How do I disable git's credential helper for a single repository?
If I have a credential helper set in my ~/.gitconfig, how can I disable/bypass it in a specific repo and use no credential helper?
I've tried editing the repo's .git/config file to blank out the credential.helper property like this:
[credential] helper =
... but when I do a git push I get the following error message, and Git uses my default credential helper from ~/.gitconfig anyway:
git: 'credential-' is not a git command. See 'git --help'. Did you mean this? credential
I'm using git version 1.7.12.
(Backstory/use case: Git is configured to use the store helper, which stores passwords unencrypted on disk. The cache helper is unavailable on this system. I have a couple repos for which I'd rather type the password every time than keep it on disk.)
With git 2.9 (June 2016), this (helper = ) will actually work!
The credential.helper configuration variable is cumulative and there is no good way to override it from the command line. As a special case, giving an empty string as its value now serves as the signal to clear the values specified in various files.
credential: let empty credential specs reset helper list
Since the credential.helper key is a multi-valued config list, there's no way to "unset" a helper once it's been set. So if your system /etc/gitconfig sets one, you can never avoid running it, but only add your own helpers on top.
Since an empty value for credential.helper is nonsensical (it would just try to run "git-credential-"), we can assume nobody is using it. Let's define it to reset the helper list, letting you override lower-priority instances which have come before.
What I've tried, and had worked well was:
$ git config --system --unset credential.helper
But in order to that works fine, I had to set git-bash.exe with Administrator rights.
Unfortunately, I think this is a global variable. You should test and see if it works for single repositories.
A config variable that is set to an empty string is not the same as an unset variable. It is not possible to force a variable to be unset in .git/config when it is already set in ~/.gitconfig.
Additionally credential.helper is one of these variables where multiple values are used, and in such cases the values are aggregated from all read config files.
So basically your options seem to be:
either do not use credential.helper in ~/.gitconfig; set the store helper only for the repositories where you want it, either in their .git/config, or in ~/.gitconfig by specifying the repo URLs, eg.
[credential "https://specific.example.com/repo.git"] helper = store
or implement your own helper that does nothing for a set of configured repositories and delegates to git credential-store for the rest.
In addition of 'git config credential.helper=' that I mention above with Git 2.9, you now (Git 2.13.x/Git 2.14, Q3 2017) can disable the credential helper just for one command (and not just for any command in a given repo)
That means git -c credential.helper= clone /url/remote/repo now works.
"git clone --config var=val" is a way to populate the per-repository configuration file of the new repository, but it did not work well when val is an empty string. This has been fixed.
clone: handle empty config values in -c
"git clone --config" uses the following incantation to add an item to a config file, instead of replacing an existing value:
git_config_set_multivar_gently(key, value, "^$", 0)
As long as no existing value matches the regex ^$, that works as intended and adds to the config. When a value is empty, though, it replaces the existing value.
Noticed while trying to set credential.helper during a clone to use a specific helper without inheriting from ~/.gitconfig and /etc/gitconfig. That is, I ran:
git clone -c credential.helper= \ -c credential.helper=myhelper \ https://example.com/repo
intending to produce the configuration:
[credential] helper = helper = myhelper
Without this patch, the 'helper =' line is not included and the credential helper from /etc/gitconfig gets used.
Note that the documentation is now clearer with commit 515360f:
credential doc: make multiple-helper behavior more prominent
Git's configuration system works by reading multiple configuration files in order, from general to specific:
- first, the system configuration /etc/gitconfig
- then the user's configuration (~/.gitconfig or ~/.config/git/config)
- then the repository configuration (.git/config)
For single-valued configuration items, the latest value wins. For multi-valued configuration items, values accumulate in that order.
For example, this allows setting a credential helper globally in ~/.gitconfig that git will try to use in all repositories, regardless of whether they additionally provide another helper. This is usually a nice thing --- e.g. I can install helpers to use my OS keychain and to cache credentials for a short period of time globally.
Sometimes people want to be able to override an inherited setting. For the credential.helper setting, this is done by setting the configuration item to empty before giving it a new value.
I just ran into this problem as well, as the first credential.helper I had configured was always executing when I wanted to test a new one. This is on macOS using git supplied with Apple's dev tools.
Listing the configs with git config --list showed both helpers.
Running git config --global --edit did not show the setting for the first helper. It's a little strange that --global when configuring the helper is not the same scope as --global while editing the configs.
Also since it I wanted to include a different helper, just blanking it out wasn't going to solve it.
Finally found the setting in two places:
Removed the credential section from the first one, but both settings were still listed using --list. After rebooting and trying every combo of unset, unset-all --system, --global, et, I found the second file.
Removed the setting from that file (again was only one) and finally --list does not show any helpers configured.