Organizing multiple Git identities

How do people handle multiple git identities with github+ssh? Since you always log in as the `git` user, you can&#x27;t reuse keys. I end up with an ~&#x2F;.ssh&#x2F;config like:<p><pre><code> Host github-client1 Hostname github.com User git IdentityFile ~&#x2F;.ssh&#x2F;id_rsa-client1 Host github-client2 Hostname github.com User git IdentityFile ~&#x2F;.ssh&#x2F;id_rsa-client2 </code></pre> Then clone using `git clone git@github-client1:username&#x2F;repo.git` Is there a better way?

I have the email address problem, but that&#x27;s the only paramter that needs to vary. I use the simplest way of handling this, which is this in my .config&#x2F;git&#x2F;config:<p><pre><code> [user] name = &quot;My Name&quot; useConfigOnly = true </code></pre> Then, the first time you commit in each repo, you&#x27;ll get an &quot;Author Identity Unknown&quot; message. Then just run `git config --local user.email hello@example.com` to set the config for that repo.

Beware that the trailing slash in the string after `gitdir` is significant! This string is a globbing pattern (it is not obvious at first sight, and seldom mentioned), and the trailing slash implies `**` [1].<p>So if you type &quot;gitdir:~&#x2F;work&quot; instead of &quot;gitdir:~&#x2F;work&#x2F;&quot;, you will lose some time wondering why your configuration is ignored.<p>[1]: <a href="https:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;git-config#_conditional_includes" rel="nofollow noreferrer">https:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;git-config#_conditional_includes</a>

I find one disadvantage of SSH key auth, in case of GitHub in particular, that SSH key grants access to all the repos independently on the organization, etc, which becomes a bigger problem when sharing the machine with other people.<p>One can set a password on the ssh key, but I still felt a bit paranoid about it. I found a way out with fine-grained personal access tokens which allow you to choose the repositories this token will have access to [1].<p>My setup consists of two ingredients:<p>1. GPG encrypted fine-grained PAT: `gpg -c --no-symkey-cache --pinentry-mode loopback my_name` ends up into `my_name.gpg` secret.<p>2. A git credential configuration which is generic across git repositories:<p><pre><code> [credential &quot;https:&#x2F;&#x2F;oauth2@github.com&quot;] helper = &quot;!f() { test \&quot;$1\&quot; = get &amp;&amp; echo \&quot;password=$(gpg -d --pinentry-mode loopback --no-symkey-cache $_GITHUB_TOKEN)\&quot;; }; f&quot; </code></pre> Now switching identities results into setting the env var `$_GITHUB_TOKEN` to the path to my gpg encrypted token, which will be decrypted by git on the fly. You can figure out a suitable way to alias this for yourself :)<p>And it only activates for git urls of the from &quot;oauth2@github.com&quot; which allows you to clone public repos without questions.<p>Another advantage is that you can share the same repo with other people, no need to maintain a copy.<p>Disadvantage is that you have to enter password each time you push&#x2F;pull.<p>[1] <a href="https:&#x2F;&#x2F;github.blog&#x2F;2022-10-18-introducing-fine-grained-personal-access-tokens-for-github&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;github.blog&#x2F;2022-10-18-introducing-fine-grained-pers...</a>

I use conditional includes for this, but I also add a single letter describing which Git identity I&#x27;m currently using to my PS1 so that it appears before $ in my shell prompt. This prevents me from committing code with the wrong identity, in case I&#x27;m using a git checkout that&#x27;s anywhere not covered by the conditional include rules.<p>I use Starship (<a href="https:&#x2F;&#x2F;starship.rs" rel="nofollow noreferrer">https:&#x2F;&#x2F;starship.rs</a>) to manage my prompt, and wrote a short script that only runs if I&#x27;m somewhere in a git repo, and if so finds my Git user&#x27;s email and looks up the corresponding letter in an associative array declared in my ~&#x2F;.config&#x2F;starship-zsh&#x2F;.zshenv:<p><pre><code> git_email=$(git config --get user.email | perl -pe &#x27;chomp if eof&#x27;) letter=$STARSHIP_GIT_USERS[$git_email] echo -n $letter </code></pre> It&#x27;s installed like this:<p><pre><code> [custom.git_user] command = &quot;ZDOTDIR=~&#x2F;.config&#x2F;starship-zsh &#x2F;path&#x2F;to&#x2F;the-script-above.sh&quot; # set ZDOTDIR, makes zsh load the .zshenv file when = &quot;git rev-parse --git-dir &gt;&#x2F;dev&#x2F;null 2&gt;&#x2F;dev&#x2F;null&quot; # only run if we&#x27;re in a git repo format = &#x27; $output&#x27; </code></pre> The .zshenv file contains the STARSHIP_GIT_USERS variable and its values, with a `declare -A` since it&#x27;s an associative array.

I&#x27;ve seen a similar trick on HN, with some basic bash aliases:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25070300">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25070300</a>

nixos solves private keys and tools switch easy. for folders, i ended up with overlays. just follow origin upstream remote locally so that http and file united.<p>i mean if remote is https github com slash dzmitry lahoda slash web3.nix<p>than local is &#x2F;home&#x2F;dz&#x2F;github com slash dzmitry lahoda slash web3.nix<p>navigation is easy. forks easy. no project1 or client 1. just navigation overlay. same works for consumption of knowledge and learning.<p>one may do codespace with nix easy too or many local homes.<p>nix and path overlays is superior and easy to maintain.<p>nix makes remote, local, ci, codespace, user switch, depending on dlmany versions of same repo super easy.<p>even by unix idiots like me.<p>that not full schema so. there are tags and data properties (security, size, files count, uniquiness of copy).<p>so decide if store local or remo only, git and syncthing same time, torrent and syncthing, gdrive and git, keepass and syncthing, what devices, ipfs. any combo.<p>tags when overlays (forced hierarchy fail). when git forks, than many remotes with overlay following most active fork.<p>that approach partially fixes some of my mental issue i guess. oh, i want to install zfs to fix duplication.<p>hardware keys for security i use also. thesd days can mix same key, but held ssh, crypto, aws creds on same device.

I found this a few years ago at <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;14754762&#x2F;can-gitconfig-options-be-set-conditionally&#x2F;59184292#59184292" rel="nofollow noreferrer">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;14754762&#x2F;can-gitconfig-o...</a> and has been my preferred setup.

Check the following comment in previous discussion about git capabilities to manage multiple identities to commit, authenticate and sign based on directories or remote repository URL. <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36800853">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36800853</a>

&gt; This trick has simplified my project onboarding quite a bit. No more &quot;You forgot to update your Email Address&quot; requests from clients!<p>Does this happen in practice? Most commits on professional git repos that I work on are of the form &lt;username&gt;@users.noreply.github.com.

Related: my own project to handle SSH keys for GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;dolmen&#x2F;github-keygen">https:&#x2F;&#x2F;github.com&#x2F;dolmen&#x2F;github-keygen</a><p>The project might not look active, but that&#x27;s because it just works. 12 years old now.

I use podman containers with lazydocker. <a href="https:&#x2F;&#x2F;github.com&#x2F;jesseduffield&#x2F;lazydocker">https:&#x2F;&#x2F;github.com&#x2F;jesseduffield&#x2F;lazydocker</a> That way my work is a bit more separated. Good tips.

I also want this, but on a folder level<p>I have a github.com folder with all the repos I cloned from GH but I always have to type git config user.name&#x2F;email before committing. It&#x27;s so annoying at this point.

Shameless plug of a tool I wrote for managing multiple git identities:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;cquintana92&#x2F;git-switch-user">https:&#x2F;&#x2F;github.com&#x2F;cquintana92&#x2F;git-switch-user</a>

Recently I tried to work on two projects that required different git credentials for push&#x2F;pull. I ended up using basic auth with HTTPS with one repo, and the other on SSH.

And here I am modifying each .git&#x2F;config by hand like a pleb

that conditional include is nice, didn&#x27;t know about that.<p>i&#x27;ve been using direnv to set env vars, but i&#x27;ll probably switch to the conditional include.

Nice git feature, I just configure my identities in .git&#x2F;config (per repository).

is there something similar for aws identities?