My way around this in the past was to accept that curl was going to have to be called. Make a pubic repo that is just a facade, generates an ssh key, and calls

My way around this in the past was to accept that curl was going to have to be called. Make a pubic repo that is just a facade, generates an ssh key, and calls GitHub (or whatever) to push the ssh key. curl -H "Authorization: token **********" --data '{"title":"test-key","key":"${key[...]}"}' https://api.github.com/user/keys https://api.github.com/user/keys On success you can then call the private repo and execute the cli installer. If the bootstrap is piped then it doesn't ever have to be installed, and you don't have it junking up your system. Extra points to pull down existing registed public keys and check if they are already there. https://coderwall.com/p/tpngvw/curl-your-github-public-keys https://coderwall.com/p/tpngvw/curl-your-github-public-keys