The standalone tarball's runshell now takes care of installing a ~/.ssh/git-annex-shell wrapper the first time it's run.

debian/changelog

@@ -31,6 +31,8 @@ git-annex (3.20121018) UNRELEASED; urgency=low
     pushed to about pushes.
   * rsync special remote: Include annex-rsync-options when running rsync
     to test a key's presence.
+  * The standalone tarball's runshell now takes care of installing a
+    ~/.ssh/git-annex-shell wrapper the first time it's run.
 
  -- Joey Hess <joeyh@debian.org>  Wed, 17 Oct 2012 14:24:10 -0400
 

standalone/linux/runshell

@@ -26,6 +26,19 @@ cd "$base"
 base="$(pwd)"
 cd "$orig"
 
+# Install shim that's used to run git-annex-shell from ssh authorized_keys.
+# The assistant also does this when run, but the user may not be using the
+# assistant.
+if [ ! -e "$HOME/.ssh/git-annex-shell" ]; then
+	mkdir "$HOME/.ssh" >/dev/null 2>&1 || true
+	(
+		echo "#!/bin/sh"
+		echo "set -e"
+		echo "exec $base/runshell git-annex-shell -c \"\$SSH_ORIGINAL_COMMAND\""
+	) > "$HOME/.ssh/git-annex-shell"
+	chmod +x "$HOME/.ssh/git-annex-shell"
+fi
+
 # Put our binaries first, to avoid issues with out of date or incompatable
 # system binaries.
 PATH=$base/bin:$PATH