PUBAPI-1146 Divorce wanted between *_KEY_ID env vars and keyId actually sent to server #3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arekinath
force-pushed
the
pubapi-1146
branch
6 times, most recently
from
88b75c8 to
a82af4b
Compare
…ly sent to server
arekinath
force-pushed
the
pubapi-1146
branch
from
08d4758 to
f15bd80
Compare
|
Merged as e6604c9 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change divorces the *_KEY_ID environment vars (and thus the input keyIds to
smartdc-authfunctions) from the keyId actually sent to the server, in order to handle compatibility with newer OpenSSH versions in a simple way.The *_KEY_ID variables will henceforth be used only to identify which key it is that the user wishes to use for authentication, and will support any known key fingerprint format. Then, the keyId actually sent to the server is generated based only on the key itself.
See also https://smartos.org/bugview/PUBAPI-1146
This change also prepares
smartdc-authto be used by not justsmartdcbut alsomantaandsdc-clientsby merging the changes in the 3 separate copy-pasted versions of this code back into this library. These changes include the Manta-originated signature and key cache, and some minor API compatibility changes fromsdc-clients.It also introduces a new commandline tool
sdc-curlwhich can be used to generate signedcurlrequests for testing and development purposes.The patch makes use of
sshpk's support for loading the public half of a private key file so that we no longer require the presence of a matching.pubfile next to a given key in$HOME/.ssh. And makes some error messages a little more actionable for users, hopefully.And finally, it re-enables the (now no longer broken) DSA key support, and paves the way for ECDSA support in future.