Starting ssh-agent from within a git process, outside a bash context?

[TaoK]

• [ X ] I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options

git version 2.37.0.windows.1
cpu: x86_64
built from commit: 989c3a6832b035f6124b0a23da9c0f8f18afa550
sizeof-long: 4
sizeof-size_t: 8
shell-path: /bin/sh
feature: fsmonitor--daemon

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

$ cmd.exe /c ver

Microsoft Windows [Version 10.0.19044.1766]

• What options did you set as part of the installation? Or did you choose the
  defaults?

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
> type "$env:USERPROFILE\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt

Editor Option: VIM
Custom Editor Path:
Default Branch Option:
Path Option: Cmd
SSH Option: OpenSSH
Tortoise Option: false
CURL Option: OpenSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Git Pull Behavior Option: Merge
Use Credential Manager: Enabled
Performance Tweaks FSCache: Enabled
Enable Symlinks: Disabled
Enable Pseudo Console Support: Disabled
Enable FSMonitor: Disabled

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

None - calling directly from Win-R run prompt (so, legacy cmd terminal).

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

#PREP:

mkdir -p /c/ssh-test
cat > /c/ssh-test/ssh-test-wrapper << "EOF"
#!/bin/bash
ssh-agent >| /dev/null
exec ssh "$@"
EOF
setx 'GIT_SSH_COMMAND' 'C:/ssh-test/ssh-test-wrapper'

#EXECUTION

Win-R: git clone [email protected]:whatever

OR: open a cmd terminal, run the same thing, type "exit"

• What did you expect to occur after running these commands?

Git to run, with success or error, and exit when done, leaving any ssh-agent processes that were spawned still running.

• What actually happened instead?

The legacy cmd console window remains open, after the process has exited, until closed manually, or until the ssh-agent process spawned within the git wrapper is killed. Closing the terminal also closes the ssh-agent.

Interestingly, if SSH was called several times (because of a connection error/retry?), then one of the ssh-agents disconnects correctly/successfully, and one gets "stuck" to the terminal process.

• If the problem was occurring with a specific repository, can you provide the
  URL to that repository to help us with testing?

No - this isn't necessarily a bug per se, what I'm doing is clearly not "expected". I'm just very perplexed by this behavior.

If the "ssh-agent" line in the wrapper file is commented out, then the behavior is the same as without the wrapper at all (console closes / completes normally).

If git is called from within a "Git Bash" shell (regardless of the terminal), or even a Cmd shell in another terminal like "Windows Terminal", then it completes normally (regardless of whether the wrapper calls "ssh-agent" or not).

In case it's not obvious, I'm trying to set things up so that an ssh-agent starts up correctly, just-in-time, even when git is called outside of git bash, eg in a GUI. My real script is obviously much more complicated/interesting than the above, but the above illustrates the perplexing "if an ssh-agent process is spawned in git, when not in the context of a bash shell, and in a windows console, then the git process does not complete until the ssh-agent process is terminated" behavior.

[dscho]

You probably want to run a variation of C:\Program Files\Git\cmd\start-ssh-agent.cmd. If you want to ensure that no console window is shown, you could try to start it via start /b.

Git for Windows' wiki page about auto-starting ssh-agent has a bit more info, too, and could potentially benefit from any solution you find.

[TaoK]

Thanks for the tips, but my requirements are a little more complex than start-ssh-agent.cmd, as far as I understand, can address for me:

• I want one ssh-agent instance to work for all git calls, from scripts or shells or GUIs - without having to "mess" with those GUIs
• I want my key(s) to be loaded on-demand (using "AddKeysToAgent yes" rather than an "ssh-add" command up-front)
• I want Git Bash and Msys2 to be able to share a single running ssh-agent, transparently - eg running rsync or ssh from msys

I finally have a working solution that I could add to the wiki page, but I believe it's overly complex - it has three moving parts:

• A sourceable Bash script that follows the GitHub pattern of loading config from user-private file, checking the socket's availability with ssh-add, and spawning a new ssh-agent if not valid
  • EXCEPT this script explicitly stores the socket env value rather than the whole output from ssh-add, and does so with a windows path (cygpath-translated) so that it can later be consistently accessed from either msys bash or git bash (cygpathed back into a unixey path when loaded into the exported env var)
  • And it doesn't add keys with ssh-add, leaving that for AddKeysToAgent on-demand later
  • (this script is sourced in a .bash_profile shared by git bash and msys)
• An SSH wrapper script that sources the bash script, in "don't spawn an ssh-agent if not found" mode, to work around the apparent bug above
  • This wrapper serves to pick up any existing ssh-agent details and populate the environment for the real ssh.exe which it then invokes, when git is called from any non-bash context - GUIs etc - where the .bash_profile didn't get to run
  • This wrapper is currently configured via GIT_SSH_COMMAND, but could use global Git Config I guess, I haven't tested that
• A VBS script to run at windows startup, calling C:\Program Files\Git\bin\bash -c "THE BASH SCRIPT" to start an empty ssh-agent (and record its socket, in windows path format) at login time, via Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, without any console window showing.

The result seems to work well, although it can always be improved (eg VBS is an ugly way to silently start a process, but I'm not aware of any better built-ins; doing it correctly would probably require a dedicated executable). If I could launch the ssh-agent "just-in-time" from the ssh wrapper script (without breaking/hanging the windows console), I could whittle this down to just the sourceable bash script and the ssh-wrapper.

To you think it's worth introducing this complexity as an option in the wiki page, or not? Would it be worth supporting this usecase (ssh-agent "just works" for git in all contexts, not only console/terminal windows) generally? Do you think I should be proposing a patch with a "productized" version of this scheme?

[dscho]

I want Git Bash and Msys2 to be able to share a single running ssh-agent

This might not be achievable in general: AFAIR OpenSSH´s ssh-agent relies on the Unix sockets emulation of the MSYS2 runtime, and while it seems to work most of the time, there is no guarantee that Git for Windows' and MSYS2's versions of the MSYS2 runtime have the exact same idea of how to emulate Unix sockets.

Having said that, I'm glad you found something that works for you. Whether or not to add it to the wiki page is up to you: people might come back to you with questions and support requests :-)

[Okeanos]

While the Git built in SSH solution is certainly workable there are other options you can test and see whether they work better for you.

One would be switching to Windows supplied OpenSSH (and enabling the Windows OpenSSH Agent service). You'll have to modify your $PATH for that or upgrade your installation and tell it to use "external OpenSSH as found on the $PATH".
Please note that Windows OpenSSH has some weird edge cases/bugs you may encounter.
This would be a system managed SSH agent working pretty much the same as on a Unix system (or on macOS) and pick up all the things configured in the ~/.ssh/config file.

Another option would be to use KeePass together with KeeAgent plugin. This way you do not have to change which OpenSSH binaries are used and can (with an experimental setting) talk to both Windows OpenSSH and Git supplied OpenSSH. KeeAgent is its own SSH Agent and would supplant the Git Bash supplied one (and obviously conflicts wit the Windows OpenSSH one as well):

1. Install KeePass and the KeeAgent plugin.
2. In KeePass > Tools > Options configure the KeeAgent plugin:
3. Enable agent for Windows OpenSSH (experimental)
4. Create a Cygwin compatible socket file with e.g. the path %UserProfile%\.ssh\cygwin.socket
5. Create a MSYS2 compatible socket file with e.g. the path %UserProfile%\.ssh\msys2.socket
6. In %UserProfile%\.bashrc or %UserProfile%\.bash_profile set the SSH_AUTH_SOCK with the value pointing at either the Cygwin or the MSYS2 path