Secretive and SSH Agent Forwarding

[paulhdk]

Hi all,

Do I understand the following correctly? Essentially, I was wondering whether Secretive addresses the issues everyone has with SSH Agent Forwarding by requiring every use of a key to be authenticated via Touch ID.

Simple example:

• Mac A runs secretive
• Mac A connects to Host B with Secretive key C and uses SSH Agent Forwarding
• GitHub Account also has key C
• Mac A clones a private GitHub repo on Host B => secretive prompts for Touch ID?

Many thanks,
Paul

[maxgoedjen]

@PBHDK TBH I haven't actually tested Secretive with forwarding in this manner – what behavior are you seeing for this?
Also, does everything work fine with a key that doesn't require Touch ID?

[mmhj]

@maxgoedjen I actually think it's a huge plus of Secretive that you should emphasise in the FAQ.

I tested this on a Macbook Pro 12.2.1, running Secretive 2.1.1, and Secretive does indeed require every use of a given SSH key to be authenticated.

[ayashjorden]

Hi @paulhdk ,
I'm also using this configuration.
But in my case, I'm also trying to sign my commits using my ssh key.
On my laptop is works as execpted (see git config snippet below), however on my remove ssh session (with AgentForwarding) it does not work

Were you able to test this use-case as well?
Git config file:

[user]
	name = John Doe
	email = [email protected]
	#signingkey = /Users/jdoe/.ssh/id_ecdsa
	signingkey = WHAT_SHOULD_I_PUT_HERE # on my laptop its the path to the public key from Secretive, or just omit it?
[gpg]
	format = ssh
[commit]
	gpgsign = true
[gpg "ssh"]
	allowedSignersFile = /Users/jdoe/.gpg.ssh.allowedSignersFile

[paulhdk]

Interesting, @ayashjorden . Yes, I have the same problem. I'm using a Secretive SSH key to sign my commits too, but have only been doing so locally. So, I didn't notice this not working in an SSH session. Does anyone else have some pointers here?

[ayashjorden]

I tried reading on the SSH_AGENT_SOCK API to figure out if the socket can be used to call the private key for signing over the socket.
I would say that this is a question for git mailing list, which I have posted, but the responses were not helpful.

[slimm609]

#405 (comment)

I was able to get it to work. The "signingKey" should be "key::ecdsa-sha2-nistp256 AAAAE2....."