95 lines
3.7 KiB
Markdown
95 lines
3.7 KiB
Markdown
# Introduction
|
|
|
|
Accessing remote git repositories using HTTPS quickly becomes inconvenient: depending on the configuration of a git repository, a single `git pull` might require to input the username/password three or more times.
|
|
|
|
Usually, generating a SSH keypair and adding the public half to the remote user profile would be easy and preferred, but working on a shared VM which erases its contents at every reboot creates some challenges: the goal of this document is to illustrate a potential workflow to securely use SSH git remotes in this environment.
|
|
|
|
## Table of Contents
|
|
|
|
1. [Workflow to generate a semipermanent git profile](#workflow-to-generate-a-semipermanent-git-profile)
|
|
2. [Workflow to restore your profile after VM reboot](#workflow-to-restore-your-profile-after-vm-reboot)
|
|
3. [Update existing `git` remotes to use an SSH URL](#update-existing-git-remotes-to-use-an-ssh-url)
|
|
4. [Alternatives](#alternatives)
|
|
|
|
|
|
|
|
|
|
# Workflow to generate a semipermanent git profile
|
|
|
|
These instructions should be followed only once, when generating for the first time your profile and keys.
|
|
The newly generated private key and the profile archive will be encrypted using (different) passphrases to minimize security risks associated with the shared environment.
|
|
|
|
## Generate SSH public keypair
|
|
|
|
- `ssh-keygen -t ed25519`
|
|
- default location is recommended
|
|
- **NOTICE**: Set a (strong) passphrase on the SSH private key (the `ssh-agent` will automatically ensure you will not have to enter this passphrase several times in a session)
|
|
- add the new public key to your Gitlab profile
|
|
- `cat $HOME/.ssh/id_ed25519.pub` to show the public key
|
|
- on Gitlab web UI: `User > Settings > SSH Keys`
|
|
|
|
## Add the new public key to your Gitlab profile
|
|
|
|
## Create a global `git` configuration
|
|
|
|
~~~bash
|
|
git config --global user.name "Mario Super"
|
|
git config --global user.email "the.mario@student.tut.fi"
|
|
~~~
|
|
|
|
## Create an encrypted tarball containing the profile
|
|
|
|
~~~bash
|
|
cd $HOME
|
|
tar cpvz .ssh .gitconfig | gpg --symmetric --output gitprofile.tar.gz.gpg
|
|
~~~
|
|
|
|
- Use a strong passphrase
|
|
- Avoid reusing the same passphrase protecting the SSH private key
|
|
- <u>Don't forget your passphrases!!</u>
|
|
- Save the encrypted archive either to an external USB drive (connecting it to the VM) or to your TUT profile folder (enabling and setting a Shared Folder from `VM > Settings > Options`)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Workflow to restore your profile after VM reboot
|
|
|
|
- recover the encrypted tarball from the storage you selected (external USB drive or TUT profile folder)
|
|
- decrypt and restore the archive:
|
|
~~~bash
|
|
gpg --decrypt /path/to/gitprofile.tar.gz.gpg | tar xpvz -C $HOME
|
|
~~~
|
|
|
|
|
|
|
|
# Update existing `git` remotes to use an SSH URL
|
|
|
|
If you used HTTPS URLs to define the remotes in your local `git` repository and wish to switch to SSH to avoid repeated user/password accesses, you can use the following commands:
|
|
|
|
~~~bash
|
|
cd /path/to/your/local/repository
|
|
git remote set-url <remote_name> <remote_SSH_URL>
|
|
~~~
|
|
|
|
Examples:
|
|
|
|
- `course_upstream`:
|
|
~~~bash
|
|
git remote set-url course_upstream git@course-gitlab.tuni.fi:comp.ce.460-real-time-systems_2023-2024/course_upstream.git
|
|
~~~
|
|
- `origin` (student project, where `${GROUP_ID}` is your group number):
|
|
~~~bash
|
|
GROUP_ID="<NN>"
|
|
git remote set-url origin git@course-gitlab.tuni.fi:comp.ce.460-real-time-systems_2023-2024/${GROUP_ID}.git
|
|
unset GROUP_ID
|
|
~~~
|
|
|
|
|
|
# Alternatives
|
|
|
|
The described workflow is by no mean the only one.
|
|
It would be perfectly fine, for example, to generate a new keypair for every session and add the ephemeral public key to Gitlab every time (and remove old ephemeral keys). In this case you would also need to set the `user.name` and `user.email` properties in the `git` configuration at every reboot.
|