I am trying to run git pull -f --tags on an ADO Services self hosted agent. The command runs fine during the build, but when I login to the machine (to troubleshoot some issue) and run it from the console I get an error.
Here is the transcript:
PS D:\_wf\03\1\s\dayforce> D:\_exe\01\externals\git\cmd\git.exe -c http.extraheader="AUTHORIZATION: bearer $t" pull -f --tags
warning: Pulling without specifying how to reconcile divergent branches is
discouraged. You can squelch this message by running one of the following
commands sometime before your next pull:
git config pull.rebase false # merge (the default strategy)
git config pull.rebase true # rebase
git config pull.ff only # fast-forward only
You can replace "git config" with "git config --global" to set a default
preference for all repositories. You can also pass --rebase, --no-rebase,
or --ff-only on the command line to override the configured default per
invocation.
fatal: could not read Password for 'https://Ceridian-dryrun@dev.azure.com': No such file or directory
PS D:\_wf\03\1\s\dayforce>
What would be the reason for git to seemingly ignore the bearer authentication and insist on password? What file is missing? How can I troubleshoot it?
Here is the git config output:
PS D:\_wf\03\1\s\dayforce> D:\_exe\01\externals\git\cmd\git.exe config -l
error: cannot spawn less: No such file or directory
core.symlinks=false
core.autocrlf=true
color.diff=auto
color.status=auto
color.branch=auto
color.interactive=true
pack.packsizelimit=2g
help.format=html
diff.astextplain.textconv=astextplain
rebase.autosquash=true
include.path=C:/Program Files (x86)/Git/etc/gitconfig
include.path=C:/Program Files/Git/etc/gitconfig
user.name=g5tfsbuild
user.email=tfsbuild@dayforce.com
core.repositoryformatversion=0
core.filemode=false
core.bare=false
core.logallrefupdates=true
core.symlinks=false
core.ignorecase=true
remote.origin.url=https://Ceridian-dryrun@dev.azure.com/Ceridian-dryrun/SharpTop/_git/dayforce
remote.origin.fetch=+refs/heads/*:refs/remotes/origin/*
gc.auto=0
http.version=HTTP/1.1
filter.lfs.clean=git-lfs clean -- %f
filter.lfs.smudge=git-lfs smudge -- %f
filter.lfs.process=git-lfs filter-process
filter.lfs.required=true
PS D:\_wf\03\1\s\dayforce>
And the git remote:
PS D:\_wf\03\1\s\dayforce> git remote -v
origin https://Ceridian-dryrun@dev.azure.com/Ceridian-dryrun/SharpTop/_git/dayforce (fetch)
origin https://Ceridian-dryrun@dev.azure.com/Ceridian-dryrun/SharpTop/_git/dayforce (push)
PS D:\_wf\03\1\s\dayforce>
EDIT 1
So it seems the reason is that git fails to apply the bearer authentication and falls back to some kind of a default which expects password to be read from somewhere. Which is weird, because bearer works in the pipeline.
I changed the code to basic and it worked:
$e = [convert]::ToBase64String($([Text.Encoding]::UTF8.GetBytes(":$t")))
D:\_exe\01\externals\git\cmd\git.exe -c http.extraheader="AUTHORIZATION: basic $e" pull -f --tags
Still the question remains - why bearer does not work on the console, but works in the pipeline?