[Feature Request] Support SSH for Github

[latot]

Would be great be able to install packages when git uses ssh keys to download and access them.

As described here only works https ones (#569 (comment))

Thx!

[gaborcsardi]

Unfortunately that's very hard to implement if we don't want to depend on git.

It is usually easy to use https, either via the git credential store or via the GITHUB_PAT env var.

Can you please explain why you need ssh?

[latot]

Some reasons.

• SSH is easier to handle to download
• Seems there is different ways to set the https credentials across platforms, which makes a lot harder to handle across some non-tech ppl, R is used a lot by non-tech ppl, so have SSH would simplify a lot installations from Git

Thx

[gaborcsardi]

First of all, downloading through https already works for everybody for public repos, even if you don't set any credentials.

For private repos, or if you want to avoid rate limits, all you need is to request a personal access token and set it in an environment variable.

IMO these are simpler than installing ssh or libssh or even git, especially on Windows and macOS.

We might have ssh support at some point, but considering that it is a lot of work, it probably won't happen soon.

[latot]

I thought it was simple, but seems is not that simple to register tokens in windows, works the first time, then they are deleted after some time (less than one day), using the credentials library.

[gaborcsardi]

The default expiration time is 30 days for classic tokens. But you can also choose to keep them forever.

No need to use the credentials package if that's what you mean, use gitcreds::gitcreds_set() or set the GITHUB_PAT env var in you .Renviron.

[jasmineirx]

I would like to add my support for using ssh as an option for accessing repos, especially for private repos.

If you read github's documentation for setting up PATs, it is filled with cautionary language about security, and they recommend using fine-grained PATs over classic:

Personal access tokens (classic) are less secure. However, some features currently will only work with personal access tokens (classic)

Personal access tokens are like passwords, and they share the same inherent security risks. Before creating a new personal access token, consider if there is a more secure method of authentication available to you

(emphasis mine)

My employer generally uses ssh for secure access to github, and I'm finding myself having to add a PAT only to use {pak}, adding in a new security consideration only for this particular workflow.