SSH vs HTTPS

SSH vs HTTPS

After this page you can authenticate to a forge over SSH or HTTPS and know which URL form you are looking at.

Two ways to talk to a remote

	SSH	HTTPS
URL	git@host:owner/repo.git	https://host/owner/repo.git
Secret	Private key on disk	Password, personal access token, or credential helper
Typical use	Daily push/fetch on a machine you own	CI, quick clone, hosts that block SSH

Both speak the Git smart protocol. The difference is how the server decides who you are. Part I does not require a forge. Set this up before chapter 11 so the first push is not a scavenger hunt.

  Linux laptop                         forge
 ┌──────────────────┐                 ┌──────────────────┐
 │ ~/.ssh/id_ed25519│  SSH            │ authorized keys  │
 │   (private)      │ ──────────────► │ git@host         │
 │ id_ed25519.pub   │  or HTTPS+token │ + Git objects    │
 └──────────────────┘                 └──────────────────┘
         git push / git fetch

SSH keys

Generate an ed25519 key if you do not have one:

ssh-keygen -t ed25519 -C "ada@example.com" -f ~/.ssh/id_ed25519

Press Enter for no passphrase, or set one (then ssh-agent remembers it for the session):

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Public key (this is what you paste into the forge):

cat ~/.ssh/id_ed25519.pub

The private file ~/.ssh/id_ed25519 stays on your machine. Never commit it. Never paste it into a ticket.

On the forge: account settings → SSH keys → paste the .pub line. GitHub, GitLab, and Forgejo all have this screen. The label can be laptop.

Test (GitHub as an example host; use your forge’s hostname):

ssh -T git@github.com

A greeting that includes your username means the key was accepted. A password prompt means the server did not see the key (ssh -v shows which files it tried).

~/.ssh/config for several hosts:

Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519

Host forgejo.home
  HostName 192.168.68.200
  User git
  Port 2222
  IdentityFile ~/.ssh/id_ed25519

A later Forgejo lab uses a port like 2222. The Host alias lets you write git@forgejo.home:ada/desk-api.git.

HTTPS and tokens

git clone https://github.com/example/desk-api.git

Pushing over HTTPS asks for a username and a personal access token (not your account password on most forges). Store it in a credential helper:

git config --global credential.helper libsecret   # GNOME Keyring / libsecret, if installed
# memory-only fallback (forgets at reboot or after a timeout):
git config --global credential.helper cache

CI systems often use HTTPS with a job-scoped token. Humans on a laptop usually have an easier time with SSH.

Pick one default

For this book’s desk repos on a machine you own: SSH. Clone and remote URLs will look like:

git@host:owner/desk-api.git

You can change a remote later (chapter 11):

git remote -v
git remote set-url origin git@host:owner/desk-api.git

Chapter 3 stays local: git init does not need SSH or HTTPS.