Github Desktop does not provide a UI to accept the public key of a new remote host

Description

When using the Github Desktop (Windows) client, there is no UI method provided to accept the public key of a new remote host (when interacting via SSH)

Version

GitHub Desktop version: 1.0.9

OS version: Windows 10

Example strings

HTTPS string: https://github.com/desktop/desktop.git SSH string: [e-mail]:desktop/desktop.git

Notes

I’ve chosen to use Github.com as the example here, but the below applies to any host you try interact with (eg, a private gitlab instance) via the desktop client

Steps to Reproduce

0. Make a copy of your ~/.ssh/known_hosts file and delete it prior to testing the below issue

1. Install Github Desktop client
2. Configure Github.com to accept your SSH public key (After following the SSH keygen process, or using a pregenerated key)
3. Add (clone) a repository using the SSH method instead of the HTTPS method (notes below regarding this, and see next step to deal with this behavior)
4. Reconfigure the repository through the UI via Repository>Repository settings to use the ssh remote origin (Potentially unexpected behavior: Even when using the SSH string method the github desktop client will swap to using the HTTPS string, so you need to change it so it actually uses the SSH string)
5. Once you’ve confirmed the repository settings are using the SSH string (i.e. [e-mail]:desktop/desktop.git) try and fetch origin (it will fail)

Steps to “fix”

1. use a git shell to git pull on a repository, this will trigger the normal prompt:

The authenticity of host 'github.com (192.30.253.113)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
Are you sure you want to continue connecting (yes/no)? yes

1. This adds an entry to ~/.ssh/known_hosts and future interaction with that host will be OK.

Expected behavior: The UI should prompt to approve/deny the new remote SSH server key

Actual behavior: An Authentication error is spawned, with no actions available (or debugging information)

Reproduces how often: 100%

Additional Information

Whilst the github desktop client changes the repository settings (at least, for github.com repositories) to use HTTPS, if a user has specified the SSH string, the client should not automatically change this to be the HTTPS string (seems like unexpected behavior / a feature that could be misleading to the user)

For external / private repositories not hosted on github.com, the client doesn’t seem to try change these to HTTPS strings.

[niik]

Hey @nanomebia, thanks for reaching out! Our SSH support definitely needs some work and we’re tracking what needs to be done over in #2579. I’ll add a link to this issue in there. I’m glad you found a workaround and thankful that you took the time to write up such a detailed issue about it. Out of curiosity, is there something that stops you from consuming Git repositories over HTTP?

I’ll close this issue out and ask that you follow along in #2579 instead.

[ewitz]

Removing the passphrase is not a solution to this SSH issue, I consider @Yajinyaya and @AgrMohit ‘solution’ as a “work-around”. Security needs to be bumped up on the list of priorities IMHO…