v1.0.0 — Day 1 General Availability

The Zero-Trust
Identity Guard for Git.

Stop leaking credentials and committing to the wrong profiles. GitSetu cryptographically sandboxes your work, personal, and client identities with zero background processes.

curl -sL https://gitsetu.bhaskarjha.dev/install | bash

Read Docs

Zero Trust

FIDO2 Ready

Bash 3.2 Core

gitsetu — bash

Click terminal to take control

Visualizing Zero-Trust

How GitSetu cryptographically separates your identities without relying on fragile global state.

GitSetu

~/work/acme

Key: ed25519-sk (YubiKey)

Email: eng@acme.corp

~/projects/oss

Key: id_rsa_github

Email: me@bhaskarjha.dev

The end of alias scripts.

Stop managing horrific SSH aliases and manual `git config` overrides. GitSetu handles it natively at the OS level.

 The Old Way ~/.ssh/config 
 # I hope I remember to use git@github-work.com...
Host github-work.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_rsa_work
  IdentitiesOnly yes

Host github-personal.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_rsa_personal

# ...and 15 other random aliases 
 
Error-prone, leaks identities globally.

 The GitSetu Way ~/.gitconfig & ~/.ssh/config 
 # ~/.gitconfig — longest-match conditional include
[includeIf "gitdir:~/work/"]
  path = ~/.config/gitsetu/profiles/work.gitconfig

# ~/.ssh/config — OpenSSH isolation (ADR 0002)
Include ~/.config/gitsetu/profiles/ssh_config 
 
Zero-Trust, Longest-Match, Automatic.

Engineered for the local machine.

Built entirely on native Git directives and Bash 3.2. No background processes, no node_modules, no latency.

Zero-Trust Sandboxing

GitSetu leverages native Git includeIf directives and OpenSSH Include isolation. Corporate keys and personal credentials never cross boundaries, with zero background daemons.

Workspace Provisioning

Instant mkdir -p provisioning on profile creation, plus clean unmounting and pruning on profile deletion.

Longest-Match Routing

Deterministic routing with full case-insensitivity on Windows (msys/cygwin) and macOS (darwin).

Pre-Commit Guard

A fail-closed hook that physically blocks commits if your active Git author email does not match the scoped workspace directory profile.

Credential Broker

Namespaced PATs stored in macOS Keychain, Linux secret-tool, and Windows Credential Manager.

FIDO2 & SSH Signing

Native YubiKey (ed25519-sk) support and automated SSH-based cryptographic commit signing.

25 Test Suites (100% Green)

198 automated assertions covering POSIX locking, signal traps, and multi-profile rehydration, backed by a 12-phase live Windows Sandbox harness.

Encrypted Profile Vaults

Export your entire identity architecture. GitSetu uses AES-256 OpenSSL encryption to securely backup, migrate, and restore profiles across workstations.

How GitSetu compares.

Verified v1.0.0 GA specification against competing ecosystem tools.

Feature	GitSetu	gitego	karn	gh CLI	GCM
Zero runtime dependencies	✅	❌	❌	❌	❌
Pre-commit identity guard	✅	⚡	❌	❌	❌
Native includeIf sandboxing	✅	✅	❌	❌	❌
Auto-provisioned workspaces (mkdir -p)	✅	❌	❌	❌	❌
Longest-prefix match routing	✅	❌	❌	❌	❌
Automated SSH key generation	✅	❌	❌	❌	❌
Zero-Trust SSH Isolation (ADR 0002)	✅	❌	❌	❌	❌
Per-profile Credential Broker	✅	❌	❌	⚡	✅
GPG & SSH commit signing	✅	❌	⚡	❌	❌
FIDO2 / YubiKey Support	✅	❌	❌	❌	❌
25 Automated Regression Suites	✅	❌	❌	❌	❌
Runtime	Bash 3.2	Go	Go	Go	.NET

✅ Full support ⚡ Partial (e.g. GPG but no SSH) ❌ None

In Sanskrit, Setu (सेतु) means bridge —
connecting two shores without disturbing either.

Good security should not require developer discipline.
The question of "Who committed this?" is no longer personal;
it is architectural.

A tool that demands your attention has failed.
GitSetu succeeds when you forget it exists.

Vision 2026

The Universal Identity Fabric.

With v1.0.0 GA established as the enterprise baseline across 25 regression test suites, GitSetu expands from local workstation security to universal developer, CI/CD, and agentic identity orchestration.

Distribution & Trust

Official package channels for Homebrew, APT, and AUR, plus an initialization wrapper for native Windows PowerShell environments.

Phase 1

Parity & Ecosystem UX

Interactive fuzzy profile switching (fzf), native VS Code status-bar identity display, and per-profile classical PGP auto-wiring.

Phase 2

The Enterprise Moat

Scheduled 90-day automated key rotations, headless ephemeral CI/CD identity runners, and pre-push secret diff scanning.

Phase 3

Deploy with Confidence.

The enterprise identity fabric that physically prevents leakage.

Get Started Now View on GitHub

The Zero-Trust Identity Guard for Git.