Git: 2.16.2 "cannot spawn git-credential-manager: Function not implemented" when running non elevated

[limasued]

• [x] I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

git version 2.16.2.windows.1
cpu: x86_64
built from commit: e1848984d1004040ec5199e749b5f282ddf4bb09
sizeof-long: 4

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

Microsoft Windows [versão 10.0.16299.309] 64-bit

• What options did you set as part of the installation? Or did you choose the defaults?

Editor Option: VisualStudioCode
Path Option: Cmd
SSH Option: OpenSSH
CURL Option: WinSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Performance Tweaks FSCache: Enabled
Use Credential Manager: Enabled
Enable Symlinks: Disabled

• Any other interesting things about your environment that might be related to the issue you're seeing?
  Nothing that I've noticed

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

Visual Studio Code

• What commands did you run to trigger this issue? If you can provide a Minimal, Complete, and Verifiable example this will help us understand the issue.

git pull origin feature

• What did you expect to occur after running these commands?
  Git would use the manager helper as set on my git global config file to find and my credentials to authenticate on remote, since the credentials were provided, git would read it and pass it to the server.

> git pull origin feature
13:08:32.271519 git.c:344               trace: built-in: git 'pull' 'origin' 'feature'
13:08:32.792874 run-command.c:627       trace: run_command: 'fetch' '--update-head-ok' 'origin' 'feature'
13:08:33.429832 git.c:344               trace: built-in: git 'fetch' '--update-head-ok' 'origin' 'feature'
13:08:33.440841 run-command.c:627       trace: run_command: 'remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
13:08:33.549437 git.c:576               trace: exec: 'git-remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
13:08:33.551439 run-command.c:627       trace: run_command: 'git-remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
13:08:38.388598 run-command.c:627       trace: run_command: 'git credential-manager get'
13:08:40.833350 git.c:576               trace: exec: 'git-credential-manager' 'get'
13:08:40.835352 run-command.c:627       trace: run_command: 'git-credential-manager' 'get'
13:08:43.266005 ...\Common.cs:527       trace: [Main] git-credential-manager (v1.14.0) 'get'
13:08:43.652348 ...\Where.cs:240        trace: [FindGitInstallations] found 1 Git installation(s).
13:08:43.671861 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 38 entries.
13:08:43.677366 ...\Where.cs:240        trace: [FindGitInstallations] found 1 Git installation(s).
13:08:43.680367 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 38 entries.
13:08:43.693376 ...\Common.cs:421       trace: [LoadOperationArguments] writelog = 'True'.
13:08:43.693877 ...\Common.cs:429       trace: [LoadOperationArguments] modalPrompt = 'True'.
13:08:43.694377 ...\Common.cs:445       trace: [LoadOperationArguments] useHttpPath = ''.
13:08:43.697379 ...\Common.cs:246       trace: [EnableTraceLogging] trace logging enabled.
13:08:43.698380 ...\Common.cs:251       trace: [EnableTraceLogging] git local config found at 'c:\Users\limas\limasued-website\.git\config'.
13:08:43.702883 ...\Common.cs:299       trace: [EnableTraceLoggingFile] trace log destination is 'c:\Users\limas\limasued-website\.git'.
13:08:43.777434 ...\Common.cs:77        trace: [CreateAuthentication] detecting authority type for 'https://limasued.visualstudio.com/_git/limasued-website'.
13:08:43.891078 ...uthentication.cs:137 trace: [DetectAuthority] 'https://limasued.visualstudio.com/_git/limasued-website' is subdomain of 'visualstudio.com', checking AAD vs MSA.
13:08:44.243759 ...uthentication.cs:245 trace: [GetAuthentication] AAD authority for tenant '2f8ca951-xxxxxx-xxxxx-xxxxx-xxxxxxx' detected.
13:08:44.356852 ...\Common.cs:121       trace: [CreateAuthentication] authority for 'https://limasued.visualstudio.com/_git/limasued-website' is Azure Directory.
13:08:44.356852 ...uthentication.cs:137 trace: [DetectAuthority] 'https://limasued.visualstudio.com/_git/limasued-website' is subdomain of 'visualstudio.com', checking AAD vs MSA.
13:08:44.457857 ...seSecureStore.cs:138 trace: [ReadCredentials] credentials for 'git:https://limasued.visualstudio.com/_git/limasued-website' read from store.
13:08:44.459858 ...uthentication.cs:269 trace: [GetCredentials] credentials for 'https://limasued.visualstudio.com/_git/limasued-website' found.
13:08:44.777621 ...zureAuthority.cs:172 trace: [ValidateCredentials] validating credentials against 'https://limasued.visualstudio.com/_apis/connectiondata'.
13:08:45.779983 ...zureAuthority.cs:178 trace: [ValidateCredentials] server returned: 'OK'.
13:08:45.979673 ...\Common.cs:599       trace: [QueryCredentials] credentials for 'https://limasued.visualstudio.com/_git/limasued-website' found.
13:08:46.041713 ...\Common.cs:495       trace: [LogEvent] Azure Directory credentials  for 'https://limasued.visualstudio.com/_git/limasued-website' successfully retrieved.
13:08:46.616469 run-command.c:627       trace: run_command: 'git credential-manager store'
13:08:47.001815 git.c:576               trace: exec: 'git-credential-manager' 'store'
13:08:47.003815 run-command.c:627       trace: run_command: 'git-credential-manager' 'store'
13:08:47.223988 ...\Common.cs:527       trace: [Main] git-credential-manager (v1.14.0) 'store'
13:08:47.533087 ...\Where.cs:240        trace: [FindGitInstallations] found 1 Git installation(s).
13:08:47.551099 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 38 entries.
13:08:47.555102 ...\Where.cs:240        trace: [FindGitInstallations] found 1 Git installation(s).
13:08:47.558104 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 38 entries.
13:08:47.572113 ...\Common.cs:421       trace: [LoadOperationArguments] writelog = 'True'.
13:08:47.572614 ...\Common.cs:429       trace: [LoadOperationArguments] modalPrompt = 'True'.
13:08:47.572614 ...\Common.cs:445       trace: [LoadOperationArguments] useHttpPath = ''.
13:08:47.578623 ...\Common.cs:246       trace: [EnableTraceLogging] trace logging enabled.
13:08:47.581621 ...\Common.cs:251       trace: [EnableTraceLogging] git local config found at 'c:\Users\limas\limasued-website\.git\config'.
13:08:47.586123 ...\Common.cs:299       trace: [EnableTraceLoggingFile] trace log destination is 'c:\Users\limas\limasued-website\.git'.
13:08:47.653167 ...\Common.cs:77        trace: [CreateAuthentication] detecting authority type for 'https://limasued.visualstudio.com/_git/limasued-website'.
13:08:47.687691 ...uthentication.cs:137 trace: [DetectAuthority] 'https://limasued.visualstudio.com/_git/limasued-website' is subdomain of 'visualstudio.com', checking AAD vs MSA.
13:08:47.717210 ...uthentication.cs:245 trace: [GetAuthentication] AAD authority for tenant '2f8ca951-xxxxxx-xxxxx-xxxxx-xxxxxxx' detected.
13:08:47.785257 ...\Common.cs:121       trace: [CreateAuthentication] authority for 'https://limasued.visualstudio.com/_git/limasued-website' is Azure Directory.
13:08:47.785257 ...uthentication.cs:137 trace: [DetectAuthority] 'https://limasued.visualstudio.com/_git/limasued-website' is subdomain of 'visualstudio.com', checking AAD vs MSA.
13:08:47.816276 ...\Program.cs:347      trace: [Store] storing VSTS credentials for 'https://limasued.visualstudio.com/_git/limasued-website'.
13:08:47.892828 run-command.c:627       trace: run_command: 'rev-list' '--objects' '--stdin' '--not' '--all' '--quiet'
13:08:48.410768 run-command.c:627       trace: run_command: 'rev-list' '--objects' '--stdin' '--not' '--all' '--quiet'
13:08:48.665071 git.c:344               trace: built-in: git 'rev-list' '--objects' '--stdin' '--not' '--all' '--quiet'
13:08:48.821161 run-command.c:1470      run_processes_parallel: preparing to run up to 1 tasks
13:08:48.821161 run-command.c:1502      run_processes_parallel: done
13:08:48.821161 run-command.c:627       trace: run_command: 'gc' '--auto'
From https://limasued.visualstudio.com/_git/limasued-website
 * branch            feature    -> FETCH_HEAD
13:08:48.980285 git.c:344               trace: built-in: git 'gc' '--auto'
13:08:49.121734 run-command.c:627       trace: run_command: 'merge' 'FETCH_HEAD'
13:08:49.261836 git.c:344               trace: built-in: git 'merge' 'FETCH_HEAD'
> git status -z -u
> git symbolic-ref --short HEAD
13:08:50.265869 git.c:344               trace: built-in: git 'symbolic-ref' '--short' 'HEAD'
> git rev-parse feature
13:08:50.611100 git.c:344               trace: built-in: git 'rev-parse' 'feature'
> git rev-parse --symbolic-full-name feature@{u}
13:08:50.971340 git.c:344               trace: built-in: git 'rev-parse' '--symbolic-full-name' 'feature@{u}'
> git rev-list --left-right feature...refs/remotes/origin/feature
13:08:51.289229 git.c:344               trace: built-in: git 'rev-list' '--left-right' 'feature...refs/remotes/origin/feature'
> git for-each-ref --format %(refname) %(objectname) --sort -committerdate
> git remote --verbose
13:08:51.624995 git.c:344               trace: built-in: git 'remote' '--verbose'
13:08:51.624995 git.c:344               trace: built-in: git 'for-each-ref' '--format' '%(refname) %(objectname)' '--sort' '-committerdate'

• What actually happened instead?
  Git were unable to handle the files for git-credential-manager since I am running Visual Studio Code non elevated (not as administrator) on the default installation path (c:\Program Files (x86)\Microsoft VS Code). I was able to contour this issue running VS Code as administrator.

> git pull origin feature
12:46:55.636308 git.c:344               trace: built-in: git 'pull' 'origin' 'feature'
12:46:55.644313 run-command.c:627       trace: run_command: 'fetch' '--update-head-ok' 'origin' 'feature'
12:46:55.877970 git.c:344               trace: built-in: git 'fetch' '--update-head-ok' 'origin' 'feature'
12:46:55.890979 run-command.c:627       trace: run_command: 'remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
12:46:56.042081 git.c:576               trace: exec: 'git-remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
12:46:56.043582 run-command.c:627       trace: run_command: 'git-remote-https' 'origin' 'https://limasued.visualstudio.com/_git/limasued-website'
12:46:56.847324 run-command.c:627       trace: run_command: 'git credential-manager get'
12:46:57.130050 git.c:576               trace: exec: 'git-credential-manager' 'get'
12:46:57.132050 run-command.c:627       trace: run_command: 'git-credential-manager' 'get'
warning: failed to restrict file handles (740)

handle #0: 0000000000000264 (type 3, handle info (1) 0
handle #1: 0000000000000268 (type 3, handle info (1) 1
handle #2: 00000000000004ec (type 3, handle info (1) 1

error: cannot spawn git-credential-manager: Function not implemented
12:46:57.166089 run-command.c:627       trace: run_command: 'c:\Program Files (x86)\Microsoft VS Code\resources\app\extensions\git\out\askpass.sh' 'Username for '\''https://limasued.visualstudio.com/_git/limasued-website'\'': '
12:47:06.577306 run-command.c:627       trace: run_command: 'c:\Program Files (x86)\Microsoft VS Code\resources\app\extensions\git\out\askpass.sh' 'Password for '\''https://limasued.visualstudio.com/_git/limasued-website'\'': '
12:47:09.076976 run-command.c:627       trace: run_command: 'git credential-manager erase'
12:47:09.316675 git.c:576               trace: exec: 'git-credential-manager' 'erase'
12:47:09.317677 run-command.c:627       trace: run_command: 'git-credential-manager' 'erase'
warning: failed to restrict file handles (740)

handle #0: 0000000000000258 (type 3, handle info (1) 0
handle #1: 0000000000000264 (type 2, handle info (1) 1
handle #2: 00000000000004ec (type 3, handle info (1) 1

error: cannot spawn git-credential-manager: Function not implemented
fatal: Authentication failed for 'https://limasued.visualstudio.com/_git/limasued-website/'

• If the problem was occurring with a specific repository, can you provide the URL to that repository to help us with testing?

Any repository I tried to pull would get the same error

[dscho]

The error 740 indeed says that the requested operation requires elevation. However, my local copy of git-credential-manager.exe has a manifest that says:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

So it does not require elevation and even says so.

Out of curiosity: did you install Git Credential Manager yourself? What does git credential-manager version say? Can you inspect the git-credential-manager.exe with ResEdit and verify that it has the same manifest as mine?

[limasued]

Hi @dscho, so... After you pointed out that your GCM runs on requestedExecutionLevel level="asInvoker" I tried to recollect my steps and figured out the issue cause. I hope I can be objective:

1. Installed Git pretty straight forward with default settings (next, next, next, finish);
2. Cloned my repo from VS Code and set up my credentials hassle free;
3. Everything was fine when, one day, GCM started to prompt me for credentials on every git command and, regardlessly I was typing the correct password and MFA codes, it never worked;
4. First I thought "oh, this is a GCM issue, lets work on that" (only later I figured out the problem was my global .gitconfig file had been set with authority = MSA for visualstudio.com domain, which is the default, but since I linked my VSTS account to my Azure subscription the correct authority to use is AAD, but I didn't know it at the time);
5. (This is where things got wrong) Trying to fix it by "DIY" principles, and without checking git trace logs, I went to the GCM installation folder and manually modified the properties of both git-credential-manager.exe and git-askpass.exe checking Run as administrator under Compatibility tab. So, since I was running VS Code non elevated, GCM was unable to get the right privileges to execute.

As I posted on issue description, running VS Code as administrator helped to contour the problem. As so undoing my tricks on step 5 solved the riddle.
I guess there's nothing to do here, since the real problem was forcing GCM to run MSA authority on an AAD-backed VSTS account. Unless you want to change that ('cause I'm almost sure I had to remove the [credential "microsoft.visualstudio.com"] authority = MSA node from my .gitconfig global setting).

Thanks for your support, it led me right to the source!

[dscho]

Excellent! I am glad you found the solution.