Disclaimer: this post is one to file under “things I’m blogging in the hope that I find the answer more quickly next time”.
I switched to using SSH key auth for GitHub and Azure DevOps Repos a long time ago and never looked back. For a while I was using SSH keys without passphrases but got round to adding passphrases a while back. I set up the Windows OpenSSH Authentication Agent - the service defaults to Disabled so I set it as Automatic start and nudged it to Running. (For more information, see the docs on installing Windows OpenSSH)
With the Agent running I could run
ssh-add to add my keys (prompting me for my pass phrase). Since I have these keys added to GitHub, I could test my ssh connection to GitHub using
ssh -T firstname.lastname@example.org. This all worked so I was happy.
I have been using WSL quite a bit recently and configured to forward SSH requests to the Windows SSH Agent (that’s a topic for another post), and the same
ssh -T email@example.com works in WSL, too.
Since configuring this, I’ve been happily working with
git in the terminal with WSL for a while. Today I wanted to work with some code that I had cloned in Windows, so ran a
git remote update to check that I was up-to-date, but that prompted me for my passphrase. At this point I was confused: this is all working fine in WSL without prompting me, and WSL is configured to forward the SSH auth to the OpenSSH Agent in Windows!
After staring at the screen and retrying the command to make sure, I re-ran the
ssh -T firstname.lastname@example.org command in Windows and that ran fine (without prompting me).
Cue lightbulb moment (actually there was some muttering to myself while pacing the office that preceeded this): git ships with its own ssh! (at least git for Windows does). There’s a hint towards that in these GitHub docs where they say to start Git Bash to run
Get-Command ssh.exe in PowerShell pointed me to the OpenSSH installation at
C:\WINDOWS\System32\OpenSSH\ssh.exe. So when I was running
ssh -T email@example.com that was using the OpenSSH
ssh.exe and connecting to the Open SSH Authentication Agent where I had added the keys.
When git was running SSH, it was running its own
ssh and was blissfully unaware of the agent I had added the keys to.
To fix this I ran
$env:GIT_SSH="C:\Windows\System32\OpenSSH\ssh.exe" to set the
GIT_SSH environment variable described here. Note that I ran this as a way to test that this worked, but it only sets the environment variable for that instance of PowerShell. The real fix is to set this environment variable at the machine level to avoid hitting the issue again.
git remote update worked, without prompting me (now that it was using the SSH agent where I had configured the keys)!