Linux - Git Credentials - How to remove an instance of a username/password combo?

Question

I just installed Libsecret and pointed it to be where my git credentials get saved:

git config --global credential.helper /usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret

But I really don't understand how to use it at all.. like at ALL.

It's been a pretty bleak experience to work with this, and actually seems like the only good solution on Linux at this point (its only been 2 years since the last update, rather than like 3+ for other options).

Is there a way to revoke a username/password stored on Libsecret? Like I have 0 clue how to wipe it other than to do --unset credential.helper, which just wipes everything. Can I not narrow it down by the repo/link the password being stored is related to? The Credential Manager on Windows makes this rediculously straightforward via the UI

Sorry to complain and talk about Windows' equivalent, but can anyone shine a light on that?

By all means, not set on using Libsecret if there are better alternatives to what I'm trying to do here. Please, any advance would be so greatly appreciated

Answer 1

It is not clear at all how to do this and the libsecret documentation -- https://developer.gnome.org/libsecret/0.18/ -- is just API/library documentation. Which is great, if you are programming an interface into libsecret. But is not great if you are an end user and want to update or remove an entry.

Also, I found that unsetting the git global config entry credential.helper just reverts git to using un-cached credentials. But when I pointed that setting back to git-credential-libsecret, my old password was still saved.

So, the answer to removing or updating a single entry turns out to be relatively simple. But NOT OBVIOUS.

1. Install Seahorse (https://wiki.gnome.org/Apps/Seahorse) if it isn't already installed. It will show up in your app menu as "Passwords and Keys"

2. Run Seahorse

   • Login (keychain) -> https://@github.com | Network Password

3. Double click or Right-click on it and edit, copy, or delete

Answer 2

As the other answer mentions, Seahorse is a GUI frontend to the same keyring, but there is also a CLI frontend called secret-tool that can access the same things.

No need to fiddle with what is behind a git credential helper.

Any git credential helper supports an "erase" method, as shown, for instance, in the sources of contrib/credential/libsecret/git-credential-libsecret.c:

/*
 * Table with helper operation callbacks, used by generic
 * credential helper main function.
 */
static struct credential_operation const credential_helper_ops[] = {
    { "get",   keyring_get },
    { "store", keyring_store },
    { "erase", keyring_erase },
    CREDENTIAL_OP_END
};

So, to erase a credential entry, you would need to type:

printf "protocol=https\nhost=github.com\nusername=<me>" | \
  git-credential-libsecret erase

Replace "github.com" and <me> with the actual remote site and remote account username.

If your credential helper is not libsecret but "manager-core" (using the Microsoft GCM which is cross-platform) , that would be:

printf "protocol=https\nhost=github.com\nusername=<me>" | \
  git-credential-manager-core erase

If your credential helper is not libsecret but "xxx" (any other helper, "store", "cache", ...):

printf "protocol=https\nhost=github.com\nusername=<me>" | \
  git-credential-xxx erase

Simply type your credential helper command: it will display its commands.
In my case:

git-credential-manager-core
Required command was not provided.

Usage:
  git-credential-manager-core [options] [command]

Options:
  --version         Show version information
  -?, -h, --help    Show help and usage information

Commands:
  get            [Git] Return a stored credential
  store          [Git] Store a credential
  erase          [Git] Erase a stored credential
  configure      Configure Git Credential Manager as the Git credential helper
  unconfigure    Unconfigure Git Credential Manager as the Git credential helper
  azure-repos    Commands for interacting with the Azure Repos host provider

Just make sure it is in your $PATH (it should be in /usr/bin, if not: /usr/lib/git-core)

Older helpers do not display all "action" commands, and use older synonyms for erase (remove or delete)

To check the erase/remove/delete has worked, display your stored password first ("get"), then "erase", then try and display it again, using again the "get" action:

printf "protocol=https\nhost=github.com\nusername=<me>" | \
  git-credential-xxx get

If it prompts for you to enter your username/password, that means you have succeeded in deleting your cached entry.