···

       
39
       
39
       
 
       
go build -o repoguard ./cmd/repoguard

     

       
40
       
40
       
 
       
```

     

       
41
       
41
       
 
       


     

       
42
       
42
       
-
       
Next, move the `keyfetch` binary to a location owned by `root` -- `/keyfetch` is

     

       
43
       
43
       
-
       
a good choice:

     

       
42
       
42
       
+
       
Next, move the `keyfetch` binary to a location owned by `root` --

     

       
43
       
43
       
+
       
`/usr/local/libexec/tangled-keyfetch` is a good choice:

     

       
44
       
44
       
 
       


     

       
45
       
45
       
 
       
```

     

       
46
       
46
       
-
       
sudo mv keyfetch /keyfetch

     

       
47
       
47
       
-
       
sudo chown root:root /keyfetch

     

       
48
       
48
       
-
       
sudo chmod 755 /keyfetch

     

       
46
       
46
       
+
       
sudo mv keyfetch /usr/local/libexec/tangled-keyfetch

     

       
47
       
47
       
+
       
sudo chown root:root /usr/local/libexec/tangled-keyfetch

     

       
48
       
48
       
+
       
sudo chmod 755 /usr/local/libexec/tangled-keyfetch

     

       
49
       
49
       
 
       
```

     

       
50
       
50
       
 
       


     

       
51
       
51
       
 
       
This is necessary because SSH `AuthorizedKeysCommand` requires [really specific

     
···

       
54
       
54
       
 
       
```

     

       
55
       
55
       
 
       
sudo tee /etc/ssh/sshd_config.d/authorized_keys_command.conf <<EOF

     

       
56
       
56
       
 
       
Match User git

     

       
57
       
57
       
-
       
  AuthorizedKeysCommand /keyfetch

     

       
57
       
57
       
+
       
  AuthorizedKeysCommand /usr/local/libexec/tangled-keyfetch

     

       
58
       
58
       
 
       
  AuthorizedKeysCommandUser nobody

     

       
59
       
59
       
 
       
EOF

     

       
60
       
60
       
 
       
```