saltstack/salt — pull request #18560 by ewdurbin (2014-11-28 04:30:58+00:00)
Title: allow for git HTTP Basic Auth when using https://

- Overview

This commit adds support for HTTP Basic Auth user and passwords when cloning a git repository. Restrictions are placed to ensure Basic Auth is only used when accessing remote repositories over HTTPS.

Support for updating remotes is included for user/password/uri changes.

Submodule support is not supported with HTTPS Basic Auth, as those are outside the scope of my initial need.

This has a terrific tendency to leak credentials in the clear due to logging in the cmd.run set of tools.

- Motivation

Specifically, GitHub's HTTPS access layer has some niceties not available when using the SSH protocol. See https://help.github.com/articles/which-remote-url-should-i-use/#cloning-with-https-recommended

It is nice to enforce read-only access to repositories from remote hosts.

Also, it is a lot cleaner to drop Passwords/Security Tokens in configurations rather than PEM form private keys.