Let ssh-client use the SDK's forgekey, and let the checks accept a module's own .ssh (issues 1480, 1484), part 2 of 17

This commit is contained in:
2026-10-20 20:44:30 +00:00
parent 1e1def4d32
commit bf8f47ce66
9 changed files with 98 additions and 35 deletions
@@ -7,7 +7,7 @@ package main
// can lock the operator out); a folder holding a key is gone into rather than moved whole. A socket
// is ssh's own runtime and stays, and so do the files ssh and sshd read by themselves (SSHReads). A
// path changed in the last Settle is being written (a temporary file of atomicWrite or ssh-keygen) and
// waits for the next sweep. The process sweeps when it starts and every KeyRound (main.go); what the
// waits for the next sweep. The process sweeps when it starts and every KeyRound of go/forgekey (main.go); what the
// last sweep did, or why it failed, is kept beside the retired folder for ssh_client_check (issue 1020).
import (
@@ -21,19 +21,21 @@ import (
"strings"
"syscall"
"time"
"git.novox.be/novox/mesh-sdk/go/forgekey"
)
// Declared are the paths under ~/.ssh this module declares (module.json) or its own process makes
// (keykeeper.go). A test checks the manifest against this list.
var Declared = map[string]bool{
"config": true,
"known_hosts": true,
"config.d": true,
"config.d/00-mesh": true,
"config.d/10-forge": true,
KeyFile: true,
KeyFile + ".pub": true,
"authorized_keys": true,
"config": true,
"known_hosts": true,
"config.d": true,
"config.d/00-mesh": true,
"config.d/10-forge": true,
forgekey.KeyFile: true,
forgekey.KeyFile + ".pub": true,
"authorized_keys": true,
}
// SSHReads are the files ssh and sshd read in ~/.ssh by themselves, though this module writes none of
@@ -371,7 +373,7 @@ func publicKey(path string) bool {
return false
}
line, _, _ := strings.Cut(string(raw), "\n")
if _, err := ParseKeyLine(line); err == nil {
if _, err := forgekey.ParseKeyLine(line); err == nil {
return true
}
f := strings.Fields(line)