git-credential-op from my private tools.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Brett Buddin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,74 @@
+# git-credential-op
+
+A `git-credential` helper for 1Password.
+
+Only username and password authentication (Basic Auth) is supported at this time (no [`capability[]`](https://git-scm.com/docs/git-credential#Documentation/git-credential.txt-codecapabilitycode) codes supported). 
+
+## Installation
+
+```
+go install github.com/brettbuddin/git-credential-op@latest
+```
+
+## Setup
+
+```
+# .gitconfig or .git/config
+
+[credential]
+    helper = op
+```
+
+### Customize
+
+#### Account and Vault
+
+```
+# .gitconfig or .git/config
+
+[credential "https://github.com"]
+    helper = "op --account personalaccount.1password.com --vault Private"
+
+[credential "https://githubenterprise.companyname.com"]
+    helper = "op --account companyaccount.1password.com --vault Private"
+```
+
+We've included `--vault` above to illustrate it can be set, but the tool will use whatever Vault 1Password considers the
+default for the account; usually "Private".
+
+#### Locator Tag
+
+Every 1Password item managed by `git-credential-op` is tagged with a locator tag. By default this is
+`git-credential-op`, but you can change it if you don't care for it. Once you change it in your configuration, you'll
+need to make sure any items in 1Password with the old tag are updated so the helper can find them.
+
+```
+# .gitconfig or .git/config
+
+[credential]
+    helper = "op --locator-tag my-cool-tag"
+```
+
+#### Title Template
+
+Every 1Password item managed by `git-credential-op` is named in accordance to a template that you can customize.
+Changing this won't affect the helper's ability to locate the item. 
+
+```
+# .gitconfig or .git/config
+
+[credential]
+    helper = "op --title 'git: {{.Host}}'"
+```
+
+#### Additional Tags
+
+You can add additional tags to items managed by the helper. All created items will have these tags included alongside
+the locator tag.
+
+```
+# .gitconfig or .git/config
+
+[credential]
+    helper = "op --additional-tags one,two,three"
+```

go.mod

@@ -0,0 +1,12 @@
+module github.com/brettbuddin/git-credential-op
+
+go 1.22.5
+
+require github.com/stretchr/testify v1.9.0
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

go.sum

@@ -0,0 +1,12 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

integration/Dockerfile

@@ -0,0 +1,33 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache \
+  nginx \
+  fcgiwrap \
+  openssl \
+  git-daemon \
+  git \
+  openrc \
+  mdevd-openrc
+
+# Install credentials: username=foo, password=bar
+RUN printf "foo:$(echo -n "bar" | openssl passwd -apr1 -stdin)\n" >> /etc/nginx/.gitpasswd
+
+# Set up the "test" repository.
+RUN mkdir -p /srv/git/test \
+	&& cd /srv/git/test \
+	&& git init . --bare --shared \
+	&& git update-server-info
+COPY gitconfig /srv/git/test/config
+
+# Install nginx configuration.
+COPY nginx.conf /etc/nginx/http.d/git.conf
+
+# Allow fcgiwrap to deal with the repository data.
+RUN chown -R fcgiwrap:www-data /srv/git
+
+# Start nginx and fcgiwrap on boot of the container
+RUN sed -i '/getty/d' /etc/inittab \
+	&& rc-update add nginx default \
+	&& rc-update add fcgiwrap default
+
+CMD ["/sbin/init"]

integration/README.md

@@ -0,0 +1,14 @@
+# Integration Test Suite
+
+I haven't found a very good way to test things end-to-end in CI so I've opted to run these on my local machine.
+
+## Setup
+
+Create "Sandbox" Vault to isolate the script from your normal items. The script will maniplate items within that vault,
+but you can override it with the `VAULT` environment variable.
+
+## Running
+
+```
+; integration/test.bash
+```

integration/askpass.bash

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+exec echo "$GIT_PASSWORD"

integration/docker-compose.yaml

@@ -0,0 +1,7 @@
+services:
+  git-server:
+    build: .
+    restart: always
+    container_name: git-server
+    ports:
+      - "8888:8888"

integration/gitconfig

@@ -0,0 +1,9 @@
+[core]
+    repositoryformatversion = 0
+    filemode = true
+    bare = true
+    sharedrepository = 1
+[receive]
+    denyNonFastforwards = false
+[http]
+    receivepack = true

integration/nginx.conf

@@ -0,0 +1,20 @@
+server {
+	listen 8888;
+
+	root /srv/git;
+
+	error_log /var/log/nginx/error.log debug;
+
+	location ~ (/.*) {
+		auth_basic "Restricted";
+		auth_basic_user_file /etc/nginx/.gitpasswd;
+
+		fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
+		include       fastcgi_params;
+		fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend;
+
+		fastcgi_param GIT_HTTP_EXPORT_ALL "";
+		fastcgi_param GIT_PROJECT_ROOT    /srv/git;
+		fastcgi_param PATH_INFO           $1;
+	}
+}

integration/test.bash

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+vault="${VAULT:-Sandbox}"
+script_dir="$(dirname "$(realpath "$0")")"
+item_tag=git-credential-op-test
+op_command="op --vault '${vault}' --additional-tags ${item_tag}"
+username=foo
+password=bar
+compose_file="$script_dir/docker-compose.yaml"
+
+trap_exit() {
+   docker compose -f "${compose_file}" down --rmi all --remove-orphans
+}
+trap trap_exit EXIT
+
+op_cleanup() {
+    op --vault "${vault}" item list --tags "${item_tag}" --format json \
+    | jq -r '.[].id' \
+    | tee /dev/tty \
+    | xargs op --vault Sandbox item delete
+
+    [[ -z "$(op_find_item)" ]]
+}
+
+git_init() {
+    tmp_dir=$(mktemp -d)
+    cd "${tmp_dir}" || exit 1
+
+    git init . -b main
+    git config user.email "me@example.com"
+    git config user.name "me"
+}
+
+git_commit() {
+    echo "$1" >> CONTENT
+    git add .
+    git commit -m "test"
+}
+
+git_push() {
+    git push origin main --force
+}
+
+git_push_with_pass() {
+    GIT_PASSWORD="$1" GIT_ASKPASS="$script_dir/askpass.bash" git push origin main --force
+}
+
+op_find_item() {
+    op --vault "${vault}" item list --tags "${item_tag}" --format json | jq -r '.[].id'
+}
+
+test_username_in_url() {
+    git_init
+    git_commit "content"
+
+    git remote add origin "http://${username}@localhost:8888/test"
+    git config credential.helper "${op_command}"
+    git_push_with_pass "bar"
+
+    [[ -n "$(op_find_item)" ]]
+}
+
+test_username_and_password_in_url() {
+    git_init
+    git_commit "content"
+
+    git remote add origin "http://${username}:${password}@localhost:8888/test"
+    git config credential.helper "${op_command}"
+    git_push
+
+    [[ -n "$(op_find_item)" ]]
+}
+
+test_username_in_config() {
+    git_init
+    git_commit "content"
+
+    git remote add origin "http://localhost:8888/test"
+    git config credential.http://localhost:8888/test.helper "${op_command}"
+    git config credential.http://localhost:8888/test.username "foo"
+    git_push_with_pass "bar"
+
+    [[ -n "$(op_find_item)" ]]
+}
+
+test_http_path() {
+    git_init
+    git_commit "content"
+
+    git remote add origin "http://localhost:8888/test"
+    git config credential.http://localhost:8888/test.helper "${op_command}"
+    git config credential.http://localhost:8888/test.username "foo"
+    git config credential.http://localhost:8888/test.useHttpPath true
+    git_push_with_pass "bar"
+
+    [[ -n "$(op_find_item)" ]]
+}
+
+test_erase_on_failure() {
+    git_init
+    git_commit "content"
+
+    git remote add origin "http://localhost:8888/test"
+    git config credential.helper "${op_command}"
+    git config credential.username "foo"
+    git_push_with_pass "bar"
+
+    # Set the password on the item to another value.
+    item_id="$(op_find_item)"
+    op --vault "${vault}" item edit "${item_id}" 'password=baz'
+
+    # Push again. Git will erase the item.
+    git_commit "more content"
+    git_push
+
+    [[ -z "$(op_find_item)" ]]
+}
+
+# Run tests
+
+docker compose -f "${compose_file}" up -d
+until curl --output /dev/null --silent --head --fail "http://${username}:${password}@localhost:8888/test/info/refs"; do
+    sleep 1
+done
+
+tests=(
+    "test_username_in_url"
+    "test_username_in_config"
+    "test_username_and_password_in_url"
+    "test_http_path" 
+    "test_erase_on_failure"
+)
+for t in "${tests[@]}"; do
+    op_cleanup
+    (export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=1; ${t}) || exit 1
+    op_cleanup
+done