By default, Xcode recommends that existing keys be installed into ~/.ssh/id_rsa. Alternatively, Xcode can also use existing keys from the local machine or manually entered keys. In this scenario, Xcode generates a 2048-bit RSA key pair with a secret passphrase and uses that combination whenever the bot checks out or clones a repository. To help, Xcode can generate unique keys while setting up a bot.

This allows bot credentials to be tracked independently. Whenever possible, it is best to generate a unique key pair for each bot and copy their public keys to the remote repository. Many hosting solutions allow a public key to be copied and pasted into an account settings field on their website in order to allow a new key to connect. For third-party repository hosting solutions, this is often the best and most secure way to connect.

RSA (a popular type of encryption) keys can also be used to connect to a remote repository hosted via SSH. If a username is embedded in the URL of a repository, it is always used, rather than prompting the bot for it. When a bot clones or checks out a project, it authenticates to the hosted repository using the “keyboard-interactive” method of authentication and responds to login prompts from the remote machine. Because credentials are not shared, any bots that use the same repository store their own sets of credentials. You provide credentials when you configure your bots, and these usernames and passwords are stored in a secure keychain on the server machine. You just enable SSH and ensure that the appropriate users are authenticated to connect. This is a good choice for any hosted repositories your organization maintains, as no significant setup is required on the hosting machine. Repositories accessed over SSH can be authenticated in the following ways: However, SSH isn’t always as readily available as HTTPS across network environments. It is a good, secure choice and is especially useful if your organization uses SSH keys for authentication. SSH encrypts credentials and transactions and is generally simpler than HTTPS because it is always secure and does not require SSL (Secure Sockets Layer) certificates. Generally, SSH is the preferred protocol for Git projects and HTTPS is recommended for Subversion projects. Xcode bots can access Git and Subversion projects over SSH (Secure Shell) or HTTPS (Hypertext Transfer Protocol Secure). For information on these systems, visit the following sites: Git and Subversion are free, open-source version management systems for code.

Source code repository tools local