v1.0.0 — Day 1 General Availability

The Zero-Trust
Identity Guard for Git.

Stop leaking credentials and committing to the wrong profiles. GitSetu cryptographically sandboxes your work, personal, and client identities with zero background processes.

Read Docs GitHub v1.0.0 Architecture & Security

curl -sL https://gitsetu.bhaskarjha.dev/install | bash

Zero Trust

FIDO2 Ready

Bash 3.2 Core

gitsetu — bash

Click terminal to take control

Visualizing Zero-Trust

How GitSetu cryptographically separates your identities without relying on fragile global state.

GitSetu

~/work/acme

Key: ed25519-sk (YubiKey)

Email: eng@acme.corp

~/projects/oss

Key: id_rsa_github

Email: me@bhaskarjha.dev

The end of alias scripts.

Stop managing horrific SSH aliases and manual `git config` overrides. GitSetu handles it natively at the OS level.

 The Old Way ~/.ssh/config 
 # I hope I remember to use git@github-work.com...
Host github-work.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_rsa_work
  IdentitiesOnly yes

Host github-personal.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_rsa_personal

# ...and 15 other random aliases 
 
Error-prone, leaks identities globally.

 The GitSetu Way ~/.gitconfig & ~/.ssh/config 
 # ~/.gitconfig — longest-match conditional include
[includeIf "gitdir:~/work/"]
  path = ~/.config/gitsetu/profiles/work.gitconfig

# ~/.ssh/config — OpenSSH isolation (ADR 0002)
Include ~/.config/gitsetu/profiles/ssh_config 
 
Zero-Trust, Longest-Match, Automatic.

Engineered for the local machine.

Built entirely on native Git directives and Bash 3.2. No background processes, no node_modules, no latency.

Zero-Trust Sandboxing

GitSetu leverages native Git includeIf directives and OpenSSH Include isolation. Corporate keys and personal credentials never cross boundaries, with zero background daemons.

Auto-Provision & Discovery

Sub-second setup --auto discovery, instant mkdir -p workspace provisioning, and clean orphaned config unmounting.

Longest-Match Routing

Deterministic routing with full case-insensitivity on Windows (msys/cygwin) and macOS (darwin).

Pre-Commit Guard

A fail-closed hook that physically blocks commits if your active Git author email does not match the scoped workspace directory profile.

Credential Broker

Namespaced PATs stored in macOS Keychain, Linux secret-tool, and Windows Credential Manager.

FIDO2 & SSH Signing

Native YubiKey (ed25519-sk) support and automated SSH-based cryptographic commit signing.

32 Test Suites (100% Green)

240+ automated assertions covering POSIX locking, signal traps, WinGet manifests, standalone bundling, and multi-profile rehydration, backed by a 24-phase (70/70 checks) Windows Sandbox harness.

Encrypted Profile Vaults

Export your entire identity architecture. GitSetu uses AES-256 OpenSSL encryption to securely backup, migrate, and restore profiles across workstations.

How GitSetu compares.

Verified v1.0.0 GA specification against competing ecosystem tools.

Feature	GitSetu	gitego	karn	gh CLI	GCM
Zero runtime dependencies	✅	❌	❌	❌	❌
Zero-prompt auto-discovery (--auto)	✅	❌	❌	❌	❌
Pre-commit identity guard	✅	⚡	❌	❌	❌
Native includeIf sandboxing	✅	✅	❌	❌	❌
Auto-provisioned workspaces (mkdir -p)	✅	❌	❌	❌	❌
Longest-prefix match routing	✅	❌	❌	❌	❌
Automated SSH key generation	✅	❌	❌	❌	❌
Zero-Trust SSH Isolation (ADR 0002)	✅	❌	❌	❌	❌
Per-profile Credential Broker	✅	❌	❌	⚡	✅
GPG & SSH commit signing	✅	❌	⚡	❌	❌
FIDO2 / YubiKey Support	✅	❌	❌	❌	❌
9 Distribution Channels (npx, brew, winget, etc.)	✅	❌	❌	⚡	⚡
Standalone monolith bundle (no git clone)	✅	❌	❌	❌	❌
32 Automated Test Suites (POSIX + Sandbox)	✅	❌	❌	❌	❌
Runtime	Bash 3.2	Go	Go	Go	.NET

✅ Full support ⚡ Partial (e.g. GPG but no SSH) ❌ None

In Sanskrit, Setu (सेतु) means bridge —
connecting two shores without disturbing either.

Good security should not require developer discipline.
The question of "Who committed this?" is no longer personal;
it is architectural.

A tool that demands your attention has failed.
GitSetu succeeds when you forget it exists.

Vision 2026

The Universal Identity Fabric.

With v1.0.0 GA established as the enterprise baseline across 32 regression test suites, GitSetu expands from local workstation security to universal developer, CI/CD, and agentic identity orchestration.

Universal Distribution

Single-file standalone bundle (no git clone), WinGet, Homebrew, Scoop, AUR, Nix Flakes, npx zero-install, GitHub CLI extension (gh gitsetu), and sub-second auto-discovery (gitsetu setup --auto).

Shipped in v1.0.0

Parity & Ecosystem UX

Interactive Web Config Visualizer on gitsetu.bhaskarjha.dev, fuzzy profile switching (fzf), native VS Code status-bar guard, and structured JSON API.

Phase 2

The Enterprise Moat

Scheduled 90-day automated key rotations, headless ephemeral CI/CD identity runners, pre-push secret scanning, and append-only compliance logs.

Phase 3

Deploy with Confidence.

The enterprise identity fabric that physically prevents leakage.

Get Started Now View on GitHub

The Zero-Trust Identity Guard for Git.