[Openembedded-architecture] Interactive password prompts and the git fetcher

[Martin Jansa]

On Tue, Sep 04, 2018 at 04:18:20PM +1200, Paul Eggleton wrote:
> Hi folks,
> 
> In the layer index / RRS code I have found that if it tries to use bitbake's 
> git fetcher to access a git repository on github that has been renamed or gone 
> private via http/https, I get prompted for a password interactively, 
> presumably on the assumption that maybe if I authenticate I might be able to 
> see the repo. Here's an example git command that will trigger it (trimmed from 
> the actual command issued by the fetcher):
> 
>   git ls-remote http://github.com/symless/synergy.git
> 
> This can be disabled by setting the environment variables GIT_ASKPASS to an 
> empty string and GIT_TERMINAL_PROMPT to 0, which allows the fetch command to 
> fail immediately. I could conceivably do this in the layer index / RRS 
> scripts, but it occurred to me that perhaps this should be disabled in 
> bitbake's git fetcher itself. We need to decide whether or not interactive 
> password prompts should be allowed during a fetch operation (I'm guessing not, 
> although I have a feeling this might be a "spacebar heating" situation for 
> some).
> 
> Thoughts? In particular, does anyone object to disabling such interactive 
> prompts during fetching?

Another common cause for interactive prompt I have seen many times is
ssh transport in git asking for confirming server's fingerprint or
complaining that the fingerprint is different in known_hosts.

Immediate failure is much better than git ls-remote stuck on background
and then wondering what's taking so long when even chromium finished to
build already.. :).

-- 
Martin 'JaMa' Jansa     jabber: Martin.Jansa at gmail.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: Digital signature
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180905/80b17d64/attachment-0002.sig>