From 24744997eba822d036775bc5688cc0a7d8654ee5 Mon Sep 17 00:00:00 2001 From: bcherb2 Date: Mon, 17 Aug 2026 21:01:19 -0400 Subject: [PATCH] docs: record where the private-tier clone credential goes, and why --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index 30ca75b..2690bcf 100644 --- a/README.md +++ b/README.md @@ -166,6 +166,17 @@ every machine you ever build. The password is spent, never stored, and never reaches `argv` — `curl -K -` reads it from stdin, so it never reaches `ps` either. +The clone URL that comes back carries a read-only token inline, and it gets the +same treatment. The token is split out into +`~/.config/dotfiles/private-credentials` (mode 600, git-credential-store +format); `chezmoi init` receives a clean URL, and the helper is written into the +clone's own config so a later `chezmoi update` still authenticates. Not printing +it was never sufficient: `/proc//cmdline` is world-readable, so passing the +credential-bearing URL to `chezmoi init` disclosed the token to every account on +the box for the length of the clone, and then persisted it in `.git/config` +until the tree was deleted. The redaction that predates this only ever covered +the trace line. + `dotup --unattended` cannot reach any of this. It has nobody to type a password, and it refuses `private` and `invasive` rows outright even if a stale state file ticks them.