Github 使用PAT(Personal Access Token)后的命令行登录

在Github上启用PAT

命令行下使用git push不能再直接使用用户名密码, 在输入密码的地方需要使用PAT来代替. 具体的创建步骤为

https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token

如果只是用于提交代码, 勾选repo部分即可, 对于大部分场景, 可以加上这几个权限gist, read:org, repo, workflow

Windows 用户

控制面板 => Credential Manager => Windows Credentials

找到 git:https://github.com => 编辑 => 将 Password 替换成在 GitHub 上生成的 Personal Access Token => OK

如果没有 git:https://github.com , 点击 Add a generic credential => Internet 地址填写 git:https://github.com , 输入用户名和 Personal Access Token => OK

之后在git中做如下设置

git config --local credential.helper wincred

Linux 用户

首先给git配置上 username 和 email

$ git config --global user.name "your_github_username"

$ git config --global user.email "your_github_email"

$ git config -l

然后用git连接 GitHub. 例如:

$ git clone https://github.com/YOUR-USERNAME/YOUR-REPOSITORY

> Cloning into `Spoon-Knife`...

$ Username for 'https://github.com' : username

$ Password for 'https://github.com' : 这里输入 personal access token

然后用下面的命令, 将这个token加入缓存

$ git config --global credential.helper cache

你可以随时使用下面的命令删除缓存

$ git config --global --unset credential.helper

$ git config --system --unset credential.helper

可以用-v参数验证一下

$ git pull -v

Linux/Debian可以用下面的命令Clone:

git clone https://@github.com//.git

开启双因子认证后命令行登入Github

在GitHub开启双因子后, 以前的登录方式不行了

mote-pad$ git pull

Username for 'https://github.com': someone

Password for 'https://someone@github.com':

remote: Support for password authentication was removed on August 13, 2021.

remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.

fatal: Authentication failed for 'https://github.com/someone/mote-pad.git/'

搜了下, 命令行登录需要通过GitHub CLi 或者 Git Credential Manager, 当前环境还没安装

mote-pad$ git credential-manager -h

git: 'credential-manager' is not a git command. See 'git --help'.

安装步骤

从 https://github.com/git-ecosystem/git-credential-manager/releases 下载 .deb 包(我用的Ubuntu环境)然后安装

# download

wget https://github.com/git-ecosystem/git-credential-manager/releases/download/v2.4.1/gcm-linux_amd64.2.4.1.deb

# install

sudo dpkg -i gcm-linux_amd64.2.4.1.deb

# configurate

git-credential-manager configure

# check

git credential-manager -h

设置存储方式

plaintext 明文方式, 默认存到 /home/[username]/.gcm/store/git/https/github.com/someone.credential, 这种方式不够安全

# cd到项目目录下, 用--local设为局部设置

git config --local credential.credentialStore plaintext

这时候就可以用github账号登录了

# 查看保存的github账号, 当前为空

git credential-manager github list

# 登录, 不需要用户名, 直接用 PAT Token

git credential-manager github login

Select an authentication method for 'https://github.com/':

1. Device code (default)

2. Personal access token

option (enter for default): 2

Enter GitHub personal access token for 'https://github.com/'...

Token:

# 检查

git credential-manager github list

someone

换成gpg存储

参考 https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/credstores.md

初始化 gpg key, 会让输入name和email, name 就是 user id, 可以用于后面的pass init

$ gpg --gen-key

...

Real name: someone

Email address: someone@outlook.com

You selected this USER-ID:

"someone "

Change (N)ame, (E)mail, or (O)kay/(Q)uit? o

We need to generate a lot of random bytes. It is a good idea to perform

some other action (type on the keyboard, move the mouse, utilize the

disks) during the prime generation; this gives the random number

generator a better chance to gain enough entropy.

We need to generate a lot of random bytes. It is a good idea to perform

some other action (type on the keyboard, move the mouse, utilize the

disks) during the prime generation; this gives the random number

generator a better chance to gain enough entropy.

gpg: key 2EDDD89402CB8758 marked as ultimately trusted

gpg: directory '/home/someone/.gnupg/openpgp-revocs.d' created

gpg: revocation certificate stored as '/home/someone/.gnupg/openpgp-revocs.d/771DB7B3382BA257BE64DB6F2EDDD89402CB8758.rev'

public and secret key created and signed.

pub rsa3072 2023-11-09 [SC] [expires: 2025-11-08]

771DB7B3382BA257BE64DB6F2EDDD89402CB8758

uid someone

sub rsa3072 2023-11-09 [E] [expires: 2025-11-08]

中间会创建一个口令, 用于日常验证

用这个user id创建pass

pass init someone

mkdir: created directory '/home/someone/.password-store/'

Password store initialized for someone

git config 换成 gpg 存储

git config --local credential.credentialStore gpg

之后第一次使用, 需要用APT登录, 后续登录, 需要使用之前创建的口令, 和sudo一样有缓存不需要每次验证