search

maxgoedjen / secretive

Store SSH keys in the Secure Enclave
MIT License
7.18k stars 158 forks source link

Git LFS enabled repository requests confirmation three times (via Apple Watch), fails on third #222

Open oschrenk opened 3 years ago

oschrenk commented 3 years ago

I have a Git LFS enabled git repository. When I try to push (with a commit unknown to remote), it

  1. triggers a dialog "SecretAgent" is trying to sign a request from "launchd" using secret "ssh". Since I have an AppleWatch, I can double tap to confirm.
  2. It again triggers the same dialog "SecretAgent" is trying to sign a request from "launchd" using secret "ssh" again I can confirm with the AppleWatch
  3. It again triggers the same dialog "SecretAgent" is trying to sign a request from "launchd" using secret "ssh" This time my watch get's the notification, I can double tap, but the confirmation does not change anything and I am left with the open dialog for which I then have to click on "Use password..." and enter the password manually.

I have two questions

  1. Is there a way to only make the process ask for confirmation once?
  2. Is there a way to fix the third time request to sign to make it work with the Apple Watch?

Furthermore: What steps can I take to aid in the resolution?

macOS 11.4 (20F71) Secretive 2.1.0 (1.494736918)

oschrenk commented 3 years ago

A small correction. On step 3 it is actually possible to double tap on the AppleWatch but the timing has to be perfect, the dialog on the Watch appears, you feel the vibration for the notification, and then you only have a very tiny amount of time to tap it (different two the first two times). I've gotten good at this, but I only manage about 20% of the time - the timings are so tight.

maxgoedjen commented 3 years ago

🤔 on 1: almost certainly not: there's no "cool down" period I'm aware of unfortunately, since access is controlled by the Secure Enclave. If this changes in a future macOS update (🤞WWDC) I'll definitely add it. on 2: maybe, I'm surprised these requests time out like that. To be honest I usually just use non-authenticated keys for Git.

mikz commented 3 years ago

You can configure persistent connection to github.com for a few seconds.

I have this in my ~/.ssh/config

Host github.com
  # Enable persistent connection multiplexing
  ControlMaster auto
  ControlPath ~/.ssh/-%r@%h:%p
  ControlPersist 5
oschrenk commented 3 years ago

@mikz What a great idea! I will need to read up on the implications of these settings but a quick test does solve the issue.