Autogenerated HTML docs for v2.37.0-rc0-54-gb4eda

1 files changed, 71 insertions, 36 deletions

diff --git a/git-config.html b/git-config.html
index 870d3e54e..88223b04c 100644
--- a/git-config.html
+++ b/git-config.html
@@ -5435,38 +5435,6 @@ fetch.writeCommitGraph
 </p>

 </dd>

 <dt class="hdlist1">

-fetch.credentialsInUrl

-</dt>

-<dd>

-<p>

-        A URL can contain plaintext credentials in the form

-        <code>&lt;protocol&gt;://&lt;user&gt;:&lt;password&gt;@&lt;domain&gt;/&lt;path&gt;</code>. Using such URLs

-        is not recommended as it exposes the password in multiple ways,

-        including Git storing the URL as plaintext in the repository config.

-        The <code>fetch.credentialsInUrl</code> option provides instruction for how Git

-        should react to seeing such a URL, with these values:

-</p>

-<div class="ulist"><ul>

-<li>

-<p>

-<code>allow</code> (default): Git will proceed with its activity without warning.

-</p>

-</li>

-<li>

-<p>

-<code>warn</code>: Git will write a warning message to <code>stderr</code> when parsing a URL

-  with a plaintext credential.

-</p>

-</li>

-<li>

-<p>

-<code>die</code>: Git will write a failure message to <code>stderr</code> when parsing a URL

-  with a plaintext credential.

-</p>

-</li>

-</ul></div>

-</dd>

-<dt class="hdlist1">

 format.attach

 </dt>

 <dd>

@@ -6308,9 +6276,12 @@ gpg.ssh.defaultKeyCommand
 <dd>

 <p>

         This command that will be run when user.signingkey is not set and a ssh

-        signature is requested. On successful exit a valid ssh public key is

-        expected in the first line of its output. To automatically use the first

-        available key from your ssh-agent set this to "ssh-add -L".

+        signature is requested. On successful exit a valid ssh public key

+        prefixed with <code>key::</code> is expected in the first line of its output.

+        This allows for a script doing a dynamic lookup of the correct public

+        key when it is impractical to statically configure <code>user.signingKey</code>.

+        For example when keys or SSH Certificates are rotated frequently or

+        selection of the right key depends on external factors unknown to git.

 </p>

 </dd>

 <dt class="hdlist1">

@@ -7047,7 +7018,7 @@ http.schannelUseSSLCAInfo
 </p>

 </dd>

 <dt class="hdlist1">

-http.pinnedpubkey

+http.pinnedPubkey

 </dt>

 <dd>

 <p>

@@ -10698,6 +10669,70 @@ trace2.maxFiles
 </p>

 </dd>

 <dt class="hdlist1">

+transfer.credentialsInUrl

+</dt>

+<dd>

+<p>

+        A configured URL can contain plaintext credentials in the form

+        <code>&lt;protocol&gt;://&lt;user&gt;:&lt;password&gt;@&lt;domain&gt;/&lt;path&gt;</code>. You may want

+        to warn or forbid the use of such configuration (in favor of

+        using <a href="git-credential.html">git-credential(1)</a>). This will be used on

+        <a href="git-clone.html">git-clone(1)</a>, <a href="git-fetch.html">git-fetch(1)</a>, <a href="git-push.html">git-push(1)</a>,

+        and any other direct use of the configured URL.

+</p>

+<div class="paragraph"><p>Note that this is currently limited to detecting credentials in

+<code>remote.&lt;name&gt;.url</code> configuration, it won&#8217;t detect credentials in

+<code>remote.&lt;name&gt;.pushurl</code> configuration.</p></div>

+<div class="paragraph"><p>You might want to enable this to prevent inadvertent credentials

+exposure, e.g. because:</p></div>

+<div class="ulist"><ul>

+<li>

+<p>

+The OS or system where you&#8217;re running git may not provide way way or

+  otherwise allow you to configure the permissions of the

+  configuration file where the username and/or password are stored.

+</p>

+</li>

+<li>

+<p>

+Even if it does, having such data stored "at rest" might expose you

+  in other ways, e.g. a backup process might copy the data to another

+  system.

+</p>

+</li>

+<li>

+<p>

+The git programs will pass the full URL to one another as arguments

+  on the command-line, meaning the credentials will be exposed to oher

+  users on OS&#8217;s or systems that allow other users to see the full

+  process list of other users. On linux the "hidepid" setting

+  documented in procfs(5) allows for configuring this behavior.

+</p>

+<div class="paragraph"><p>If such concerns don&#8217;t apply to you then you probably don&#8217;t need to be

+concerned about credentials exposure due to storing that sensitive

+data in git&#8217;s configuration files. If you do want to use this, set

+<code>transfer.credentialsInUrl</code> to one of these values:</p></div>

+</li>

+<li>

+<p>

+<code>allow</code> (default): Git will proceed with its activity without warning.

+</p>

+</li>

+<li>

+<p>

+<code>warn</code>: Git will write a warning message to <code>stderr</code> when parsing a URL

+  with a plaintext credential.

+</p>

+</li>

+<li>

+<p>

+<code>die</code>: Git will write a failure message to <code>stderr</code> when parsing a URL

+  with a plaintext credential.

+</p>

+</li>

+</ul></div>

+</dd>

+<dt class="hdlist1">

 transfer.fsckObjects

 </dt>

 <dd>