golang/go · error

'git credential fill' failed (url=%s): %w %s

Error message

'git credential fill' failed (url=%s): %w
%s

What it means

Returned by runGitAuth when `exec.Command("git", "credential", "fill")` (run with cmd.Dir = dir and `url=<url>` on stdin) fails via CombinedOutput. The error wraps the underlying exec error with %w and appends git's combined stdout/stderr with %s, so the message shows both why git failed and what git printed.

Source

Thrown at src/cmd/go/internal/auth/gitauth.go:50

// The caller must not mutate the header.
func runGitAuth(client *http.Client, dir, url string) (string, http.Header, error) {
	if url == "" {
		// No explicit url was passed, but 'git credential'
		// provides no way to enumerate existing credentials.
		// Wait for a request for a specific url.
		return "", nil, fmt.Errorf("no explicit url was passed")
	}
	if dir == "" {
		// Prevent config-injection attacks by requiring an explicit working directory.
		// See https://golang.org/issue/29230 for details.
		panic("'git' invoked in an arbitrary directory") // this should be caught earlier.
	}
	cmd := exec.Command("git", "credential", "fill")
	cmd.Dir = dir
	cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
	out, err := cmd.CombinedOutput()
	if err != nil {
		return "", nil, fmt.Errorf("'git credential fill' failed (url=%s): %w\n%s", url, err, out)
	}
	parsedPrefix, username, password := parseGitAuth(out)
	if parsedPrefix == "" {
		return "", nil, fmt.Errorf("'git credential fill' failed for url=%s, could not parse url\n", url)
	}
	// Check that the URL Git gave us is a prefix of the one we requested.
	if !strings.HasPrefix(url, parsedPrefix) {
		return "", nil, fmt.Errorf("requested a credential for %s, but 'git credential fill' provided one for %s\n", url, parsedPrefix)
	}
	req, err := http.NewRequest("HEAD", parsedPrefix, nil)
	if err != nil {
		return "", nil, fmt.Errorf("internal error constructing HTTP HEAD request: %v\n", err)
	}
	req.SetBasicAuth(username, password)
	// Asynchronously validate the provided credentials using a HEAD request,
	// allowing the git credential helper to update its cache without blocking.
	// This avoids repeatedly prompting the user for valid credentials.
	// This is a best-effort update; the primary validation will still occur

View on GitHub (pinned to b6b368adc5)

Solutions

  1. Configure a credential helper: `git config --global credential.helper manager` (or store/osxkeychain/cache).
  2. Pre-approve the credential so `git credential fill` succeeds: `printf 'protocol=https\nhost=example.com\nusername=u\npassword=p\n' | git credential approve`.
  3. Verify git is installed: `git --version`.
  4. Run `go get -x <url>` to read the wrapped git output in the message.
Defensive patterns

Strategy: try-catch

Validate before calling

// Verify git credential fill works for the URL ahead of time.
cmd := exec.Command("git", "credential", "fill")
cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
if out, err := cmd.CombinedOutput(); err != nil {
    return fmt.Errorf("git credential fill failed: %w\n%s", err, out)
}

Try / catch

// Inspect the wrapped exec error and git output.
if prefix, header, err := runGitAuth(client, dir, url); err != nil {
    log.Printf("git auth failed for %s: %v", url, err)
    // fall back to another GOAUTH method
} else {
    storeCredential(prefix, header)
}

Prevention

When it happens

Trigger: git is not installed or not on PATH; `git credential fill` exits non-zero because no credential helper can satisfy the request; the helper errors; git prompts interactively in a non-TTY and aborts.

Common situations: No credential helper configured for the host; expired/revoked token; git version too old; helper lock contention; corporate proxy requiring credentials git doesn't have.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f1cfd1c457f9f28c. Report an issue: GitHub.