Level 65
Depends where it's stored and who has access to it I guess.
Oct 2, 2014
11
Level 8
Is it a bad idea to store passwords in my global git configuration?
This is not laravel related but i have created a bash script that will automatically create a git repo in my current folder, create a remote in bitbucket, push it there and also create the deployment setup in ftploy. using both bitbucket and ftploy apis.
Its neat coz i only need to issue a single command and does everything. all i need to supply is the ssh user/pass for my specific project.
bitbucket and ftploy user/password thought i store in git global configuration file so i can easily pull them in my bash script. I am saving them using a command such as git config --global bitbucket.user.pass "mypassword"
just wondering if its generally is a bad idea to store passwords in my global git configuration file?
Level 8
its basically a file sitting in ~/.gitconfig
i understand that anyone with a physical access to my machine could get that file.
just want to make sure git itself wont put that info somewhere public in bitbucket or github
Level 65
The only thing I know people can access is your public keys and the email used to commit a commit.
Like so: https://github.com/jeffreyway.keys
Level 8
thats why i was wondering if this data will be pushed anywhere coz my name and email is in there which git uses obviously
Level 65
It shouldn't pull in a custom file stored in .gitconfig but looking around there's ways of grabbing it from keychain?
git config --global credential.helper osxkeychain
Level 8
i'll probably store them in the bash script itself instead of the git configuration file just to be on the safe side :)
1 like
Level 3
For Bitbucket you can use SSH keys. Wouldn't that be better than user/pass as you only need to revoke the keys if you suspect anything?
Level 8
i am using bitbucket api to create a repo via command line. the api requires the username/password i dont see anywhere in the docs how to authenticate using an ssh key.
here is the command i am basically executing
curl -X POST -v -u ${BB_USER}:${BB_PASS} -H "Content-Type: application/json" https://api.bitbucket.org/2.0/repositories/${BB_USER}/${DIR_SLUG} -d '{"scm": "git", "language": "php", "is_private": "true", "fork_policy": "no_public_forks" }';
Level 65
I guess in the script is fine for that then... the script is only on your computer right?
Level 8
yep its on my mac and dont plan to share it or store it anywhere else so i guess its safer to keep my credentials in there at the end of the day.
with git configuration file am not 100% sure thats why i thought of asking :)
Level 65
Indeed, no question is a stupid question! So to speak :P
Please or to participate in this conversation.