Aldebaran has asked for the wisdom of the Perl Monks concerning the following question:

Hi monks,

I'm rolling in pretty banged up, because I made a change in my telephone situation, namely, I let service to the iphone that I was basing my life on lapse, as the number is now involved in litigation. It's a heck of a thing to read your own texts in deposition. I'm not going to be giving those particular lawyers anything more to read at that number.

To fill the service gap, I've purchased a generic burner android, and this is now going to be my traveling phone. It would be correct to say I have re-googleized. I'm so impressed with how quickly smart this $30 thing is with the help of chatgpt. I hope to retain the iphone at home: I never wanted to be Out There with such a fancy and pricy mini-computer.

Anyways, I've been surveying the wreckage, and the first poochscrew is with gitlab, where I had 2FA in effect. I thought I had low-level and redundant connections established on my backup truly-linux laptop, but I would find out that my ssh key had also expired. I had a bash script for accessing git that is called by a perl language wrapper that I think is a nifty little number that I came up with recently with tips from bliako and kcott. I always want return values, and I don't get them in a world dominated by python unless I make efforts to log them myself.

#!/usr/bin/perl use v5.030; # strictness implied use warnings; use Path::Tiny; use Time::Piece; use Log::Log4perl; use IPC::System::Simple qw/systemx capturex/; use utf8; my ($argv1) = @ARGV; if (not defined $argv1) { die "Need argv1\n"; } my $t = localtime; my $jd = $t->julian_day; my $log_conf4 = '/home/fritz/Documents/perlmonks/conf_files/4.conf'; Log::Log4perl::init($log_conf4); #info my $logger = Log::Log4perl->get_logger(); $logger->info("Time is $t"); $logger->info("Julian day is $jd"); $logger->info("$0"); my ($path) = @ARGV; if (not defined $path) { die "Need path in\n"; } my $file_in = path("$path"); my @lines = $file_in->lines_utf8; my @commands; # for my $line (@lines){ if ( $line =~ /^(?:#|$)/){ say "line matched $line"; next; } else { push( @commands, $line ); } } say @commands; say "cardinality: ", scalar @commands; my $target_dir = path('/tmp'); my $tempfile = $target_dir->tempfile('foobarXXXXXX'); $tempfile->spew("@commands"); # not atomic my $capture = capturex "bash", $tempfile; $logger->info("capx: $capture"); __END__

Output:

fritz@laptop:~/Documents/gitlab1$ ./1.wrap.pl 3.git.sh Time is Sun Aug 18 01:08:20 2024 Julian day is 2460540.7974537 ./1.wrap.pl line matched #!/bin/bash line matched #echo "starting fresh with rm -rf .git" line matched #rm -rf .git | tee 1.txt line matched #git init line matched #ls >README.md line matched #git remote add origin git@gitlab.com:perlmonks/$1.git line matched #git push -uf master main | tee 2.txt line matched

So it matches on the shebang, comments, and empty lines. In the commented code I see earlier commands that don't need executing when things are going right. Then, what doesn't match is herded into an array and made executable by means of Path::Tiny, which I've always liked.

pwd >2.txt git add *.pl git add *.sh git add *.txt git commit -m 'next revision' | tee 2.txt git push -uf origin master | tee 2.txt cardinality: 6 remote: remote: ============================================================== +========== remote: remote: ERROR: Your SSH key has expired. remote: remote: ============================================================== +========== remote: fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. capx: On branch master ...

So now I've got a chicken and egg problem of a variety that I haven't had before, and I don't know what to do. I realized I have the same problem with github, and I just created a new identity for that, as I don't have any code there. With gitlab, I think I've given them my credit card, which I think of as a back door of sorts in most cases, but maybe my status as a well-connected Yankee might not suffice. As they have that plastic, that's another reason not to abandon the account.

I realize that git-stuff is not perl, but I will claim that it is topic-adjacent for most us, and I, for one can brush up on it. I wouldn't say I had git syntax down completely either, but not for lack of trying. It's more like I need it when I need it, and then I completely forget about it otherwise. If I didn't have it stacked up in scripts, I wouldn't get any of it right. I'll label the question OT though:

[OT] What means might I use to authenticate with gitlab, given a 2FA poochscrew and expired keys?

[Also OT] What's a better way to deal with 2FA than SMS?

[This on-topic] Is there a perl way to deal with 2FA?

The heat is finally letting up here in Idaho. I got to play pickleball, so it was a good day. Thanks for your comments.

Replies are listed 'Best First'.
Re: 2FA workarounds
by hippo (Archbishop) on Aug 25, 2024 at 11:15 UTC
    What's a better way to deal with 2FA than SMS?

    Pretty much anything. SMS is widely regarded as just about the worst option for 2FA (other than nothing at all). TOTP is fine for me and is what I use for gitlab.com.

    Is there a perl way to deal with 2FA?

    I use Authen::OATH and have been doing so since 2017. It has proven reliable over that time.


    🦛

Re: 2FA workarounds
by NERDVANA (Priest) on Aug 26, 2024 at 21:57 UTC
    Reading your post gave me flashbacks to Weird Al's Albuquerque. Then I had to go listen to it. That was fun :-)

    If you're asking how to get back into your GitHub account, GitHub gives you a list of one-time passwords when you enable 2FA, specifically for the purpose of recovering your account after losing the 2FA device. Maybe this jogs a memory? Maybe you wrote them down somewhere, in an encrypted file or on a piece of paper in a desk drawer? Aside from that, you might be able to contact support and use your email to get back in, especially if you're a paying customer. (or become a paying customer)

    If you're asking for best practices going forward, I'd suggest writing down those OTP codes in both an encrypted password safe, like KeePass, and also on paper in the back of a desk drawer. The choice of OTP mechanism is personal preference, but there are Fido-based hardware keys like the YubiKey (what I use) and the Google Authenticator app for phones or tablets.

    I'm not sure why your SSH key expired - I've been using mine since forever. I guess I should probably rotate it from time to time, but its 4096 bit so probably fine. The SSH key won't get you into the GitHub user interface though.