From 1f79a073474b41263f50c3c0b35dc17b5cdddcf7 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Sat, 26 Sep 2026 22:23:04 +0100 Subject: Use Ubuntu SSH for corporate Git authentication --- docs/canonical-laptop.md | 7 +++++++ dot_config/git/config.tmpl | 2 ++ tests/test_canonical.py | 1 + 3 files changed, 10 insertions(+) diff --git a/docs/canonical-laptop.md b/docs/canonical-laptop.md index 610901a..733e3ba 100644 --- a/docs/canonical-laptop.md +++ b/docs/canonical-laptop.md @@ -162,6 +162,13 @@ group, compare it with the corresponding `/usr/bin` command. Do not change the account UID or add a duplicate entry to `/etc/passwd`. The test VM uses a local account and does not test authd lookups. +Corporate Git uses `/usr/bin/ssh` so Ubuntu can resolve the authd account. +The work key still comes from `~/.ssh/config`. If a clone reports +`No user exists for uid 10000`, test it with +`GIT_SSH_COMMAND=/usr/bin/ssh git clone REPOSITORY`. +After updating this repo, run `just apply` to deploy the Git setting. +`GIT_SSH_COMMAND`, repository settings, and `config.local` can override it. + Tuicr's Rust crates are fetched from the official static archive server with Cargo.lock checksum verification. `just nix-crate-check` tests a fresh download without using its cached output. Bootstrap does not need a manual crate prefetch. diff --git a/dot_config/git/config.tmpl b/dot_config/git/config.tmpl index 9987261..1e1265f 100644 --- a/dot_config/git/config.tmpl +++ b/dot_config/git/config.tmpl @@ -18,6 +18,8 @@ {{ if ne (default "host" (index . "machineRole")) "canonical" }} hooksPath = ~/.config/git/hooks sshCommand = "ssh -i ~/.ssh/nym.pub" +{{ else }} + sshCommand = /usr/bin/ssh {{ end }} [branch] sort=-committerdate diff --git a/tests/test_canonical.py b/tests/test_canonical.py index fb0bff9..4097b3c 100644 --- a/tests/test_canonical.py +++ b/tests/test_canonical.py @@ -246,6 +246,7 @@ class RoleTests(unittest.TestCase): self.assertIn('name = "Work User"', git) self.assertIn('signingkey = "' + "A" * 40 + '"', git) self.assertNotIn("includeIf", git) + self.assertIn("sshCommand = /usr/bin/ssh", git) ssh = subprocess.check_output( self.command( "canonical", -- cgit v1.3.1