Learning - Category - vkvk17's Blog https://vkvk17.pages.dev/en/categories/learning/ Learning - Category - vkvk17's Blog Hugo -- gohugo.ioenvkvk17@foxmail.com (vkvk17) vkvk17@foxmail.com (vkvk17)Sat, 01 Aug 2026 15:44:09 +0000 GitHub SSH Authentication and Commit Signing https://vkvk17.pages.dev/en/posts/github-ssh-authentication-and-commit-signing/ Sat, 01 Aug 2026 15:44:09 +0000 vkvk17 https://vkvk17.pages.dev/en/posts/github-ssh-authentication-and-commit-signing/ About SSH

SSH (Secure Shell) is an encrypted protocol for connecting to another computer. It normally uses port 22.

For GitHub, SSH can be used to authenticate access to repositories. The local machine keeps the private key, while GitHub stores the corresponding public key.

SSH authentication answers: “Can you connect to GitHub and push code?”

Commit signing answers: “Was this commit created by you, and has it been changed?”

These are separate features and do not replace each other.

When a repository uses an address such as git@github.com:owner/repository.git:

  • SSH keys authenticate the connection.
  • SSH avoids entering a password or Personal Access Token for every operation.
  • The communication channel is encrypted.
  • The private key stays on your computer and must remain secret.
  • GitHub stores your public key.
  • During connection setup, GitHub sends a challenge.
  • Your private key answers the challenge, and GitHub verifies it with the public key.

SSH authentication only applies when the connection is established. It does not sign or protect the commit itself.

Anyone can change git config user.name and git config user.email and create a commit that appears to use your name. If that person pushes with their own authorized SSH key, GitHub can authenticate the account that pushed the commit, but it cannot use the author name alone to prove who wrote it.

# Generate an Ed25519 key (recommended over RSA)
ssh-keygen -t ed25519 -C "your-github-email"

# Start the SSH agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Print the public key
cat ~/.ssh/id_ed25519.pub

Add the complete public key in GitHub Settings -> SSH and GPG keys -> New SSH key. Select Authentication Key as the key type.

Test the connection:

ssh -T git@github.com

A digital signature is attached to the commit or tag data. It can show that:

  • The commit was created by someone holding the signing private key.
  • The signed data has not been changed after signing.
  • GitHub can display the green Verified label when the signature is valid.

Git originally focused on GPG signatures. Git 2.34 and later also support SSH signatures, so an existing SSH key can be used without generating a separate GPG key.

If you want to use one SSH key for both GitHub access and commit signing, add it twice in GitHub: once as an Authentication Key and once as a Signing Key.

# Use SSH signatures instead of the default GPG format
git config --global gpg.format ssh

# Use the public key as the signing key
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# Sign every commit automatically
git config --global commit.gpgsign true

# Sign tags automatically
git config --global tag.gpgsign true

Open Settings -> SSH and GPG keys -> New SSH key.

Enter any title, select Signing Key as the key type, and paste the complete contents of id_ed25519.pub.

Do not select Authentication Key for this second entry. The same public key may appear twice, but the two entries have different purposes.

# Create an empty test commit
git commit --allow-empty -m "test ssh signed commit"

# Show the signature information
git log --show-signature -1

git push

After GitHub verifies the signature, the commit should show the Verified label.

]]> My openSUSE Tumbleweed and KDE Installation Notes https://vkvk17.pages.dev/en/posts/opensuse-tumbleweed-kde-installation-notes/ Sat, 28 Mar 2026 14:10:05 +0000 vkvk17 https://vkvk17.pages.dev/en/posts/opensuse-tumbleweed-kde-installation-notes/ Before Installation

There is not much to say here. I like using Ventoy to create a bootable USB drive, then copying the openSUSE Tumbleweed image onto it.

My Plasma configuration is very simple. It mainly consists of the following steps:

  1. Move the panel to the top and reduce its size to 40.
  2. Go to Settings > Appearance > Icons and choose an icon pack I like. The default icon pack looks a little ugly to me, so I use Papirus.
  3. Go to Settings > Workspace Behavior > Virtual Desktops and adjust the virtual desktop layout. I set the number of rows to 1, and the default 2 virtual desktops are enough.
  4. Go to Settings > Window Management > Task Switcher and change the task switching effect from Breeze to Compact. It is the simplest switcher effect. I also remove the Alt + ` shortcut.
  5. Go to Settings > Input Devices > Keyboard > Advanced, enable Configure keyboard options, then enable Make Caps Lock an additional Ctrl. Of course we want to completely turn Caps Lock into Ctrl.

After logging into the system, KDE Plasma users may see a KDE Wallet error the first time they connect to a wireless network because a key is missing.

To avoid entering an authentication password repeatedly, open KDE Wallet, choose to create a new wallet, select the traditional Blowfish encrypted file format, leave the password empty, and confirm. This gives you an empty KDE Wallet with no authentication password, so connecting to the network no longer requires identity verification.

First, install the Simplified Chinese language package. In YaST > Language > Secondary Language, select Simplified Chinese to install it.

Next, open Software Repositories and remove the local repository that comes with the installation, something like openSUSE-20240216-0.

Then switch the official repositories to the USTC openSUSE mirror. Because openSUSE uses MirrorBrain, the central server (download.opensuse.org) redirects download requests to nearby mirrors based on IP geolocation. However, repository metadata is still fetched from the central server when refreshing repositories, so changing mirrors usually speeds up repository refreshes more than actual package downloads.

Then add the Packman repository directly in the terminal:

bash

sudo zypper ar -cfp 90 https://mirrors.ustc.edu.cn/packman/suse/openSUSE_Tumbleweed/ USTC:PACKMAN

After that, refresh and update Tumbleweed:

bash

sudo zypper ref && sudo zypper dup
sudo reboot

Then install some multimedia codecs:

bash

sudo zypper dist-upgrade --from USTC:PACKMAN --allow-vendor-change
sudo zypper install --from USTC:PACKMAN ffmpeg gstreamer-plugins-{good,bad,ugly,libav} libavcodec-full vlc-codecs

I use v2raya for network proxying. First install the v2ray core and v2raya:

bash

sudo zypper in v2ray
opi v2raya

After starting the v2raya service, follow the quick start guide to use the proxy. Transparent proxying can provide proxy access for almost all programs.

bash

sudo systemctl enable --now v2raya.service

For more proxy usage methods, see Configuring proxies.

Installing fonts in KDE is easy: drag the fonts into Font Management, preferably into the Personal Fonts group. Then refresh the font cache with fc-cache -fv.

The more traditional method is to place fonts in the following directories, listed roughly by priority:

bash

Font directories:
        /usr/X11R6/lib/X11/fonts
        /opt/kde3/share/fonts
        ~/.local/share/fonts
        ~/.local/share/flatpak/exports/share/fonts
        /var/lib/flatpak/exports/share/fonts
        /usr/local/share/fonts
        /usr/share/fonts
        ~/.fonts
        /usr/share/fonts/100dpi
        /usr/share/fonts/75dpi
        /usr/share/fonts/Type1
        /usr/share/fonts/cyrillic
        /usr/share/fonts/encodings
        /usr/share/fonts/ghostscript
        /usr/share/fonts/misc
        /usr/share/fonts/texlive-lm
        /usr/share/fonts/truetype
        /usr/share/fonts/xscreensaver
        /usr/share/fonts/encodings/large

I recommend putting fonts in ~/.fonts or ~/.local/share/fonts, then refreshing them with fc-cache -fv.

My recommended font is Sarasa Term SC Nerd, because it handles table alignment well in Emacs and includes Nerd Fonts, which saves some trouble.

For input methods, I recommend installing Fcitx5:

bash

sudo zypper in fcitx5 fcitx5-chinese-addons
sudo zypper in fcitx5-configtool # install the configuration tool (optional)

When installing Fcitx5, the old Fcitx will be removed and replaced by default. Just follow the system prompts.

After installation, log in again. Then go to Settings > Regional Settings > Input Method and click Add Input Method to add Pinyin. If you are using KDE on X11, the required environment variables are already set automatically by the system.

You can also click Configure addons to adjust the input method UI and related settings.

Dictionaries can improve the input method experience. Here are two popular dictionaries:

Follow the README files in those repositories and place the downloaded or extracted .dict files into ~/.local/share/fcitx5/pinyin/dictionaries/. If the directory does not exist, create it manually, then restart fcitx5.

Here is a list of some software I install at the beginning. This is just a casual list; install what you need:

bash

Install with zypper:
git
emacs
opi
keepassxc
mpv
telegram-desktop
qbittorrent
filezilla
wireshark
flameshot # installation guide (https://zh.opensuse.org/Flameshot)
cheat
nodejs
syncthing

Install with opi:
megasync
google-chrome-stable
v2raya

The default TLP configuration is fine. You can use TLPUI for easier configuration.

bash

sudo zypper in tlp
sudo systemctl disable tlp && sudo systemctl stop tlp
sudo systemctl enable tlp

In TLPUI, I simply configure the charging thresholds, which can help extend laptop battery life a little:

bash

START_CHARGE_THRESH_BAT0=75
# start charging threshold
STOP_CHARGE_THRESH_BAT0=85
# stop charging threshold

Use the following command to check battery status:

bash

sudo tlp-stat -b

Use whichever terminal emulator feels comfortable. I used to spend a lot of time tweaking shells, but now I am too lazy to configure them, so the default bash is fine. Installing Oh My Bash can make it look nicer. At the moment, my favorite shell may actually be Eshell inside Emacs.

Also, if I use zsh, I personally dislike Oh My Zsh and would switch to a lighter configuration framework such as zim.

For terminal emulators, I have been using kitty. It has good color support and includes kitten plugins. Whenever I set up a new machine, I can use kitten directly to configure themes and other settings. It is also very fast.

My favorite terminal font is CaskaydiaMono Nerd Font.

Also, the newer terminal emulator Warp was already available on Linux when I wrote this article. I have always liked using this very modern terminal on macOS.

For terminal emulator configuration, changing the font is usually enough. One more thing: I really dislike transparent terminal backgrounds.

]]> How to Use Denote https://vkvk17.pages.dev/en/posts/how-to-use-denote/ Sat, 28 Mar 2026 14:10:00 +0000 vkvk17 https://vkvk17.pages.dev/en/posts/how-to-use-denote/ About

These are casual notes on how to use Denote. Most of the content is translated or adapted directly from the official documentation.

Denote documentation

Commands that prompt the user for input when creating notes include, but are not limited to:

  • denote
  • denote-signature
  • denote-type
  • denote-date
  • denote-subdirectory
  • denote-rename-file
  • denote-dired-rename-files

Users can start a new note from a template.

A template can be configured like this:

elisp

(setq denote-templates
      '((report . "* Some heading

* Another heading")
        (memo . "* Some heading

* Another heading)))

A better approach is to use concat to join strings together:

emacs-lisp

(setq denote-templates
      `((report . "* Some heading

* Another heading")
        (memo . ,(concat "* Some heading"
                         "

"
                         "* Another heading"
                         "

"))))

The idea of silos means that notes are stored in different places, and those directories are separated from one another. We call these directories silos.

To create a silo, first create a .dir-locals.el file inside the note directory. When creating it, Emacs will ask whether to store this path variable; choose yes.

Write the following into .dir-locals.el:

emacs-lisp

;;; Directory Local Variables.  For more information evaluate:
;;;
;;;     (info "(emacs) Directory Variables")

((nil . ((denote-directory . "/path/to/silo/")
         (denote-infer-keywords . nil))))

Here is my notes directory (01Index is my denote-directory):

bash

./01Index/
├── .DS_Store
├── 20240228T160157--mastering-eshell__emacs_linux_shell.assets
├── 20240228T160157--mastering-eshell__emacs_linux_shell.org
├── 20240315T225352--c语言程序设计现代方法__c.org
├── 20240317T201104--cpp-primer__cpp.org
├── 20240407T230222--西方哲学史__reading.org
└── ltximg
./02Area/
├── .dir-locals.el
├── 20240201T021341--emacs-manual-note__emacs.assets
├── 20240201T021341--emacs-manual-note__emacs.org
├── 20240302T153745--计算机网络原理__network.assets
├── 20240302T153745--计算机网络原理__network.org
├── 20240320T175109--操作系统__operatingsystem.assets
├── 20240320T175109--操作系统__operatingsystem.org
├── 20240328T141613--计算机系统结构__computerarchitecture.assets
└── 20240328T141613--计算机系统结构__computerarchitecture.org
./03Resource/
├── .dir-locals.el
├── 20240221T162109--kde-plasma-桌面-korganizer-等软件关闭后仍然占用约-800-m-内存__bug_kde.assets
├── 20240221T162109--kde-plasma-桌面-korganizer-等软件关闭后仍然占用约-800-m-内存__bug_kde.org
└── 20240222T000349--opensuse-tumbleweed-和-kde-的个人安装过程__kde_linux_opensuse.org
./04Project/
├── .dir-locals.el
└── 20240417T220159--denote-使用方法__emacs.org

After that, we still need a custom user command that selects the silo automatically. In normal use, denote will put notes into 01Index by default. When we switch to 02Area, Denote-related commands will automatically store notes in the current silo.

My user configuration is as follows:

emacs-lisp

(defvar my-denote-silo-directories
    `("/home/MEGA/02Area"
      "/home/MEGA/03Resource"
      "/home/MEGA/04Project"
      ;; You don't actually need to include the `denote-directory' here
      ;; if you use the regular commands in their global context.  I am
      ;; including it for completeness.
      ,denote-directory)
    "List of file paths pointing to my Denote silos.
  This is a list of strings.")

  (defvar my-denote-commands-for-silos
    '(denote
      denote-date
      denote-subdirectory
      denote-template
      denote-type)
    "List of Denote commands to call after selecting a silo.
  This is a list of symbols that specify the note-creating
  interactive functions that Denote provides.")

  (defun my-denote-pick-silo-then-command (silo command)
    "Select SILO and run Denote COMMAND in it.
  SILO is a file path from `my-denote-silo-directories', while
  COMMAND is one among `my-denote-commands-for-silos'."
    (interactive
     (list (completing-read "Select a silo: " my-denote-silo-directories nil t)
           (intern (completing-read
                    "Run command in silo: "
                    my-denote-commands-for-silos nil t))))
    (let ((denote-directory silo))
      (call-interactively command)))

The implementation of silos is not especially elegant. It is a relatively new feature, so for now we can only make do with it. I think the author should probably integrate this distributed-repository concept into the configuration around denote-directory.

After all, I cannot always put all notes in one folder, and always using denote-subdirectory is not a great solution either.

Notes are stored in denote-directory, which defaults to ~/Documents/notes.

By default, Denote follows this naming convention:

text

DATE==SIGNATURE--TITLE__KEYWORDS.EXTENSION

The DATE field represents the date in year-month-day format, followed by an uppercase T for the current time. DATE also serves as the unique identifier of each note file.

The SIGNATURE field contains an alphanumeric string. A signature has no predefined purpose; it is defined by the user. One possible use is to establish ordering relationships between files, such as 1, 1a, 1b, 1b1, 1b2, and so on.

The TITLE field is lowercase by default and uses hyphens.

The KEYWORDS field consists of one or more entries separated by underscores; when entering KEYWORDS, use commas as separators.

Examples:

text

20220610T043241--initial-thoughts-on-the-zettelkasten-method__notetaking.org
20220610T062201--define-custom-org-hyperlink-type__denote_emacs_package.md
20220610T162327--on-hierarchy-and-taxis__notetaking_philosophy.txt

denote-prompts can be configured in the following forms:

text

DATE.EXT
DATE--TITLE.EXT
DATE__KEYWORDS.EXT
DATE==SIGNATURE.EXT
DATE==SIGNATURE--TITLE.EXT
DATE==SIGNATURE--TITLE__KEYWORDS.EXT
DATE==SIGNATURE__KEYWORDS.EXT

denote provides several commands for creating links between notes.

All linked files must be Denote files; other files cannot be recognized.

The denote-link command selects a file in the minibuffer and inserts it into the current file as a link. The link format depends on whether the current file is Org or Markdown.

In Org files, links to headings are also supported through the denote-org-store-link-to-heading command. Other file formats are not supported.

When denote-link is called with a prefix argument (C-u by default), it sets the link to the [[denote:IDENTIFIER]] format regardless of file type.

By default, the link description is determined as follows:

The option denote-org-store-link-to-heading determines whether org-store-link links to the current heading in an Org file.

org-store stores the current link so it can later be inserted with org-insert-link, and the denote-org-store-link-to-heading option affects this command.

When this option is non-nil, org-store-link stores the link to the current heading instead of the Denote file itself.

If the heading does not have a CUSTOM_ID, Denote creates a PROPERTIES drawer and includes it in the heading. If a CUSTOM_ID already exists, org-store-link uses it as is.

As part of the denote-org-extras.el extension, denote-org-extras-link-to-heading provides links to headings inside Org files.

The link takes this form:

text

[[denote:IDENTIFIER::#ORG-HEADING-CUSTOM-ID]][Description::Heading text]]

The command denote-add-links adds multiple links that match a regular expression. These links are inserted as a list, for example:

text

- link1
- link2
- link3

Examples of usable regular expressions:

  • journal matches all notes whose title contains journal.
  • _journal matches all notes whose keyword is journal.
  • ^2022.*_journal matches all notes that start with 2022 and contain the keyword journal.
  • \.txt matches files with the txt extension.

In a note-taking workflow, you may be developing one topic and want to connect it to another. Denote provides several convenient commands:

  • denote-link-after-creating

    Create a new note in the background and link to it directly.

  • denote-link-after-creating-with-command

    This command is similar to the previous one, but it prompts for the command used to create the note.

  • denote-link-or-create

    Use denote-link on the target file, creating it if necessary.

denote-backlinks generates a custom buffer that shows backlinks to the current note. A backlink is a link that points back to the current entry.

By default, the backlinks buffer is designed to show the names of files that contain annotations linked to the current entry. Each file name is displayed on its own line.

text

Backlinks to "On being honest" (20220614T130812)
------------------------------------------------

20220614T145606--let-this-glance-become-a-stare__journal.txt
20220616T182958--feeling-butterflies-in-your-stomach__journal.txtx

The backlinks buffer uses Emacs’ built-in Xref infrastructure. On some operating systems, users may need to add certain executables to the relevant environment variables.

]]>