Thread

Git-bug: Distributed, offline-first bug tracker embedded in Git

364 points · 111 comments · alentred

jason_oster · 1790352075 · focus · HN ↗
I tried git-bug a few months ago, and <a href="https://github.com/git-bug/git-bug/issues/1023" rel="nofollow">https://github.com/git-bug/git-bug/issues/1023 is a showstopper.
There is a workaround, but it isn't pretty. You can push/pull bugs and identities with normal, ssh-agent-less git commands: <a href="https://gist.github.com/parasyte/80ef925d4b01216f6bcb051356faffb9" rel="nofollow">https://gist.github.com/parasyte/80ef925d4b01216f6bcb051356f...
1. jsiepkes · 1790353622 · focus · HN ↗
  Isn't "show stopper" a bit dramatic? What is the big problem with an SSH agent? If security is a problem you should probably store your SSH keys on a HSM like a Nitrokey or Yubikey. In which case you need an agent.
  1. elehack · 1790355256 · focus · HN ↗
    The agent requirement is a symptom of a deeper potential issue: not using the system's ssh. Providing built-in as a fast-path option is fine, but ~/.ssh/config can do a lot of useful things, and providing an easy option to say "just use real ssh" lets people have their config just work.
    Specifying identify files for specific hosts, using bastion hosts (ProxyJump), etc. For example, my laptop SSH config detects when I'm not on my university network or VPN and adds a ProxyJump through the department bastion host, but connects directly when I'm on the network. Configurations like that break when software makes too many assumptions about how ssh is configured.
    Magicrafter13 · 1790359745 · focus · HN ↗
    oh wow, how can your ssh config change based on the network you're using?
    Meneth · 1790366768 · focus · HN ↗
    ssh_config allows several ways to execute arbitrary shell commands, such as "Match exec" and "ProxyCommand". Specify a program that can detect networks and choose different connections. Then the config file itself wouldn't change.
    [deleted] · 1790367653 · focus · HN ↗
    [deleted]
  2. iririririr · 1790357005 · focus · HN ↗
    you don't need an agent for hsm.
    also, don't know a good security researcher who uses agents (some even use ssh config to limit which keys are even tried per domain)
    ssh config hacks are also a must if you have, say, two or more identities to github.com for example.
  3. Magicrafter13 · 1790359696 · focus · HN ↗
    hi - this is incorrect
    I use a Yubikey for some of my keys, and I've never used an "agent", don't know how, and don't want to start, unless someone can give me a good reason to
    ssh-keygen -t ed25519-sk
    that's all you need to use a Yubikey with SSH
2. michaelmure · 1790355581 · focus · HN ↗
  I'll fix that soon. I really wanted to avoid calling the git binary for security reason, but I have to admit that go-git is not robust enough in some cases. I'll have at least the option to use the git binary for push/pull, possibly as a default depending on how it goes.
  1. jthoward64 · 1790382704 · focus · HN ↗
    You could always FFI to libgit2 rather than calling git
  2. jason_oster · 1790393809 · focus · HN ↗
    Glad to hear it! Thanks.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.