Skip to main content
Version: Alpha

Git access and SSH keys

Provider and source authority

This portable contract describes its linked source snapshot. For current deployment instructions, use current installation, authentication and native Cloudflare guides. Historical receipts do not verify later builds.

Golf's developer preview manages your account's public SSH keys. Git transport remains a native backend operation; Golf does not yet provide a Git HTTP credential gateway, scoped agent Git credentials or protected merge enforcement.

Add a public key​

  1. Choose Your account → User settings → SSH keys, or open /account/ssh-keys.
  2. Choose New SSH key to open the inline editor, then enter a descriptive title and one OpenSSH public authentication key. Keep the private key on your device or in your own credential store.
  3. Add the key and inspect its SHA256 fingerprint in the list. Refresh to load current native state. Search and sortable table headers operate only on loaded keys; Load more SSH keys requests another server page.

Cancel closes the editor and discards its draft without adding a key.

Titles are trimmed, valid UTF-8, 1–64 bytes without control characters. Public keys are bounded to 8192 bytes; comments are discarded. Options, multiple lines/keys, certificates, private keys, DSA and RSA below 2048 bits are rejected. Ed25519, ECDSA, supported security keys and adequate RSA pass input validation; the backend can impose additional restrictions. The current real transport proof uses Ed25519.

A native read:user credential permits listing; add/remove requires write:user. Golf always uses your mapped credential and verifies your immutable native identity and key ownership. It does not impersonate an administrator. Read-only Golf API credentials cannot manage or list SSH keys through this service; CLI/MCP do not add key-management tools. See the generated API.

Clone and push​

Use the clone URL returned by the repository page. The local Compose SSH origin uses port 2222, separate from the Golf web application on 8080:

git clone ssh://git@localhost:2222/OWNER/REPOSITORY.git
cd REPOSITORY
git fetch origin
# After creating a local commit:
git push origin HEAD

Replace OWNER and REPOSITORY with your repository. Verify the SSH server host-key fingerprint through your installation operator before trusting a host. The smoke test's loopback host-key capture is a controlled fixture, not a production enrollment procedure.

The local HTTP Git origin is http://localhost:3001. Native personal tokens are the qualified HTTP credential path. A Golf password signs you into Golf; it is not a direct native HTTP Git password. A golf_ro_ API credential is not a Git credential. Avoid putting tokens in clone URLs or shell arguments.

Bundled Compose and Helm set an explicit native ROOT_URL and PUBLIC_URL_DETECTION=never, preventing internal API hostnames from becoming user-facing clone links. External backend operators must configure the equivalent public origin; Golf does not rewrite arbitrary clone URLs. See native configuration.

Credential and removal boundaries​

Account keys follow the native account's repository permissions. They are persistent broad account credentials: Golf logout, session expiry, password reset and local-only account disable do not revoke them. Unified suspension, MFA/step-up, key-use audit and short-lived/repository-scoped agent Git credentials remain release gates.

Choose Remove and confirm to remove an owned key. Cancel/Escape leaves it unchanged. Successful removal is checked against the native API and denies new SSH connections; already accepted connections are not guaranteed to be cancelled.

There is no read-only account-key selector. An earlier source-specific provider proof observed an accepted read_only:true request returning a stored user key with read_only:false. Repository deploy keys or managed Git ingress need separate qualification before read-only agent access is claimed. Current provider acceptance remains separate; inspect the supported Forgejo API for the selected build.

Key writes are not automatically retried. Connection loss or a failed receipt check can occur after the backend accepted a change. Golf blocks another write until you refresh and inspect the list. There is no durable key mutation journal or exactly-once guarantee; current inventory cannot prove which concurrent request created a key.

Repeatable local qualification​

From the product repository, with Compose running and the Go/Node, Git and OpenSSH prerequisites installed:

make qualify-git

The command combines the existing API/CLI smoke with disposable users, repositories and SSH keys. Private keys live in a temporary 0700 directory and are removed on exit. Tokens remain in process memory/environment; the fixture uses its own strict known-hosts file, disables agent/connection reuse and leaves your Git/SSH configuration and retained users unchanged.

The real-service proof covers:

  • Private SSH initial push, clone and fetch; cross-user denial.
  • Branch creation/deletion, amended history, successful force-with-lease and rejection with a stale expected commit.
  • Annotated tags and deletion, plus transport of a locally merged history.
  • Private HTTP clone/fetch using the exact clone URL returned by Golf.
  • Owned key removal, denial of new connections with that key and continued access with another retained key.
  • Served-browser settings navigation, private-key rejection, add/reload/mobile, cancellation and confirmed removal.

Browser fixtures additionally exercise lost-response/no-retry behavior and removal of cached private content after permission failure. These bounded checks do not establish complete GitHub parity. Existing recovery qualification separately covers LFS/signatures; full forks/PR review/protected merge/release workflows, integrated coding agents, Actions/GitLab execution, Cloudflare execution and load qualification remain open. See the product contract and evidence.