{"id":391,"date":"2021-09-19T08:12:25","date_gmt":"2021-09-19T16:12:25","guid":{"rendered":"http:\/\/spacefold.com\/colin\/morethanfour\/?p=391"},"modified":"2021-09-19T12:39:36","modified_gmt":"2021-09-19T20:39:36","slug":"learning-git-appendix-c-petra-rabbits-authentication-palooza","status":"publish","type":"post","link":"https:\/\/spacefold.com\/colin\/morethanfour\/2021\/09\/19\/learning-git-appendix-c-petra-rabbits-authentication-palooza\/","title":{"rendered":"Learning Git &#8211; Appendix C: Petra Rabbit&#8217;s Authentication-palooza"},"content":{"rendered":"\n<p>Petra Rabbit is a developer. She would like to contribute to some private repositories that Zach Cat has set up on BitBucket and GitHub.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Using SSH to clone a repository on BitBucket<\/h3>\n\n\n\n<p>Zach has a private repository on BitBucket called &#8220;X_Files&#8221; that Petra needs to clone locally:<\/p>\n\n\n\n<pre>$ git clone git@bitbucket.org:zach-the-cat\/x_files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'x_files'...\nThe authenticity of host 'bitbucket.org (104.192.141.1)' can't be established.\nRSA key fingerprint is SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? \nWarning: Permanently added 'bitbucket.org' (RSA) to the list of known hosts.<\/pre>\n\n\n\n<p>This is the first time Petra has used SSH to talk to the BitBucket server on this computer. Consequently, she sees that prompt from SSH asking her if it is okay to add the server IP address to its list of known hosts.<\/p>\n\n\n\n<pre>yes<\/pre>\n<pre class=\"console-output\">Warning: Permanently added 'bitbucket.org' (RSA) to the list of known hosts.\n<b>Forbidden<\/b>\nfatal: Could not read from remote repository.\nPlease make sure you have the correct access rights and the repository exists.<\/pre>\n\n\n\n<p>Yeah&#8230; it&#8217;s just not that easy. In order for this to happen:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Petra has to create a user account on BitBucket;<\/li><li>Zach has to grant Petra&#8217;s BitBucket user account read+write permission on his repository;<\/li><li>Petra has to create a public+private RSA key pair for her development laptop<\/li><li>She has to upload the public key to her BitBucket account<\/li><\/ul>\n\n\n\n<p>Zach goes to BitBucket &gt; X_Files &gt; Repository Settings &gt; User and Group Access, and searches for Petra by email address; selects WRITE access; and confirms.<\/p>\n\n\n\n<p>And now Petra sees an email from Atlassian, &#8220;Zach The Cat invited you to collaborate on the X_Files repository on BitBucket&#8221;. Of course, she accepts the invitation&#8230; When she logs in to BitBucket in her browser, she can now see Zach&#8217;s repo. Try again, Petra:<\/p>\n\n\n\n<pre>$ git clone git@bitbucket.org:zach-the-cat\/x_files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'x_files'...\n<b>git@bitbucket.org: Permission denied (publickey).<\/b>\nfatal: Could not read from remote repository.\nPlease make sure you have the correct access rights and the repository exists.<\/pre>\n\n\n\n<p>Well, at least it&#8217;s a different error, because she&#8217;s not quite done yet: She has to create an RSA key pair identifying her on her development laptop, and upload the public key to her account on BitBucket:<\/p>\n\n\n\n<pre>$ ssh-keygen<\/pre>\n<pre class=\"console-output\">Generating public\/private rsa key pair.\nEnter file in which to save the key (\/home\/petra\/.ssh\/id_rsa): \nEnter passphrase (empty for no passphrase): *********\nEnter same passphrase again: *********\nYour identification has been saved in \/home\/petra\/.ssh\/id_rsa\nYour public key has been saved in \/home\/petra\/.ssh\/id_rsa.pub<\/pre>\n\n\n\n<p>She was prompted to enter a passphrase, and she&#8217;s going to need it every time she talks to the remote repository, so let&#8217;s hope she picked something memorable!<\/p>\n\n\n\n<p>Now Petra goes to BitBucket &gt; Profile and Settings &gt; Personal settings &gt; SSH Keys. It says &#8220;There are no keys configured&#8221; but she can click on the <strong>Add Key<\/strong> button, and paste the contents of the <strong>id_rsa.pub<\/strong> file, along with a descriptive label. The label could be any text but it helps to use something that identifies the current user and client computer (i.e. the development machine), because if she switches machines (i.e. uses a virtual machine or another laptop) then She&#8217;ll need to upload a separate public key for that environment also.<\/p>\n\n\n\n<p>Having uploaded the public key to BitBucket, and with the private key accessible to SSH locally, Petra should now be able to clone the repository successfully:<\/p>\n\n\n\n<pre>$ git clone git@bitbucket.org:zach-the-cat\/x_files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'x_files'...<\/pre>\n\n\n\n<p>At this point she&#8217;s prompted to enter her passphrase for the RSA key pair, and does so.<\/p>\n\n\n\n<pre class=\"console-output\">remote: Enumerating objects: 13, done.\nremote: Counting objects: 100% (13\/13), done.\nremote: Compressing objects: 100% (12\/12), done.\nremote: Total 13 (delta 2), reused 0 (delta 0), pack-reused 0\nReceiving objects: 100% (13\/13), done.\nResolving deltas: 100% (2\/2), done.<\/pre>\n\n\n\n<p>Let&#8217;s review:<\/p>\n\n\n\n<pre>$ ls -l<\/pre>\n<pre class=\"console-output\">total 4\ndrwxrwxr-x 3 petra petra 4096 Sep 10 11:48 x_files<\/pre>\n<pre>$ cd x_files\n$ git status<\/pre>\n<pre class=\"console-output\">On branch main\nYour branch is up to date with 'origin\/main'.\nnothing to commit, working tree <\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Git Passphrase Persistence<\/h4>\n\n\n\n<p>Petra may get prompted for her RSA key pass phrase every time she <strong>commit<\/strong>s a change, or <strong>fetch<\/strong>es changes, but a Git Bash session can run an agent process that takes care of this for her. It is per-session \u2013 during the remainder of that session, she won&#8217;t get prompted for the pass phrase, except for one time while setting up the agent:<\/p>\n\n\n\n<pre>$ eval $(ssh-agent)<\/pre>\n<pre class=\"console-output\">Agent pid 227166<\/pre>\n<pre>$ ssh-add ~\/.ssh\/id_rsa<\/pre>\n<pre class=\"console-output\">Enter passphrase for \/home\/petra\/.ssh\/id_rsa: *************\nIdentity added: \/home\/petra\/.ssh\/id_rsa (petra@mcgregor_garden)<\/pre>\n\n\n\n<p>For further reading: <a rel=\"noreferrer noopener\" href=\"https:\/\/smallstep.com\/blog\/ssh-agent-explained\/\" target=\"_blank\">https:\/\/smallstep.com\/blog\/ssh-agent-explained\/<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Differences between Windows and Linux<\/h4>\n\n\n\n<p>If you use the Git Bash console on Windows, then the workflow is almost exactly the same as that described above. The only difference is that the RSA key files are located in C:\\Users\\&lt;user&gt;\\.ssh\\<\/p>\n\n\n\n<p>If you don&#8217;t use Git Bash or ssh-keygen, then there are tutorials out there on <a rel=\"noreferrer noopener\" href=\"https:\/\/phoenixnap.com\/kb\/generate-ssh-key-windows-10\" target=\"_blank\">how to use PuTTYgen or OpenSSH<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Using HTTPS to clone a private repository on BitBucket<\/h3>\n\n\n\n<p>Petra Rabbit experiments with using HTTPS instead. Typically BitBucket or GitHub will tell us that the Git URL to use with HTTPS is:<\/p>\n\n\n\n<pre>https:\/\/user-name@bitbucket.org\/user-name\/repo-name.git<\/pre>\n\n\n\n<p>It&#8217;s easy to forget that the first user-name is the <strong>user<\/strong> we are authenticating as, and the second user is the <strong>owner<\/strong> of the repository. So, Petra needs to use her BitBucket account name in place of the first, authenticating user:<\/p>\n\n\n\n<pre>$ git clone https:\/\/petra-rabbit@bitbucket.org\/zach-the-cat\/x_files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'x_files'...\nPassword for 'https:\/\/petra-rabbit@bitbucket.org': *******\nUnpacking objects: 100% (13\/13), 2.65 KiB | 677.00 KiB\/s, done.<\/pre>\n\n\n\n<p>BitBucket accepts her &#8220;petra-rabbit&#8221; account password.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Using HTTPS to clone a repository on GitHub<\/h3>\n\n\n\n<p>Petra has created her own private repository on GitHub called &#8220;Y_Files&#8221; and she&#8217;d like to clone it locally so that she can develop offline. GitHub tells her the URL to use for HTTPS:<\/p>\n\n\n\n<pre>https:\/\/github.com\/petra-rabbit\/Y_Files.git<\/pre>\n\n\n\n<p>It&#8217;s interesting that it is different from the URL that BitBucket suggests, it&#8217;s missing the &#8220;user-name@&#8221; prefix. No problem, it will just prompt for a user name:<\/p>\n\n\n\n<pre>$ git clone https:\/\/github.com\/petra-rabbit\/Y_Files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'Y_Files'...\nUsername for 'https:\/\/github.com': petra-rabbit\nPassword for 'https:\/\/petra-rabbit@github.com': ********\nremote: Support for password authentication was removed on August 13, 2021. Please use a personal access token instead.\nremote: Please see https:\/\/github.blog\/2020-12-15-token-authentication-requirements-for-git-operations\/ for more information.\n<b>fatal: Authentication failed for 'https:\/\/github.com\/petra-rabbit\/Y_Files.git\/'<\/b><\/pre>\n\n\n\n<p>Interesting. GitHub is going to require Petra to learn about Personal Access Tokens:<br><a href=\"https:\/\/docs.github.com\/en\/github\/authenticating-to-github\/keeping-your-account-and-data-secure\/creating-a-personal-access-token\">https:\/\/docs.github.com\/en\/github\/authenticating-to-github\/keeping-your-account-and-data-secure\/creating-a-personal-access-token<\/a><\/p>\n\n\n\n<p> Petra opens GitHub in her web browser and navigates to: GitHub Profile &gt; Settings &gt; Developer Settings &gt; Personal access tokens.<\/p>\n\n\n\n<p>She clicks on <strong>Generate New Token<\/strong>.; ticks the <strong>[x] repo<\/strong> checkbox; generates the token; and saves it in a text file in a secret location.<\/p>\n\n\n\n<p>Try again, this time including the user-name prefix, just to prove it works:<\/p>\n\n\n\n<pre>$ git clone https:\/\/petra-rabbit@github.com\/petra-rabbit\/Y_Files.git<\/pre>\n<pre class=\"console-output\">Cloning into 'Y_Files'...\nPassword for 'https:\/\/petra-rabbit@github.com': <\/pre>\n\n\n\n<p>This time, instead of her GitHub account password, Petra pastes the PAT string:<\/p>\n\n\n\n<pre class=\"console-output\">Password for 'https:\/\/petra-rabbit@github.com': ********************************\nremote: Enumerating objects: 9, done.\nremote: Counting objects: 100% (9\/9), done.\nremote: Compressing objects: 100% (6\/6), done.\nremote: Total 9 (delta 1), reused 0 (delta 0), pack-reused 0\nUnpacking objects: 100% (9\/9), 1.95 KiB | 664.00 KiB\/s, done.<\/pre>\n\n\n\n<p>Repository successfully cloned locally:<\/p>\n\n\n\n<pre>$ cd Y_Files\n$ git status<\/pre>\n<pre class=\"console-output\">On branch main\nYour branch is up to date with 'origin\/main'.\nnothing to commit, working tree clean<\/pre>\n\n\n\n<p>Sorted.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Granting permission to other developers in GitHub<\/h3>\n\n\n\n<p>Petra would like to invite Zach The Cat to contribute to her Y_Files repo on GitHub.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>She navigates to GitHub &gt; Repositories &gt; Y_Files &gt; Settings &gt; Manage Access<\/li><li>She presses the <strong>Invite a collaborator<\/strong> button<\/li><li>She searches for the user zach-the-cat, selects him, and waits.<\/li><li>Zach receives an invitation via email and accepts.<\/li><li>Petra&#8217;s Y_Files repository now has one collaborator<\/li><\/ul>\n\n\n\n<p>Exercise for the Student: Save your Git repository remote authentication credentials in your favorite IDE.<\/p>\n\n\n\n<p>That&#8217;s all for this Appendix. Go back to the Top.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Petra Rabbit is a developer. She would like to contribute to some private repositories that Zach Cat has set up on BitBucket and GitHub. 1. Using SSH to clone a repository on BitBucket Zach has a private repository on BitBucket called &#8220;X_Files&#8221; that Petra needs to clone locally: $ git clone git@bitbucket.org:zach-the-cat\/x_files.git Cloning into &#8216;x_files&#8217;&#8230; [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-391","post","type-post","status-publish","format-standard","hentry","category-source-control","post-preview"],"_links":{"self":[{"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/posts\/391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/comments?post=391"}],"version-history":[{"count":0,"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/posts\/391\/revisions"}],"wp:attachment":[{"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/media?parent=391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/categories?post=391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/spacefold.com\/colin\/morethanfour\/wp-json\/wp\/v2\/tags?post=391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}