如何指定在 git 中使用哪个 SSH 密钥进行 git push 以便将 gitorious 作为镜像？

How to specify which SSH key to use within git for git push in order to have gitorious as a mirror?

提问by Mildred

I have a project hosted on git.debian.org (alioth) and I'd like to configure a post-receive hook to update a mirror of the repository on http://gitorious.org

我有一个托管在 git.debian.org (alioth) 上的项目，我想配置一个 post-receive 挂钩来更新http://gitorious.org 上存储库的镜像

I suppose I'll have to use git push --mirror gitorious

我想我将不得不使用 git push --mirror gitorious

Now, I'll need to have Alioth authorized on gitorious for the push to succeed. How do I do that?

现在，我需要在 gitorious 上获得 Alioth 的授权才能推动成功。我怎么做？

I suppose I need to configure a user on gitorious and create a ssh key for it. And then when I do the git push in the post-receive hook, make sure this ssh key is used.

我想我需要在 gitorious 上配置一个用户并为其创建一个 ssh 密钥。然后当我在 post-receive 钩子中执行 git push 时，确保使用了这个 ssh 密钥。

I could use a ~/.ssh/configbut the problem is that many users can push on alioth, and everyone would have to log in and configure the ~/.ssh/config. Instead, I'd like to have a command line option or an environment variable to tell ssh which key to use. Can I do that?

我可以使用 a~/.ssh/config但问题是许多用户可以推送 alioth，每个人都必须登录并配置~/.ssh/config. 相反，我想要一个命令行选项或一个环境变量来告诉 ssh 使用哪个密钥。我可以这样做吗？

Also, do you have other ideas how mirroring can be achieved? And, is it possible to configure it the other way around (gitorious pushing on alioth)?

另外，您对如何实现镜像有其他想法吗？并且，是否可以以相反的方式对其进行配置（大力推动 alioth）？

采纳答案by Mildred

The answer is to be found in the git reference manual.

答案可以在git 参考手册中找到。

GIT_SSH

If this environment variable is set then git fetch and git push will use this command instead of ssh when they need to connect to a remote system. The $GIT_SSHcommand will be given exactly two arguments: the username@host (or just host) from the URL and the shell command to execute on that remote system.

To pass options to the program that you want to list in GIT_SSHyou will need to wrap the program and options into a shell script, then set GIT_SSHto refer to the shell script.

Usually it is easier to configure any desired options through your personal .ssh/configfile. Please consult your ssh documentation for further details.

GIT_SSH

如果设置了此环境变量，则 git fetch 和 git push 将在需要连接到远程系统时使用此命令而不是 ssh。该$GIT_SSH命令将提供两个参数：来自 URL 的 username@host（或仅主机）和在该远程系统上执行的 shell 命令。

要将选项传递给您要在其中列出的程序，您需要GIT_SSH将程序和选项包装到一个 shell 脚本中，然后设置GIT_SSH为引用该 shell 脚本。

通常，通过您的个人.ssh/config文件配置任何所需的选项会更容易。请查阅您的 ssh 文档以获取更多详细信息。

So, I need to write a wrapper script, I write this push-gitorious.shscript:

所以，我需要写一个包装脚本，我写了这个push-gitorious.sh脚本：

#!/bin/sh


if [ "run" != "" ]; then
  exec ssh -i "$GITORIOUS_IDENTITY_FILE" -o "StrictHostKeyChecking no" "$@"
fi

remote=YOUR_SSH_GITORIOUS_URL

echo "Mirroring to $remote"

export GITORIOUS_IDENTITY_FILE="`mktemp /tmp/tmp.XXXXXXXXXX`"
export GIT_SSH="
path/to/push-gitorious.sh run
"

cat >"$GITORIOUS_IDENTITY_FILE" <<EOF
YOUR SSH PRIVATE KEY

EOF
cat >"$GITORIOUS_IDENTITY_FILE.pub" <<EOF
YOUR SSH PUBLIC KEY

EOF

#echo git push --mirror "$remote"
git push --mirror "$remote"

rm -f "$GITORIOUS_IDENTITY_FILE"
rm -f "$GITORIOUS_IDENTITY_FILE.pub"

exit 0

Of course, you have to fill in the private key (the public key is included in the script for reference only. You also need to fill in the gitorious URL.

当然，你必须填写私钥（公钥包含在脚本中仅供参考。你还需要填写gitorious URL。

In the post-receive hook, you have to put:

在 post-receive 钩子中，你必须输入：

$ PKEY=~/.ssh/keyfile.pem git clone [email protected]:me/repo.git

The run option is important, otherwise it will run ssh directly.

run选项很重要，否则会直接运行ssh。

Warning:no checking is done on the remote host identity. You can remove the option from the ssh command line and customize known_hostsif you want to. In this use case, I don't think it's important.

警告：不对远程主机身份进行检查。您可以从 ssh 命令行中删除该选项并根据known_hosts需要进行自定义。在这个用例中，我认为这并不重要。

回答by alvinabad

The are two methods I know so that you can specify any keyfile you want to use for a git site at the git command line. You don't need to hard-code this keyfile in a config file or script. You simply supply this straight at the git command line.

这是我知道的两种方法，因此您可以在 git 命令行中指定要用于 git 站点的任何密钥文件。您不需要在配置文件或脚本中对此密钥文件进行硬编码。您只需在 git 命令行中直接提供它。

Method 1: Use the GIT_SSH environment variable

方法一：使用 GIT_SSH 环境变量

The usage will be like this at the command line:

在命令行中的用法如下：

#!/bin/sh
if [ -z "$PKEY" ]; then
    # if PKEY is not specified, run ssh using default keyfile
    ssh "$@"
else
    ssh -i "$PKEY" "$@"
fi

To use this command, you need to do some pre-setup. First, create a shell script with the following contents:

要使用此命令，您需要进行一些预先设置。首先，创建一个shell脚本，内容如下：

$ export GIT_SSH=~/ssh-git.sh

Next, export and set the GIT_SSH variable with a value equal to the location of the shell script above.

接下来，导出并设置 GIT_SSH 变量的值等于上述 shell 脚本的位置。

$ chmod +x ~/ssh-git.sh

where ~/ssh-git.sh is the filename of the shell script above.

其中 ~/ssh-git.sh 是上述 shell 脚本的文件名。

The script must be executable so do a chmod:

脚本必须是可执行的，所以执行 chmod：

$ PKEY=~/.ssh/keyfile1.pem git clone [email protected]:me/repo.git

Now you can run this command with any keyfile you choose to use:

现在您可以使用您选择使用的任何密钥文件运行此命令：

$ PKEY=~/.ssh/keyfile2.pem git clone [email protected]:other/repo.git

To use another keyfile for a different host:

为不同的主机使用另一个密钥文件：

$ git.sh -i ~/.ssh/keyfile.pem clone [email protected]:me/repo.git

This supports any keyfile you want to use. Every time you need to run git with a keyfile you want to use you, just supply it to the PKEY variable. You can forget everything else as long as the GIT_SSH has been pre-configured.

这支持您要使用的任何密钥文件。每次您需要使用要使用的密钥文件运行 git 时，只需将其提供给 PKEY 变量即可。只要预先配置了 GIT_SSH，您就可以忘记其他一切。

Take note of the PKEY variable. You may use any name as long as it matches what is used in the shell script GIT_SSH is pointing to.

记下 PKEY 变量。您可以使用任何名称，只要它与 GIT_SSH 指向的 shell 脚本中使用的名称匹配即可。

Method 2: Use a wrapper script

方法 2：使用包装脚本

The usage of the wrapper script will be something like this:

包装器脚本的用法将是这样的：

ssh-keygen -f ~/.ssh/id_rsa_robot

This usage is intuitive since it looks like running ssh with the -i option.

这种用法很直观，因为它看起来像使用 -i 选项运行 ssh。

This doesn't require pre-setup of a shell script and GIT_SSH. You only need to download and run this single wrapper script with the git command.

这不需要预先设置 shell 脚本和 GIT_SSH。您只需要使用 git 命令下载并运行这个单一的包装器脚本。

You can get a copy of this wrapper script here: http://alvinabad.wordpress.com/2013/03/23/how-to-specify-an-ssh-key-file-with-the-git-command/

您可以在此处获取此包装器脚本的副本：http: //alvinabad.wordpress.com/2013/03/23/how-to-specify-an-ssh-key-file-with-the-git-command/

回答by alvinabad

A simpler alternative which does not involve any external scripts is to use a SSH alias. I know the original poster asked specifically not to change ~/.ssh/config, but I suspect there is a misunderstanding here.

不涉及任何外部脚本的更简单的替代方法是使用 SSH 别名。我知道原始海报专门要求不要更改 ~/.ssh/config，但我怀疑这里存在误解。

The local user on the server is not the same as the person doing the commit and can be a different person than the one doing the 'git push'.

服务器上的本地用户与执行提交的人不同，并且可以与执行“git push”的人不同。

• on the server the hosting software can run as a single user (usually 'git')
• the identity of the person doing the commit is only git's buisness (to add to commit's meta data), is irrelevant for the server and is not subject to authentication on the server
• the identity of the 'git push'-er is relevant and is established on systems running the git hosting software on the server based on the ssh key

• 在服务器上，托管软件可以作为单个用户运行（通常是“git”）
• 执行提交的人的身份只是 git 的业务（添加到提交的元数据），与服务器无关，不受服务器上的身份验证
• 'git push'-er 的身份是相关的，是在基于 ssh 密钥的服务器上运行 git 托管软件的系统上建立的

For this reason, on the system doing the push one can force a specific identity even for the same local account and the same remote server, even within the same git repository by using an ssh alias following using the method explained below.

出于这个原因，在执行推送的系统上，即使对于相同的本地帐户和相同的远程服务器，甚至在相同的 git 存储库中，通过使用 ssh 别名并使用下面解释的方法，也可以强制使用特定的身份。

Assume you have on the gitorious.org server your regular account, let's call it 'developer'. You don't want to automatically push using your 'developer' account [1], so you create another gitorious account for the sync, let's call it 'robot'.

假设您在 gitorious.org 服务器上有您的常规帐户，我们称之为“开发人员”。您不想使用您的“开发人员”帐户[1]自动推送，因此您为同步创建了另一个巨大的帐户，我们称之为“机器人”。

For automation only the 'robot' account will be used:

对于自动化，将仅使用“机器人”帐户：

Step 1: Add 'robot' to the gitorius project which needs to be pushed to.

第一步：在需要推送的gitorius项目中添加“robot”。

Step 2: On the local machine create a paswordless key (this will be associated with the robot account on gitorious).

第 2 步：在本地机器上创建一个无密码密钥（这将与 gitorious 上的机器人帐户相关联）。

host robot.gitorious.org
        HostName gitorious.org
        IdentityFile ~/.ssh/id_rsa_robot
        IdentitiesOnly "yes"

Step 3: upload the public key ~/.ssh/id_rsa_robot.pub on gitorious in the 'robot' account.

第 3 步：将公钥 ~/.ssh/id_rsa_robot.pub 上传到 'robot' 帐户中的 gitorious。

Step 4: The git SSH URIs on gitorious have the format [e-mail]:prj_or_user/subproject.git. In your ~/.ssh/config file add the following lines:

步骤4：于gitorious的GIT中的URI SSH具有格式的git @ gitorious.org：prj_or_user / subproject.git。在您的 ~/.ssh/config 文件中添加以下几行：

git remote add autopush [email protected]:project/project.git

This will make sure that:

这将确保：

• whenever your use the 'robot.gitorious.org' hostname it will connect to gitorious.org (HostName option),
• it will use the passwordless key to authenticate as robot on gitorius.org (IdentiFile option) and
• even if you have a ssh agent running, it will ignore the default key and use the passwordless one (IdentiesOnly "yes").

• 每当您使用“robot.gitorious.org”主机名时，它将连接到 gitorious.org（主机名选项），
• 它将使用无密码密钥在 gitorius.org 上作为机器人进行身份验证（IdentiFile 选项）和
• 即使您运行了 ssh 代理，它也会忽略默认密钥并使用无密码密钥（IdentiesOnly“是”）。

Step 5: Assuming the SSH URI on gitorious for your project is '[email protected]:project/project.git', in the local repository define a new remote 'autopush' with a slightly modified host name:

第 5 步：假设您项目的 gitorious 上的 SSH URI 是“[email protected]:project/project.git”，在本地存储库中定义一个新的远程“autopush”，并稍微修改主机名：

git push autopush master

The setup is done, now try to push to gitorious via the 'autopush' remote.

设置完成，现在尝试通过'autopush'遥控器推送到gitorious。

##代码##

If everything went well and there are changes to push, you should see you succesfully pushed to 'gitorious.org' as 'robot'

如果一切顺利并且有更改要推送，您应该会看到您成功推送到 'gitorious.org' 为 'robot'

[1] For automatic pushes a passwordless key must be generated for the account, but attaching it to the gitorious 'developer' account would mean that the automated job can push to any of the gitourious projects where 'developer' is involved on gitorious.

[1] 对于自动推送，必须为帐户生成无密码密钥，但将其附加到 gitorious 'developer' 帐户将意味着自动化作业可以推送到任何 'developer' 涉及 gitorious 的 gitourious 项目。