Python / Linux / VMware 4: Linking PyCharm to GitHub via SSH

I'm trying to expand my knowledge of Linux and Python. I'm taking a "start from scratch" approach, building some virtual environments at home, and documenting every step along the way. This is the fourth of five posts capturing those steps; the end-state is PyCharm IDE, Python 3.6, CentOS 7.3, VMware Workstation Pro 12 running on Windows 10.

Part 1: Installing VMware and CentOS
Part 2: Expanding CentOS's Minimal Install
Part 3: Installing Python 3.6
This is Part 4: Linking PyCharm to Github via SSH
Part 5: Running through Git-It again, this time with PyCharm

In this post I'm going to configure PyCharm to use GitHub for version control (then I'm going to get it working with SSH). This will let me accomplish two things:

• It will let me work more easily from multiple machines on the same code.
• It will make it easier for me to review or assist with other projects that are on my radar, because those are also in GitHub.

What is GitHub?

First, GitHub is not git. git is a version control tool written by Linus Torvalds, the guy responsible for Linux. Think of it as a series of snapshots of your code - so you can say 'oops, I really screwed this up, I want to go back to what I had 36 hours ago.'

GitHub is an online, web-based version control repository (with some other cool features, too). Imagine taking all of those incremental snapshots (with git) and saving them to DropBox or Google Drive. GitHub accomplishes this, but because it is specifically designed around this sort of purpose, it does it really, really well. This provides a few benefits:

• It allows multiple people to work on the same project without the need for a common physical network. I can concurrently collaborate on code with colleagues in Kansas, Colorado, Kenya and Kuala Lumpur.
• It allows work to continue on the same code, from multiple machines - I can make a lot of progress on my system at home, but if I have an idea while I'm at work, I can make a change without waiting to get back to my home system.

Going into any more depth about version control or GitHub is beyond the scope of what I want to accomplish here. If it's a new concept to you, or if you do not have a GitHub account, I highly recommend working through the following two items. They are fairly quick, and serve as a good introduction to GitHub and some of principle ideas and terms of version control.

tryGit

https://try.github.io/ has some tutorials from GitHub. It doesn't use 'real' code and repositories, but it serves as a decent introduction. Once you've completed that introduction, they also have more in-depth tutorials available, if you want to explore further.

Git-it

https://github.com/jlord/git-it-electron - I love this one. It's an application that steps you through most of the common tasks you'll do with GitHub, using a command line, and using real files. Very much worth the time.

Git-it has versions for Mac, Windows, and Linux. If you run the Linux version on your new virtual machine, there is a dependency that's missing - you can figure it out yourself with yum search and so forth, or you can take a shortcut and just issue the following command, after which Git-it will work like a champ.

$ sudo yum -y install libXScrnSaver

Once that's installed:

1. Get Get-it's latest version from the Git-it releases folder
2. Extract it with unzip
3. Remove the original downloaded file (good housekeeping, y'know)
4. Run the executable called Git-it in the newly extracted folder

Pre-configure Git

If you successfully completed the Git-it tutorial, then skip forward to adding an SSH key to your GitHub account. Otherwise, check the output of this command:

$ git config -l
$

If, like here, it gives you no results, then let's set a few things. First, set your name and email address:

$ git config --global user.name "Your Name"
$ git config --global user.email "youremail@example.com"

Now set your Github user name (if you don't have an account at Github, go there and create one first):

$ git config --global user.username your_gh_username

Now tell git to cache your Github password, and to change the default cache timeout, in seconds (default is 900, or 15 minutes):

$ git config --global credential.helper cache
$ git config --global credential.helper 'cache=3600'

Add an SSH key to your GitHub account

We're going to configure GitHub to use SSH when transferring files. You'll therefore need to provide a public key to GitHub (and create one if it doesn't exist).

1. Check for existing SSH keys

If you already have a public and private key pair that you'd like to use, then skip forward to 2b, Check key file permissions (I have a pair elsewhere that I have already copied over to my virtual machine, for example).

In a terminal, check for existing SSH keys:

$ ls -al ~/.ssh
 ## lists keys in your SSH directory (if it exists)

If you see No such file or directory, that will be taken care of in the next step.

By default the public key filenames end in .pub - id_rsa.pub, id_dsa.pub, id_ecdsa.pub, id_ed25519.pub, and so on. A public and private pair will have a corresponding file with no extension - for example, you might see id_rsa.pub and id_rsa.

If you already have a private and public key pair here that you'd like use to connect to GitHub, move on to 2b, Check key file permissions. Otherwise, let's make a new one.

2a. Generate a new SSH key

In a Terminal, use ssh-keygen to create a new key.

$ ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/you/.ssh/id_rsa): [Press Enter; file optional]
Created directory '/home/you/.ssh'.
Enter passphrase (empty for no passphrase): [Essential! Type a passphrase]
Enter same passphrase again: [Type passphrase again]
Your identification has been saved in /home/you/.ssh/id_rsa.
Your public key has been saved in /home/you/.ssh/id_rsa.pub.
The key fingerprint is:
a2:f6:2b:94:67:3a:79:26:07:9e:63:a0:86:ee:a9:b1 your_email@example.com
The key's randomart image is:
+--[ RSA 4096]----+
|                 |
|                 |
|                 |
|                 |
|     .. S        |
|  . +.o.         |
|o. +oB           |
|o+..@.+          |
|E+ . Oo.         |
+-----------------+
$ 

Since your key has just been created, we know that its permissions are correct, so skip ahead to 3, Add your key to the SSH Agent.

2b. Check key file permissions

Take a look at the permissions on the private / public key pair that you are going to use. User should have read and write permissions on both keys; group and other should also have read permissions on the public key.

$ ls -Al
total 8
-rw-------. 1 you     you      3326 Feb 13 07:17 id_rsa
-rw-r--r--. 1 you     you       741 Feb 13 07:17 id_rsa.pub
 ## These are the results you want to see.
$ 

If you have copied these files in from a different location, then these permissions might be wrong. For example, the ones that I use are copied over from my VMware host system, which is running Windows, and so right after copying these files over, the permissions look like this:

$ ls -Al
total 8
-rwxrw-rw-. 1 you     you      3326 Feb 13 07:17 id_rsa
-rwxrw-rw-. 1 you     you       741 Feb 13 07:17 id_rsa.pub
 ## Oops, that's not right! Let's fix it.
$ 

If it's anything other than the proper permissions shown above, then use chmod to fix it.

$ sudo chmod 600 ~/.ssh/id_rsa
$ sudo chmod 644 ~/.ssh/id_rsa.pub
$ ls -Al
total 8
-rw-------. 1 you     you      3326 Feb 13 07:17 id_rsa
-rw-r--r--. 1 you     you       741 Feb 13 07:17 id_rsa.pub
 ## That's much better.
$ 

3. Add your key to the SSH agent

If your private SSH key is protected by a good strong passphrase, that's good. One down side to this, though, is that you will need to type in this passphrase fairly often when you're using SSH. Not only can this get tedious, but it will slow down your workflow, and can make you think dark thoughts about using shorter passphrases, or none at all.

This is where ssh-agent comes in. Its purpose is to store that passphrase in memory for the duration of your local login session. If you were running only a shell (without the GNOME desktop), you'd want to use something like the following (don't use this):

$ eval "$(ssh-agent -s)"
 ## makes sure that ssh-agent is running.
$ ssh-add ~/.ssh/id_rsa
Enter passphrase for /home/you/.ssh/id_rsa: 
Identity added: /home/gbarwis/.ssh/id_rsa (/home/you/.ssh/id_rsa)
$

However, you'll still find that you need to enter your passphrase more than a few times throughout your login session, which then still encourages some bad habits. There are a number of increasingly clever ways to solve this problem; this StackExchange post discusses a few of them. However, these pose some interesting security concerns of their own (see http://rabexc.org/posts/pitfalls-of-ssh-agents for a good discussion of these, including examples of how they can be exploited).

Fortunately, GNOME - like most desktop environments - includes its own solution, GNOME Keyring: a collection of components in GNOME that store secrets, passwords, keys, certificates and make them available to applications. GNOME Keyring is integrated with the user's login, so that their secret storage can be unlocked when the user logins into their session.

Notice that GNOME Keyring is integrated with the user's login? Bring up a terminal and run ssh-add -l, which will list the fingerprints of all identities currently represented by the agent.

$ ssh-add -l
Could not open a connection to your authentication agent.
$

Now log out of your GNOME session, then log back in.

Finally, bring up a terminal and run ssh-add -l again:

$ ssh-add -l
4096 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx your_email@example.com (RSA)
$

You are now using GNOME Keyring's SSH agent functionality.

4. Add your SSH key to your GitHub account

You'll need to copy the contents of a file to the clipboard, so you'll need a tool that will do that. You can open the file in any file editor, but I find it easier to use a tool called xclip. If you want to use your own method, just skip on to the next step. Note that xclip comes from the EPEL repository, which you'd previously installed via sudo yum -y install epel-release.

$ sudo yum -y install xclip
 ## Status updates as the tool installs
Complete!
$

Now copy your public SSH key to your clipboard.

$ xclip -sel clip < ~/.ssh/id_rsa.pub

Log in to Github, click on your profile icon in the upper right, and click on Settings. On the left side of the subsequent screen, click on SSH and GPG keys.

Click on New SSH key (or Add SSH key). Add a descriptive title (for example, "Carl's home Linux VM"), paste your public key into the Key field, and click on Add SSH key. Confirm your Github password if prompted.

5. Test your SSH connection to Github

Now it's time to test remote connectivity to Github, in order to confirm that everything is working properly. From a terminal, enter the following command. Look carefully at the response - the IP address may differ, but the RSA key fingerprint should be the same as the one listed below.

$ ssh -T git@github.com
 ## You'll be prompted to enter the passphrase you created for your private key
The authenticity of host 'github.com (192.30.253.112)' can't be established.
RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
Are you sure you want to continue connecting (yes/no)? yes [Type yes here and press Enter]
Warning: Permanently added 'github.com,192.30.253.112' (RSA) to the list of known hosts.
Hi you! You've successfully authenticated, but GitHub does not provide shell access.
$ 

This indicates that SSH connectivity is working properly.

• If you see an error that says Agent admitted failure to sign, refer to the Error: Agent admitted failure to sign troubleshooting page on Github.
• If you see an error about permission denied, refer to the Error: Permission denied (publickey) troubleshooting page on Github.

It is important to note that using SSH instead of HTTPS will require a slightly different syntax when connecting to remote repositories on Github.

As an example, if you previously worked through Git-it, Instead of these:
$ git remote add origin https://github.com/username/hello-world
$ git remote add upstream htts://github.com/jlord/patchwork.git

You'd use these:
$ git remote add origin git@github.com:username/hello-world
$ git remote add upstream git@github.com:jlord/patchwork.git

Linking PyCharm to Github

Okay, git and SSH are both configured. Now we're going to actually connect PyCharm to Github (using SSH).

Launch PyCharm, and we'll get that set up.

Configure the Github plugin in Pycharm

In the lower right of the PyCharm startup window, click on Configure and then on Settings.

Expand the Version Control menu on the left, and select GitHub. If you do not see an option for GitHub, then you'll need to click on Plugins on the left and add the GitHub plugin from there.

Token is the authentication type recommended by Github for third party integrations, because it does not require the application (PyCharm, in this case) to remember your password. This authentication type is selected by default; we just need to create the token.

Click on Create API Token and enter your Github credentials. This will populate the Token box. Put a checkmark in Clone git repositories using ssh and then click on OK.

Test it: use PyCharm to clone the repository you made in Git-it

To confirm that PyCharm is properly speaking with Github, we're going to clone the hello-world repository that you created with Git-it (or a different repo of your choosing, if you have others in Github).

On the main PyCharm screen, Click Check out from Version Control and then GitHub.

Since PyCharm is connected to Github, your list of available repositories should include the one that you created earlier. Note the syntax (git@github.com) indicates that you're using SSH to transfer the files, as mentioned earlier.

Select your Github hello-world repository, and then click on Test.

You will be prompted for a password - note that this is the passphrase that is associated with your SSH key.

After you get a message indicating that the test was successful, click on Clone, and PyCharm will copy the remote repository to your local file system.

You're all set!

Part 1: Installing VMware and CentOS
Part 2: Expanding CentOS's Minimal Install
Part 3: Installing Python 3.6
That was Part 4: Linking PyCharm to Github via SSH
Part 5: Running through Git-It again, this time with PyCharm