19 ms·

Setting up Git identities

350 points by micahhenning 7y ago

pianoben 7y ago
Nice article! The only thing I'd add is that you can extend this to multiple GitHub identities, too, via SSH configs: https://www.bendb.com/blog/ssh-with-multiple-github-accounts/ https://www.bendb.com/blog/ssh-with-multiple-github-accounts... I've been using variations on this technique for a few years now. It's kind of a pain to remember which URL to use to clone a repo, but is great for keeping that veneer of separation between work and personal projects.
- unityByFreedom 7y ago
  Yeah I also sometimes forget to use the proper URL, I wish it were a little easier to setup and use the concept of separating work/personal or public/private repositories.
- neilpa 7y ago
  You can extend this trick further by specifying the User in your SSH config to make for even shorter URLs. Host gh-me Hostname github.com User git IdentityFile ~/.ssh/id_rsa Host gh-work Hostname github.com User git IdentityFile ~/.ssh/id_rsa_work Then all you need is a `git clone gh-me:org/repo` or `git clone gh-work:work/repo`. I've been using this for sometime and it's not too hard to remember. Although when I don't it's easy enough to fix the origin url by editing `.git/config`.
- epistasis 7y ago
  I've been using the same account for both work and personal repos, without much issue due to the existence of github organizations. What sorts of separation are beneficial for you? I'm wondering if I should switch, but I don't fully understand.
  - pianoben 7y ago
    Depending on the employer and the side-project, using the same account for both could _in theory_ bolster a (ridiculous, absurd) ownership claim over your work, for example. Stranger things have happened. More pragmatically, I've been burned in the past by using personal accounts (not GitHub specifically) for work things. For example, I used a personal commuter card for a former job's benefits program. When I left, they deactivated my card. Awkward! Not the same kind of risk with GH, to be sure, but after that I do prefer to keep my digital selves as compartmentalized as possible.
sirn 7y ago
You can also do a per-directory _global_ git configuration, e.g. in .gitconfig, you say: [user] name = Me Myself email = personal@example.com signingkey = D34DB44F [includeIf "gitdir:~/src/github.com/work_org/"] path = ~/.gitconfig_work Then in ~/.gitconfig_work: [user] name = Me Myself email = work@example.com signingkey = D34DC0D4 [core] sshCommand = ssh -i ~/.ssh/work_ed25519 I like this way better, because I don't need to remember to specify per-project config, as long I put them in the right directory :-)
- bobwaycott 7y ago
  This is fantastic. I had no idea this was possible.
  - deleted 7y ago
    [deleted]
- Copenjin 7y ago
  Exactly, have a similar setup, I would recommend against using the approach suggested in the post if you want to be 100% sure of always using the right account.
  - lloeki 7y ago
    The article guarantees that by: - requiring a user to be set - not having one filled in the global settings The upside is that even if the folder is moved, the user config still applies. The downside is that you have to set it per repository (but only once). There are pros and cons, but I don't see one being any better or worse than the other in absolute terms.
  - rkangel 7y ago
    This setup does ensure this. These are the two relevant commands: git config --global --unset user.email (etc.) git config --global user.useConfigOnly true This means that there is no default email set, and that git will error if you try and commit, because there is no email set. I do a lighter weight version of this article by just doing the above. Then when I do the first commit in a repo, I get that error and I do the following command: git config --local user.email me@myworkemail.com (or the my personal email as appropriate). Then I have per repo config that persists unless I blow the repo away completely.
eliaspro 7y ago
All this wouldn't be necessary if git supported traversing through parent directories for a configuration lookup to have "per directory structure" configurations. Any idea, why this relatively simple and inexpensive approach isn't implemented? Simply because no one bothered to do it so far?
- bobwaycott 7y ago
  You mean like a sibling commenter posted here? https://news.ycombinator.com/item?id=22672682 https://news.ycombinator.com/item?id=22672682
- saagarjha 7y ago
  > All this wouldn't be necessary if git supported traversing through parent directories for a configuration lookup to have "per directory structure" configurations. Clang-format has this “delightful” feature, which isn’t actually all that horrible except I cannot find a way to pass it a configuration file via the command line. If I’m editing files in /tmp (or using an editor that relies on this directory) I have to do a nasty hack of copying ~/.clang-format to the current directory to make it work: https://github.com/saagarjha/dotfiles/blob/master/_nano-clang-format https://github.com/saagarjha/dotfiles/blob/master/_nano-clan.... Basically, this is a long-winded way of saying that this kind of setting can often work but it’s really not great in certain situations.
ithkuil 7y ago
I found https://github.com/prydonius/karn https://github.com/prydonius/karn to be helpful (although I wish there was a more native solution)
- captn3m0 7y ago
  Can +1 this. I have it set to run periodically, and it sets up the identities for my "work" projects and personal projects.
Ayesh 7y ago
But why? All SSH/GPG private keys will be in the same storage anyway, and it doesn't provide any security advantage in case a key is compromised. They are already computationally impossible to brute Force too. Isn't the point of GPG keys is to have an established trust? How does using multiple keys help with it?
- Jestar342 7y ago
  Privacy. I don't want my professional identity muddled with my personal identity.
  - SAI_Peregrinus 7y ago
    My work laptop is owned by my company. All company work goes on there. (And since it's a company-owned resource anything made using it is something they could claim rights to.) My personal computer is owned by me. Nothing company owned touches it. This makes domain separation easier.
- rrobukef 7y ago
  The Japanese say you have three faces. The first face, you show to the world. The second face, you show to your close friends, and your family. The third face, you never show anyone. It is the truest reflection of who you are.
- koolba 7y ago
  Even with keys tied to machines and not just people, it’s convenient to have distinct meta data (name or email) associated with projects or directories. It’s an easy way to prevent accidentally your FOSS contributions or projects with your $WORK email address.
- micahhenning 7y ago
  The keys have a User ID packet with a userId field that contains a name and email address, which is an identity. I prefer to keep my identities separate from one another. For me it's not necessarily about security, it's more so about compartmentalization.
OJFord 7y ago
It's a good idea, but could do with explaining that it's not a concept built in to git. Until I got to 'define an alias ...' I thought it was about a user-switching feature of git that I was unaware of.
- micahhenning 7y ago
  It's in the second sentence of the post =P "This is a procedure for leveraging git aliases to set an identity at the project level..."
Brajeshwar 7y ago
Here is something I did. Ignore the other details in the article, and focus on the "SSH Split Personality Disorder" part. This article was written for a 200-ish member team of a Startup and so most of won't be relevant to anyone outside the Company. https://story.mobisy.com/bulletin/2019/03/08/eagle-eye-ssh-split-wiki/ https://story.mobisy.com/bulletin/2019/03/08/eagle-eye-ssh-s... I split the Git Identities based on which directory I'm working on.
sbrass 7y ago
Thanks for the great post! However, I discourage the usage of RSA with 4096 bit as it does not offer any substantial security over RSA with 2048 bit. The mean idea behind the "No-4096-bit" is nicely explained by GnuPG people themselves, https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40.... Therefore, wouldn't it be more efficient to use elliptic curve cryptography, i.e. ED25519, if you want that extra bit of security? It's included in GnuPG since version 2.1.0 released in November 2014 - at least in an experimental state.
- NilsIRL 7y ago
  As suggested by the [release notes](https://gnupg.org/faq/whats-new-in-2.1.html#ecc https://gnupg.org/faq/whats-new-in-2.1.html#ecc), not many PGP implementations support ECC.
  - arianvanp 7y ago
    Also GitHub doesn't support it. The website just crashes with "An unknown error has occured" when you try to upload an ECC key for gpg
    - patrickmcnamara 7y ago
      GitHub definitely supports it. I've been using an Ed25519 key for about a year now.
      - arianvanp 7y ago
        Are you sure you're talking about GPG and not SSH? I just tried again and it did not work
  - zaarn 7y ago
    Then you can't verify it unless you upgrade, but I think it's an acceptable price that those pay who run older versions.
  - 7y ago
nickez 7y ago
Why are they generating new GPG keypairs for every identity? This is an honest question. I've been curious if there are any benefits to having multiple keypairs over just one keypair and multiple uids. Also IMO the proper way to use GPG is to generate the keys on an offline machine and then move the private key to a physical token.
abhishekjha 7y ago
What do I do if my key has expired?
- micahhenning 7y ago
  Generate a new key and update the global git config with the new public key hash. Then add the new public key to Github/Gitlab to support verification of signed commits with new key.
  - abhishekjha 7y ago
    But that would invalidate the old signed commits, wouldn't it?
    - chipsa 7y ago
      Pretty sure you can keep your old keys in there. You just don't use the old key for signing.
- jlgaddis 7y ago
  You can change the expiration date of an expired key.
sleepychu 7y ago
https://github.com/bobbo/git-profile https://github.com/bobbo/git-profile is a utility my friend wrote to do the same thing.
progval 7y ago
My alternative is to use multiple user accounts on my computer to work on different projects. This solves multiple issues at once: * Git identities (I just need to clone from the right user) * access restriction (building one compromised project won't compromise everything else) * no need to manage virtualenvs (or the equivalent for non-python environments), just install everything in ~/.local/
- dewey 7y ago
  Personally this wouldn't really work for me. I always switch between projects to get some files (Like a CI config I already wrote for another project) or look how I have done something in another code base. Also all my editor configs, bookmarks, browser logins for Github are all there. If I'd have to switch between users for each project that sounds really cumbersome.
  - cvwright 7y ago
    I do what the GP describes as well. It’s not that bad. When you want to enable some limited sharing, it helps to create a new group for all your user accounts. For files and directories that you want to share, just set the group to your new user group, and use the OS group permissions to manage read/write/execute.
  - progval 7y ago
    Everything I do is open source, so all my code is readable by all users. If you don't, see cvwright's answer. > Also all my editor configs My editor and shell configs are in /etc. Again, it may not work for everyone, as you may have to share the computer. > bookmarks, browser logins for Github are all there. If I'd have to switch between users for each project that sounds really cumbersome. Sorry, I was unclear. I don't logout/login every time I change project. I have a main user, and use sudo to run commands as other users (it even works with graphical apps, provided you whitelist them)
  - scarejunba 7y ago
    That sounds like just a group permissions issue in their model, and a shared mount model in the VM guy's model. These are pretty creative approaches using the built-in access control Unix has. I like it.
jgeerts 7y ago
What I use to switch git identities is direnv (https://direnv.net/ https://direnv.net/) which automatically loads specific config based on the dir that you are in. You can use it to switch AWS profiles, proxy settings, npm settings, maven settings, git configuration and so on.
lawry 7y ago
Would someone happen to know, what the icon looking like a [ is in front of every command prompt. And potentially how to remove it from appearing?
kanox 7y ago
I just have multiple .gitconfig files and symlink them based on `hostname`. It's easy and there is no per-repo setup.
naetius 7y ago
Not sure why GPG got in the picture. As other connectors have pointed out, changing Git identities is a trivial operation that can be done in so many different ways.
aesthetics1 7y ago
To get around this problem I just use a simple command-line utility that I wrote called gitswitch that I call whenever I jump to a new project. My name never changes but my email does, so that's all the utility changes. I suppose it would be neat to build in profiles, but I jump between 2-3 PCs regularly and would probably forget to update my profiles. https://github.com/jboyer87/gitswitch https://github.com/jboyer87/gitswitch Example: gitswitch jboyer87@my-work-email.com gitswitch jboyer87@my-personal-email.com
JetSpiegel 7y ago
There's a project to do this properly, but integrating this on git itself would be great. it's just a shell script really: https://github.com/madx/git-identity https://github.com/madx/git-identity It's already on AUR: https://aur.archlinux.org/packages/git-identity-git/ https://aur.archlinux.org/packages/git-identity-git/
- JetSpiegel 7y ago
  To clarify, this has a better API and integrates cleanly with git itself. $ git identity -h usage: git identity [-d | --define] <identity> <name> <email> [<ssh-file>] [<gpgkeyid>] or: git identity [-p | --print] [<identity>] or: git identity [-s | --get-settings] or: git identity [-r | --remove] <identity> or: git identity [-l | --list] or: git identity [-R | --list-raw] or: git identity [--define-gpg] <gpgkeyid> or: git identity [--define-ssh] <ssh-file> [<ssh-verbosity>] or: git identity [-u | --update] or: git identity [-c | --get-shell-command] [<identity>] [<command>] or: git identity <identity> So you can define identities such as `work`, `personal`, and then after cloning/init, run `git identity personal` to setup GPG or SSH keys, name and email.

350 points by micahhenning 7y ago

Nice article! The only thing I'd add is that you can extend this to multiple GitHub identities, too, via SSH configs: https://www.bendb.com/blog/ssh-with-multiple-github-accounts/ https://www.bendb.com/blog/ssh-with-multiple-github-accounts... I've been using variations on this technique for a few years now. It's kind of a pain to remember which URL to use to clone a repo, but is great for keeping that veneer of separation between work and personal projects.

unityByFreedom 7y ago
Yeah I also sometimes forget to use the proper URL, I wish it were a little easier to setup and use the concept of separating work/personal or public/private repositories.
neilpa 7y ago
You can extend this trick further by specifying the User in your SSH config to make for even shorter URLs. Host gh-me Hostname github.com User git IdentityFile ~/.ssh/id_rsa Host gh-work Hostname github.com User git IdentityFile ~/.ssh/id_rsa_work Then all you need is a `git clone gh-me:org/repo` or `git clone gh-work:work/repo`. I've been using this for sometime and it's not too hard to remember. Although when I don't it's easy enough to fix the origin url by editing `.git/config`.
epistasis 7y ago
I've been using the same account for both work and personal repos, without much issue due to the existence of github organizations. What sorts of separation are beneficial for you? I'm wondering if I should switch, but I don't fully understand.
- pianoben 7y ago
  Depending on the employer and the side-project, using the same account for both could _in theory_ bolster a (ridiculous, absurd) ownership claim over your work, for example. Stranger things have happened. More pragmatically, I've been burned in the past by using personal accounts (not GitHub specifically) for work things. For example, I used a personal commuter card for a former job's benefits program. When I left, they deactivated my card. Awkward! Not the same kind of risk with GH, to be sure, but after that I do prefer to keep my digital selves as compartmentalized as possible.

sirn 7y ago

You can also do a per-directory _global_ git configuration, e.g. in .gitconfig, you say: [user] name = Me Myself email = personal@example.com signingkey = D34DB44F [includeIf "gitdir:~/src/github.com/work_org/"] path = ~/.gitconfig_work Then in ~/.gitconfig_work: [user] name = Me Myself email = work@example.com signingkey = D34DC0D4 [core] sshCommand = ssh -i ~/.ssh/work_ed25519 I like this way better, because I don't need to remember to specify per-project config, as long I put them in the right directory :-)

bobwaycott 7y ago
This is fantastic. I had no idea this was possible.
- deleted 7y ago
  [deleted]
Copenjin 7y ago
Exactly, have a similar setup, I would recommend against using the approach suggested in the post if you want to be 100% sure of always using the right account.
- lloeki 7y ago
  The article guarantees that by: - requiring a user to be set - not having one filled in the global settings The upside is that even if the folder is moved, the user config still applies. The downside is that you have to set it per repository (but only once). There are pros and cons, but I don't see one being any better or worse than the other in absolute terms.
- rkangel 7y ago
  This setup does ensure this. These are the two relevant commands: git config --global --unset user.email (etc.) git config --global user.useConfigOnly true This means that there is no default email set, and that git will error if you try and commit, because there is no email set. I do a lighter weight version of this article by just doing the above. Then when I do the first commit in a repo, I get that error and I do the following command: git config --local user.email me@myworkemail.com (or the my personal email as appropriate). Then I have per repo config that persists unless I blow the repo away completely.

eliaspro 7y ago

All this wouldn't be necessary if git supported traversing through parent directories for a configuration lookup to have "per directory structure" configurations. Any idea, why this relatively simple and inexpensive approach isn't implemented? Simply because no one bothered to do it so far?

bobwaycott 7y ago
You mean like a sibling commenter posted here? https://news.ycombinator.com/item?id=22672682 https://news.ycombinator.com/item?id=22672682
saagarjha 7y ago
> All this wouldn't be necessary if git supported traversing through parent directories for a configuration lookup to have "per directory structure" configurations. Clang-format has this “delightful” feature, which isn’t actually all that horrible except I cannot find a way to pass it a configuration file via the command line. If I’m editing files in /tmp (or using an editor that relies on this directory) I have to do a nasty hack of copying ~/.clang-format to the current directory to make it work: https://github.com/saagarjha/dotfiles/blob/master/_nano-clang-format https://github.com/saagarjha/dotfiles/blob/master/_nano-clan.... Basically, this is a long-winded way of saying that this kind of setting can often work but it’s really not great in certain situations.

ithkuil 7y ago

I found https://github.com/prydonius/karn https://github.com/prydonius/karn to be helpful (although I wish there was a more native solution)

captn3m0 7y ago
Can +1 this. I have it set to run periodically, and it sets up the identities for my "work" projects and personal projects.

Ayesh 7y ago

But why? All SSH/GPG private keys will be in the same storage anyway, and it doesn't provide any security advantage in case a key is compromised. They are already computationally impossible to brute Force too. Isn't the point of GPG keys is to have an established trust? How does using multiple keys help with it?

Jestar342 7y ago
Privacy. I don't want my professional identity muddled with my personal identity.
- SAI_Peregrinus 7y ago
  My work laptop is owned by my company. All company work goes on there. (And since it's a company-owned resource anything made using it is something they could claim rights to.) My personal computer is owned by me. Nothing company owned touches it. This makes domain separation easier.
rrobukef 7y ago
The Japanese say you have three faces. The first face, you show to the world. The second face, you show to your close friends, and your family. The third face, you never show anyone. It is the truest reflection of who you are.
koolba 7y ago
Even with keys tied to machines and not just people, it’s convenient to have distinct meta data (name or email) associated with projects or directories. It’s an easy way to prevent accidentally your FOSS contributions or projects with your $WORK email address.
micahhenning 7y ago
The keys have a User ID packet with a userId field that contains a name and email address, which is an identity. I prefer to keep my identities separate from one another. For me it's not necessarily about security, it's more so about compartmentalization.

OJFord 7y ago

It's a good idea, but could do with explaining that it's not a concept built in to git. Until I got to 'define an alias ...' I thought it was about a user-switching feature of git that I was unaware of.

micahhenning 7y ago
It's in the second sentence of the post =P "This is a procedure for leveraging git aliases to set an identity at the project level..."

Brajeshwar 7y ago

Here is something I did. Ignore the other details in the article, and focus on the "SSH Split Personality Disorder" part. This article was written for a 200-ish member team of a Startup and so most of won't be relevant to anyone outside the Company. https://story.mobisy.com/bulletin/2019/03/08/eagle-eye-ssh-split-wiki/ https://story.mobisy.com/bulletin/2019/03/08/eagle-eye-ssh-s... I split the Git Identities based on which directory I'm working on.

sbrass 7y ago

Thanks for the great post! However, I discourage the usage of RSA with 4096 bit as it does not offer any substantial security over RSA with 2048 bit. The mean idea behind the "No-4096-bit" is nicely explained by GnuPG people themselves, https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40.... Therefore, wouldn't it be more efficient to use elliptic curve cryptography, i.e. ED25519, if you want that extra bit of security? It's included in GnuPG since version 2.1.0 released in November 2014 - at least in an experimental state.

NilsIRL 7y ago
As suggested by the [release notes](https://gnupg.org/faq/whats-new-in-2.1.html#ecc https://gnupg.org/faq/whats-new-in-2.1.html#ecc), not many PGP implementations support ECC.
- arianvanp 7y ago
  Also GitHub doesn't support it. The website just crashes with "An unknown error has occured" when you try to upload an ECC key for gpg
  - patrickmcnamara 7y ago
    GitHub definitely supports it. I've been using an Ed25519 key for about a year now.
    - arianvanp 7y ago
      Are you sure you're talking about GPG and not SSH? I just tried again and it did not work
- zaarn 7y ago
  Then you can't verify it unless you upgrade, but I think it's an acceptable price that those pay who run older versions.
- 7y ago

nickez 7y ago

Why are they generating new GPG keypairs for every identity? This is an honest question. I've been curious if there are any benefits to having multiple keypairs over just one keypair and multiple uids. Also IMO the proper way to use GPG is to generate the keys on an offline machine and then move the private key to a physical token.

abhishekjha 7y ago

What do I do if my key has expired?

micahhenning 7y ago
Generate a new key and update the global git config with the new public key hash. Then add the new public key to Github/Gitlab to support verification of signed commits with new key.
- abhishekjha 7y ago
  But that would invalidate the old signed commits, wouldn't it?
  - chipsa 7y ago
    Pretty sure you can keep your old keys in there. You just don't use the old key for signing.
jlgaddis 7y ago
You can change the expiration date of an expired key.

sleepychu 7y ago

https://github.com/bobbo/git-profile https://github.com/bobbo/git-profile is a utility my friend wrote to do the same thing.

progval 7y ago

My alternative is to use multiple user accounts on my computer to work on different projects. This solves multiple issues at once: * Git identities (I just need to clone from the right user) * access restriction (building one compromised project won't compromise everything else) * no need to manage virtualenvs (or the equivalent for non-python environments), just install everything in ~/.local/

dewey 7y ago
Personally this wouldn't really work for me. I always switch between projects to get some files (Like a CI config I already wrote for another project) or look how I have done something in another code base. Also all my editor configs, bookmarks, browser logins for Github are all there. If I'd have to switch between users for each project that sounds really cumbersome.
- cvwright 7y ago
  I do what the GP describes as well. It’s not that bad. When you want to enable some limited sharing, it helps to create a new group for all your user accounts. For files and directories that you want to share, just set the group to your new user group, and use the OS group permissions to manage read/write/execute.
- progval 7y ago
  Everything I do is open source, so all my code is readable by all users. If you don't, see cvwright's answer. > Also all my editor configs My editor and shell configs are in /etc. Again, it may not work for everyone, as you may have to share the computer. > bookmarks, browser logins for Github are all there. If I'd have to switch between users for each project that sounds really cumbersome. Sorry, I was unclear. I don't logout/login every time I change project. I have a main user, and use sudo to run commands as other users (it even works with graphical apps, provided you whitelist them)
- scarejunba 7y ago
  That sounds like just a group permissions issue in their model, and a shared mount model in the VM guy's model. These are pretty creative approaches using the built-in access control Unix has. I like it.

jgeerts 7y ago

What I use to switch git identities is direnv (https://direnv.net/ https://direnv.net/) which automatically loads specific config based on the dir that you are in. You can use it to switch AWS profiles, proxy settings, npm settings, maven settings, git configuration and so on.

lawry 7y ago

Would someone happen to know, what the icon looking like a [ is in front of every command prompt. And potentially how to remove it from appearing?

kanox 7y ago

I just have multiple .gitconfig files and symlink them based on `hostname`. It's easy and there is no per-repo setup.

naetius 7y ago

Not sure why GPG got in the picture. As other connectors have pointed out, changing Git identities is a trivial operation that can be done in so many different ways.

aesthetics1 7y ago

To get around this problem I just use a simple command-line utility that I wrote called gitswitch that I call whenever I jump to a new project. My name never changes but my email does, so that's all the utility changes. I suppose it would be neat to build in profiles, but I jump between 2-3 PCs regularly and would probably forget to update my profiles. https://github.com/jboyer87/gitswitch https://github.com/jboyer87/gitswitch Example: gitswitch jboyer87@my-work-email.com gitswitch jboyer87@my-personal-email.com

JetSpiegel 7y ago

There's a project to do this properly, but integrating this on git itself would be great. it's just a shell script really: https://github.com/madx/git-identity https://github.com/madx/git-identity It's already on AUR: https://aur.archlinux.org/packages/git-identity-git/ https://aur.archlinux.org/packages/git-identity-git/

JetSpiegel 7y ago
To clarify, this has a better API and integrates cleanly with git itself. $ git identity -h usage: git identity [-d | --define] <identity> <name> <email> [<ssh-file>] [<gpgkeyid>] or: git identity [-p | --print] [<identity>] or: git identity [-s | --get-settings] or: git identity [-r | --remove] <identity> or: git identity [-l | --list] or: git identity [-R | --list-raw] or: git identity [--define-gpg] <gpgkeyid> or: git identity [--define-ssh] <ssh-file> [<ssh-verbosity>] or: git identity [-u | --update] or: git identity [-c | --get-shell-command] [<identity>] [<command>] or: git identity <identity> So you can define identities such as `work`, `personal`, and then after cloning/init, run `git identity personal` to setup GPG or SSH keys, name and email.