Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Organizing multiple Git identities

garrit.xyz

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Organizing multiple Git identities

#41

Post by zamubafoo »

diggan wrote: post #13
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Different gitconfigs per path on disk, git automatically uses the right identity depending on where you are on disk. Allows you to separate all projects into different users and every repository within those directories will use the specified user. Main/default config (~/.gitconfig): [user] email = git@victor.earth name = Victor Bjelkholm [includeIf "gitdir:/home/user/projects/user-a/"] path = /home/user/.gitconfig-u…

You can also filter based on the remote URL! I find this much more useful than the location of the directory on disk.

  ; include only if a remote with the given URL exists (note
  ; that such a URL may be provided later in a file or in a
  ; file read after this file is read, as seen in this example)
  [includeIf "hasconfig:remote.*.url:https://example.com/\*"]
      path = foo.inc
  [remote "origin"]
      url = https://example.com/git*

Re: Organizing multiple Git identities

#43

Post by l72 »

hk1337 wrote: post #39
king_geedorah wrote: post #38

Earlier quoted context omitted.

Last I checked, one can't use the same SSH key for multiple github accounts, so if that is part of your workflow then you have to have different keys configured.

True, but I guess I am still wondering why would you need multiple GitHub accounts. I could see 1 for personal and 1 for work but still kind of wonder why. Even in that scenario, you would only need to account for 2 different ssh keys. Typically, for Client1 and Client2, both clients could invite the same account to the organization.

It depends on the client but several of mine have wanted me to use a separate account with an email for their domain. I suppose this is so they can take over the account rather than just removing my main account.

Re: Organizing multiple Git identities

#44

Post by diggan »

zamubafoo wrote: post #41
diggan wrote: post #13

Earlier quoted context omitted.

Different gitconfigs per path on disk, git automatically uses the right identity depending on where you are on disk. Allows you to separate all projects into different users and every repository within those directories will use the specified user. Main/default config (~/.gitconfig): [user] email = git@victor.earth name = Victor Bjelkholm [includeIf "gitdir:/home/user/projects/user-a/"] path = /home/user/.gitconfig-u…

You can also filter based on the remote URL! I find this much more useful than the location of the directory on disk. ; include only if a remote with the given URL exists (note ; that such a URL may be provided later in a file or in a ; file read after this file is read, as seen in this example) [includeIf "hasconfig:remote.*.url:https://example.com/\*"] path = foo.inc [remote "origin"] url = https://example.com/git*

Handy, didn't know about that, thanks for sharing!

The reason for doing it by location is probably because my directory structure for projects look something like this:

/home/user/projects/organization/project

so github.com/victorb/neat-project would go into /home/user/projects/victor/neat-project

So my solution is tailored to that structure I suppose :)

Re: Organizing multiple Git identities

#46

Post by l72 »

XorNot wrote: post #26
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Just don't use GitHub and SSH. Git has excellent HTTPS support now, and organising identities around that just plain works better.

It was, but GitHub has basically removed authenticated access via https

Re: Organizing multiple Git identities

#47

Post by vindex10 »

atoav wrote: post #33
vindex10 wrote: post #28

I find one disadvantage of SSH key auth, in case of GitHub in particular, that SSH key grants access to all the repos independently on the organization, etc, which becomes a bigger problem when sharing the machine with other people. One can set a password on the ssh key, but I still felt a bit paranoid about it. I found a way out with fine-grained personal access tokens which allow you to choose the repositories this…

> Disadvantage is that you have to enter password each time you push/pull. Run ssh-add in your terminal session before doing your push/pull dance — this way you only have to enter the password once. This gives you the security of the password protected key without bothering you too much in practise. If you need to pull on a remote that doesn't have your private keys (as is good and proper) you can run ssh -A foo@bar.…

thanks for the suggestion. I haven't used agent forwarding myself. I read a bit in the manual, and this seems to have a problem if the users I'm sharing the machine with have `sudo`:

> Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent. A safer alternative may be to use a jump host (see -J).

> Run ssh-add in your terminal session before doing your push/pull dance

originally my comment was about gpg encrypted files. also I suspect any kind of agent would expose privileges of my key to others if they have sudo.

Re: Organizing multiple Git identities

#48

Post by [deleted] »

qntmfred wrote: post #6
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

I used to do it that way. Recently learned this approach put this in your ~/.gitconfig-personal [core] sshCommand = "ssh -i ~/.ssh/github_personal_ed25519" and this in your ~/.gitconfig-work [core] sshCommand = "ssh -i ~/.ssh/github_work_ed25519"

[deleted]

Re: Organizing multiple Git identities

#49

Post by thamer »

I use conditional includes for this, but I also add a single letter describing which Git identity I'm currently using to my PS1 so that it appears before $ in my shell prompt. This prevents me from committing code with the wrong identity, in case I'm using a git checkout that's anywhere not covered by the conditional include rules.

I use Starship (https://starship.rs) to manage my prompt, and wrote a short script that only runs if I'm somewhere in a git repo, and if so finds my Git user's email and looks up the corresponding letter in an associative array declared in my ~/.config/starship-zsh/.zshenv:

    git_email=$(git config --get user.email | perl -pe 'chomp if eof')
    letter=$STARSHIP_GIT_USERS[$git_email]
    echo -n $letter
It's installed like this:

    [custom.git_user]
    command = "ZDOTDIR=~/.config/starship-zsh /path/to/the-script-above.sh" # set ZDOTDIR, makes zsh load the .zshenv file
    when = "git rev-parse --git-dir >/dev/null 2>/dev/null" # only run if we're in a git repo
    format = ' $output'
The .zshenv file contains the STARSHIP_GIT_USERS variable and its values, with a `declare -A` since it's an associative array.

Re: Organizing multiple Git identities

#50

Post by Arnavion »

diggan wrote: post #13
l72 wrote: post #3

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can't reuse keys. I end up with an ~/.ssh/config like: Host github-client1 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~/.ssh/id_rsa-client2 Then clone using `git clone git@github-client1:username/repo.git` Is there a better way?

Different gitconfigs per path on disk, git automatically uses the right identity depending on where you are on disk. Allows you to separate all projects into different users and every repository within those directories will use the specified user. Main/default config (~/.gitconfig): [user] email = git@victor.earth name = Victor Bjelkholm [includeIf "gitdir:/home/user/projects/user-a/"] path = /home/user/.gitconfig-u…

Note that this doesn't work if you have a default IdentityKey specified in your ssh config, because `-i` is always unioned with the default IdentityKey in that case (which is a feature, not a bug, of how IdentityKey / `-i` work) and it's possible that that key will be sent to the server before the one you specified in `-i`

Say my IdentityKey that I use for regular ssh is also associated with GH user foo, and then I have the above gitconfig to use a different key associated with GH user bar under certain directories. It's still possible that ssh will try the IdentityKey before the `-i` key when I do git operations under those directories, which means GH will identify me as user foo anyway.

I'm not sure what order ssh uses to sort the union, if any, but at least in my case it seems to always use the IdentityKey before the `-i` key even though it prints them in the opposite order initially (according to `-vvvv`).

And no, `-o IdentitiesOnly=yes` doesn't affect this behavior.

Post reply on HN