Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 May 17:35
v0.3.0
16f7071

Highlights

Per-profile SSH sub-agent for git-as

git-as <profile> now routes through its own ssh-agent loaded with only that profile's key, addressed via IdentityAgent=<sock>. The system agent is untouched — plain git push and plain ssh github.com continue to use whatever key your default agent serves. Inside git-as, only the profile's key is offered, so a colliding key on another account can no longer win the race and silently authenticate as the wrong user.

The sub-agent persists across invocations as a passphrase cache:

  • macOS: ssh-add --apple-use-keychain is passed automatically. First-ever invocation prompts; passphrase is stored in Keychain; every subsequent call (including across reboots) is silent.
  • Linux: inherits your SSH_ASKPASS chain, so gnome-keyring / ksshaskpass / etc. caches it the same way they do for the system agent.

New: git-id agent subcommand tree

git-id agent list                # alive/dead, PID, key count, socket path
git-id agent kill <profile>      # terminate (next git-as respawns)
git-id agent kill --all
git-id agent reload <profile>    # re-run ssh-add against the existing sub-agent

New profile field: usecustomagent

Default true. Set to false to opt out of the sub-agent for a specific profile — useful when your system agent is itself per-key isolated (1Password, KeePassXC, gpg-agent with destination constraints, gnome-keyring's gcr-ssh-agent).

git-id set <profile> usecustomagent false

Bug fix: env override after execve

Profile env entries appended to os.Environ() left duplicate keys in the slice handed to syscall.Exec. On macOS the kernel/libc dedup keeps the first occurrence — the parent's value — so a parent-set GIT_SSH_COMMAND or GIT_AUTHOR_EMAIL silently survived. Fixed by stripping overridden keys from the parent env before appending profile values.

Documentation

User-facing references moved out of the README:

Install / upgrade

brew upgrade jdevera/tap/git-this-bread

Compatibility

  • Existing profiles continue to work; usecustomagent defaults to true, which means the sub-agent is on by default. Single-key users won't notice anything except (on macOS) one passphrase prompt the first time, then silence forever.
  • The fallback to /tmp/gtb-<uid>/ triggers when the cache-dir socket path would exceed the ~104-byte sun_path limit (mostly relevant on macOS with deep $TMPDIR).
Assets 19
Loading