Add SSH key generation & uploading to `gh auth login` flow by mislav · Pull Request #2892 · cli/cli

mislav · 2021-02-01T22:50:22Z

When "SSH" protocol is selected during gh auth login interactive mode, this offers to generate and upload an SSH key to the user's GitHub account.

The order of gh auth login questions was reshuffled to accommodate the new flow and to know beforehand which OAuth scopes to request (workflow for HTTPS mode, admin:public_key for SSH mode).

The new flow when no SSH keys exist locally:

$ gh auth login -h github.com
? What is your preferred protocol for Git operations?  [Use arrows to move, type to filter]
  HTTPS
> SSH
? Generate a new SSH key to add to your GitHub account? (Y/n)
? Enter the passphrase for your new SSH key *****
? How would you like to authenticate GitHub CLI?  [Use arrows to move, type to filter]
> Login with a web browser
  Paste an authentication token

! First copy your one-time code: ****-****
- Press Enter to open github.com in your browser...
✓ Authentication complete. Press Enter to continue...

- gh config set -h github.com git_protocol ssh
✓ Configured git protocol
✓ Uploaded the SSH key to your GitHub account: /Users/mislav/.ssh/id_ed25519.pub
✓ Logged in as mislav

The new flow when existing ~/.ssh/*.pub files (SSH public keys) were found locally:

$ gh auth login -h github.com
? What is your preferred protocol for Git operations?  [Use arrows to move, type to filter]
  HTTPS
> SSH
? Upload your SSH public key to your GitHub account?  [Use arrows to move, type to filter]
> /Users/mislav/.ssh/id_ed25519.pub
  Skip
? How would you like to authenticate GitHub CLI? Login with a web browser

! First copy your one-time code: ****-****
- Press Enter to open github.com in your browser...
✓ Authentication complete. Press Enter to continue...

- gh config set -h github.com git_protocol ssh
✓ Configured git protocol
✓ Uploaded the SSH key to your GitHub account: /Users/mislav/.ssh/id_ed25519.pub
✓ Logged in as mislav

Under the hood:

This approach goes out of its way to request only the minimum OAuth scopes necessary
We only offer to generate a SSH key when ssh-keygen is available on the system. On Windows, we try to locate ssh-keygen within the Git for Windows installation.
We select the ed25519 algorithm when generating SSH keys, which is also recommended by GitHub help. Some older ssh-keygen implementations might not support ed25519.
We avoid ever overwriting any existing key under the ~/.ssh directory.
Trying to re-upload an SSH key that is already in the user's account will succeed silently instead of yielding a HTTP 422 error.
Removes the need for overridable shared.ClientFromCfg function
- Fixes the correct User-Agent header being used for API requests during gh auth

Questions for the team:

Does the prompt order & phrasing make sense?
Should gh auth refresh also have any of this functionality?

TODO:

Test coverage for ssh-keygen flow

Fixes #2627

We now request it conditionally only for "HTTPS" login flow

…esh`

vilmibm

This is great ✨ marking request change for my one incredibly minor request about passphrases.

vilmibm · 2021-02-04T18:05:44Z

pkg/cmd/auth/shared/ssh_keys.go

+	// err = prompt.SurveyAskOne(&survey.Input{
+	// 	Message: "Enter the label for your new SSH key",
+	// }, &sshLabel)
+	// if err != nil {
+	// 	return "", fmt.Errorf("could not prompt: %w", err)
+	// }


should this be deleted?

Yes, good call. I was on the fence about leaving it in, but it's entirely optional for SSH keys in general and adds yet another prompt in this command that already has a dozen prompts. Best to avoid it.

pkg/cmd/auth/shared/ssh_keys.go

ampinsk · 2021-02-04T19:04:57Z

Re: this part of the existing ssh key flow:

? Upload your SSH public key to your GitHub account?  [Use arrows to move, type to filter]
> /Users/mislav/.ssh/id_ed25519.pub
  Skip

Should we offer to let you create a new one here? Or is that unnecessary?

Co-authored-by: Amanda Pinsker <ampinsk@github.com>

mislav · 2021-02-05T09:24:50Z

Should we offer to let you create a new one here? Or is that unnecessary?

That's a great idea which I hadn't at all considered. When the user already has some SSH keys of their own, I assumed that they wanted to reuse one of them for GitHub because that's what I would have done, but it's entirely possible that they might want to generate a new one for GitHub.

Here's a catch though. Since some keys already exist, when generating a new one we'd have to also ask the person to name their new key on disk (to avoid clashes with existing keys). And, if the user names their key something other than id_dsa, id_ecdsa, id_ed25519, or id_rsa (i.e. the default key names), then they would have to add additional lines to their ~/.ssh/config to wire up their key for use with GitHub:

Host github.com
  IdentityFile ~/.ssh/<my-new-key>

We could either tell the user they have to do this, or do it for them, but I'm a bit wary of editing people's ~/.ssh/config. @vilmibm do you have opinions on how best to handle this?

vilmibm · 2021-02-05T20:17:57Z

@mislav @ampinsk

Offering to generate new keys at that step makes sense but I think can be punted on. The kind of folks that tend to generate new keypairs per remote are more security conscious and I feel like our SSH helpers here are for people less familiar with SSH. Given that and the complexities you mentioned (ensuring we don't overwrite and potentially handling the ssh config) I think we should leave things as they are in the PR.

Regarding updating the SSH config, the cleanest way that I can think of is converting a user's ssh config to .ssh/config.d and adding a file there but I'd be uncomfortable with that level of manipulation of a user's .ssh directory.

vilmibm

💯

Add SSH key generation & uploading to gh auth login flow

5a110c8

mislav requested review from a team and ampinsk February 4, 2021 16:27

mislav added 2 commits February 4, 2021 17:40

Remove workflow from default OAuth scopes

075b6f8

We now request it conditionally only for "HTTPS" login flow

Extract parts of HTTPS-related setup shared between login and `refr…

1bd6d7b

…esh`

vilmibm suggested changes Feb 4, 2021

View reviewed changes

Tweak prompt for SSH passphrase

9550ad0

Co-authored-by: Amanda Pinsker <ampinsk@github.com>

vilmibm approved these changes Feb 5, 2021

View reviewed changes

mislav mentioned this pull request Feb 6, 2021

Win 10 ~/.ssh/config Problem #2927

Closed

mislav added 3 commits February 17, 2021 15:29

Merge remote-tracking branch 'origin' into auth-with-ssh

4cd43cc

Add tests for SSH login flow

87fcda5

Close pubkey file after reading

b4bf8cd

mislav merged commit 3a224b7 into trunk Feb 17, 2021

mislav deleted the auth-with-ssh branch February 17, 2021 16:07

This was referenced Feb 17, 2021

Add ssh-key add command and publish ssh-key #2990

Merged

Fix pasting Personal Access Token to auth login for GHE #3019

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SSH key generation & uploading to `gh auth login` flow#2892

Add SSH key generation & uploading to `gh auth login` flow#2892
mislav merged 7 commits intotrunkfrom
auth-with-ssh

mislav commented Feb 1, 2021 •

edited

Loading

Uh oh!

vilmibm left a comment

Uh oh!

vilmibm Feb 4, 2021

Uh oh!

mislav Feb 5, 2021

Uh oh!

Uh oh!

ampinsk commented Feb 4, 2021

Uh oh!

mislav commented Feb 5, 2021 •

edited

Loading

Uh oh!

vilmibm commented Feb 5, 2021 •

edited

Loading

Uh oh!

vilmibm left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mislav commented Feb 1, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vilmibm left a comment

Choose a reason for hiding this comment

Uh oh!

vilmibm Feb 4, 2021

Choose a reason for hiding this comment

Uh oh!

mislav Feb 5, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ampinsk commented Feb 4, 2021

Uh oh!

mislav commented Feb 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vilmibm commented Feb 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vilmibm left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mislav commented Feb 1, 2021 •

edited

Loading

mislav commented Feb 5, 2021 •

edited

Loading

vilmibm commented Feb 5, 2021 •

edited

Loading