[macOS] keychain的跳坑之旅!git拉取的权限问题

故事背景,svn与git各有长处,不过git大势所趋吧,那就搞搞。git的服务端,是基于phabricator搭建的,关于它的资料自行google就好了。其实之前运维已经搭好了phabricator了,也给过我叫做test的账号去试过了,只不过还有些问题没处理好,拖了一段时间后,我着手来弄一下。
1. 建diffusion
详细就不多说,diffusion名字叫swallowframework,很简单,也有教程。
第一次,没有分权限,所有人都可以visit, push
```
git clone http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git eelly_swallow
```
代码可以正常拉取,没问题

第二次,将用户按项目分了组,只有php项目的人才能visit, push,将我自己加入到php项目里面去
```
git clone http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git eelly_swallow
```
报错了!
```
fatal: unable to access 'http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git/': The requested URL returned error: 403
```
一看这提示就是权限问题。当然是google啦,找来找去,phabricator上面的设置都是正常的。
又叫了在php项目的同事去拉代码。卧槽,他们是正常的,而且拉取的时候,会提示让他输入账号,密码,而我的拉取过程,根本就没有提示我去输入账号密码!
只能通过输出拉取的调试信息来看看问题在哪里了,使用的是GIT_CURL_VERBOSE=1
```
GIT_CURL_VERBOSE=1 git clone http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git eelly_swallow
```
输出的详细信息如下
```
Cloning into 'eelly_swallow'...
* Couldn't find host phabricator.eelly.test in the .netrc file; using defaults
* Trying 172.18.107.96...
* TCP_NODELAY set
* Connected to phabricator.eelly.test (172.18.107.96) port 80 (#0)
> GET /diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack HTTP/1.1
Host: phabricator.eelly.test
User-Agent: git/2.10.1 (Apple Git-78)
Accept: */*
Accept-Encoding: gzip
Pragma: no-cache

< HTTP/1.1 401 You must log in to access repositories.
< Server: nginx
< Date: Thu, 09 Mar 2017 13:59:26 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< WWW-Authenticate: Basic realm="Phabricator Repositories"
<
* Curl_http_done: called premature == 0
* Connection #0 to host phabricator.eelly.test left intact
* Couldn't find host phabricator.eelly.test in the .netrc file; using defaults
* Found bundle for host phabricator.eelly.test: 0x7ff01250c7c0 [can pipeline]
* Hostname phabricator.eelly.test was found in DNS cache
* Trying 172.18.107.96...
* TCP_NODELAY set
* Connected to phabricator.eelly.test (172.18.107.96) port 80 (#1)
> GET /diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack HTTP/1.1
Host: phabricator.eelly.test
User-Agent: git/2.10.1 (Apple Git-78)
Accept: */*
Accept-Encoding: gzip
Pragma: no-cache

< HTTP/1.1 401 You must log in to access repositories.
< Server: nginx
< Date: Thu, 09 Mar 2017 13:59:26 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< WWW-Authenticate: Basic realm="Phabricator Repositories"
<
* Ignoring the response-body
* Curl_http_done: called premature == 0
* Connection #1 to host phabricator.eelly.test left intact
* Issue another request to this URL: 'http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack'
* Couldn't find host phabricator.eelly.test in the .netrc file; using defaults
* Found bundle for host phabricator.eelly.test: 0x7ff01250c7c0 [can pipeline]
* Re-using existing connection! (#1) with host phabricator.eelly.test
* Connected to phabricator.eelly.test (172.18.107.96) port 80 (#1)
* Server auth using Basic with user 'test'
> GET /diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack HTTP/1.1
Host: phabricator.eelly.test
Authorization: Basic dGVzdDp0MTIzNDU2Nzg=
User-Agent: git/2.10.1 (Apple Git-78)
Accept: */*
Accept-Encoding: gzip
Pragma: no-cache

< HTTP/1.1 403 You do not have permission to access this repository.
< Server: nginx
< Date: Thu, 09 Mar 2017 13:59:26 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Vary: Accept-Encoding
< Content-Encoding: gzip
<
* Curl_http_done: called premature == 0
* Connection #1 to host phabricator.eelly.test left intact
fatal: unable to access 'http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git/': The requested URL returned error: 403
```
这里涉及的几次握手的过程就不详细解释了,大家用心看一下还是可以明白的。
重点关注这几行代码
```
* Ignoring the response-body
* Curl_http_done: called premature == 0
* Connection #1 to host phabricator.eelly.test left intact
* Issue another request to this URL: 'http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack'
* Couldn't find host phabricator.eelly.test in the .netrc file; using defaults
* Found bundle for host phabricator.eelly.test: 0x7ff01250c7c0 [can pipeline]
* Re-using existing connection! (#1) with host phabricator.eelly.test
* Connected to phabricator.eelly.test (172.18.107.96) port 80 (#1)
* Server auth using Basic with user 'test'
> GET /diffusion/SWALLOWFRAMEWORK/swallowframework.git/info/refs?service=git-upload-pack HTTP/1.1
Host: phabricator.eelly.test
Authorization: Basic dGVzdDp0MTIzNDU2Nzg=
User-Agent: git/2.10.1 (Apple Git-78)
Accept: */*
Accept-Encoding: gzip
Pragma: no-cache
```
这里的意思是,Ignoring the response-body,忽略响应的内容,Server auth using Basic with user 'test',直接用test这个账号去尝试登录。我在其它同事debug这个clone的过程,是没有这些步骤的,他们是,去到 WWW-Authenticate: Basic realm="Phabricator Repositories" 这一步的时候,就会显示输入账号密码的过程,怎么回事呢?为什么一直都是用test这个账号去尝试登录呢?
过程是很复杂的,反正也花了两个小时去找解决方案,也尝试了不同方法。最后在这里找到了头绪,http://git.vger.kernel.narkive.com/iW0NHyKd/git-https-transport-and-wrong-password
这文章里面关键点在于这些对话
```
1. Using a credential helper that supports secure long-term storage
(osxkeychain, wincred, etc).

2. Specifying the username to the credential subsystem explicitly, by
putting something like:

[credential "https://yourhost/"]
username = yourusername

in your git config.
```
意思是说,在你的git config里面,直接针对某个远程地址,设置账号,于是我改了一下自己的git配置
```
vim ~/.gitconfig
```
在后面加入
```
[credential "http://phabricator.eelly.test"]
username = xxxxxxx
```
再次进行拉取
```
GIT_CURL_VERBOSE=1 git clone http://phabricator.eelly.test/diffusion/SWALLOWFRAMEWORK/swallowframework.git eelly_swallow
```
这次就正常了,提示我输入密码,搞掂!从以上文章,大概联想了一下,应该是macOS的keychain保存了一些账号导致在clone的时候,默认使用了test这个账号去进行登录的,于是再看了下keychain里面的东西。真是无语了,果然是这样子


干脆一做二不休,直接将keychain对应的账号密码,由test改为我自己的账号密码,完成!

have fun with macOS & git!

posted @ 2017-03-10 09:25 DavidHHuan 阅读(...) 评论(...) 编辑 收藏