Magit: use password-store as auth source for Push and Pull operations?

I use pass and the emacs package password-store to manage my passwords. I'd love the password-store (used as auth-source) to handle Name and/or password retrieval. Is this possible?

Why use passwords? Generate access tokens on whatever forge you use. They are dead simple to set up and more secure than a password.

In my setup use [pass-git-helper](https://github.com/languitar/pass-git-helper) and it works with both magit and CLI git without any problems

It's very unusual to use any kind of password for Git push/pull operations. The typical setup will use Git over SSH, leaning on SSH for authentication using a keypair. My strong suggestion is to go that route instead of using a password at all.

I use [git-credential-manager](https://github.com/GitCredentialManager/git-credential-manager) as git credential helper with `secretservice` as `credentialStore` which is handled by KeePassXC. You can see the list of supported stores [here](https://github.com/GitCredentialManager/git-credential-manager/blob/main/docs/credstores.md). You can also see the supported authentication modes in [configuration.md](https://github.com/GitCredentialManager/git-credential-manager/blob/main/docs/configuration.md).

sorry, i'm kind of a noob and don't know how to do what you describe. is there a chance you have a resource handy?

do you happen to have a resource handy on how to approach this in the context of emacs and magit?

Just Google for „git ssh how to use”; after you get it configured on your system, it will not require any further changes in Emacs or Magit, everything will just-work :-)

No, because there's no Magit or Emacs setup necessary. You're better off searching for info on this, but broadly, you need to generate a SSH keypair, configure SSH to use the private key, configure your remote (that is, GitHub or whatever hosts the repo) with the public key, and either re-clone with the `git@` URL or use `git remote set-url REMOTE NEW-URL`.

I don't know for other repos but Github has quite detailed [step-by-step guide](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent), if you use Github. I guess others have it too.

Here is a good place to start: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

Access tokens are technically still passwords so the issue persists.

Do you mean only for git operations or also forge? In any case Magit and forge uses Emacs authsource, in the emacs manual it's explained how to set it up. https://www.gnu.org/software/emacs/manual/html_node/auth/index.html#Top

You can also configure auth source and setup emacs to save any credential in emacs.

You can also use Gpg instead of an SSH keypair for ssh.

They are not the same. This answer on Stack Exchange covers the basics: https://security.stackexchange.com/questions/63435/why-use-an-authentication-token-instead-of-the-username-password-per-request

They are credentials if you want to call them password, access token or whatever it doesn't change what happens if someone else gets them. You want to save them somewhere safe. In his case he wants to safe them in his password store.

Yes, I have my SSH private key on my YubiKey (and nowhere else).

You can put the SSH key on the key but also use the GPG on the key for SSH.

I have this setup to make magit and forge to use pass through auth-source: (use-package auth-source-pass :config (auth-source-pass-enable))