gitea's forge-account reads the forge's own host key file before scanning its sshd, so a forge restart no longer refuses every forge account (issue 1939) #472

2026-10-24T11:26:13Z

mesh-tools commented

2026-10-24 11:26:13 +00:00

Issue 1939: forge-account ran ssh-keyscan against the forge's sshd; while the forge restarts that fails for every node and module pair ('the forge's ssh host key cannot be read: ssh-keyscan: exit status 1'). Met twice, the second time at 13:23:15 today on novox right after gitea was redelivered.

forge-account now reads ${dir:data}/ssh/ssh_host_ed25519_key.pub (public key only) first, then scans the sshd, then keeps the key it read before; it errors only when none gives a key. Tests: a failing scan still gets the key from the file; a missing file falls back to the scan; a restarting forge keeps the earlier key. Hardening notes (logging the fallbacks, an unparseable file) are on issue 1939, note 3.

Reviewed-by: review-1939@shanks at 75156fce00
Pushed-by: lead-47@shanks

Issue 1939: forge-account ran ssh-keyscan against the forge's sshd; while the forge restarts that fails for every node and module pair ('the forge's ssh host key cannot be read: ssh-keyscan: exit status 1'). Met twice, the second time at 13:23:15 today on novox right after gitea was redelivered. forge-account now reads ${dir:data}/ssh/ssh_host_ed25519_key.pub (public key only) first, then scans the sshd, then keeps the key it read before; it errors only when none gives a key. Tests: a failing scan still gets the key from the file; a missing file falls back to the scan; a restarting forge keeps the earlier key. Hardening notes (logging the fallbacks, an unparseable file) are on issue 1939, note 3. Reviewed-by: review-1939@shanks at 75156fce007e15536f7f706b430cba5d367b2d39 Pushed-by: lead-47@shanks

mesh-tools added 1 commit 2026-10-24 11:26:13 +00:00

gitea: forge-account reads the forge's own host key file before scanning its sshd (issue 1939)

mesh/check pass 75156fce007e on 25176e1ccdb3 | unit 31 run, 4403 kept | integration 0 run, 4476 kept | over bound: unit | composition passed in 83ms o…

mesh/delivery ready: it delivers once merged

Details

75156fce00

mesh-tools commented

2026-10-24 11:26:24 +00:00

Delivery novox/mesh-catalog@75156fce007e — ready since 2026-10-24T11:28:44Z

Transitions

2026-10-24 11:26 (new) → proposed (announced): novox/mesh-catalog#472's head announced
2026-10-24 11:28 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-24 11:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@75156fce007e` — **ready** since 2026-10-24T11:28:44Z **Transitions** - 2026-10-24 11:26 (new) → proposed (announced): novox/mesh-catalog#472's head announced - 2026-10-24 11:28 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-24 11:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben referenced this issue from a commit

2026-10-24 11:42:00 +00:00

Move source.main for a merge the gate caught up after a gap, so the checker re-checks open heads on the trunk that is (issue 1726)

All checks were successful

mesh/delivery ready: it delivers once merged

Details

mesh/check pass 75156fce007e on 25176e1ccdb3 | unit 31 run, 4403 kept | integration 0 run, 4476 kept | over bound: unit | composition passed in 83ms o…

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/1939-forge-host-key:fix/1939-forge-host-key

git checkout fix/1939-forge-host-key

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#472