git checkouts wich ask for auth input must be serialized

[TheMeier]

if you have multiple references to git modules in your Puppetfile wich will trigger git to prompt you for a password input g10k will give you multiple password inputs all at once.
i would expect g10k to serialize the git interactive inputs.

[xorpaul]

There is currently no support for any authentication for git repositories except SSH key authentication.

Do you know how r10k deals with this issue? Given that r10k usually does these things in sequence you should also get multiple password prompts.

[TheMeier]

the authentication works in g10k, its just when multiple authentications are needed that you get multiple password prompts simultaniously.
since r10k is serial there is no problem there

[ntnn]

No tool acting with ssh sessions handles this.
The user is responsible for setting up the environment with e.g. GIT_ASKPASS or via shared connections.

[TheMeier]

This is https. If I could use ssh I wouldn't run into this issue

[ntnn]

Same problem. Without g10k starting to handle HTTPS/SSH/... itself, rather than using libraries or executing external commands, there is no easy way to know if there is a prompt coming up waiting for input.

Another possibility (for https) would be to template u/p data into the uri before passing the puppetfile to g10k or to add a format which allows g10k to retrieve the credentials from somewhere to deliver as a payload for the specified uris.

E.g.

mod 'somemodule',
    :uri => 'https://some.uri/somemodule',
    :user => 'someuser',
    :password => 'somepass'

But I'm still not convinced that this is g10k's job to handle.

[xorpaul]

Yeah, I was thinking about adding some module attributes for this, which should be a quick fix.

Would that solve your problem?

[xorpaul]

Although if I keep thinking about it, something like

mod 'somemodule',
    :uri => 'https://some.uri/somemodule',
    :auth_file => '/home/foobar/.config/somemodule.auth'

should be better. Otherwise everyone with read access to the control repository can access the module.

[TheMeier]

Hmm, un this special scenario the repos are actually configured with uri: => 'git@...' but in an devel environment i use git config --global url."https://....".insteadOf git@... because the devel system is not allowed git-over-ssh.

So what actually might help me here would be passing in the auth (or better authfile) information via command line argument or environment variable.

[xorpaul]

Is the addition of the git module paramter :use_ssh_agent in #171 which skips the explicit ssh-add commands before each git command a possible solution for this or do you still want to enter the SSH key password?