dropbearkey: save a public key file .pub

[stokito]

For a better interoperability with OpenSSH I want to have their interface working similarly.

When generating a key with ssh-keygen it saves the identity file e.g. id_rsa and its public key id_rsa.pub. To get a public key a user can just cat id_rsa.pub.

But the dropbearkey stores only the identity file.
When you need to get a public key you can execute dropbearkey -y and it will extract a public key from the private. It also prints a fingerprint of the key.
In many scripts and tutorials it is removed with dropbearkey -y -f ~/.ssh/id_ed25519 | grep "^ssh-"

The ssh-keygen -y behaves similarly but it doesn't print a fingerprint but only a raw pubkey. You can use a separate command ssh -l to print a fingerprint.
Also the ssh-keygen -C comment allows to specify an email for the key. The comment is saved in both private and public keys.
The dropbearkey generates a comment on the fly and a user can't specify the comment.

I wanted to check how to resolve the issues and the PR is a result of my attempt. I don't like the result but still I decided to share it. Maybe you also had an intention to work with the problem or someone needs this functionality.

The PR works as follows:
0. During a key generation a user can specify a comment with the -C.

1. After the generation print the public key and save it a .pub file. The .pub file is exactly same as for ssh-keygen e.g. it has a comment and without a fingerprint.
2. When making a dropbearkey -y check if the .pub file exists and if yes then print it. If it doesn't exists then work as before and extract a public key from the private key. This is breaking change because the .pub file doesn't have the fingerprint. In the same time its output is the same as for ssh-keygen -y.

To avoid conflicts we can add a condition if the program was dropbearkey then don't generate the .pub but if dropbear ssh-keygen then generate it.

Please feel free to close the PR. We can keep it for a history purposes if anyone is looking for the same functionality.

[stokito]

Now I think we can just leave saving of the .pub file but don't print it when -y.
Then a user won't see its comment but we will keep showing a fingerprint for a backward compatibility. This will icompatible with ssh-keygen and some scripts potentially may broke if they don't expect the fingerprint. But I guess openssh don't use the -y but use cat .pub instead.

A typical OpenWrt script generates a key and then use -y to store a public key. That means that it can override the generated .pub with comment. Not a big deal. Also newer scripts versions won't make a separate -y if the .pub exists.

One day the Dropbear may switch to openssh key format and we will store and print the comment in -y.
This will make the PR simpler.

Maybe we can also add the -l flag to print a fingerprint but not sure if anyone need it at all. The ECC keys are so small that it easier to fully show them instead of a fingerprint.

Please let me know what are you think.

[stokito]

I updated the PR. The old code I pushed to https://github.com/stokito/dropbear/tree/dbkey-print-pub

[mkj]

Thanks. Outputting .pub files is something I've wanted for a while but haven't got round to. I think it should be OK in terms of compatibility, just a couple of small comments.

[stokito]

I fixed your suggestions, added a comment, improved description of commits.
The code is not ideal and may be refactored but I'm not a C dev and that's hard to me.
I used dprintf function that was added to POSIX.1‐2001 and I don't know if it's fine to use it given that the DB may be used on older platforms.

[mkj]

Ah yes, I'll change it to use fprintf() instead. Dropbear could do with a CI test for other OSes I guess (there's the old C version test, but that's orthogonal to old posix)

[mkj]

Thanks!