Automic Vault

Automic Vault 3.16.0 · macOS

GitHub CLI hardener

The changes, security properties, caveats, and verification path for the gh hardener.

GitHub CLI hardener

Run av harden gh to apply this hardener and av doctor gh to verify it.

How Automic Vault Hardens gh

We provide a patched version of gh. av harden gh installs it from our tap when Homebrew is available, or installs the same signed release directly at /usr/local/bin/gh. The patches are concerned with:

  1. Is codesigned such that gh (and only gh) can access its secure credentials.
  2. Ensures that authenticated gh usage goes via the Automic Vault Secret Gate system.

Credential Migration

Use av harden gh to install the Isotope and migrate existing gh credentials into Automic Vault. Direct installs are updated by running the same command when av doctor gh reports a new release.

Secret Gate

The menu bar app creates a gh Secret Gate as soon as the hardened CLI is installed. Configure its default and per-Launcher Access Levels there. Read Only automically authorizes known read-only commands and gh api GET requests. Local Write also authorizes repo clone, pr checkout, gist clone, and download commands, which can change local files but do not mutate GitHub. Write Access authorizes recognized remote writes, but Secret Disclosure through gh auth token or gh auth status --show-token still requires approval.

Details

  • The migration covers standard hosts.yml token entries and legacy macOS Keychain items named gh:<host>.
  • Existing Git configuration can still delegate GitHub credentials to gh auth git-credential; the hardened gh helper path requests the token through Automic Vault.
  • av harden gh-cli remains accepted as a compatibility alias.

Read this page as Markdown