feat: support cloning repos over ssh - #1554
Open
zkade0 wants to merge 1 commit into
Open
Conversation
zkade0
force-pushed
the
feat/ssh-clone
branch
2 times, most recently
from
July 31, 2026 21:35
93535f2 to
92d255d
Compare
Adds a git_ssh option to Build, Repo, Stack and ResourceSync. When set,
the remote becomes git@{git_provider}:{repo} and no token is embedded in
the url.
Git provider accounts gain an optional ssh_key alongside token, so the
credential passed to Periphery is now a GitCredential { token, ssh_key }
rather than a bare token string. If the key is left empty, git falls back
to the ssh config of the host running the clone; if it is set, Periphery
writes it to a 0600 temp file for the duration of each git command and
passes it via core.sshCommand, removing it afterwards.
Addresses moghtech#758
zkade0
changed the title
maluramichael
added a commit
to maluramichael/komodo
that referenced
this pull request
Aug 27, 2026
Improvements informed by the parallel PR moghtech#1554 by @zkade0: - create the temp key file with mode 0600 atomically (create_new + mode) instead of write-then-chmod, so the key is never world readable even briefly. - document and test the host-config fallback: when ssh is on but no key is configured, git runs plainly and uses the host's ssh config / agent. - add tests for file mode, cleanup on drop, that the key body never reaches the command env, and the fallback behaviour. Keeps the GIT_SSH_COMMAND approach (verified end-to-end) rather than the `git -c core.sshCommand` variant.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #758.
Komodo only accepts
{ username, token }today, which is always a user-scoped credential. Some credentials can't be expressed that way — a GitHub deploy key is scoped to one repo and isn't tied to an account. #1537 is the related complaint about the token ending up in.git/config.This adds a
git_sshoption to Build, Repo, Stack and ResourceSync. When set,remote_url()returnsgit@{git_provider}:{repo}and no token is embedded.The key can come from either side:
ssh_keyempty — git uses the ssh config of whichever host runs the clone (Core for syncs, the target server's Periphery otherwise).ssh_keyset — Core sends it with the request, as it already does with tokens, so a new server needs no ssh setup. Periphery writes it to a0600temp file, passes it viacore.sshCommandwithIdentitiesOnly=yesandStrictHostKeyChecking=accept-new, and removes it on drop. Only the path reaches the command string.To carry both, the credential on the wire is now
GitCredential { token, ssh_key }instead ofOption<String>. That rename is most of the diff; the behaviour change is small.In the UI the existing
https:///http://button next to the git provider becomes a three-way cycle ending ingit@, and git accounts get anSSH Keyfield.Tests cover
remote_urlin both forms, and the key file's mode, cleanup on drop, and that the key body never reaches the command.cargo check --workspace --all-targetsandcargo fmt --allare clean. I haven't run the UI build, so the fourconfig.tsxchanges and the regenerated types are worth a look.