fazel
/
spacy-fa-pipeline
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Wire gitea credential helper to pass, document smartcard failure mode 

pass gitea/token_AllExceptAdmin is byte-identical to the rbw mirror. The earlier
empty return was gpg-agent having no cached session for the smartcard-backed key:
pass blocks ~60s then exits 0 with empty stdout, so a helper wired to it fails auth
with no visible cause. Records the one-command diagnosis and keeps rbw as the
documented fallback for when the card is absent.
This commit is contained in:
Mohamad Fazeli 2026-07-29 21:09:21 +03:30
parent c2ad4d0022
commit cdb8020752
Signed by: fazel
GPG Key ID: 05E227BF4D6736DE
1 changed files with 31 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
.omp/AGENTS.md
View File

@ -8,19 +8,15 @@
## Pushing to Gitea ## Pushing to Gitea
Credentials come from `rbw` (Bitwarden CLI) — no token in git config or any tracked file. Credentials come from `pass` — no token in git config or any tracked file.
**rbw entry:** `api/gitea_token_AllExceptAdmin` **Pass path:** `gitea/token_AllExceptAdmin`
> Note: the older `site_farsi` convention used `pass gitea/token_AllExceptAdmin`. That entry
> exists but its GPG agent is not unlocked on this machine — `pass` blocks for ~60s and
> returns empty. Use `rbw`.
The credential helper is set locally in `.git/config` (never committed): The credential helper is set locally in `.git/config` (never committed):
``` ```
credential.https://gitea.cap.nlogn.ir.helper= credential.https://gitea.cap.nlogn.ir.helper=
!f() { echo username=fazel; echo password=$(rbw get "api/gitea_token_AllExceptAdmin" | head -1); }; f !f() { echo username=fazel; echo password=$(pass gitea/token_AllExceptAdmin); }; f
``` ```
**Push command** (bypass proxy — Gitea is on the local network): **Push command** (bypass proxy — Gitea is on the local network):
@ -30,8 +26,34 @@ NO_PROXY="*" no_proxy="*" http_proxy="" https_proxy="" HTTP_PROXY="" HTTPS_PROXY
git push gitea main git push gitea main
``` ```
If `rbw` is locked, `rbw unlock` first. To rotate: update in the Gitea UI, then ### If `pass` returns an empty string
`rbw edit "api/gitea_token_AllExceptAdmin"`. No git config change needed.
The store is encrypted to `caci96@gmail.com`, whose secret key lives on an **OpenPGP
smartcard** (`gpg --list-secret-keys --with-colons` shows serial `D276000124010304…`). When
gpg-agent has no cached session and no pinentry can reach a terminal, `pass` blocks for ~60s
and exits with empty stdout — it does *not* error. A credential helper wired to it then fails
auth for no visible reason.
Diagnose, do not guess:
```bash
export GPG_TTY=$(tty)
gpg --batch --pinentry-mode error --decrypt ~/.password-store/gitea/token_AllExceptAdmin.gpg
```
Success means the agent is unlocked and `pass` will work. `Bad passphrase`/`No secret key`
means insert the smartcard, or `export GPG_TTY=$(tty)` and re-run `pass` once interactively to
satisfy pinentry.
The same token is mirrored in `rbw` at `api/gitea_token_AllExceptAdmin` (verified
byte-identical). It needs no smartcard, so it is the fallback when the card is unavailable:
```
!f() { echo username=fazel; echo password=$(rbw get "api/gitea_token_AllExceptAdmin" | head -1); }; f
```
To rotate: update in the Gitea UI, then `pass edit gitea/token_AllExceptAdmin` **and**
`rbw edit "api/gitea_token_AllExceptAdmin"` so the two stay in sync. No git config change.
## What is NOT committed ## What is NOT committed