GitHub over SSH

What GitHub adds

GitHub hosts git repositories. Your repository on GitHub is an ordinary remote, plus a web view of your code and history, pull requests for proposing and reviewing changes (next lesson), issues for tracking work, and an off-site backup. GitLab, Codeberg, and others do the same job; the git commands don’t change.

Make a free account at github.com. Use the same email you set as user.email (module 1), so your commits are linked to your account.

Two ways to connect

GitHub accepts two kinds of remote URL ¹:

• HTTPS, like https://github.com/you/garden.git. Git asks for your username and a personal access token, which GitHub uses in place of your password ¹.
• SSH, like git@github.com:you/garden.git, which uses an SSH key instead of any password.

SSH is set up once per computer and then just works. It’s also the same SSH you’ll use to log in to other Linux machines (Linux course). Here’s how.

Making a key

An SSH key is a pair of files. The private key stays on your computer and is never shared; the public key can go anywhere. A server holding your public key can check that you hold the matching private key without the private key ever being sent ².

Generate an Ed25519 key, GitHub’s recommended type, labeled with your email ²:

me@linuxbox:~$ ssh-keygen -t ed25519 -C "you@example.com"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/me/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Press Enter to accept the default file. Then type a passphrase: it encrypts the private key on disk, so a stolen laptop or backup doesn’t give someone your GitHub account ². You end up with two files, ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public).

To avoid typing the passphrase on every push, load the key into ssh-agent, which remembers it for your session ²:

me@linuxbox:~$ eval "$(ssh-agent -s)"
me@linuxbox:~$ ssh-add ~/.ssh/id_ed25519

Make one key per computer, so you can revoke one without touching the others.

Adding it to GitHub

Print the public key and copy it ³:

me@linuxbox:~$ cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... you@example.com

On GitHub: your profile picture, Settings, SSH and GPG keys, New SSH key. Give it a title naming the computer, like “WSL laptop,” paste the key, and save ³.

Test the connection ⁴:

me@linuxbox:~$ ssh -T git@github.com
The authenticity of host 'github.com (...)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
Are you sure you want to continue connecting (yes/no)? yes
Hi you! You've successfully authenticated, but GitHub does not provide shell access.

The first time, SSH asks whether to trust GitHub’s server. Check that the fingerprint matches the one GitHub publishes before typing yes ⁴. SSH remembers it from then on.

Your first GitHub repository

On GitHub, click New repository, name it garden, choose Private, and leave it empty (no README) since you already have one locally. GitHub then shows the commands; choose the SSH URL ⁵:

me@linuxbox:~/garden$ git remote add origin git@github.com:you/garden.git
me@linuxbox:~/garden$ git push -u origin main

Refresh the page: your files and history are there. From now on, git push and git pull work as in the last lesson. If you’d already added an HTTPS remote, switch it with git remote set-url origin git@github.com:you/garden.git.

Keeping private things private

• Private repositories are visible only to you and people you invite; public ones to everyone. Start private.
• Never commit secrets: passwords, tokens, private keys. Remember module 2: once committed, a secret is in history even after you delete the file, so change it instead.
• Never paste your private key anywhere. If it’s ever exposed, delete the public key from GitHub’s settings and make a new pair.

Your turn

So

GitHub hosts your remote and adds pull requests and a web view. Connect over SSH: ssh-keygen -t ed25519 with a passphrase, ssh-add it to the agent, paste the public key into GitHub, and test with ssh -T git@github.com. Then add the SSH URL as origin and git push -u origin main. Keep repositories private by default and secrets out of them.