Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Organizing multiple Git identities

garrit.xyz

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Organizing multiple Git identities

#31

Post by nickjj »

qntmfred wrote: post #6
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

I used to do it that way. Recently learned this approach put this in your ~/.gitconfig-personal [core] sshCommand = "ssh -i ~/.ssh/github_personal_ed25519" and this in your ~/.gitconfig-work [core] sshCommand = "ssh -i ~/.ssh/github_work_ed25519"

This is what I do too, I've written about it in detail at: https://nickjanetakis.com/blog/using-a-custom-ssh-key-to-acc...

You can also set that in your `.git/config` file on a per repo basis. Additionally you can set `GIT_SSH_COMMAND="ssh -i /tmp/custom_key_ed25519 -o IdentitiesOnly=yes" git pull` to override whatever is in your global or repo config for 1 off pulls / clones as a different user.

Re: Organizing multiple Git identities

#32

Post by vindex10 »

tjoff wrote: post #29
vindex10 wrote: post #28

I find one disadvantage of SSH key auth, in case of GitHub in particular, that SSH key grants access to all the repos independently on the organization, etc, which becomes a bigger problem when sharing the machine with other people. One can set a password on the ssh key, but I still felt a bit paranoid about it. I found a way out with fine-grained personal access tokens which allow you to choose the repositories this…

> I find one disadvantage of SSH key auth, in case of GitHub in particular, that SSH key grants access to all the repos independently on the organization, etc. Doesn't the article fix exactly that?

my concern is not the configuration of gitconfig, but keeping the "escalated" ssh keys on the shared machine

if I understood correctly, the article suggests the way how to choose ssh key among those already stored on the server

Re: Organizing multiple Git identities

#33

Post by atoav »

vindex10 wrote: post #28

I find one disadvantage of SSH key auth, in case of GitHub in particular, that SSH key grants access to all the repos independently on the organization, etc, which becomes a bigger problem when sharing the machine with other people. One can set a password on the ssh key, but I still felt a bit paranoid about it. I found a way out with fine-grained personal access tokens which allow you to choose the repositories this…

> Disadvantage is that you have to enter password each time you push/pull.

Run ssh-add in your terminal session before doing your push/pull dance — this way you only have to enter the password once. This gives you the security of the password protected key without bothering you too much in practise.

If you need to pull on a remote that doesn't have your private keys (as is good and proper) you can run ssh -A foo@bar.com to take that identity with you onto that remote (e.g. so you are able to pus/pull from there).

Re: Organizing multiple Git identities

#34

Post by computerfriend »

xp84 wrote: post #22
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

This is pretty cool. I'm curious, what are people's opinions about the pro/cons of maintaining multiple GitHub identities like this? Personally, I have never found it necessary to do this, but about 1/3 to ½ of the people I work with usually have "-companyname" in their usernames, so it appears semi-popular. What I do is just add my work email as a secondary to my GitHub account and configure the work laptop to use t…

That con was reason enough for me to never do this. Another reason is, when using my personal GitHub account, I'm doing personal things and don't want to see work-related stuff (even if it is just private contributions or the "use SSO to see $employer repositories" message).

Re: Organizing multiple Git identities

#35

Post by nine_k »

nickjj wrote: post #31
qntmfred wrote: post #6

Earlier quoted context omitted.

I used to do it that way. Recently learned this approach put this in your ~/.gitconfig-personal [core] sshCommand = "ssh -i ~/.ssh/github_personal_ed25519" and this in your ~/.gitconfig-work [core] sshCommand = "ssh -i ~/.ssh/github_work_ed25519"

This is what I do too, I've written about it in detail at: https://nickjanetakis.com/blog/using-a-custom-ssh-key-to-acc... You can also set that in your `.git/config` file on a per repo basis. Additionally you can set `GIT_SSH_COMMAND="ssh -i /tmp/custom_key_ed25519 -o IdentitiesOnly=yes" git pull` to override whatever is in your global or repo config for 1 off pulls / clones as a different user.

This is indispensable when you have to clone a repo, so no config settings based on being inside a repo do not apply.

Re: Organizing multiple Git identities

#36

Post by jackbravo »

xp84 wrote: post #22
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

This is pretty cool. I'm curious, what are people's opinions about the pro/cons of maintaining multiple GitHub identities like this? Personally, I have never found it necessary to do this, but about 1/3 to ½ of the people I work with usually have "-companyname" in their usernames, so it appears semi-popular. What I do is just add my work email as a secondary to my GitHub account and configure the work laptop to use t…

about the "cons", another con is that granting access to your unified account from your work or business perspective is "tricky". Github Business accounts can grant specific access only for people identifying with your company's identity provider, like okta or similar. So that can potentially reduce that risk as well, so that your employer can revoke access to okta, and thus revoke access to work repositories, for example. Without that you need to be very strict and do some manual work to grant and revoke accesses.

Re: Organizing multiple Git identities

#37

Post by hk1337 »

l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Curious, why would you need separate ssh keys for the same site? In the above example, you're authenticating the GitHub, not really to client1 or client2.

The only thing that would need to change, AFAIK, is the name and email you use for commits, not necessarily our ssh key.

I do use this:

    [includeIf "gitdir:~/Projects/Client1/"]
       path = ~/Projects/Client1/.gitconfig

    [includeIf "gitdir:~/Projects/Client2/"]
       path = ~/Projects/Client2/.gitconfig
to define the user.name and user.email for different projects

Re: Organizing multiple Git identities

#38

Post by king_geedorah »

hk1337 wrote: post #37
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Curious, why would you need separate ssh keys for the same site? In the above example, you're authenticating the GitHub, not really to client1 or client2. The only thing that would need to change, AFAIK, is the name and email you use for commits, not necessarily our ssh key. I do use this: [includeIf "gitdir:~/Projects/Client1/"] path = ~/Projects/Client1/.gitconfig [includeIf "gitdir:~/Projects/Client2/"] path = ~/P…

Last I checked, one can't use the same SSH key for multiple github accounts, so if that is part of your workflow then you have to have different keys configured.

Re: Organizing multiple Git identities

#39

Post by hk1337 »

king_geedorah wrote: post #38
hk1337 wrote: post #37

Earlier quoted context omitted.

Curious, why would you need separate ssh keys for the same site? In the above example, you're authenticating the GitHub, not really to client1 or client2. The only thing that would need to change, AFAIK, is the name and email you use for commits, not necessarily our ssh key. I do use this: [includeIf "gitdir:~/Projects/Client1/"] path = ~/Projects/Client1/.gitconfig [includeIf "gitdir:~/Projects/Client2/"] path = ~/P…

Last I checked, one can't use the same SSH key for multiple github accounts, so if that is part of your workflow then you have to have different keys configured.

True, but I guess I am still wondering why would you need multiple GitHub accounts. I could see 1 for personal and 1 for work but still kind of wonder why. Even in that scenario, you would only need to account for 2 different ssh keys.

Typically, for Client1 and Client2, both clients could invite the same account to the organization.

Re: Organizing multiple Git identities

#40

Post by CamJN »

l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Here's pretty much what I do:

ssh config:

    Host github.com gist.github.com
      Hostname %h
      User git
      RequestTTY no
      RemoteCommand none
      IdentitiesOnly yes
      ControlMaster no

    Match host github.com,gist.github.com exec "~/Developer/C/getargv/bin/getargv -0 -s 1 $PPID | env POSIXLY_CORRECT=1 xargs -0 getopt '46AaCfGgKkMNnqsTtVvXxYyB:b:c:D:E:e:F:I:i:J:L:l:m:O:o:p:Q:R:S:W:w:' | perl -pe 's|.*? -- ||' | fgrep -e username1"
      IdentityFile ~/.ssh/keys/github_rsa

    Match host github.com,gist.github.com exec "~/Developer/C/getargv/bin/getargv -0 -s 1 $PPID | env POSIXLY_CORRECT=1 xargs -0 getopt '46AaCfGgKkMNnqsTtVvXxYyB:b:c:D:E:e:F:I:i:J:L:l:m:O:o:p:Q:R:S:W:w:' | perl -pe 's|.*? -- ||' | fgrep -e company2"
      IdentityFile ~/.ssh/keys/github_rsa2
I set the common github configs in the top Host block, then each Match block looks at the arguments passed to ssh, parses them, and checks for the github username and if it matches, sets the correct key.

The ~/Developer/C/getargv/bin/getargv program is just an implementation of `cat /proc/$PPID/cmdline` for macOS, on linux you don't need a separate tool.

This works for cloning, pushing, pulling, etc.

Post reply on HN