Error "No credential store has been selected" when using multiple credential helpers

[hickford]

Git supports multiple credential helpers configured in sequence. I tried the following Git config to use a custom storage helper followed by GCM:

[credential]
	helper = storage
	helper = manager

But GCM gave me error:

fatal: No credential store has been selected.

This refers to the choice of GCM's internal credential store. This error makes sense when GCM is the only Git credential helper, but is superfluous when multiple credential helpers are configured.

Workaround: effectively disable GCM's internal credential store by telling it to cache with timeout zero.

[credential]
	helper = storage
	helper = manager
	credentialStore = cache
	cacheoptions = --timeout 0

[hickford]

It would be interesting to understand any differences in behaviour between typical GCM configuration with internal credential store:

[credential]
	helper = manager
	credentialStore = keychain

and using GCM as one of multiple Git credential helpers

[credential]
	helper = osxkeychain 
	helper = manager
	credentialStore = cache
	cacheoptions = --timeout 0

[mjcheetham]

It would be interesting to understand any differences in behaviour between typical GCM configuration with internal credential store:
and using GCM as one of multiple Git credential helpers

At least for the macOS Keychain, there are some differences in the actual keychain entry that is used. GCM uses kSecClassGenericPassword class for items, whereas git-credential-osxkeychain uses ksecclassinternetpassword (by virtue of using the *InternetPassword Keychain APIs.

The other is the identity of the application that is actually reading/writing to the keychain is different. macOS Keychain's ACLs record the specific executable identity that can access those entries:

Finally, we preface our credentials with an optional namespace that is user configurable.. defaulting to git. So our credentials are stored as git:<service> on all platforms by default, whereas osxkeychain doesn't prefix (cannot, due to being an internet password class).

[mjcheetham]

This error makes sense when GCM is the only Git credential helper, but is superfluous when multiple credential helpers are configured.

One thing we could consider is adding a passthrough option to credentialStore that effectively does the same as the cache workaround and just acts as a no-op.