Support FIDO security keys for commit signing signing and ssh auth

[krlvi]

No description provided.

[stgarf]

Would love to be able to use Gitbutler but patiently watching this issue because we require Yubikeys. Please let me know if I can participate in alpha/beta testing when you're ready!

[jokeyrhyme]

I can confirm that this combination works:

• GitButler 0.10.28 (and perhaps older, this is just where I reproduced it) with "Project settings" -> "Git authentication" -> "Use a Git executable"
• ssh-agent setup with the SSH_AUTH_SOCK environment variable set for all new processes in my login session
• Yubikey security key setup via ssh-keygen -O resident -t ed25519-sk
• corresponding public key enrolled in my GitHub settings

For any SSH request to GitHub, my security key flashes and nothing happens until I tap the security key

[alexandervaneck]

@jokeyrhyme How exactly did you setup ssh-agent?

Did you use https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#ssh-agent-forwarding ?

[jokeyrhyme]

@alexandervaneck

my default shell is nushell, and I've got it configured to start ssh-agent if it isn't already running and load its environment variables into dbus/systemd/launchd so they'll take effect in future processes (the way my system launches them, anyway), and also runs ssh-add -K if there is a Yubico security key plugged in:

• https://gitlab.com/jokeyrhyme/dotfiles/-/blob/bd615428b36fdfc7e6ebdec5ae66c9d8ac8afda2/config/nushell/interactive.nu#L25-84
• https://gitlab.com/jokeyrhyme/dotfiles/-/blob/bd615428b36fdfc7e6ebdec5ae66c9d8ac8afda2/config/interactive.sh#L62-98 (older bash/zsh equivalent that has not been tested for years)

so, my workflow is to open a terminal, and my keys are PIN-protected so ssh-add -K prompts to input the PIN, and once my shell prompt appears, I can then run GitButler from my desktop GUI launcher (not running it directly via this terminal/shell session) and it'll have the correct SSH_AUTH_SOCK environment variable

it's worth learning how to inspect the environment variables actually available to running processes, if you do not already do so for debugging this kind of thing

[Qix-]

The system executable auth flow now allows for GIT_SSH and GIT_SSH_COMMAND to be specified, too. Along with the above I'm going to close this as that's probably the preferred method to set up different authentication methods on your respective development machines.

Let me know if something was missed here, or if for some reason something isn't working with regards to FIDO keys!