Save Private Repo Credentials for Push/Pull

[ArnaudGlt]

Is your feature request related to a problem? Please describe.
I created a Private Access Token from my GitHub account and I cloned my private repo through the Git tab in SageMaker Studio. When I did this, my Chrome browser (Windows 11) saved my credentials.

Each time I push/pull to this private repo (for which credentials are required), SageMaker studio asks me to provide my credentials. However, the web browser doesn't recognize the form and I have to manually copy/paste them in the right boxes.

FYI, the Private Access Token it provided only once and it means that I need to have it saved somewhere else.

Describe the solution you'd like
2 possible solutions:

• Enable the web browser to capture the credential form and paste automatically the credentials into them. Then the user just needs to select which Username from the Browser-Pre-Saved Password List or directly press OK.
• Have the possibility to configure git in order to pull out the credentials automatically from AWS ARN Secret. The ARN would be generated a 1st time by adding the git repo in SageMaker > Notebook > Git repositories > Add Repository. Then we would just refer to the arn link from SageMaker Studio.

Describe alternatives you've considered
So far 3 alternatives:

1. Fill by hand
2. Avoid using studio -> fall back on regular notebook instances
3. Try to write a script based on ssh connection + config of git client (noticed that ssh-add didn't work for me -> "Could not open a connection to your authentication agent.")

Additional context
None

[icoxfog417]

@ArnaudGlt

Thank you for using the Studio Lab!
You can use gh library to remember your credential. Please refer the following official GitHub document.

https://docs.github.com/en/get-started/getting-started-with-git/caching-your-github-credentials-in-git

The following instruction would be helpful for you.

1. Launch the Terminal in Studio Lab
2. conda install -c conda-forge gh
3. gh auth login

[ArnaudGlt]

Hi @icoxfog417, thanks a lot for trying to help me here!

Thanks for the doc! I don't know if conda decides by default to choose the conda-forge channel but in the doc you provided, it recommended the following command for the install:

conda install gh --channel conda-forge

Regarding this command and the next you recommended me to execute. Should it be run in a System Terminal or the (Docker) Image Terminal (or to include it in a script when a prompt ask for joining a script when we run a notebook for the 1st time) ?

I would have thought that it should be run in a System Terminal, correct?
So I ran:

bash-4.2$  conda install -v gh --channel conda-forge -y

When I do so, I get the following stdout:

Collecting package metadata: ...working... done
Solving environment: ...working... Killed

There is a gh version v0.0.4 installed already but it doesn't recoginze auth login as a valid argument.

bash-4.2$ gh auth login
usage: gh [-h] [--home] [-p] [-b] [-s] [-r] [-t] [-c] [-w] [-i] [-d] [-v]
gh: error: unrecognized arguments: auth login

Any ideas ?

[ArnaudGlt]

Here is my fix: "Treat SageMaker Studio as any remote server + set ssh connection with GitHub"

1. Open System Terminal
2. Create private/public ssh key pair with ssh-keygen
3. Set-up ssh config for github.com in ~/.ssh/config with vi
4. chmod 600 the config file (check also for the private key)
5. Add public key to Github.com account in Settings
6. git clone through the system terminal the project

Now the SageMaker Studio GUI doesn't ask for credentials. No need for Private Access Tokens.

[icoxfog417]

@ArnaudGlt I'm glad you can finally solve the credential issue. If you have not any other problems, please close this issue.

You can install gh by conda install -c conda-forge gh (I fixed the above comment). Something wrong will occur when installing the gh from the log you shared Solving environment: ...working... Killed. The latest gh is v2.5.2, I think you can update gh if you install successfully.

I assume that you use SageMaker Studio Notebook and here is SageMaker Studio Lab repository. In any case, you can solve the credential issue by your ssh procedure or gh procedure.

[ArnaudGlt]

Hi @icoxfog417,
I confirm that I was using SageMaker Studio Lab (see my 1st post for instance) and that the Private Access Token issue for which I opened this thread is still not solved.

I couldn't use the gh method. The conda update failed. Without trying to sound harsh, your latest reply didn't help me in that regard.

Here is a try at a fix using gh (which honestly won't beat the good old ssh method I wrote above).

For those reading this issue, AWS SageMaker runs on EC2 based on a CentOS like distribution. The package manager for this OS is yum.

kudos to: https://computingforgeeks.com/how-to-install-github-cli-on-linux-and-windows/ for the first steps required to install gh with the CLI

Here is how you can update gh if the conda update fails (like in my case):

VERSION=`curl  "https://api.github.com/repos/cli/cli/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/' | cut -c2-` 
echo $VERSION
curl -sSL https://github.com/cli/cli/releases/download/v${VERSION}/gh_${VERSION}_linux_amd64.tar.gz -o gh_${VERSION}_linux_amd64.tar.gz
tar xvf gh_${VERSION}_linux_amd64.tar.gz
sudo cp gh_${VERSION}_linux_amd64/bin/gh /usr/local/bin/

However, since the conda gh is installed in /opt/conda/bin and that my $PATH starts like this /opt/conda/bin:/usr/local/sbin:/usr/local/bin we won't be accessing the latest gh but the one installed under this broken conda, so we have to create a .profile and update the path, here is how:

echo 'export PATH=$(echo $PATH | sed "s%/usr/local/bin:%%g" | sed "s%/%/usr/local/bin:/%")' > .profile
. .profile
echo $PATH

Now, you should read /usr/local/bin:/opt/conda/bin:/usr/local/sbin.

From there you should be able to use the latest version of gh:

gh version

Then you can try to use gh as proposed by @icoxfog417 (not tested by me). I can only confirm that my fix for the $PATH is resilient to killing and restarting any System Terminal. The .profile file is sourced properly by the Amazon Linux distro. Keep in mind that the .profile is for the current user and not for all users on the machine. In that case, you may want to have a look at /etc/profile.d.

Personally, I would stick to the ssh method ;)

I'll close the issue when someone will have tried this method successfully.

[icoxfog417]

@ArnaudGlt I'm sorry for gh method does not work for you. I have confirmed gh method works in my Studio Lab environment already. But there seems to be some difference between my environment and your environment.

The OS of Studio Lab is Ubuntu as I show the following image.

When you install gh by conda install, the libraries are installed in you environement. If you use default studio-lab environement, the gh command locates /home/studio-lab-user/.conda/envs/studiolab/bin/.

And you can execute gh.

I'm not sure Studio Lab has different OS type (CentOS base and Ubuntu base). I can not execute ssh-keygen and vi in my environment and can not install them in Studio Lab. From the #40, only support package installations via pip and conda. If you can use these, your ssh method is general way to setup git.

[ArnaudGlt]

Thanks for the feedback @icoxfog417

Here is what I have on my side:

I noticed that you were using Studio Lab and I am on Studio...

[ArnaudGlt]

So I understood the problem, it is not related to Studio Lab, my bad. I was discovering the AWS universe, and it was confusing, they are 2 different services and 4 different features with almost the same names.

SageMaker Studio Lab: Free and Github community
SageMaker Studio: Paid service with 3 features:

• Studio
• Notebook - Jupyter (same as jupyter notebook)
• Notebook - Jupyter Lab (same as jupyter lab)

For a Basic Support Plan, support on SageMaker AWS is inexistant. So, I came here following the doc on AWS.

All in all, I am closing this issue, as I realize that it doesn't target the right service. Sorry for that. I just want to say that at this time, Studio Lab (the free version), looks much more user friendly than the paid version Studio.

[austinlasseter]

FWIW, I wrote up a tutorial (with screenshots) about how to do this, here: https://austinlasseter.medium.com/cloning-your-first-repo-to-amazon-sagemaker-studio-lab-992dc7a8c72