Secretive and SSH Agent Forwarding

[paulhdk]

Hi all,

Do I understand the following correctly? Essentially, I was wondering whether Secretive addresses the issues everyone has with SSH Agent Forwarding by requiring every use of a key to be authenticated via Touch ID.

Simple example:

• Mac A runs secretive
• Mac A connects to Host B with Secretive key C and uses SSH Agent Forwarding
• GitHub Account also has key C
• Mac A clones a private GitHub repo on Host B => secretive prompts for Touch ID?

Many thanks,
Paul

[maxgoedjen]

@PBHDK TBH I haven't actually tested Secretive with forwarding in this manner – what behavior are you seeing for this?
Also, does everything work fine with a key that doesn't require Touch ID?

[paulhdk]

@maxgoedjen, I was able to test it in the meantime, and it works exactly as expected! Every use of an SSH key is confirmed via Secretive. It's very handy and did not require any extra configuration. Also tested with multiple SSH keys.

Do you think this would warrant a pull request to the FAQ section?

[maxgoedjen]

Nice, thanks for testing :)
On the FAQ - certainly couldn't hurt, especially if there's anything non-obvious about it or the process.

[mmhj]

@maxgoedjen I actually think it's a huge plus of Secretive that you should emphasise in the FAQ.

I tested this on a Macbook Pro 12.2.1, running Secretive 2.1.1, and Secretive does indeed require every use of a given SSH key to be authenticated.

[ayashjorden]

Hi @paulhdk ,
I'm also using this configuration.
But in my case, I'm also trying to sign my commits using my ssh key.
On my laptop is works as execpted (see git config snippet below), however on my remove ssh session (with AgentForwarding) it does not work

Were you able to test this use-case as well?
Git config file:

[user]
	name = John Doe
	email = [email protected]
	#signingkey = /Users/jdoe/.ssh/id_ecdsa
	signingkey = WHAT_SHOULD_I_PUT_HERE # on my laptop its the path to the public key from Secretive, or just omit it?
[gpg]
	format = ssh
[commit]
	gpgsign = true
[gpg "ssh"]
	allowedSignersFile = /Users/jdoe/.gpg.ssh.allowedSignersFile

[paulhdk]

Interesting, @ayashjorden . Yes, I have the same problem. I'm using a Secretive SSH key to sign my commits too, but have only been doing so locally. So, I didn't notice this not working in an SSH session. Does anyone else have some pointers here?