GCM Release 2.3.1 (#1376)

Changes:

- Ensure only unique accounts are returned from credential store
  - Issue: #1368
  - PR: #1369
- Migrate GCM from `microsoft/homebrew-git` to `Homebrew/homebrew-core`
tap
  - Issue: #1102 
  - PR: #1374

Author: ldennington

.github/workflows/release-homebrew.yaml

@@ -9,12 +9,13 @@ jobs:
     environment: release
     steps:
     - name: Update Homebrew tap
-      uses: mjcheetham/update-homebrew@v1.3
+      uses: mjcheetham/update-homebrew@v1.4
       with:
         token: ${{ secrets.HOMEBREW_TOKEN }}
-        tap: microsoft/git
-        name: git-credential-manager-core
+        tap: Homebrew/homebrew-cask
+        name: git-credential-manager
         type: cask
+        alwaysUsePullRequest: true
         releaseAsset: |
           gcm-osx-x64-(.*)\.pkg
           gcm-osx-arm64-(.*)\.pkg

VERSION

@@ -1 +1 @@
-2.3.0.0
+2.3.1.0

docs/faq.md

@@ -230,6 +230,51 @@ demonstration purposes).
 5. Re-authorizing the application with the new scope (GCM should automatically
 initiate this flow for you next time access is requested).
 
+### Q: What do the `configure` and `unconfigure` commands do?
+
+#### `configure`
+
+The `configure` command will set up Git to use GCM exclusively as the credential
+helper. The `configure` command is automatically called by the installers for
+Windows and macOS, but you can also run it manually.
+
+It will also set Git to provide the full remote URL (including path) to
+credential helpers for Azure Repos remotes using the `dev.azure.com` URL format.
+This is required in order to be to able to correctly identify the correct
+authority for that Azure DevOps organization.
+
+Specifically, the `configure` command will modify your user Git configuration to
+include the following lines:
+
+```ini
+[credential]
+    helper =
+    helper = <path-to-gcm>
+[credential "https://dev.azure.com"]
+    useHttpPath = true
+```
+
+..where `<path-to-gcm>` is the absolute path to the GCM executable.
+
+The empty `helper =` line makes sure that existing credential helpers that may
+be set in the system Git configuration are not used. For more details see the
+[credential.helper][helper-config-docs].
+
+If you pass the `--system` option, the `configure` command will instead modify
+the system Git configuration. This is useful if you want to set up GCM for all
+users on a machine.
+
+#### `unconfigure`
+
+This command essentially undoes what the `configure` command does. It will check
+your Git configuration for the lines added by the `configure` command and remove
+them. The `unconfigure` command is run by the uninstaller for Windows and the
+uninstall script on macOS.
+
+On Windows, if run with the `--system` option, the `unconfigure` command will
+also ensure that the `credential.helper` setting in the system Git configuration
+is not removed and is left as `manager`, the default set by Git for Windows.
+
 [autodetect]: autodetect.md
 [azure-ssh]: https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops
 [bitbucket-ssh]: https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html
@@ -251,6 +296,7 @@ initiate this flow for you next time access is requested).
 [gitlab-apps]: https://gitlab.com/-/profile/applications
 [gitlab-oauthapp-revoke]: ./img/gitlab-oauthapp-revoke.png
 [gitlab-oauthapp-revoked]: ./img/gitlab-oauthapp-revoked.png
+[helper-config-docs]: https://git-scm.com/docs/gitcredentials#Documentation/gitcredentials.txt-helper
 [multiple-users]: multiple-users.md
 [netconfig-http-proxy]: netconfig.md#http-proxy
 [linux-uninstall-from-src]: ./linux-fromsrc-uninstall.md

docs/img/msa-confirm.png

@@ -14,22 +14,21 @@ you have installed this using Homebrew, this installation will be unlinked
 #### Install
 
 ```shell
-brew tap microsoft/git
-brew install --cask git-credential-manager-core
+brew install --cask git-credential-manager
 ```
 
 After installing you can stay up-to-date with new releases by running:
 
 ```shell
-brew upgrade git-credential-manager-core
+brew upgrade --cask git-credential-manager
 ```
 
 #### Uninstall
 
 To uninstall, run the following:
 
 ```shell
-brew uninstall --cask git-credential-manager-core
+brew uninstall --cask git-credential-manager
 ```
 
 ---

docs/img/msa-remove.png

@@ -97,9 +97,23 @@ or by running `git credential-manager github --help`.
 
 ## TL;DR: Tell GCM to remember which account to use
 
-The easiest way to have GCM remember which account to use for which repository
-is to include the account name in the remote URL. If you're using HTTPS remotes,
-you can include the account name in the URL by inserting it before the `@` sign
+To set a default account for a particular remote you can simply set the
+following Git configuration:
+
+```shell
+git config --global credential.<URL>.username <USERNAME>
+```
+
+..where `<URL>` is the remote URL and `<USERNAME>` is the account you wish to
+have as the default. For example, for `github.com` and the user `alice`:
+
+```shell
+git config --global credential.https://github.com.username alice
+```
+
+If you wish to set a user for a specific repository or remote URL, you can
+include the account name in the remote URL. If you're using HTTPS remotes, you
+can include the account name in the URL by inserting it before the `@` sign
 in the domain name.
 
 For example, if you want to always use the `alice` account for the `mona/test`

docs/install.md

@@ -11,6 +11,23 @@ At the time, the actual exectuable name was not updated and continued to be
 `git-credential-manager-core`. As of [2.0.877][rename-ver], the executable has
 been renamed to `git-credential-manager`, matching the new project name.
 
+---
+
+:warning: **Update:** :warning:
+
+As of [2.3.0][no-symlink-ver] the `git-credential-manager-core` symlinks have been
+removed.
+
+If you have not updated your configuration you will see error messages similar to:
+
+```console
+git: 'credential-manager-core' is not a git command. See 'git --help'.
+```
+
+To fix your configuration, please follow the [instructions][instructions] below.
+
+---
+
 ## Rename transition
 
 If you continue to use the `git-credential-manager-core` executable name you may
@@ -35,7 +52,7 @@ name as soon as possible to prevent any issues in the future.
 ### Git for Windows
 
 If you are using GCM bundled with Git for Windows (recommended), you should make
-sure you have updated to at least version WINGIT_VERSION.
+sure you have updated to the latest version.
 
 [Download the latest Git for Windows ⬇️][git-windows]
 
@@ -164,3 +181,5 @@ or `manager` respectively.
 [gcm-latest]: https://aka.ms/gcm/latest
 [warnings]: #rename-transition
 [win-standalone-instr]: ../README.md#standalone-installation
+[instructions]: #how-to-update
+[no-symlink-ver]: https://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.3.0

docs/multiple-users.md

@@ -86,7 +86,9 @@ your machine: requiring certain kinds of sign-in, turning on antivirus and
 firewall software, and enabling BitLocker.
 Your identity will also be available to other apps on the computer for signing
 in, some of which may do so automatically.
+
 ![Example of policies pushed to an Intune-enrolled device][aad-bitlocker]
+
 - If you uncheck "allow my organization to manage my device" and click "OK",
 your computer will be registered with Azure AD but will not be MDM-enrolled.
 Your identity will be available to other apps on the computer for signing in.
@@ -95,6 +97,7 @@ organization to manage your device. Despite joining Azure AD, your
 organization's Conditional Access policies may still prevent you from accessing
 Azure DevOps.
 If so, you'll be prompted with instructions on how to enroll in MDM.
+
 - If you instead click "No, sign in to this app only", your machine will not be
 joined to Azure AD or MDM-enrolled, so no policies can be enforced, and your
 identity won't be made available to other apps on the computer.
@@ -132,27 +135,48 @@ improve over time and a "personal account" option to be presented in the future.
 
 If you've connected your MSA to Windows or signed-in to other Microsoft
 applications such as Office, then you may see this account listed in the
-authentication prompts when using GCM. For any connected MSA, you can control
-whether or not the account is available to other Microsoft applications in
-**Settings**, **Accounts**, **Emails & accounts**:
+authentication prompts when using GCM.
+
+---
+
+⚠️ **Important** ⚠️
+
+When adding a new MSA to Windows, you'll be asked to select whether to use this
+account across all of your device (**option 1**), or only permit Microsoft-apps
+to access your identity (**option 2**). If you opt to use the account everywhere,
+then your local Windows user account will be connected to that MSA.
+This means you'll need to use your MSA credentials to sign in to Windows going
+forward.
+
+Selecting "just this app" or "Microsoft apps only" will still allow you to use
+this MSA across apps in Windows, but will not require you to use your MSA
+credentials to sign in to Windows.
+
+![Confirmation to connect your MSA to Windows][msa-confirm]
+
+To disconnect an MSA added using option 1, you can go into **Settings**,
+**Accounts**, **Your info** and click **Stop signing in to all Microsoft apps
+automatically**.
+
+![Remove your Microsoft account from Windows][msa-remove]
+
+For MSAs added for "Microsoft apps only", you can modify whether or not these
+accounts are available to other applications, and also remove the accounts from
+ **Settings**, **Accounts**, **Emails & accounts**:
 
 ![Allow all Microsoft apps to access your identity][all-ms-apps]
 
 ![Microsoft apps must ask to access your identity][apps-must-ask]
 
-Two very important things to note:
+## Running as administrator
 
-- If you haven't connected any Microsoft accounts to Windows before, the first
-account you connect will cause the local Windows user account to be converted to
-a connected account.
-- In addition, you can't change the usage preference for the first Microsoft
-account connected to Windows: all Microsoft apps will be able to sign you in
-with that account.
+### GCM 2.1 and later
 
-As far as we can tell, there are no workarounds for either of these behaviors
-(other than to not use the WAM broker).
+From version 2.1 onwards, GCM uses a version of the [Microsoft Authentication
+Library (MSAL)][msal-dotnet] that supports use of the Windows
+broker from an elevated process.
 
-## Running as administrator
+### Previous versions
 
 The Windows broker ("WAM") makes heavy use of [COM][ms-com], a remote procedure
 call (RPC) technology built into Windows. In order to integrate with WAM, Git
@@ -181,8 +205,10 @@ See https://aka.ms/gcm/wamadmin for more information.
 
 In order to fix the problem, there are a few options:
 
-1. Run Git or Git Credential Manager from non-elevated processes.
-2. Disable the broker by setting the
+1. Update to the [latest Git for Windows][git-for-windows-latest]
+   **(recommended)**.
+2. Run Git or Git Credential Manager from non-elevated processes.
+3. Disable the broker by setting the
    [`GCM_MSAUTH_USEBROKER`][GCM_MSAUTH_USEBROKER]
    environment variable or the
    [`credential.msauthUseBroker`][credential.msauthUseBroker]
@@ -204,5 +230,8 @@ In order to fix the problem, there are a few options:
 [all-ms-apps]: img/all-microsoft.png
 [apps-must-ask]: img/apps-must-ask.png
 [ms-com]: https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model
+[msa-confirm]: img/msa-confirm.png
+[msa-remove]: img/msa-remove.png
 [msal-dotnet]: https://aka.ms/msal-net
 [devbox]: https://azure.microsoft.com/en-us/products/dev-box
+[git-for-windows-latest]: https://git-scm.com/download/win

docs/rename.md

@@ -34,6 +34,7 @@ <h2>Uninstall</h2>
             <h2>Resources</h3>
             <ul>
                 <li><a href="https://aka.ms/gcm">Project homepage</a></li>
+                <li><a href="https://aka.ms/gcm/faq">Frequently asked questions</a></li>
                 <li><a href="https://aka.ms/gcm/config">Configuration options</a></li>
             </ul>
         </div>

docs/windows-broker.md

@@ -28,6 +28,7 @@ <h2>Installation notes</h2>
             <h2>Learn more</h2>
             <ul>
                 <li><a href="https://aka.ms/gcm">Project homepage</a></li>
+                <li><a href="https://aka.ms/gcm/faq">Frequently asked questions</a></li>
             </ul>
         </div>
     </body>

src/osx/Installer.Mac/resources/en.lproj/conclusion.html

@@ -39,7 +39,7 @@ public SecretServiceCollection(string @namespace)
 
         public IList<string> GetAccounts(string service)
         {
-            return Enumerate(service, null).Select(x => x.Account).ToList();
+            return Enumerate(service, null).Select(x => x.Account).Distinct().ToList();
         }
 
         public ICredential Get(string service, string account)

src/osx/Installer.Mac/resources/en.lproj/welcome.html

@@ -66,15 +66,15 @@ public IList<string> GetAccounts(string service)
                         if (typeId == CFArrayGetTypeID())
                         {
                             int len = (int)CFArrayGetCount(resultPtr);
-                            var accounts = new List<string>(len);
+                            var accounts = new HashSet<string>(len);
                             for (int i = 0; i < len; i++)
                             {
                                 IntPtr dict = CFArrayGetValueAtIndex(resultPtr, i);
                                 string account = GetStringAttribute(dict, kSecAttrAccount);
                                 accounts.Add(account);
                             }
 
-                            return accounts;
+                            return accounts.ToList();
                         }
 
                         throw new InteropException($"Unknown keychain search result type CFTypeID: {typeId}.", -1);

src/shared/Core/Interop/Linux/SecretServiceCollection.cs

@@ -26,7 +26,7 @@ public WindowsCredentialManager(string @namespace = null)
 
         public IList<string> GetAccounts(string service)
         {
-            return Enumerate(service, null).Select(x => x.UserName).ToList();
+            return Enumerate(service, null).Select(x => x.UserName).Distinct().ToList();
         }
 
         public ICredential Get(string service, string account)

src/shared/Core/Interop/MacOS/MacOSKeychain.cs

@@ -25,7 +25,7 @@ public PlaintextCredentialStore(IFileSystem fileSystem, string storeRoot, string
 
         public IList<string> GetAccounts(string service)
         {
-            return Enumerate(service, null).Select(x => x.Account).ToList();
+            return Enumerate(service, null).Select(x => x.Account).Distinct().ToList();
         }
 
         public ICredential Get(string service, string account)

src/shared/Core/Interop/Windows/WindowsCredentialManager.cs

@@ -16,7 +16,7 @@ public TestCredentialStore()
 
         public IList<string> GetAccounts(string service)
         {
-            return Query(service, null).Select(x => x.Account).ToList();
+            return Query(service, null).Select(x => x.Account).Distinct().ToList();
         }
 
         ICredential ICredentialStore.Get(string service, string account)