Trouble with auth on macOS due to SIP #40
Comments
|
What version of Julia, and what version of Git.jl? Also, what version of macOS? |
|
@giordano Any idea on this part? |
|
Julia v1.6.1, Git v1.2.1, MacOS v11.2.3 (Big Sur) |
|
What do you get when you run And then what do you get when you run this in Julia: run(`$(git()) credential-osxkeychain`) |
What's the version of |
|
In Julia: julia> run(`$(git()) credential-osxkeychain`)
git: 'credential-osxkeychain' is not a git command. See 'git --help'.
ERROR: failed processIn the terminal: ❯ git credential-osxkeychain
usage: git credential-osxkeychain <get|store|erase> |
(jl_MgOS5U) pkg> st -m
Status `/private/var/folders/jb/plyyfc_d2bz195_0rc0n_zcw0000gp/T/jl_MgOS5U/Manifest.toml`
[d7ba0133] Git v1.2.1
[692b3bcd] JLLWrappers v1.3.0
[21216c6a] Preferences v1.2.2
[2e619515] Expat_jll v2.2.10+0
[78b55507] Gettext_jll v0.20.1+7
[f8c6e375] Git_jll v2.31.0+0
[94ce4f54] Libiconv_jll v1.16.1+0
[458c3c95] OpenSSL_jll v1.1.10+0
[02c8fc9c] XML2_jll v2.9.12+0plus stdlibs |
|
I can't reproduce it: I don't have an SSH agent set up yet, though, if that's relevant |
|
I get the message when I try to use |
|
What's the value of |
|
|
Uhm, Can you reproduce the error locally, or it's only in CI? |
|
The CI passes for Linux and Windows but fails for macOS. Unfortunately I don't have any access to macOS for testing locally. |
|
Do you have a simple reproducer I could try (besides running all the tests)? |
|
You can start to see if the tests fail locally for |
|
I fear It looks like |
|
A small reproducer (the high-level git command run) would still be helpful though 🙂 |
|
Not exactly small but this is enough to trigger the error in CI and should let you eliminate LocalRegistry from the equation. |
|
Ok, that's perfect, thanks! I translated that to a simple shell script #!/bin/sh
set -euf -o pipefail
export DYLD_FALLBACK_LIBRARY_PATH="$(julia-16 -E 'using Git_jll; Git_jll.LIBPATH[]')"
GIT="$(julia-16 -e 'using Git_jll; print(Git_jll.git_path)')"
dir1=$(mktemp -d)
url1="file://${dir1}"
dir2=$(mktemp -d)
"${GIT}" -C "${dir1}" -c "user.name=a" -c "user.email=b@c" init --bare
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" init
echo "test" > "${dir2}/README"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" add --all
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" commit -qm test
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" remote add origin "${url1}"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" push --set-upstream origin masterbut unfortunately now this one doesn't reproduce the failure: mose@Moses-MacBook-Pro tmp % ./git.sh
warning: templates not found in /workspace/destdir/share/git-core/templates
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: git branch -m <name>
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.YHxZbGQQ/
warning: templates not found in /workspace/destdir/share/git-core/templates
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: git branch -m <name>
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.EnE1XJfk/.git/
Enumerating objects: 3, done.
Counting objects: 100% (3/3), done.
Writing objects: 100% (3/3), 190 bytes | 190.00 KiB/s, done.
Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
To file:///var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.YHxZbGQQ
* [new branch] master -> master
Branch 'master' set up to track remote branch 'master' from 'origin'.I can't debug further now, but leaving some breadcrumbs here for future reference |
|
Ok, I had to set some extra environment variables to reproduce the error #!/bin/sh
set -euf -o pipefail
export DYLD_FALLBACK_LIBRARY_PATH="$(julia-16 -e 'using Git_jll; print(Git_jll.LIBPATH[])')"
GIT_DIR="$(julia-16 -e 'using Git_jll; print(Git_jll.artifact_dir)')"
GIT="${GIT_DIR}/bin/git"
export GIT_EXEC_PATH="${GIT_DIR}/libexec/git-core"
export GIT_TEMPLATE_DIR="${GIT_DIR}/share/git-core/templates"
export GIT_SSL_CAINFO="$(julia-16 -e 'print(dirname(Sys.BINDIR))')/share/julia/cert.pem"
dir1=$(mktemp -d)
url1="file://${dir1}"
dir2=$(mktemp -d)
"${GIT}" -C "${dir1}" -c "user.name=a" -c "user.email=b@c" init --bare
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" init
echo "test" > "${dir2}/README"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" add --all
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" commit -qm test
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" remote add origin "${url1}"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" push --set-upstream origin masteroutput mose@Moses-MacBook-Pro tmp % ./git.sh
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: git branch -m <name>
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.abYaa1to/
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: git branch -m <name>
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.PKK9TZUK/.git/
dyld: Library not loaded: @rpath/libgettextlib-0.20.1.dylib
Referenced from: /Users/mose/.julia/artifacts/554453215888cc66406fca3bc8a2285995626b67/libexec/git-core/git-receive-pack
Reason: image not found
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists. |
|
With Mose's help, I've been digging into this a little. I ran into what's probably a related issue, where calling The culprit appears to be Mac's SIP, together with the fact that Git loves to start all kinds of child processes, including I was able to get As for the issue here, it seems reasonable that, somehow, when e.g. At the moment I can think of two solutions:
I also have some scripts here that I used to debug and test stuff on CI, including simple implementations of the two oh-so-pretty workarounds. |
|
I have attempted to take Mosè's script and translate it to Julia: using Git
gitd(dir, cmd) = run(`$(git()) -C $(dir) -c "user.name=a" -c "user.email=b@c" $(cmd)`)
mktempdir() do dir1; mktempdir() do dir2;
gitd(dir1, `init --bare`)
gitd(dir2, `init`)
open(joinpath(dir2, "README"); write=true) do io
println(io, "test")
end
gitd(dir2, `add --all`)
gitd(dir2, `commit -qm test`)
gitd(dir2, `remote add origin file://$(dir1)`)
gitd(dir2, `push --set-upstream origin main`)
end; endThis works just fine for me, does it work for everyone else? |
|
Is SIP enabled on your Mac? |
|
Also, did you set the additional environment variables listed in #40 (comment)? |
|
I needed to edit your script - I changed the penultimate line to this: When I did so, it failed for me with: I have SIP enabled on this Mac. I did not set the additional environment variables listed in #40 (comment). Full output: (click to expand) |
DilumAluthge
changed the title
Are we going full circle? Julia was the starting point: #40 (comment) |
|
I don't have a Mac to try on but the GitHub runners keep failing with GunnarFarneback/LocalRegistry.jl#38, from which this testcase was derived. |
|
@giordano can you try this in your # Move C binary to `_git`
mv git _git
# Create new `git` wrapper script:
cat >git << 'EOF'
#!/bin/bash
SCRIPT_DIR=$( cd -- "$( dirname -- $(readlink -f "${BASH_SOURCE[0]}") )" &> /dev/null && pwd )
export DYLD_FALLBACK_LIBRARY_PATH="${JLL_DYLD_FALLBACK_LIBRARY_PATH}"
exec -a "${BASH_SOURCE[0]}" "${SCRIPT_DIR}/_git" "$@"
EOF
chmod +x gitFor me, this passes on a SIP-enabled mac. The important two pieces here are:
Hah, I saw |
|
Yes, with the proposed changes this updated shell script works for me: #!/bin/sh
set -euf -o pipefail
JULIA="julia --project=/tmp"
export JLL_DYLD_FALLBACK_LIBRARY_PATH="$(${JULIA} -e 'using Git_jll; print(Git_jll.LIBPATH[])')"
GIT="$(${JULIA} -e 'using Git_jll; print(Git_jll.git_path)')"
dir1=$(mktemp -d)
url1="file://${dir1}"
dir2=$(mktemp -d)
"${GIT}" -C "${dir1}" -c "user.name=a" -c "user.email=b@c" init --bare
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" init
echo "test" > "${dir2}/README"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" add --all
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" commit -qm test
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" remote add origin "${url1}"
"${GIT}" -C "${dir2}" -c "user.name=a" -c "user.email=b@c" push --set-upstream origin main% ./test.sh
warning: templates not found in /workspace/destdir/share/git-core/templates
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.wLhmC0XD/
warning: templates not found in /workspace/destdir/share/git-core/templates
Initialized empty Git repository in /private/var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.xu3TRY8B/.git/
Enumerating objects: 3, done.
Counting objects: 100% (3/3), done.
Writing objects: 100% (3/3), 189 bytes | 189.00 KiB/s, done.
Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
To file:///var/folders/v2/hmy3kzgj4tb3xsy8qkltxd0r0000gn/T/tmp.wLhmC0XD
* [new branch] main -> main
branch 'main' set up to track 'origin/main'.And also your Julia code works, unchanged. |
|
It works for me also if I don't rename the It isn't entirely clear to me why we can't just set the environment variable and avoid using the shell driver. |
I don't think that will work in all cases. The breaking case is when we have something like |
|
Ah, I don't need your shell driver if I set both export DYLD_FALLBACK_LIBRARY_PATH="$(${JULIA} -e 'using Git_jll; print(Git_jll.LIBPATH[])')"
export JLL_DYLD_FALLBACK_LIBRARY_PATH="${DYLD_FALLBACK_LIBRARY_PATH}" |
|
Are you sure you're testing the right case? In your code snippet above you're not even setting |
|
Yes, sorry, that was a copy-paste error, but it was really working for me. Anyway, in JuliaPackaging/Yggdrasil#4987 I'm now creating the shell driver you suggested, I downloaded the artifact built in CI, installed in my artifact dir and now |
|
|
DilumAluthge
changed the title
DilumAluthge
changed the title
If I try to clone a private repo, it prompts to ask for a username. I'd like it to auth automatically, like my command line git. I think that works because I have
in my
git config --global -l.I can do
which does set the setting correctly as I check with
but when I try to clone a private repo, I get
Any ideas?
The text was updated successfully, but these errors were encountered: