bgauduch · September 9, 2026 16:19 · slmg · May 20, 2020 · bgauduch · May 26, 2020
diff --git a/0 - Multiple git identities on one machine.md b/0 - Multiple git identities on one machine.md
diff --git a/lab.Dockerfile b/lab.Dockerfile
 # Bare workstation for the multiple-git-identities demo: Debian, git, gh, glab.
 # No git config, no ssh key, no token. Build once, run `docker run --rm -it`.
 # openssh-client + known_hosts only so that `ssh -T git@<host>` (guide, Step 5) can be played: it must fail with `Permission denied (publickey)`.
 FROM debian:trixie-slim

 ARG GLAB_VERSION=1.116.0

 RUN apt-get update \
 && apt-get install -y --no-install-recommends git ca-certificates curl gnupg less openssh-client \
 && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
 && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
 && apt-get update && apt-get install -y --no-install-recommends gh \
 && arch="$(dpkg --print-architecture)" \
 && curl -fsSL "https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_${arch}.deb" \
      -o /tmp/glab.deb \
 && dpkg -i /tmp/glab.deb && rm /tmp/glab.deb \
 && rm -rf /var/lib/apt/lists/* \
 && mkdir -m 700 /root/.ssh \
 && ssh-keyscan -t ed25519 github.com gitlab.com > /root/.ssh/known_hosts 2>/dev/null

 WORKDIR /root
 CMD ["bash"]
diff --git a/lab.sh b/lab.sh
 #!/usr/bin/env bash
 # Multiple git identities, from a bare machine to two providers.
 # Version: 4.2
 # Changelog:
 #   2026-09-03 - v4.2 repositories under ~/git (was ~/code); check() ends with the whole config, --show-origin --show-scope.
 #   2026-09-02 - v4.1 titles for a first-time viewer: step N/8, each title states what the output shows; the verification is `check`, no cross-reference.
 #   2026-09-02 - v3.1 blank line before the verify block.
 #   2026-09-02 - v3.0 every command on screen: mkdir, cd, rm, the README write and git add go through run()/seed(). No silent step.
 #   2026-09-02 - v2.1 two blank lines before each step title.
 #   2026-09-02 - v2.0 verify(): the guide's Step 5 block played as is (show-origin email+name, git var, ssh -T) after each remote-driven identity (steps 4 and 7).
 #   2026-09-02 - v1.3 step 1 title: git guesses the author, it does not invent one (advice.implicitIdentity).
 #   2026-09-02 - v1.2 fix: trimmed glab status killed the script (SIGPIPE 141 under pipefail).
 #   2026-09-02 - v1.1 trim glab auth status output (env-token notice).
 #   2026-09-02 - v1.0 initial: 8 steps, GitHub + GitLab over https, no ssh key required.
 #
 # Run inside the companion container (see lab.Dockerfile), never on your workstation:
 #   docker build -f lab.Dockerfile -t git-identity-lab .
 #   docker run --rm -it --hostname laptop.local --env-file tokens.env git-identity-lab
 #   ./lab.sh            # all 8 steps, pause between each
 #   ./lab.sh --auto     # all 8 steps, no pause
 #   ./lab.sh 4          # one step
 #
 # Environment (tokens.env, chmod 600, never committed):
 #   GH_TOKEN          fine-grained PAT, Contents: read/write on LAB_GITHUB_REPO only
 #   GITLAB_TOKEN      personal access token, scopes read_user + write_repository
 #   LAB_GITHUB_REPO   owner/name of an EMPTY public repository on github.com
 #   LAB_GITLAB_REPO   namespace/name of an EMPTY public project on gitlab.com
 #   LAB_PERSONAL_NAME / LAB_PERSONAL_EMAIL   identity for GitHub (defaults below)
 #   LAB_WORK_NAME     / LAB_WORK_EMAIL       identity for GitLab (defaults below)
 # Steps 6 and 8 push; every other step works offline.
 set -euo pipefail

 : "${LAB_GITHUB_REPO:=you/git-identity-lab}"
 : "${LAB_GITLAB_REPO:=you/git-identity-lab}"
 : "${LAB_PERSONAL_NAME:=personal_username}"
 : "${LAB_PERSONAL_EMAIL:=personal@users.noreply.github.com}"
 : "${LAB_WORK_NAME:=work_username}"
 : "${LAB_WORK_EMAIL:=you@company.example}"
 ROOT="$HOME/git"

 bold=$'\e[1m'; dim=$'\e[2m'; off=$'\e[0m'
 title() { printf '\n\n%s== step %s/8 · %s ==%s\n' "$bold" "$1" "$2" "$off"; }
 run()   { printf '%s$ %s%s\n' "$dim" "$*" "$off"; "$@" || true; }   # builtins too: no subshell, so `run cd` moves the script
 seed()  { printf '%s$ echo "# %s" > README.md && git add README.md%s\n' "$dim" "$1" "$off"; echo "# $1" > README.md && git add README.md; }
 ident() { printf '%s$ git var GIT_AUTHOR_IDENT%s\n' "$dim" "$off"; { git var GIT_AUTHOR_IDENT 2>&1 || true; } | head -1; }
 check() {  # the guide's verification block (Part 1, Step 5), verbatim; $1 = host. ssh -T must be denied: no key here, the push goes through the CLI
  printf '\n%s-- check: identity, source file, ssh --%s\n' "$bold" "$off"
  run git config --show-origin --get user.email
  run git config --show-origin --get user.name
  ident
  run ssh -T "git@$1"
  run git config --list --show-origin --show-scope
 }

 step1() { title 1 "bare machine: git signs with the OS user and the hostname"
  run git --version
  run ls -la "$HOME/.gitconfig"
  run mkdir -p "$ROOT/scratch"
  run cd "$ROOT/scratch"
  run git init -q .
  run git commit -q --allow-empty -m "first commit"
  run git log -1 --format='%an <%ae>'
  ident
 }

 step2() { title 2 "one file per identity"
  run git config --file="$HOME/.gitconfig-personal" --replace-all user.name  "$LAB_PERSONAL_NAME"
  run git config --file="$HOME/.gitconfig-personal" --replace-all user.email "$LAB_PERSONAL_EMAIL"
  run git config --file="$HOME/.gitconfig-work" --replace-all user.name  "$LAB_WORK_NAME"
  run git config --file="$HOME/.gitconfig-work" --replace-all user.email "$LAB_WORK_EMAIL"
  run cat "$HOME/.gitconfig-personal"
  run cat "$HOME/.gitconfig-work"
 }

 step3() { title 3 "~/.gitconfig: rules only, no identity, no guessing"
  run git config --global --replace-all "includeif.hasconfig:remote.*.url:https://github.com/**.path" "~/.gitconfig-personal"
  run git config --global --replace-all "includeif.hasconfig:remote.*.url:https://gitlab.com/**.path" "~/.gitconfig-work"
  run git config --global user.useConfigOnly true
  run cat "$HOME/.gitconfig"
 }

 step4() { title 4 "a repository takes its identity from its remote"
  run mkdir -p "$ROOT/github"
  run cd "$ROOT/github"
  run rm -rf lab
  run git init -q -b main lab
  run cd lab
  ident
  run git commit -q --allow-empty -m "who am I"
  run git remote add origin "https://github.com/$LAB_GITHUB_REPO.git"
  ident
  run git config --show-origin --get user.email
  seed "$LAB_GITHUB_REPO"
  run git commit -q -m "personal identity, picked by the remote"
  run git log -1 --format='%an <%ae>'
  check github.com
 }

 step5() { title 5 "identity by folder: the trailing slash"
  run git config --global --replace-all "includeif.gitdir:~/git/github.path" "~/.gitconfig-personal"
  run cd "$ROOT/github/lab"
  run git remote remove origin
  ident
  run git config --global --unset "includeif.gitdir:~/git/github.path"
  run git config --global --replace-all "includeif.gitdir:~/git/github/.path" "~/.gitconfig-personal"
  ident
  run git config --show-origin --get user.email
  run git remote add origin "https://github.com/$LAB_GITHUB_REPO.git"
 }

 step6() { title 6 "push to GitHub with the gh token, no ssh key"
  run gh auth status
  run gh auth setup-git
  run git config --global --get-regexp '^credential'
  run cd "$ROOT/github/lab"
  run git push -u origin main
  echo "open https://github.com/$LAB_GITHUB_REPO/commits/main"
 }

 step7() { title 7 "same on GitLab, the other identity"
  run mkdir -p "$ROOT/gitlab"
  run cd "$ROOT/gitlab"
  run rm -rf lab
  run git init -q -b main lab
  run cd lab
  run git remote add origin "https://gitlab.com/$LAB_GITLAB_REPO.git"
  ident
  seed "$LAB_GITLAB_REPO"
  run git commit -q -m "work identity, picked by the remote"
  run git log -1 --format='%an <%ae>'
  check gitlab.com
 }

 step8() { title 8 "push to GitLab with the glab token, then the ssh pattern"
  { glab auth status 2>&1 || true; } | head -3   # env-token notice trimmed; the group absorbs SIGPIPE under pipefail
  run git config --global --replace-all "credential.https://gitlab.com.helper" '!glab auth git-credential'
  run cd "$ROOT/gitlab/lab"
  run git push -u origin main
  echo "open https://gitlab.com/$LAB_GITLAB_REPO/-/commits/main"
  run git remote set-url origin "git@gitlab.com:$LAB_GITLAB_REPO.git"
  ident
  run git config --global --replace-all "includeif.hasconfig:remote.*.url:git@gitlab.com:**.path" "~/.gitconfig-work"
  ident
  run git config --global --unset "includeif.hasconfig:remote.*.url:git@gitlab.com:**.path"
  run git config --global --replace-all "includeif.hasconfig:remote.*.url:git@gitlab.com:*/**.path" "~/.gitconfig-work"
  ident
  run git remote set-url origin "https://gitlab.com/$LAB_GITLAB_REPO.git"
 }

 pause() { [ "${AUTO:-0}" = 1 ] || { printf '%s[enter for next step]%s' "$dim" "$off"; read -r; }; }

 AUTO=0
 case "${1:-}" in
  --auto) AUTO=1; set -- ;;
 esac
 if [ $# -ge 1 ]; then "step$1"; exit; fi
 for n in 1 2 3 4 5 6 7 8; do "step$n"; [ "$n" = 8 ] || pause; done
Feature	Minimum git
`user.useConfigOnly`	2.8
`includeIf "gitdir:"` / `gitdir/i:` (identity per folder)	2.13
`includeIf "onbranch:"`	2.23
SSH commit signing (`gpg.format = ssh`)	2.34
`includeIf "hasconfig:remote.*.url:"` (identity per remote)	2.36
	`gitdir:` (per folder)	`hasconfig:remote..url:` (per remote*)
The identity follows	where the repo is cloned	who hosts the repo
Does not match	a clone outside the folder (`/tmp`)	a repo without remote (`git init`)
Scope	File	Flag
system	`/etc/gitconfig`	`--system`
global	`~/.gitconfig` or `~/.config/git/config`	`--global`
local	`<repo>/.git/config`	`--local`
worktree	`<repo>/.git/config.worktree`	`--worktree`
Pattern	Matches	Rule
`gitdir:~/git/perso/`	✅	trailing `/` appends `**`: everything below
`gitdir:~/git/perso`	❌	no trailing slash: that exact path only
`gitdir:perso/`	✅	no leading `~/`, `./`, `/` or `/`: `/` is prepended
`gitdir:~/git/perso/**/.git`	✅	explicit glob, not required
`gitdir:~/GIT/perso/`	❌	case-sensitive
`gitdir/i:~/GIT/perso/`	✅	`/i`: case-insensitive (Windows, macOS)
Symptom	Cause	Fix
`git config --get user.email` prints nothing	2.2	`cd` into a repo
Commits carry `you@your-machine.local`	no rule matched, `user.useConfigOnly` unset	Step 4, then fix the rule
Not applied in a repo under the folder	no trailing `/` in `gitdir:`	2.3
Not applied, path looks right	case or symlink	`gitdir/i:`, or the resolved path, 2.2
Applied, wrong value	`user.email` in `.git/config`	`git config --local --unset user.email`, 2.1
Three emails in an identity file	`--add`	`--replace-all`
Right author, wrong account on push	ssh key or helper, not git config	`ssh -T git@host`, `IdentitiesOnly yes`, 2.5
`hasconfig:` never matches	no remote yet (Step 1)	add the remote, or a `gitdir:` rule
`hasconfig:` matches ssh clones but not https, or the reverse	one glob per URL shape	2.3
Commit shown as unverified	signing key ≠ commit email on the account	2.6
	# Bare workstation for the multiple-git-identities demo: Debian, git, gh, glab.
	# No git config, no ssh key, no token. Build once, run `docker run --rm -it`.
	# openssh-client + known_hosts only so that `ssh -T git@<host>` (guide, Step 5) can be played: it must fail with `Permission denied (publickey)`.
	FROM debian:trixie-slim

	ARG GLAB_VERSION=1.116.0

	RUN apt-get update \
	&& apt-get install -y --no-install-recommends git ca-certificates curl gnupg less openssh-client \
	&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
	-o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
	&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
	> /etc/apt/sources.list.d/github-cli.list \
	&& apt-get update && apt-get install -y --no-install-recommends gh \
	&& arch="$(dpkg --print-architecture)" \
	&& curl -fsSL "https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_${arch}.deb" \
	-o /tmp/glab.deb \
	&& dpkg -i /tmp/glab.deb && rm /tmp/glab.deb \
	&& rm -rf /var/lib/apt/lists/* \
	&& mkdir -m 700 /root/.ssh \
	&& ssh-keyscan -t ed25519 github.com gitlab.com > /root/.ssh/known_hosts 2>/dev/null

	WORKDIR /root
	CMD ["bash"]
	#!/usr/bin/env bash
	# Multiple git identities, from a bare machine to two providers.
	# Version: 4.2
	# Changelog:
	# 2026-09-03 - v4.2 repositories under ~/git (was ~/code); check() ends with the whole config, --show-origin --show-scope.
	# 2026-09-02 - v4.1 titles for a first-time viewer: step N/8, each title states what the output shows; the verification is `check`, no cross-reference.
	# 2026-09-02 - v3.1 blank line before the verify block.
	# 2026-09-02 - v3.0 every command on screen: mkdir, cd, rm, the README write and git add go through run()/seed(). No silent step.
	# 2026-09-02 - v2.1 two blank lines before each step title.
	# 2026-09-02 - v2.0 verify(): the guide's Step 5 block played as is (show-origin email+name, git var, ssh -T) after each remote-driven identity (steps 4 and 7).
	# 2026-09-02 - v1.3 step 1 title: git guesses the author, it does not invent one (advice.implicitIdentity).
	# 2026-09-02 - v1.2 fix: trimmed glab status killed the script (SIGPIPE 141 under pipefail).
	# 2026-09-02 - v1.1 trim glab auth status output (env-token notice).
	# 2026-09-02 - v1.0 initial: 8 steps, GitHub + GitLab over https, no ssh key required.
	#
	# Run inside the companion container (see lab.Dockerfile), never on your workstation:
	# docker build -f lab.Dockerfile -t git-identity-lab .
	# docker run --rm -it --hostname laptop.local --env-file tokens.env git-identity-lab
	# ./lab.sh # all 8 steps, pause between each
	# ./lab.sh --auto # all 8 steps, no pause
	# ./lab.sh 4 # one step
	#
	# Environment (tokens.env, chmod 600, never committed):
	# GH_TOKEN fine-grained PAT, Contents: read/write on LAB_GITHUB_REPO only
	# GITLAB_TOKEN personal access token, scopes read_user + write_repository
	# LAB_GITHUB_REPO owner/name of an EMPTY public repository on github.com
	# LAB_GITLAB_REPO namespace/name of an EMPTY public project on gitlab.com
	# LAB_PERSONAL_NAME / LAB_PERSONAL_EMAIL identity for GitHub (defaults below)
	# LAB_WORK_NAME / LAB_WORK_EMAIL identity for GitLab (defaults below)
	# Steps 6 and 8 push; every other step works offline.
	set -euo pipefail

	: "${LAB_GITHUB_REPO:=you/git-identity-lab}"
	: "${LAB_GITLAB_REPO:=you/git-identity-lab}"
	: "${LAB_PERSONAL_NAME:=personal_username}"
	: "${LAB_PERSONAL_EMAIL:=personal@users.noreply.github.com}"
	: "${LAB_WORK_NAME:=work_username}"
	: "${LAB_WORK_EMAIL:=you@company.example}"
	ROOT="$HOME/git"

	bold=$'\e[1m'; dim=$'\e[2m'; off=$'\e[0m'
	title() { printf '\n\n%s== step %s/8 · %s ==%s\n' "$bold" "$1" "$2" "$off"; }
	run() { printf '%s$ %s%s\n' "$dim" "$*" "$off"; "$@" \|\| true; } # builtins too: no subshell, so `run cd` moves the script
	seed() { printf '%s$ echo "# %s" > README.md && git add README.md%s\n' "$dim" "$1" "$off"; echo "# $1" > README.md && git add README.md; }
	ident() { printf '%s$ git var GIT_AUTHOR_IDENT%s\n' "$dim" "$off"; { git var GIT_AUTHOR_IDENT 2>&1 \|\| true; } \| head -1; }
	check() { # the guide's verification block (Part 1, Step 5), verbatim; $1 = host. ssh -T must be denied: no key here, the push goes through the CLI
	printf '\n%s-- check: identity, source file, ssh --%s\n' "$bold" "$off"
	run git config --show-origin --get user.email
	run git config --show-origin --get user.name
	ident
	run ssh -T "git@$1"
	run git config --list --show-origin --show-scope
	}

	step1() { title 1 "bare machine: git signs with the OS user and the hostname"
	run git --version
	run ls -la "$HOME/.gitconfig"
	run mkdir -p "$ROOT/scratch"
	run cd "$ROOT/scratch"
	run git init -q .
	run git commit -q --allow-empty -m "first commit"
	run git log -1 --format='%an <%ae>'
	ident
	}

	step2() { title 2 "one file per identity"
	run git config --file="$HOME/.gitconfig-personal" --replace-all user.name "$LAB_PERSONAL_NAME"
	run git config --file="$HOME/.gitconfig-personal" --replace-all user.email "$LAB_PERSONAL_EMAIL"
	run git config --file="$HOME/.gitconfig-work" --replace-all user.name "$LAB_WORK_NAME"
	run git config --file="$HOME/.gitconfig-work" --replace-all user.email "$LAB_WORK_EMAIL"
	run cat "$HOME/.gitconfig-personal"
	run cat "$HOME/.gitconfig-work"
	}

	step3() { title 3 "~/.gitconfig: rules only, no identity, no guessing"
	run git config --global --replace-all "includeif.hasconfig:remote..url:https://github.com/*.path" "~/.gitconfig-personal"
	run git config --global --replace-all "includeif.hasconfig:remote..url:https://gitlab.com/*.path" "~/.gitconfig-work"
	run git config --global user.useConfigOnly true
	run cat "$HOME/.gitconfig"
	}

	step4() { title 4 "a repository takes its identity from its remote"
	run mkdir -p "$ROOT/github"
	run cd "$ROOT/github"
	run rm -rf lab
	run git init -q -b main lab
	run cd lab
	ident
	run git commit -q --allow-empty -m "who am I"
	run git remote add origin "https://github.com/$LAB_GITHUB_REPO.git"
	ident
	run git config --show-origin --get user.email
	seed "$LAB_GITHUB_REPO"
	run git commit -q -m "personal identity, picked by the remote"
	run git log -1 --format='%an <%ae>'
	check github.com
	}

	step5() { title 5 "identity by folder: the trailing slash"
	run git config --global --replace-all "includeif.gitdir:~/git/github.path" "~/.gitconfig-personal"
	run cd "$ROOT/github/lab"
	run git remote remove origin
	ident
	run git config --global --unset "includeif.gitdir:~/git/github.path"
	run git config --global --replace-all "includeif.gitdir:~/git/github/.path" "~/.gitconfig-personal"
	ident
	run git config --show-origin --get user.email
	run git remote add origin "https://github.com/$LAB_GITHUB_REPO.git"
	}

	step6() { title 6 "push to GitHub with the gh token, no ssh key"
	run gh auth status
	run gh auth setup-git
	run git config --global --get-regexp '^credential'
	run cd "$ROOT/github/lab"
	run git push -u origin main
	echo "open https://github.com/$LAB_GITHUB_REPO/commits/main"
	}

	step7() { title 7 "same on GitLab, the other identity"
	run mkdir -p "$ROOT/gitlab"
	run cd "$ROOT/gitlab"
	run rm -rf lab
	run git init -q -b main lab
	run cd lab
	run git remote add origin "https://gitlab.com/$LAB_GITLAB_REPO.git"
	ident
	seed "$LAB_GITLAB_REPO"
	run git commit -q -m "work identity, picked by the remote"
	run git log -1 --format='%an <%ae>'
	check gitlab.com
	}

	step8() { title 8 "push to GitLab with the glab token, then the ssh pattern"
	{ glab auth status 2>&1 \|\| true; } \| head -3 # env-token notice trimmed; the group absorbs SIGPIPE under pipefail
	run git config --global --replace-all "credential.https://gitlab.com.helper" '!glab auth git-credential'
	run cd "$ROOT/gitlab/lab"
	run git push -u origin main
	echo "open https://gitlab.com/$LAB_GITLAB_REPO/-/commits/main"
	run git remote set-url origin "git@gitlab.com:$LAB_GITLAB_REPO.git"
	ident
	run git config --global --replace-all "includeif.hasconfig:remote..url:git@gitlab.com:*.path" "~/.gitconfig-work"
	ident
	run git config --global --unset "includeif.hasconfig:remote..url:git@gitlab.com:*.path"
	run git config --global --replace-all "includeif.hasconfig:remote..url:git@gitlab.com:/**.path" "~/.gitconfig-work"
	ident
	run git remote set-url origin "https://gitlab.com/$LAB_GITLAB_REPO.git"
	}

	pause() { [ "${AUTO:-0}" = 1 ] \|\| { printf '%s[enter for next step]%s' "$dim" "$off"; read -r; }; }

	AUTO=0
	case "${1:-}" in
	--auto) AUTO=1; set -- ;;
	esac
	if [ $# -ge 1 ]; then "step$1"; exit; fi
	for n in 1 2 3 4 5 6 7 8; do "step$n"; [ "$n" = 8 ] \|\| pause; done