Add startup check to ensure ssh to Github works

[sorenlouv]

backport relies on ssh access to Github. There are a couple of scenarios where the git commands will fail due to issues with ssh. Instead of handling these midway in the backporting process, the user should be told upfront about configuration issues, and how to fix them.

Issues that backport should warn about:

• github.com is not in "known_hosts" file.
  If the user has never accessed github over ssh, Github's IP-address will not be trusted, and will prompt the user. Instead of handling the prompt inside backport the user should abort backport and run something like ssh -T [email protected] which will bring up the prompt.

  ssh-keygen -H -F github.com can be used to detect if github.com is added to "known_hosts".

• ssh key is protected with a passphrase, and has not been added to ssh-agent
  If the user has a passphrase on their ssh key, and are not using ssh-agent, backport will choke on this prompt:
  Enter passphrase for key '/Users/sqren/.ssh/id_rsa':

  Instead of trying to handle the prompt, and the back/forth input exchange (I really don't want to touch the user's passphrase) we should abort backport and tell the user how to add their ssh key to ssh-agent. Possible by linking to Github's excellent docs: https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/#adding-your-ssh-key-to-the-ssh-agent

  I still don't know how to detect if the user has a key with a passphrase, that has not been added to ssh-agent. It's possible to detect whether the user has added a key to ssh-agent with ssh-add -l.

Update
It might be possible to check for both cases by simply trying to SSH to Github:

ssh -oBatchMode=yes -T [email protected]

• If everything is fine, the process will exit with status code 1 and print "Hi {username}! You've successfully authenticated, but GitHub does not provide shell access."
• If github.com is not in known_hosts it will exit with 255 and print "Host key verification failed."
  Solution: ssh -T [email protected]
• if the key has a passphrase which is not stored in ssh-agent it will exit with 255 and print "[email protected]: Permission denied (publickey)."
  Solution: https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/#adding-your-ssh-key-to-the-ssh-agent

Caveats: this has a noticeable delay, and shouldn't be done on every startup.

• Only check the very first time backport is executed (would require state to be stored somewhere)
• Only check whenever a repo is setup (cloned). Doesn't require additional state, and happens very rarely.

Debugging workflow

List all keys

ssh-add -l

Remove all keys from ssh-agent:

ssh-add -D

Add key to ssh agent:

ssh-add -K ~/.ssh/id_rsa

Verify ssh-agent

ssh -oBatchMode=yes -T [email protected]

credential.helper

# disable
git config --unset credential.helper

# enable
git config credential.helper store