\n{\n public static class BitbucketConstants\n {\n public const string Id = \"bitbucket\";\n\n public const string Name = \"Bitbucket\";\n\n public const string DefaultAuthenticationHelper = \"Atlassian.Bitbucket.UI\";\n\n public static class EnvironmentVariables\n {\n public const string AuthenticationHelper = \"GCM_BITBUCKET_HELPER\";\n public const string AuthenticationModes = \"GCM_BITBUCKET_AUTHMODES\";\n public const string AlwaysRefreshCredentials = \"GCM_BITBUCKET_ALWAYS_REFRESH_CREDENTIALS\";\n public const String ValidateStoredCredentials = \"GCM_BITBUCKET_VALIDATE_STORED_CREDENTIALS\";\n }\n\n public static class GitConfiguration\n {\n public static class Credential\n {\n public const string AuthenticationHelper = \"bitbucketHelper\";\n public const string AuthenticationModes = \"bitbucketAuthModes\";\n public const string AlwaysRefreshCredentials = \"bitbucketAlwaysRefreshCredentials\";\n public const string ValidateStoredCredentials = \"bitbucketValidateStoredCredentials\";\n }\n }\n public static class HelpUrls\n {\n public const string DataCenterPasswordReset = \"/passwordreset\";\n public const string DataCenterLogin = \"/login\";\n public const string PasswordReset = \"https://bitbucket.org/account/password/reset/\";\n public const string SignUp = \"https://bitbucket.org/account/signup/\";\n public const string TwoFactor = \"https://support.atlassian.com/bitbucket-cloud/docs/enable-two-step-verification/\";\n }\n\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketHelper.cs", "content": "using System;\nusing Atlassian.Bitbucket.Cloud;\nusing GitCredentialManager;\n\nnamespace Atlassian.Bitbucket\n{\n public static class BitbucketHelper\n {\n public static string GetBaseUri(Uri remoteUri)\n {\n var pathParts = remoteUri.PathAndQuery.Split('/');\n var pathPart = remoteUri.PathAndQuery.StartsWith(\"/\") ? pathParts[1] : pathParts[0];\n var path = !string.IsNullOrWhiteSpace(pathPart) ? \"/\" + pathPart : null;\n return $\"{remoteUri.Scheme}://{remoteUri.Host}:{remoteUri.Port}{path}\";\n }\n\n public static bool IsBitbucketOrg(InputArguments input) \n {\n return IsBitbucketOrg(input.GetRemoteUri());\n }\n\n public static bool IsBitbucketOrg(Uri targetUri)\n {\n return IsBitbucketOrg(targetUri.Host);\n }\n\n public static bool IsBitbucketOrg(string targetHost)\n {\n return StringComparer.OrdinalIgnoreCase.Equals(targetHost, CloudConstants.BitbucketBaseUrlHost);\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketHostProvider.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing Atlassian.Bitbucket.Cloud;\nusing GitCredentialManager;\nusing GitCredentialManager.Authentication.OAuth;\n\nnamespace Atlassian.Bitbucket\n{\n public class BitbucketHostProvider : IHostProvider\n {\n private readonly ICommandContext _context;\n private readonly IBitbucketAuthentication _bitbucketAuth;\n private readonly IRegistry _restApiRegistry;\n\n public BitbucketHostProvider(ICommandContext context)\n : this(context, new BitbucketAuthentication(context), new BitbucketRestApiRegistry(context)) { }\n\n public BitbucketHostProvider(ICommandContext context, IBitbucketAuthentication bitbucketAuth, IRegistry restApiRegistry)\n {\n EnsureArgument.NotNull(context, nameof(context));\n EnsureArgument.NotNull(bitbucketAuth, nameof(bitbucketAuth));\n EnsureArgument.NotNull(restApiRegistry, nameof(restApiRegistry));\n\n _context = context;\n _bitbucketAuth = bitbucketAuth;\n _restApiRegistry = restApiRegistry;\n }\n\n #region IHostProvider\n\n public string Id => BitbucketConstants.Id;\n\n public string Name => BitbucketConstants.Name;\n\n public IEnumerable SupportedAuthorityIds => BitbucketAuthentication.AuthorityIds;\n\n public bool IsSupported(InputArguments input)\n {\n if (input is null)\n {\n return false;\n }\n\n if (input.WwwAuth.Any(x => x.Contains(\"realm=\\\"Atlassian Bitbucket\\\"\", StringComparison.InvariantCultureIgnoreCase)))\n {\n return true;\n }\n\n // Split port number and hostname from host input argument\n if (!input.TryGetHostAndPort(out string hostName, out _))\n {\n return false;\n }\n\n // We do not recommend unencrypted HTTP communications to Bitbucket, but it is possible.\n // Therefore, we report `true` here for HTTP so that we can show a helpful\n // error message for the user in `GetCredentialAsync`.\n return (StringComparer.OrdinalIgnoreCase.Equals(input.Protocol, \"http\") ||\n StringComparer.OrdinalIgnoreCase.Equals(input.Protocol, \"https\")) &&\n hostName.EndsWith(CloudConstants.BitbucketBaseUrlHost, StringComparison.OrdinalIgnoreCase);\n }\n\n public bool IsSupported(HttpResponseMessage response)\n {\n if (response is null)\n {\n return false;\n }\n\n // Identify Bitbucket on-prem instances from the HTTP response using the Atlassian specific header X-AREQUESTID\n var supported = response.Headers.Contains(\"X-AREQUESTID\");\n\n _context.Trace.WriteLine($\"Host is{(supported ? null : \"n't\")} supported as Bitbucket\");\n\n return supported;\n }\n\n public async Task GetCredentialAsync(InputArguments input)\n {\n // We should not allow unencrypted communication and should inform the user\n if (!_context.Settings.AllowUnsafeRemotes &&\n StringComparer.OrdinalIgnoreCase.Equals(input.Protocol, \"http\") &&\n BitbucketHelper.IsBitbucketOrg(input))\n {\n throw new Trace2Exception(_context.Trace2,\n \"Unencrypted HTTP is not recommended for Bitbucket.org. \" +\n \"Ensure the repository remote URL is using HTTPS \" +\n $\"or see {Constants.HelpUrls.GcmUnsafeRemotes} about how to allow unsafe remotes.\");\n }\n\n var authModes = await GetSupportedAuthenticationModesAsync(input);\n\n ICredential credential = await GetStoredCredentials(input, authModes) ??\n await GetRefreshedCredentials(input, authModes);\n return new GetCredentialResult(credential);\n }\n\n private async Task GetStoredCredentials(InputArguments input, AuthenticationModes authModes)\n {\n if (_context.Settings.TryGetSetting(BitbucketConstants.EnvironmentVariables.AlwaysRefreshCredentials,\n Constants.GitConfiguration.Credential.SectionName, BitbucketConstants.GitConfiguration.Credential.AlwaysRefreshCredentials,\n out string alwaysRefreshCredentials) && alwaysRefreshCredentials.ToBooleanyOrDefault(false))\n {\n _context.Trace.WriteLine(\"Ignore stored credentials\");\n return null;\n }\n\n Uri remoteUri = input.GetRemoteUri();\n string credentialService = GetServiceName(remoteUri);\n _context.Trace.WriteLine($\"Look for existing credentials under {credentialService} ...\");\n\n ICredential credentials = _context.CredentialStore.Get(credentialService, input.UserName);\n\n if (credentials == null)\n {\n _context.Trace.WriteLine(\"No stored credentials found\");\n return null;\n }\n\n _context.Trace.WriteLineSecrets($\"Found stored credentials: {credentials.Account}/{{0}}\", new object[] { credentials.Password });\n\n // Check credentials are still valid\n if (!await ValidateCredentialsWork(input, credentials, authModes))\n {\n return null;\n }\n\n return credentials;\n }\n\n private async Task GetRefreshedCredentials(InputArguments input, AuthenticationModes authModes)\n {\n _context.Trace.WriteLine(\"Refresh credentials...\");\n\n // Check for presence of refresh_token entry in credential store\n Uri remoteUri = input.GetRemoteUri();\n var refreshTokenService = GetRefreshTokenServiceName(remoteUri);\n\n _context.Trace.WriteLine(\"Checking for refresh token...\");\n ICredential refreshToken = SupportsOAuth(authModes)\n ? _context.CredentialStore.Get(refreshTokenService, input.UserName)\n : null;\n\n if (refreshToken is null)\n {\n _context.Trace.WriteLine(\"No stored refresh token found\");\n // There is no refresh token either because this is a non-2FA enabled account (where OAuth is not\n // required), or because we previously erased the RT.\n\n _context.Trace.WriteLine(\"Prompt for credentials...\");\n\n var result = await _bitbucketAuth.GetCredentialsAsync(remoteUri, input.UserName, authModes);\n if (result is null || result.AuthenticationMode == AuthenticationModes.None)\n {\n var message = \"User cancelled credential prompt\";\n _context.Trace.WriteLine(message);\n throw new Trace2Exception(_context.Trace2, message);\n }\n\n switch (result.AuthenticationMode)\n {\n case AuthenticationModes.Basic:\n // Return the valid credential\n return result.Credential;\n\n case AuthenticationModes.OAuth:\n // If the user wants to use OAuth fall through to interactive auth\n break;\n\n default:\n throw new ArgumentOutOfRangeException(\n $\"Unexpected {nameof(AuthenticationModes)} returned from prompt\");\n }\n\n // Fall through to the start of the interactive OAuth authentication flow\n }\n else\n {\n _context.Trace.WriteLineSecrets(\"Found stored refresh token: {0}\", new object[] { refreshToken });\n\n try\n {\n return await GetOAuthCredentialsViaRefreshFlow(input, refreshToken);\n }\n catch (OAuth2Exception ex)\n {\n var message = \"Failed to refresh existing OAuth credential using refresh token\";\n _context.Trace.WriteLine(message);\n _context.Trace.WriteException(ex);\n _context.Trace2.WriteError(message);\n\n // We failed to refresh the AT using the RT; log the refresh failure and fall through to restart\n // the OAuth authentication flow\n }\n }\n\n return await GetOAuthCredentialsViaInteractiveBrowserFlow(input);\n }\n\n private async Task GetOAuthCredentialsViaRefreshFlow(InputArguments input, ICredential refreshToken)\n {\n Uri remoteUri = input.GetRemoteUri();\n\n var refreshTokenService = GetRefreshTokenServiceName(remoteUri);\n _context.Trace.WriteLine(\"Refreshing OAuth credentials using refresh token...\");\n\n OAuth2TokenResult refreshResult = await _bitbucketAuth.RefreshOAuthCredentialsAsync(input, refreshToken.Password);\n\n // Resolve the username\n _context.Trace.WriteLine(\"Resolving username for refreshed OAuth credential...\");\n string refreshUserName = await ResolveOAuthUserNameAsync(input, refreshResult.AccessToken);\n _context.Trace.WriteLine($\"Username for refreshed OAuth credential is '{refreshUserName}'\");\n\n // Store the refreshed RT\n _context.Trace.WriteLine(\"Storing new refresh token...\");\n _context.CredentialStore.AddOrUpdate(refreshTokenService, remoteUri.GetUserName(), refreshResult.RefreshToken);\n\n // Return new access token\n return new GitCredential(refreshUserName, refreshResult.AccessToken);\n }\n\n private async Task GetOAuthCredentialsViaInteractiveBrowserFlow(InputArguments input)\n {\n Uri remoteUri = input.GetRemoteUri();\n\n var refreshTokenService = GetRefreshTokenServiceName(remoteUri);\n\n // We failed to use the refresh token either because it didn't exist, or because the refresh token is no\n // longer valid. Either way we must now try authenticating using OAuth interactively.\n\n // Start OAuth authentication flow\n _context.Trace.WriteLine(\"Starting OAuth authentication flow...\");\n OAuth2TokenResult oauthResult = await _bitbucketAuth.CreateOAuthCredentialsAsync(input);\n\n // Resolve the username\n _context.Trace.WriteLine(\"Resolving username for OAuth credential...\");\n string newUserName = await ResolveOAuthUserNameAsync(input, oauthResult.AccessToken);\n _context.Trace.WriteLine($\"Username for OAuth credential is '{newUserName}'\");\n\n // Store the new RT\n _context.Trace.WriteLine(\"Storing new refresh token...\");\n _context.CredentialStore.AddOrUpdate(refreshTokenService, newUserName, oauthResult.RefreshToken);\n _context.Trace.WriteLine(\"Refresh token was successfully stored.\");\n\n // Return the new AT as the credential\n return new GitCredential(newUserName, oauthResult.AccessToken);\n }\n\n private static bool SupportsOAuth(AuthenticationModes authModes)\n {\n return (authModes & AuthenticationModes.OAuth) != 0;\n }\n\n private static bool SupportsBasicAuth(AuthenticationModes authModes)\n {\n return (authModes & AuthenticationModes.Basic) != 0;\n }\n\n public async Task GetSupportedAuthenticationModesAsync(InputArguments input)\n {\n // Check for an explicit override for supported authentication modes\n if (_context.Settings.TryGetSetting(\n BitbucketConstants.EnvironmentVariables.AuthenticationModes,\n Constants.GitConfiguration.Credential.SectionName, BitbucketConstants.GitConfiguration.Credential.AuthenticationModes,\n out string authModesStr))\n {\n if (Enum.TryParse(authModesStr, true, out AuthenticationModes authModes) && authModes != AuthenticationModes.None)\n {\n _context.Trace.WriteLine($\"Supported authentication modes override present: {authModes}\");\n return authModes;\n }\n else\n {\n _context.Trace.WriteLine($\"Invalid value for supported authentication modes override setting: '{authModesStr}'\");\n }\n }\n\n // It isn't possible to detect what Bitbucket.org is expecting so return the predefined answers.\n if (BitbucketHelper.IsBitbucketOrg(input))\n {\n // Bitbucket should use Basic, OAuth or manual PAT based authentication only\n _context.Trace.WriteLine($\"{input.GetRemoteUri()} is bitbucket.org - authentication schemes: '{CloudConstants.DotOrgAuthenticationModes}'\");\n return CloudConstants.DotOrgAuthenticationModes;\n }\n\n // For Bitbucket DC/Server the supported modes can be detected\n _context.Trace.WriteLine($\"{input.GetRemoteUri()} is Bitbucket DC - checking for supported authentication schemes...\");\n\n try\n {\n var authenticationMethods = await _restApiRegistry.Get(input).GetAuthenticationMethodsAsync();\n\n var modes = AuthenticationModes.None;\n\n if (authenticationMethods.Contains(AuthenticationMethod.BasicAuth))\n {\n modes |= AuthenticationModes.Basic;\n }\n\n var isOauthInstalled = await _restApiRegistry.Get(input).IsOAuthInstalledAsync();\n if (isOauthInstalled)\n {\n modes |= AuthenticationModes.OAuth;\n }\n\n _context.Trace.WriteLine($\"Bitbucket DC/Server instance supports authentication schemes: {modes}\");\n return modes;\n }\n catch (Exception ex)\n {\n var format = \"Failed to query '{0}' for supported authentication schemes.\";\n var message = string.Format(format, input.GetRemoteUri());\n\n _context.Trace.WriteLine(message);\n _context.Trace.WriteException(ex);\n _context.Trace2.WriteError(message, format);\n\n _context.Terminal.WriteLine($\"warning: {message}\");\n\n // Fall-back to offering all modes so the user is never blocked from authenticating by at least one mode\n return AuthenticationModes.All;\n }\n }\n\n public Task StoreCredentialAsync(InputArguments input)\n {\n // It doesn't matter if this is an OAuth access token, or the literal username & password\n // because we store them the same way, against the same credential key in the store.\n // The OAuth refresh token is already stored on the 'get' request.\n Uri remoteUri = input.GetRemoteUri();\n string service = GetServiceName(remoteUri);\n\n _context.Trace.WriteLine(\"Storing credential...\");\n _context.CredentialStore.AddOrUpdate(service, input.UserName, input.Password);\n _context.Trace.WriteLine(\"Credential was successfully stored.\");\n\n return Task.CompletedTask;\n }\n\n public Task EraseCredentialAsync(InputArguments input)\n {\n // Erase the stored credential (which may be either the literal username & password, or\n // the OAuth access token). We don't need to erase the OAuth refresh token because on the\n // next 'get' request, if the RT is bad we will erase and reacquire a new one at that point.\n Uri remoteUri = input.GetRemoteUri();\n string service = GetServiceName(remoteUri);\n\n _context.Trace.WriteLine(\"Erasing credential...\");\n if (_context.CredentialStore.Remove(service, input.UserName))\n {\n _context.Trace.WriteLine(\"Credential was successfully erased.\");\n }\n else\n {\n _context.Trace.WriteLine(\"Credential was not erased.\");\n }\n\n return Task.CompletedTask;\n }\n\n #endregion\n\n #region Private Methods\n\n private async Task ResolveOAuthUserNameAsync(InputArguments input, string accessToken)\n {\n RestApiResult result = await _restApiRegistry.Get(input).GetUserInformationAsync(null, accessToken, isBearerToken: true);\n if (result.Succeeded)\n {\n return result.Response.UserName;\n }\n\n throw new Trace2Exception(_context.Trace2,\n $\"Failed to resolve username. HTTP: {result.StatusCode}\");\n }\n\n private async Task ResolveBasicAuthUserNameAsync(InputArguments input, string username, string password)\n {\n RestApiResult result = await _restApiRegistry.Get(input).GetUserInformationAsync(username, password, isBearerToken: false);\n if (result.Succeeded)\n {\n return result.Response.UserName;\n }\n\n throw new Trace2Exception(_context.Trace2,\n $\"Failed to resolve username. HTTP: {result.StatusCode}\");\n }\n\n private async Task ValidateCredentialsWork(InputArguments input, ICredential credentials, AuthenticationModes authModes)\n {\n if (_context.Settings.TryGetSetting(\n BitbucketConstants.EnvironmentVariables.ValidateStoredCredentials,\n Constants.GitConfiguration.Credential.SectionName, BitbucketConstants.GitConfiguration.Credential.ValidateStoredCredentials,\n out string validateStoredCredentials) && !validateStoredCredentials.ToBooleanyOrDefault(true))\n {\n _context.Trace.WriteLine($\"Skipping validation of stored credentials due to {BitbucketConstants.GitConfiguration.Credential.ValidateStoredCredentials} = {validateStoredCredentials}\");\n return true;\n }\n\n if (credentials is null)\n {\n return false;\n }\n\n // TODO: ideally we'd also check if the credentials have expired based on some local metadata\n // (once/if we get such metadata storage), and return false if they have.\n // This would be more efficient than having to make REST API calls to check.\n Uri remoteUri = input.GetRemoteUri();\n _context.Trace.WriteLineSecrets($\"Validate credentials ({credentials.Account}/{{0}}) are fresh for {remoteUri} ...\", new object[] { credentials.Password });\n\n // Bitbucket supports both OAuth + Basic Auth unless there is explicit GCM configuration.\n // The credentials could be for either scheme therefore need to potentially test both possibilities.\n if (SupportsOAuth(authModes))\n {\n try\n {\n await ResolveOAuthUserNameAsync(input, credentials.Password);\n _context.Trace.WriteLine(\"Validated existing credentials using OAuth\");\n return true;\n }\n catch (Exception ex)\n {\n var message = \"Failed to validate existing credentials using OAuth\";\n _context.Trace.WriteLine(message);\n _context.Trace.WriteException(ex);\n _context.Trace2.WriteError(message);\n }\n }\n\n if (SupportsBasicAuth(authModes))\n {\n try\n {\n await ResolveBasicAuthUserNameAsync(input, credentials.Account, credentials.Password);\n _context.Trace.WriteLine(\"Validated existing credentials using BasicAuth\");\n return true;\n }\n catch (Exception ex)\n {\n var message = \"Failed to validate existing credentials using Basic Auth\";\n _context.Trace.WriteLine(message);\n _context.Trace.WriteException(ex);\n _context.Trace2.WriteError(message);\n return false;\n }\n }\n\n return true;\n }\n\n private static string GetServiceName(Uri remoteUri)\n {\n return remoteUri.WithoutUserInfo().AbsoluteUri.TrimEnd('/');\n }\n\n internal /* for testing */ static string GetRefreshTokenServiceName(Uri remoteUri)\n {\n Uri baseUri = remoteUri.WithoutUserInfo();\n\n // The refresh token key never includes the path component.\n // Instead we use the path component to specify this is the \"refresh_token\".\n Uri uri = new UriBuilder(baseUri) { Path = \"/refresh_token\" }.Uri;\n\n return uri.AbsoluteUri.TrimEnd('/');\n }\n\n #endregion\n\n public void Dispose()\n {\n _restApiRegistry.Dispose();\n _bitbucketAuth.Dispose();\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketOAuth2Client.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Net.Http;\nusing System.Threading;\nusing System.Threading.Tasks;\nusing GitCredentialManager;\nusing GitCredentialManager.Authentication.OAuth;\n\nnamespace Atlassian.Bitbucket\n{\n public abstract class BitbucketOAuth2Client : OAuth2Client\n {\n public BitbucketOAuth2Client(HttpClient httpClient,\n OAuth2ServerEndpoints endpoints,\n string clientId,\n Uri redirectUri,\n string clientSecret,\n ITrace2 trace2) : base(httpClient, endpoints, clientId, trace2, redirectUri, clientSecret, false)\n {\n }\n\n public abstract IEnumerable Scopes { get; }\n\n public string GetRefreshTokenServiceName(InputArguments input)\n {\n Uri baseUri = input.GetRemoteUri(includeUser: false);\n\n // The refresh token key never includes the path component.\n // Instead we use the path component to specify this is the \"refresh_token\".\n Uri uri = new UriBuilder(baseUri) { Path = \"/refresh_token\" }.Uri;\n\n return uri.AbsoluteUri.TrimEnd('/');\n }\n\n public Task GetAuthorizationCodeAsync(IOAuth2WebBrowser browser, CancellationToken ct)\n {\n return this.GetAuthorizationCodeAsync(Scopes, browser, ct);\n }\n\n protected override bool TryCreateTokenEndpointResult(string json, out OAuth2TokenResult result)\n {\n // We override the token endpoint response parsing because the Bitbucket authority returns\n // the non-standard 'scopes' property for the list of scopes, rather than the (optional)\n // 'scope' (note the singular vs plural) property as outlined in the standard.\n if (TryDeserializeJson(json, out BitbucketTokenEndpointResponseJson jsonObj))\n {\n result = jsonObj.ToResult();\n return true;\n }\n\n result = null;\n return false;\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketResources.Designer.cs", "content": "//------------------------------------------------------------------------------\n// \n// This code was generated by a tool.\n// Runtime Version:4.0.30319.42000\n//\n// Changes to this file may cause incorrect behavior and will be lost if\n// the code is regenerated.\n// \n//------------------------------------------------------------------------------\n\nnamespace Atlassian.Bitbucket {\n using System;\n \n \n [System.CodeDom.Compiler.GeneratedCodeAttribute(\"System.Resources.Tools.StronglyTypedResourceBuilder\", \"4.0.0.0\")]\n [System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [System.Runtime.CompilerServices.CompilerGeneratedAttribute()]\n internal class BitbucketResources {\n \n private static System.Resources.ResourceManager resourceMan;\n \n private static System.Globalization.CultureInfo resourceCulture;\n \n [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute(\"Microsoft.Performance\", \"CA1811:AvoidUncalledPrivateCode\")]\n internal BitbucketResources() {\n }\n \n [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]\n internal static System.Resources.ResourceManager ResourceManager {\n get {\n if (object.Equals(null, resourceMan)) {\n System.Resources.ResourceManager temp = new System.Resources.ResourceManager(\"Atlassian.Bitbucket.BitbucketResources\", typeof(BitbucketResources).Assembly);\n resourceMan = temp;\n }\n return resourceMan;\n }\n }\n \n [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]\n internal static System.Globalization.CultureInfo Culture {\n get {\n return resourceCulture;\n }\n set {\n resourceCulture = value;\n }\n }\n \n internal static string AuthenticationResponseSuccessHtml {\n get {\n return ResourceManager.GetString(\"AuthenticationResponseSuccessHtml\", resourceCulture);\n }\n }\n \n internal static string AuthenticationResponseFailureHtmlFormat {\n get {\n return ResourceManager.GetString(\"AuthenticationResponseFailureHtmlFormat\", resourceCulture);\n }\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketResources.resx", "content": "\n\n\n \n \n\n \n \n \n text/microsoft-resx\n \n \n 1.3\n \n \n System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n \n System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n \n\n\n \n Bitbucket Authentication\n \n \n \n\n\n\t
\n\t\t\"Bitbucket\"\n
\n
\n
\n

Authentication Successful

\n

Git Credential Manager has been successfully authenticated. You may now close this page.

\n
\n
\n
\n \n
\n\n]]>\n \n\n\n \n Bitbucket Authentication\n \n \n\t\n\t\n\n\n\t
\n\t\t\"Bitbucket\"\n
\n
\n
\n
\n\t\t\t\t\t\t

Authentication Failed

\n\t\t\t\t\t\t

Git Credential Manager failed to be authenticated.

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
Error
\n\t\t\t\t\t\t\t
{0}\n\t\t\t\t\t\t\t
Description
\n\t\t\t\t\t\t\t
{1}\n\t\t\t\t\t\t\t
URL
\n\t\t\t\t\t\t\t
{2}\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\n
\n \n
\n\n]]>\n\n" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketRestApiRegistry.cs", "content": "using Atlassian.Bitbucket.Cloud;\nusing GitCredentialManager;\n\nnamespace Atlassian.Bitbucket\n{\n public class BitbucketRestApiRegistry : IRegistry\n {\n private readonly ICommandContext context;\n private BitbucketRestApi cloudApi;\n private DataCenter.BitbucketRestApi dataCenterApi;\n\n public BitbucketRestApiRegistry(ICommandContext context)\n {\n this.context = context;\n }\n\n public IBitbucketRestApi Get(InputArguments input)\n {\n if(!BitbucketHelper.IsBitbucketOrg(input))\n {\n return DataCenterApi;\n }\n\n return CloudApi;\n }\n\n public void Dispose()\n {\n context.Dispose();\n cloudApi?.Dispose();\n dataCenterApi?.Dispose();\n }\n\n private Cloud.BitbucketRestApi CloudApi => cloudApi ??= new Cloud.BitbucketRestApi(context);\n private DataCenter.BitbucketRestApi DataCenterApi => dataCenterApi ??= new DataCenter.BitbucketRestApi(context);\n }\n}" }, { "path": "src/shared/Atlassian.Bitbucket/BitbucketTokenEndpointResponseJson.cs", "content": "using System;\nusing System.Text.Json;\nusing GitCredentialManager.Authentication.OAuth.Json;\nusing System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket\n{\n [JsonConverter(typeof(BitbucketCustomTokenEndpointResponseJsonConverter))]\n public class BitbucketTokenEndpointResponseJson : TokenEndpointResponseJson\n {\n // To ensure the \"scopes\" property used by Bitbucket is deserialized successfully with System.Text.Json, we must\n // use a custom converter. Otherwise, ordering will matter (i.e. if \"scopes\" is the final property, its value\n // will be used, but if \"scope\" is the final property, its value will be used).\n }\n\n public class BitbucketCustomTokenEndpointResponseJsonConverter : JsonConverter\n {\n public override BitbucketTokenEndpointResponseJson Read(\n ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)\n {\n if (reader.TokenType != JsonTokenType.StartObject)\n {\n throw new JsonException();\n }\n\n var response = new BitbucketTokenEndpointResponseJson();\n\n while (reader.Read())\n {\n if (reader.TokenType == JsonTokenType.EndObject)\n {\n return response;\n }\n\n if (reader.TokenType == JsonTokenType.PropertyName)\n {\n var propertyName = reader.GetString();\n reader.Read();\n if (propertyName != null)\n {\n switch (propertyName)\n {\n case \"access_token\":\n response.AccessToken = reader.GetString();\n break;\n case \"token_type\":\n response.TokenType = reader.GetString();\n break;\n case \"expires_in\":\n if (reader.TryGetUInt32(out var expiration))\n response.ExpiresIn = expiration;\n else\n response.ExpiresIn = null;\n break;\n case \"refresh_token\":\n response.RefreshToken = reader.GetString();\n break;\n case \"scopes\":\n response.Scope = reader.GetString();\n break;\n }\n }\n }\n }\n\n throw new JsonException();\n }\n\n public override void Write(\n Utf8JsonWriter writer, BitbucketTokenEndpointResponseJson tokenEndpointResponseJson, JsonSerializerOptions options)\n { }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/Cloud/BitbucketOAuth2Client.cs", "content": "// Copyright (c) Microsoft Corporation. All rights reserved.\n// Licensed under the MIT license.\nusing System;\nusing System.Collections.Generic;\nusing System.Net.Http;\nusing GitCredentialManager;\nusing GitCredentialManager.Authentication.OAuth;\n\nnamespace Atlassian.Bitbucket.Cloud\n{\n public class BitbucketOAuth2Client : Bitbucket.BitbucketOAuth2Client\n {\n public BitbucketOAuth2Client(HttpClient httpClient, ISettings settings, ITrace2 trace2)\n : base(httpClient, GetEndpoints(),\n GetClientId(settings), GetRedirectUri(settings), GetClientSecret(settings), trace2)\n {\n }\n\n public override IEnumerable Scopes => new string[] {\n CloudConstants.OAuthScopes.RepositoryWrite,\n CloudConstants.OAuthScopes.Account,\n };\n\n private static string GetClientId(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n CloudConstants.EnvironmentVariables.OAuthClientId,\n Constants.GitConfiguration.Credential.SectionName, CloudConstants.GitConfiguration.Credential.OAuthClientId,\n out string clientId))\n {\n return clientId;\n }\n\n return CloudConstants.OAuth2ClientId;\n }\n\n private static Uri GetRedirectUri(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n CloudConstants.EnvironmentVariables.OAuthRedirectUri,\n Constants.GitConfiguration.Credential.SectionName, CloudConstants.GitConfiguration.Credential.OAuthRedirectUri,\n out string redirectUriStr) && Uri.TryCreate(redirectUriStr, UriKind.Absolute, out Uri redirectUri))\n {\n return redirectUri;\n }\n\n return CloudConstants.OAuth2RedirectUri;\n }\n\n private static string GetClientSecret(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n CloudConstants.EnvironmentVariables.OAuthClientSecret,\n Constants.GitConfiguration.Credential.SectionName, CloudConstants.GitConfiguration.Credential.OAuthClientSecret,\n out string clientSecret))\n {\n return clientSecret;\n }\n\n return CloudConstants.OAuth2ClientSecret;\n }\n\n private static OAuth2ServerEndpoints GetEndpoints()\n {\n return new OAuth2ServerEndpoints(\n CloudConstants.OAuth2AuthorizationEndpoint,\n CloudConstants.OAuth2TokenEndpoint\n );\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/Cloud/BitbucketRestApi.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing GitCredentialManager;\nusing System.Text.Json;\nusing System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket.Cloud\n{\n public class BitbucketRestApi : IBitbucketRestApi\n {\n private readonly ICommandContext _context;\n private readonly Uri _apiUri = CloudConstants.BitbucketApiUri;\n\n public BitbucketRestApi(ICommandContext context)\n {\n EnsureArgument.NotNull(context, nameof(context));\n\n _context = context;\n }\n\n public async Task> GetUserInformationAsync(string userName, string password, bool isBearerToken)\n {\n var requestUri = new Uri(_apiUri, \"2.0/user\");\n using (HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUri))\n {\n if (isBearerToken)\n {\n request.AddBearerAuthenticationHeader(password);\n }\n else\n {\n request.AddBasicAuthenticationHeader(userName, password);\n }\n\n _context.Trace.WriteLine($\"HTTP: GET {requestUri}\");\n using (HttpResponseMessage response = await HttpClient.SendAsync(request))\n {\n _context.Trace.WriteLine($\"HTTP: Response {(int) response.StatusCode} [{response.StatusCode}]\");\n\n string json = await response.Content.ReadAsStringAsync();\n\n if (response.IsSuccessStatusCode)\n {\n var obj = JsonSerializer.Deserialize(json,\n new JsonSerializerOptions\n {\n PropertyNameCaseInsensitive = true,\n });\n\n return new RestApiResult(response.StatusCode, obj);\n }\n\n return new RestApiResult(response.StatusCode);\n }\n }\n }\n\n public Task IsOAuthInstalledAsync()\n {\n return Task.FromResult(true);\n }\n\n public Task> GetAuthenticationMethodsAsync()\n {\n // For Bitbucket Cloud there is no REST API to determine login methods\n // instead this is determined later in the process by attempting\n // authenticated REST API requests and checking the response.\n return Task.FromResult(new List());\n }\n\n private HttpClient _httpClient;\n private HttpClient HttpClient => _httpClient ??= _context.HttpClientFactory.CreateClient();\n\n public void Dispose()\n {\n _httpClient?.Dispose();\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/Cloud/CloudConstants.cs", "content": "using System;\n\nnamespace Atlassian.Bitbucket.Cloud\n{\n public static class CloudConstants\n {\n public const string BitbucketBaseUrlHost = \"bitbucket.org\";\n public static readonly Uri BitbucketApiUri = new Uri(\"https://api.bitbucket.org\");\n\n // TODO: use the GCM client ID and secret once we have this approved.\n // Until then continue to use Sourcetree's values like GCM Windows.\n //public const string OAuth2ClientId = \"b5AKdPfpgFdEGpKzPE\";\n //public const string OAuth2ClientSecret = \"7NUP5qUtSR3SxdFK4xAGaU6PMNvNdE59\";\n //public static readonly Uri OAuth2RedirectUri = new Uri(\"http://localhost:46337/\");\n public const string OAuth2ClientId = \"HJdmKXV87DsmC9zSWB\";\n public const string OAuth2ClientSecret = \"wwWw47VB9ZHwMsD4Q4rAveHkbxNrMp3n\";\n public static readonly Uri OAuth2RedirectUri = new Uri(\"http://localhost:34106/\");\n\n public static readonly Uri OAuth2AuthorizationEndpoint = new Uri(\"https://bitbucket.org/site/oauth2/authorize\");\n public static readonly Uri OAuth2TokenEndpoint = new Uri(\"https://bitbucket.org/site/oauth2/access_token\");\n\n public static class OAuthScopes\n {\n public const string RepositoryWrite = \"repository:write\";\n public const string Account = \"account\";\n }\n\n /// \n /// Supported authentication modes for Bitbucket.org\n /// \n public const AuthenticationModes DotOrgAuthenticationModes = AuthenticationModes.Basic | AuthenticationModes.OAuth;\n\n public static class EnvironmentVariables\n {\n public const string OAuthClientId = \"GCM_BITBUCKET_CLOUD_CLIENTID\";\n public const string OAuthClientSecret = \"GCM_BITBUCKET_CLOUD_CLIENTSECRET\";\n public const string OAuthRedirectUri = \"GCM_BITBUCKET_CLOUD_OAUTH_REDIRECTURI\";\n }\n\n public static class GitConfiguration\n {\n public static class Credential\n {\n public const string OAuthClientId = \"cloudOAuthClientId\";\n public const string OAuthClientSecret = \"cloudOAuthClientSecret\";\n public const string OAuthRedirectUri = \"cloudOauthRedirectUri\";\n }\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/Cloud/UserInfo.cs", "content": "using System;\nusing System.Text.Json;\nusing System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket.Cloud\n{\n public class UserInfo : IUserInfo\n {\n [JsonPropertyName(\"username\")]\n public string UserName { get; set; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/BitbucketOAuth2Client.cs", "content": "// Copyright (c) Microsoft Corporation. All rights reserved.\n// Licensed under the MIT license.\nusing System;\nusing System.Collections.Generic;\nusing System.Net.Http;\nusing System.Threading;\nusing System.Threading.Tasks;\nusing GitCredentialManager;\nusing GitCredentialManager.Authentication.OAuth;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public class BitbucketOAuth2Client : Bitbucket.BitbucketOAuth2Client\n {\n public BitbucketOAuth2Client(HttpClient httpClient, ISettings settings, ITrace2 trace2)\n : base(httpClient, GetEndpoints(settings),\n GetClientId(settings), GetRedirectUri(settings), GetClientSecret(settings), trace2)\n {\n }\n\n public override IEnumerable Scopes => new string[] {\n DataCenterConstants.OAuthScopes.PublicRepos,\n DataCenterConstants.OAuthScopes.RepoRead,\n DataCenterConstants.OAuthScopes.RepoWrite\n };\n\n private static string GetClientId(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n DataCenterConstants.EnvironmentVariables.OAuthClientId,\n Constants.GitConfiguration.Credential.SectionName, DataCenterConstants.GitConfiguration.Credential.OAuthClientId,\n out string clientId))\n {\n return clientId;\n }\n\n throw new ArgumentException(\"Bitbucket DC OAuth Client ID must be defined\");\n }\n\n private static Uri GetRedirectUri(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n DataCenterConstants.EnvironmentVariables.OAuthRedirectUri,\n Constants.GitConfiguration.Credential.SectionName, DataCenterConstants.GitConfiguration.Credential.OAuthRedirectUri,\n out string redirectUriStr) && Uri.TryCreate(redirectUriStr, UriKind.Absolute, out Uri redirectUri))\n {\n return redirectUri;\n }\n\n return DataCenterConstants.OAuth2RedirectUri;\n }\n\n private static string GetClientSecret(ISettings settings)\n {\n // Check for developer override value\n if (settings.TryGetSetting(\n DataCenterConstants.EnvironmentVariables.OAuthClientSecret,\n Constants.GitConfiguration.Credential.SectionName, DataCenterConstants.GitConfiguration.Credential.OAuthClientSecret,\n out string clientSecret))\n {\n return clientSecret;\n }\n\n throw new ArgumentException(\"Bitbucket DC OAuth Client Secret must be defined\");\n }\n\n private static OAuth2ServerEndpoints GetEndpoints(ISettings settings)\n {\n var remoteUri = settings.RemoteUri;\n if (remoteUri == null)\n {\n throw new ArgumentException(\"RemoteUri must be defined to generate Bitbucket DC OAuth2 endpoint Urls\");\n }\n\n return new OAuth2ServerEndpoints(\n new Uri(BitbucketHelper.GetBaseUri(remoteUri) + \"/rest/oauth2/latest/authorize\"),\n new Uri(BitbucketHelper.GetBaseUri(remoteUri) + \"/rest/oauth2/latest/token\")\n );\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/BitbucketRestApi.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Net;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing GitCredentialManager;\nusing System.Text.Json;\nusing System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public class BitbucketRestApi : IBitbucketRestApi\n {\n private readonly ICommandContext _context;\n\n private HttpClient _httpClient;\n\n public BitbucketRestApi(ICommandContext context)\n {\n EnsureArgument.NotNull(context, nameof(context));\n\n _context = context;\n\n }\n\n public async Task> GetUserInformationAsync(string userName, string password, bool isBearerToken)\n {\n if (_context.Settings.TryGetSetting(\n BitbucketConstants.EnvironmentVariables.ValidateStoredCredentials,\n Constants.GitConfiguration.Credential.SectionName, BitbucketConstants.GitConfiguration.Credential.ValidateStoredCredentials,\n out string validateStoredCredentials) && !validateStoredCredentials.ToBooleanyOrDefault(true))\n {\n _context.Trace.WriteLine($\"Skipping retreival of user information due to {BitbucketConstants.GitConfiguration.Credential.ValidateStoredCredentials} = {validateStoredCredentials}\");\n return new RestApiResult(HttpStatusCode.OK, new UserInfo() { UserName = DataCenterConstants.OAuthUserName });;\n }\n\n // Bitbucket Server/DC doesn't actually provide a REST API we can use to trade an access_token for the owning username,\n // therefore this is always going to return a placeholder username, however this call does provide a way to validate the\n // credentials we do have\n var requestUri = new Uri(ApiUri, \"api/1.0/users\");\n using (HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUri))\n {\n if (isBearerToken)\n {\n request.AddBearerAuthenticationHeader(password);\n }\n else\n {\n request.AddBasicAuthenticationHeader(userName, password);\n }\n\n _context.Trace.WriteLine($\"HTTP: GET {requestUri}\");\n using (HttpResponseMessage response = await HttpClient.SendAsync(request))\n {\n _context.Trace.WriteLine($\"HTTP: Response {(int) response.StatusCode} [{response.StatusCode}]\");\n\n string json = await response.Content.ReadAsStringAsync();\n\n if (response.IsSuccessStatusCode)\n {\n // No REST API in BBS that can be used to return just my user account based on my login AFAIK.\n // but we can prove the credentials work.\n return new RestApiResult(HttpStatusCode.OK, new UserInfo() { UserName = DataCenterConstants.OAuthUserName });\n }\n\n return new RestApiResult(response.StatusCode);\n }\n }\n\n }\n\n public async Task IsOAuthInstalledAsync()\n {\n var requestUri = new Uri(ApiUri.AbsoluteUri + \"oauth2/1.0/client\");\n using (HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUri))\n {\n _context.Trace.WriteLine($\"HTTP: GET {requestUri}\");\n using (HttpResponseMessage response = await HttpClient.SendAsync(request))\n {\n _context.Trace.WriteLine($\"HTTP: Response {(int)response.StatusCode} [{response.StatusCode}]\");\n\n if (HttpStatusCode.Unauthorized == response.StatusCode)\n {\n // accessed anonymously so no access but it does exist.\n return true;\n }\n\n return false;\n }\n }\n }\n\n public async Task> GetAuthenticationMethodsAsync()\n {\n var authenticationMethods = new List();\n\n var requestUri = new Uri(ApiUri.AbsoluteUri + \"authconfig/1.0/login-options\");\n using (HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUri))\n {\n _context.Trace.WriteLine($\"HTTP: GET {requestUri}\");\n using (HttpResponseMessage response = await HttpClient.SendAsync(request))\n {\n _context.Trace.WriteLine($\"HTTP: Response {(int)response.StatusCode} [{response.StatusCode}]\");\n\n string json = await response.Content.ReadAsStringAsync();\n\n if (response.IsSuccessStatusCode)\n {\n var loginOptions = JsonSerializer.Deserialize(json,\n new JsonSerializerOptions\n {\n PropertyNameCaseInsensitive = true,\n DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull\n });\n\n if (loginOptions.Results.Any(r => \"LOGIN_FORM\".Equals(r.Type)))\n {\n authenticationMethods.Add(AuthenticationMethod.BasicAuth);\n }\n\n if (loginOptions.Results.Any(r => \"IDP\".Equals(r.Type)))\n {\n authenticationMethods.Add(AuthenticationMethod.Sso);\n }\n }\n }\n }\n\n return authenticationMethods;\n }\n\n public void Dispose()\n {\n _httpClient?.Dispose();\n }\n\n private HttpClient HttpClient => _httpClient ??= _context.HttpClientFactory.CreateClient();\n\n private Uri ApiUri\n {\n get\n {\n var remoteUri = _context.Settings?.RemoteUri;\n if (remoteUri == null)\n {\n throw new ArgumentException(\"RemoteUri must be defined to generate Bitbucket DC OAuth2 endpoint Urls\");\n }\n\n return new Uri(BitbucketHelper.GetBaseUri(remoteUri) + \"/rest/\");\n }\n }\n }\n}" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/DataCenterConstants.cs", "content": "using System;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public static class DataCenterConstants\n {\n public static class OAuthScopes\n {\n public const string PublicRepos = \"PUBLIC_REPOS\";\n public const string RepoWrite = \"REPO_WRITE\";\n public const string RepoRead = \"REPO_READ\";\n }\n\n public static readonly Uri OAuth2RedirectUri = new Uri(\"http://localhost:34106/\");\n\n /// \n /// Supported authentication modes for Bitbucket Server/DC\n /// \n public const AuthenticationModes ServerAuthenticationModes = AuthenticationModes.Basic | AuthenticationModes.OAuth;\n\n /// \n /// Bitbucket Server/DC does not have a REST API we can use to trade an OAuth access_token for the owning username.\n /// However one is needed to construct the Basic Auth request made by Git HTTP requests, therefore use a hardcoded\n /// placeholder for the username.\n /// \n public const string OAuthUserName = \"OAUTH_USERNAME\";\n\n public static class EnvironmentVariables\n {\n public const string OAuthClientId = \"GCM_BITBUCKET_DATACENTER_CLIENTID\";\n public const string OAuthClientSecret = \"GCM_BITBUCKET_DATACENTER_CLIENTSECRET\";\n public const string OAuthRedirectUri = \"GCM_BITBUCKET_DATACENTER_OAUTH_REDIRECTURI\";\n }\n\n public static class GitConfiguration\n {\n public static class Credential\n {\n public const string OAuthClientId = \"bitbucketDataCenterOAuthClientId\";\n public const string OAuthClientSecret = \"bitbucketDataCenterOAuthClientSecret\";\n public const string OAuthRedirectUri = \"bitbucketDataCenterOauthRedirectUri\";\n }\n }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/LoginOption.cs", "content": "using System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public class LoginOption\n {\n [JsonPropertyName(\"type\")]\n public string Type { get ; set; }\n\n [JsonPropertyName(\"id\")]\n public int Id { get; set; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/LoginOptions.cs", "content": "using System.Collections.Generic;\nusing System.Text.Json.Serialization;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public class LoginOptions\n {\n [JsonPropertyName(\"results\")]\n public List Results { get; set; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/DataCenter/UserInfo.cs", "content": "using System;\n\nnamespace Atlassian.Bitbucket.DataCenter\n{\n public class UserInfo : IUserInfo\n {\n public string UserName { get; set; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/IBitbucketRestApi.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Threading.Tasks;\n\nnamespace Atlassian.Bitbucket\n{\n public interface IBitbucketRestApi : IDisposable\n {\n Task> GetUserInformationAsync(string userName, string password, bool isBearerToken);\n Task IsOAuthInstalledAsync();\n Task> GetAuthenticationMethodsAsync();\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/IRegistry.cs", "content": "using System;\nusing GitCredentialManager;\n\nnamespace Atlassian.Bitbucket\n{\n public interface IRegistry : IDisposable\n {\n T Get(InputArguments input);\n }\n}" }, { "path": "src/shared/Atlassian.Bitbucket/IUserInfo.cs", "content": "using System;\nnamespace Atlassian.Bitbucket\n{\n public interface IUserInfo\n {\n string UserName{ get; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/InternalsVisibleTo.cs", "content": "using System.Runtime.CompilerServices;\n\n[assembly: InternalsVisibleTo(\"Atlassian.Bitbucket.Tests\")]\n" }, { "path": "src/shared/Atlassian.Bitbucket/OAuth2ClientRegistry.cs", "content": "using System.Net.Http;\nusing GitCredentialManager;\n\nnamespace Atlassian.Bitbucket\n{\n public class OAuth2ClientRegistry : DisposableObject, IRegistry\n {\n private readonly ICommandContext _context;\n\n private HttpClient _httpClient;\n private Cloud.BitbucketOAuth2Client _cloudClient;\n private DataCenter.BitbucketOAuth2Client _dataCenterClient;\n\n public OAuth2ClientRegistry(ICommandContext context)\n {\n EnsureArgument.NotNull(context, nameof(context));\n _context = context;\n }\n\n public BitbucketOAuth2Client Get(InputArguments input)\n {\n if (!BitbucketHelper.IsBitbucketOrg(input))\n {\n return DataCenterClient;\n }\n\n return CloudClient;\n }\n\n protected override void ReleaseManagedResources()\n {\n _httpClient?.Dispose();\n _cloudClient = null;\n _dataCenterClient = null;\n base.ReleaseManagedResources();\n }\n\n private HttpClient HttpClient => _httpClient ??= _context.HttpClientFactory.CreateClient();\n\n private Cloud.BitbucketOAuth2Client CloudClient =>\n _cloudClient ??= new Cloud.BitbucketOAuth2Client(HttpClient, _context.Settings, _context.Trace2);\n\n private DataCenter.BitbucketOAuth2Client DataCenterClient =>\n _dataCenterClient ??= new DataCenter.BitbucketOAuth2Client(HttpClient, _context.Settings, _context.Trace2);\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/RestApiResult.cs", "content": "using System.Net;\n\nnamespace Atlassian.Bitbucket\n{\n public class RestApiResult\n {\n public RestApiResult(HttpStatusCode statusCode)\n : this(statusCode, default(T)) { }\n\n public RestApiResult(HttpStatusCode statusCode, T response)\n {\n StatusCode = statusCode;\n Response = response;\n }\n\n public HttpStatusCode StatusCode { get; }\n\n public T Response { get; }\n\n public bool Succeeded => 199 < (int)StatusCode && (int)StatusCode < 300;\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/UI/Commands/CredentialsCommand.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.CommandLine;\nusing System.CommandLine.Invocation;\nusing System.Threading;\nusing System.Threading.Tasks;\nusing Atlassian.Bitbucket.UI.ViewModels;\nusing GitCredentialManager;\nusing GitCredentialManager.UI;\n\nnamespace Atlassian.Bitbucket.UI.Commands\n{\n public abstract class CredentialsCommand : HelperCommand\n {\n protected CredentialsCommand(ICommandContext context)\n : base(context, \"prompt\", \"Show authentication prompt.\")\n {\n var url = new Option(\"--url\", \"Bitbucket Server or Data Center URL\");\n AddOption(url);\n\n var userName = new Option(\"--username\", \"Username or email.\");\n AddOption(userName);\n\n var oauth = new Option(\"--show-oauth\", \"Show OAuth option.\");\n AddOption(oauth);\n\n var basic = new Option(\"--show-basic\", \"Show username/password option.\");\n AddOption(basic);\n\n this.SetHandler(ExecuteAsync, url, userName, oauth, basic);\n }\n\n private async Task ExecuteAsync(Uri url, string userName, bool showOAuth, bool showBasic)\n {\n var viewModel = new CredentialsViewModel(Context.SessionManager)\n {\n Url = url,\n UserName = userName,\n ShowOAuth = showOAuth,\n ShowBasic = showBasic\n };\n\n await ShowAsync(viewModel, CancellationToken.None);\n\n if (!viewModel.WindowResult || viewModel.SelectedMode == AuthenticationModes.None)\n {\n throw new Trace2Exception(Context.Trace2, \"User cancelled dialog.\");\n }\n\n switch (viewModel.SelectedMode)\n {\n case AuthenticationModes.OAuth:\n WriteResult(new Dictionary\n {\n [\"mode\"] = \"oauth\"\n });\n break;\n\n case AuthenticationModes.Basic:\n WriteResult(new Dictionary\n {\n [\"mode\"] = \"basic\",\n [\"username\"] = viewModel.UserName,\n [\"password\"] = viewModel.Password,\n });\n break;\n\n default:\n throw new ArgumentOutOfRangeException(nameof(AuthenticationModes),\n \"Unknown authentication mode\", viewModel.SelectedMode.ToString());\n }\n\n return 0;\n }\n\n protected abstract Task ShowAsync(CredentialsViewModel viewModel, CancellationToken ct);\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/UI/ViewModels/CredentialsViewModel.cs", "content": "using System;\nusing System.ComponentModel;\nusing System.Windows.Input;\nusing GitCredentialManager;\nusing GitCredentialManager.UI;\nusing GitCredentialManager.UI.ViewModels;\n\nnamespace Atlassian.Bitbucket.UI.ViewModels\n{\n public class CredentialsViewModel : WindowViewModel\n {\n private readonly ISessionManager _sessionManager;\n\n private Uri _url;\n private string _userName;\n private string _password;\n private bool _showOAuth;\n private bool _showBasic;\n\n public CredentialsViewModel()\n {\n // Constructor the XAML designer\n }\n\n public CredentialsViewModel(ISessionManager sessionManager)\n {\n EnsureArgument.NotNull(sessionManager, nameof(sessionManager));\n\n _sessionManager = sessionManager;\n\n Title = \"Connect to Bitbucket\";\n LoginCommand = new RelayCommand(AcceptBasic, CanLogin);\n CancelCommand = new RelayCommand(Cancel);\n OAuthCommand = new RelayCommand(AcceptOAuth, CanAcceptOAuth);\n ForgotPasswordCommand = new RelayCommand(ForgotPassword);\n SignUpCommand = new RelayCommand(SignUp);\n\n PropertyChanged += OnPropertyChanged;\n }\n\n private void OnPropertyChanged(object sender, PropertyChangedEventArgs e)\n {\n switch (e.PropertyName)\n {\n case nameof(UserName):\n case nameof(Password):\n LoginCommand.RaiseCanExecuteChanged();\n break;\n }\n }\n\n private bool CanLogin()\n {\n return !string.IsNullOrWhiteSpace(UserName) && !string.IsNullOrWhiteSpace(Password);\n }\n\n private void AcceptBasic()\n {\n SelectedMode = AuthenticationModes.Basic;\n Accept();\n }\n\n private void AcceptOAuth()\n {\n SelectedMode = AuthenticationModes.OAuth;\n Accept();\n }\n\n private bool CanAcceptOAuth()\n {\n return ShowOAuth;\n }\n\n private void ForgotPassword()\n {\n Uri passwordResetUri = _url is null\n ? new Uri(BitbucketConstants.HelpUrls.PasswordReset)\n : new Uri(_url, BitbucketConstants.HelpUrls.DataCenterPasswordReset);\n\n _sessionManager.OpenBrowser(passwordResetUri);\n }\n\n private void SignUp()\n {\n Uri signUpUri = _url is null\n ? new Uri(BitbucketConstants.HelpUrls.SignUp)\n : new Uri(_url, BitbucketConstants.HelpUrls.DataCenterLogin);\n\n _sessionManager.OpenBrowser(signUpUri);\n }\n\n public Uri Url\n {\n get => _url;\n set => SetAndRaisePropertyChanged(ref _url, value);\n }\n\n public string UserName\n {\n get => _userName;\n set => SetAndRaisePropertyChanged(ref _userName, value);\n }\n\n public string Password\n {\n get => _password;\n set => SetAndRaisePropertyChanged(ref _password, value);\n }\n\n /// \n /// Show the OAuth option.\n /// \n public bool ShowOAuth\n {\n get => _showOAuth;\n set => SetAndRaisePropertyChanged(ref _showOAuth, value);\n }\n\n /// \n /// Show the basic authentication options.\n /// \n public bool ShowBasic\n {\n get => _showBasic;\n set => SetAndRaisePropertyChanged(ref _showBasic, value);\n }\n\n public AuthenticationModes SelectedMode { get; private set; }\n\n /// \n /// Start the process to validate the username/password\n /// \n public RelayCommand LoginCommand { get; }\n\n /// \n /// Cancel the authentication attempt.\n /// \n public ICommand CancelCommand { get; }\n\n /// \n /// Use OAuth authentication instead of username/password.\n /// \n public ICommand OAuthCommand { get; }\n\n /// \n /// Hyperlink to the Bitbucket forgotten password process.\n /// \n public ICommand ForgotPasswordCommand { get; }\n\n /// \n /// Hyperlink to the Bitbucket sign up process.\n /// \n public ICommand SignUpCommand { get; }\n }\n}\n" }, { "path": "src/shared/Atlassian.Bitbucket/UI/Views/CredentialsView.axaml", "content": "\n \n \n \n \n \n