Weirdness in SSH auth usage

[tiennou]

I'm debugging SSH clones from Objective-Git. I already asked for some help on SO but even though @carlosmn answer was helpful, I still have to DIY and sadly I don't get much docs to help me ;-).

So, I see that git_credtype_t enum with its 3 values represent a requested credential type. I also see that here they're or'ed — which I wasn't expecting from the looks of the enum, which means that GIT_CREDTYPE_USERPASS_PLAINTEXT | GIT_CREDTYPE_SSH_KEYFILE_PASSPHRASE == GIT_CREDTYPE_SSH_PUBLICKEY, but then this loses me completely...

My current test is cloning the Objective-Git repo from my git:// URL, which correctly triggers an authentication request. But now, I'm more or less forced to ignore the allowed_types parameter — which I'm happily doing, that's testing after all ;-) — and bump ssh keys around to make it work (using #1851 I'm getting "Username/PublicKey combination invalid" which means an error on my side).

I can happily make a PR fixing the weirdness I find as I see them, provided I get some guidance because hem I have no idea how it should work ;-).

[tiennou]

Okay, small update with my findings about GIT_CRED_SSH_PUBLIC_KEY and when/how to use it. This one calls libssh2_userauth_publickey, which is more-or-less equivalent (I'll explain below why) to libssh2_userauth_publickey_fromfile above. The code in libssh2_userauth_publickey_fromfile (which is the only direct user of libssh2_userauth_publickey I've been able to find on the intarwebz) ends up calling its own private callback to decrypt the private key from the file and (I'm mostly paraphrasing here) use it to sign data to prove the other side we have the private key, using APIs that are mostly private to libssh2 (for example, LIBSSH2_HOSTKEY_METHOD is declared in libssh2_priv.h, which I can't be accessed from either libgit2 or Objective-Git) to actually decrypt the private key using the password passed to libssh2_userauth_publickey_fromfile.

So, the main difference between those 2 methods is that one actually allows the client library to sign the data using something else than the decrypted private key directly (for example, a key stored in OS X's Keychain, god bless the poor soul that would go that far in crypto-land).

[carlosmn]

The credential type is now OR-able and the names have been changed to more accurately reflect their function inside the library.