Backwards-compatible support for @cert-authority #9

evanelias · 2024-07-08T18:50:09Z

This pull request adds support for @cert-authority lines in known_hosts files in an optional, backwards-compatible manner. Fixes #7.

With this PR's changes, users can switch from knownhosts.New() to the newly-introduced knownhosts.NewDB() in order to opt-in to the @cert-authority support. This returns a new HostKeyDB struct instead of a HostKeyCallback. It has a very slight performance penalty as it requires re-reading the known_hosts file, and it has a different return type of its HostKeys() method, but otherwise it should be a drop-in replacement for users who require CA support. This makes sense for use-cases such as general-purpose SSH clients.

~~Git-specific SSH use-cases can likely stay on knownhosts.New(), since public Git forges (GitHub, Gitlab, etc) don't seem to use CAs for host keys anyway.~~ [Edit: not necessarily true, see discussion in comments below.]

All previous HostKeyCallback logic remains backwards-compatible and avoids any functionality changes. [Edit to clarify: When using knownhosts.New or knownhosts.HostKeyCallback directly, there is no CA support. To get the CA support, your calling code must switch to using knownhosts.NewDB instead.]

Implementation

This includes @Javier-varez's commit from #8 as-is, and then adds an additional commit on top to adjust the following:

Move the CA support to new HostKeyDB struct, making it opt-in. This avoids changing the function signature of the HostKeyCallback.HostKeys() method, in order to retain backwards compatibility and avoiding a v2 version bump for the module.
When re-reading the known_hosts files to implement the CA support, it only re-reads each file a single time, at constructor time instead of in the callback. It reads using buffered IO similar to x/crypto/ssh/knownhosts which should ensure its line-counting behavior matches.
Add test coverage for all new behaviors and @cert-authority logic.

Alternatives considered

Conceptually the information on @cert-authority lines needs to be tracked somewhere, but the difficulty with the previous design is that New() returns a HostKeyCallback which is just a function, rather than a struct. So the chosen solution here leaves that type as-is, and instead introduces a separate new struct which supports adding more fields.

Instead of introducing a separate new struct, an alternative approach would have been to use a non-exported package global of the form map[*HostKeyCallback]CertInfo, in order to track additional information on each HostKeyCallback. This would result in simpler user-facing logic, however it would then require a separate function to "de-register" a callback to avoid a memory leak. Overall that seems hackier, and less extensible if additional metadata fields are needed in the future.

Testing and feedback

The PR includes unit test coverage, but it could use some further real-world testing to ensure it properly solves #7. I will keep this PR open a few days, and hugely appreciate any community feedback.

cc @lonnywong @abakum @Javier-varez

The previous commit d314bf3 added support for @cert-authority lines, but technically broke backwards compatibility due to changing the return type of one exported method. This commit adjusts that previous commit's new logic to restore backwards compatibility, and makes additional changes as follows: * Introduce new exported type HostKeyDB, which handles @cert-authority lines correctly and is returned by NewDB; old exported type HostKeyCallback (which is returned by New) omits that handling. Git-specific use-cases can likely remain with using New, since Git forges typically don't support CAs. Non-Git use-cases, such as general-purpose SSH clients, should consider switching to NewDB to get the CA logic. * When NewDB re-reads the known_hosts files to implement the CA support, it only re-reads each file a single time (vs potentially multiple times at callback execution time in d314bf3), and it reads using buffered IO similar to x/crypto/ssh/knownhosts. * This package's PublicKey struct now exports its Cert boolean field, vs keeping it private in d314bf3. * Refactor the RSA-to-algo expansion logic to simplify its handling in the CA situation. * Add test coverage for all new behaviors and @cert-authority logic.

coveralls-official · 2024-07-08T18:51:54Z

coverage: 92.857% (+0.3%) from 92.593%
when pulling 53a26cc on certs-backwards-compat
into 5832aa8 on main.

Javier-varez · 2024-07-08T21:50:47Z

Hi @evanelias,

Thank you so much for taking the initiative to improve my original proposal. I do think this is a better choice going forward considering the number of users that depend on this repository. Making the functionality opt-in seems sensible to me.

Curiously enough, I do need this functionality for a git ssh backend that uses certificate authorities. We have an internal tool that was recently migrated from plain git subcommand calls to https://github.com/go-git/go-git, and that's when we first encountered this issue. If we go this route, I will then propose the go-git maintainers to either support this functionality or provide some sort of toggle so that it can be enabled in third party tools. Unfortunately for us this problem was hidden a couple of dependencies down the tree.

I will test this during the next couple of days and give you some feedback if it all seems to work as intended, but on first sight, it looks good to me.

Instead of introducing a separate new struct, an alternative approach would have been to use a non-exported package global of the form map[*HostKeyCallback]CertInfo, in order to track additional information on each HostKeyCallback. This would result in simpler user-facing logic, however it would then require a separate function to "de-register" a callback to avoid a memory leak. Overall that seems hackier, and less extensible if additional metadata fields are needed in the future.

I agree with you. I tend to really dislike globals for many reasons, like concurrency issues (to avoid concurrent mutations you'd probably introduce an undesired lock) and just the plain fact that over the runtime of a program, the host key callbacks can also change, so keeping them around doesn't sound like the best idea. I like this alternative best.

abakum · 2024-07-09T10:32:22Z

It is correct that the returned result from func (hkdb *knownhosts.HostKeyDB) HostKeyCallback() is ssh.HostKeyCallback
but from func knownhosts.New(files ...string) is knownhosts.HostKeyCallback ?

evanelias · 2024-07-09T17:09:46Z

@Javier-varez

Curiously enough, I do need this functionality for a git ssh backend that uses certificate authorities.

Oh interesting, I didn't realize anyone used CAs for Git use-cases. I'll revise the package and method doc comments later today to remove the stuff about Git use-cases being fine to remain on the old New constructor.

I will then propose the go-git maintainers to either support this functionality or provide some sort of toggle so that it can be enabled in third party tools

Sounds good. Probably the best path would be to just have go-git switch to using NewDB always. Making it an optional toggle in go-git could be messy, since NewDB and New return different types.

Just to be safe, I'll add a method to make this easier, allowing conversion from knownhosts.HostKeyCallback to a non-CA-supporting knownhosts.HostKeyDB for this situation. But hopefully callers won't actually need it.

I will test this during the next couple of days and give you some feedback if it all seems to work as intended

Thank you, that sounds great.

evanelias · 2024-07-09T17:13:07Z

It is correct that the returned result from func (hkdb *knownhosts.HostKeyDB) HostKeyCallback() is ssh.HostKeyCallback
but from func knownhosts.New(files ...string) is knownhosts.HostKeyCallback ?

@abakum yes, that is correct and intentional. After switching to knownhosts.NewDB / knownhosts.HostKeyDB, you should no longer need to use knownhosts.New or knownhosts.HostKeyCallback at all for anything. I can try to improve the method doc string comments further if that isn't clear currently?

* Add new exported method HostKeyCallback.ToDB, to provide a mechanism for callers who want to conditionally enable or disable CA support, while still using a *HostKeyDB for both cases. * Clarify many doc string comments. * Add new exported function WriteKnownHostCA for writing a @cert-authority line to a known_hosts file. Previously this logic was in a test helper, but it could be useful to others, so let's export it outside of the tests.

abakum · 2024-07-09T20:37:26Z

Thanks, evanelias, it works for me!

abakum · 2024-07-10T08:45:04Z

@evanelias, if line in known_hosts like

@cert-authority * SHA256:HGzeMguvVfTsMb+WfkqmjZNXaeVcBXCQqXyjKUBy9pA

then kh.HostKeyAlgorithms("127.0.0.1:22") return [ecdsa-sha2-nistp256-cert-v01@openssh.com]
but kh.HostKeyAlgorithms("127.0.0.1:2222") return []
and ssh from OpenSSH works well.
How to handle it?

evanelias · 2024-07-10T17:21:10Z

@abakum Interesting catch, thanks. But the core host-matching logic is still handled by x/crypto/ssh/knownhosts, we don't re-implement or change that here.

The match logic in x/crypto/ssh/knownhosts appears to only apply wildcards like * to the hostname portion, not the port, per https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.24.0:ssh/knownhosts/knownhosts.go;l=110

return wildcardMatch([]byte(p.addr.host), []byte(a.host)) && p.addr.port == a.port

So in order to match 127.0.0.1:2222 the known_hosts entry would need to specifically be[*]:2222.

I just searched the issue tracker for https://github.com/golang/go and found golang/go#52056 which seems to describe the root of the problem. I've commented there now too.

abakum · 2024-07-10T18:40:06Z

golang/go#67295 (comment)

evanelias · 2024-07-10T19:45:51Z

On second thought, it might be possible to build a work-around here in skeema/knownhosts for that problem with wildcards and non-standard ports. The callback logic I'm envisioning will need to be nested and tricky, so I'm not 100% certain this is feasible, but I can give this a try sometime in the next few days.

Javier-varez · 2024-07-11T08:10:17Z

@evanelias

Just to be safe, I'll add a method to make this easier, allowing conversion from knownhosts.HostKeyCallback to a non-CA-supporting knownhosts.HostKeyDB for this situation. But hopefully callers won't actually need it.

This is a good point, thank you. I drafted here how it would look like to use the knownhosts DB. Javier-varez/go-git@0879ef1

I will test this during the next couple of days and give you some feedback if it all seems to work as intended

Thank you, that sounds great.

On this front, I tested the change, and it works great for my usecase. Thank you!

abakum · 2024-07-11T13:53:22Z

I'm trying to re-check https://github.com/abakum/knownhosts/blob/0280d4dc9533ee3f92de6b57a5efb45087cbf3e0/cmd/main.go

First run with empty known_hosts

PS Y:\src\knownhosts\cmd> go run .
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:22 to known_hosts
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:222 to known_hosts

known_hosts now

10.161.115.189 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=
[10.161.115.189]:222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

Edit known_hosts to:

* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

run ssh -v user_@10.161.115.189

...
debug1: Host '10.161.115.189' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\user/.ssh/known_hosts:1
...

run ssh -v user_@10.161.115.189 -p 222

...
debug1: Host '[10.161.115.189]:222' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\user/.ssh/known_hosts:1...

Second run with * in known_hosts

PS Y:\src\knownhosts\cmd> go run .
main.go:95: [ecdsa-sha2-nistp256]
main.go:145: [ecdsa-sha2-nistp256]
main.go:117: innerCallback(hostname, remote, key) <nil>
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) false
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:222 to known_hosts

evanelias · 2024-07-11T16:03:32Z

@Javier-varez awesome, thank you! re: proposed go-git changes, makes sense and looks good. Might need to leave the old NewKnownHostsCallback in place too though as deprecated, since it's exported and could be used by third-party code, unless their versioning policy isn't strict about this. Inside go-git itself that function is also called from a unit test -- see plumbing/transport/ssh/auth_method_test.go

@abakum can you please summarize the finding? Is it just confirming that * wildcards are not working with non-standard ports, or something else? Thanks!

abakum · 2024-07-11T16:13:40Z

Yes golang not working but OpenSSH working

evanelias · 2024-07-12T21:01:36Z

Thank you both again for the testing assistance! I'm going to merge this momentarily.

Early next week, I'll do a separate branch / pull request with a fix for the wildcards on non-standard port issue. And then once that one looks good and gets merged too, I'll tag a new release.

abakum · 2024-07-13T08:51:41Z

I'm trying to re-check https://github.com/abakum/knownhosts/blob/0280d4dc9533ee3f92de6b57a5efb45087cbf3e0/cmd/main.go

First run with empty known_hosts

PS Y:\src\knownhosts\cmd> go run .
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:22 to known_hosts
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:222 to known_hosts

known_hosts now

10.161.115.189 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=
[10.161.115.189]:222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

Edit known_hosts to:

* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

run ssh -v user_@10.161.115.189

...
debug1: Host '10.161.115.189' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\user/.ssh/known_hosts:1
...

run ssh -v user_@10.161.115.189 -p 222

...
debug1: Host '[10.161.115.189]:222' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\user/.ssh/known_hosts:1...

Second run with * in known_hosts

PS Y:\src\knownhosts\cmd> go run .
main.go:95: [ecdsa-sha2-nistp256]
main.go:145: [ecdsa-sha2-nistp256]
main.go:117: innerCallback(hostname, remote, key) <nil>
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) false
main.go:95: []
main.go:98: Failed to dial:  ssh: handshake failed: knownhosts: key is unknown
main.go:145: []
main.go:117: innerCallback(hostname, remote, key) knownhosts: key is unknown
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) true
main.go:129: Added host 10.161.115.189:222 to known_hosts

known_hosts now

* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=
[10.161.115.189]:222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

Edit known_hosts to:

* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBARrpBl177hs/ykMnXHfkjmyKTbsax/vtSl+rInZvJoF8LfJaWCZSrai0uD5qRuYhy4QnJs563NBTmCgSBhm/MA=

After fix from https://github.com/skeema/knownhosts/tree/fix-wildcards-port-match run with * in known_hosts works well:

PS Y:\src\knownhosts\cmd> go run .
main.go:95: [ecdsa-sha2-nistp256]
main.go:145: [ecdsa-sha2-nistp256]
main.go:117: innerCallback(hostname, remote, key) <nil>
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) false
main.go:95: [ecdsa-sha2-nistp256]
main.go:145: [ecdsa-sha2-nistp256]
main.go:117: innerCallback(hostname, remote, key) <nil>
main.go:118: knownhosts.IsHostKeyChanged(err) false
main.go:119: knownhosts.IsHostUnknown(err) false

Thanks, @evanelias !

*** This is a work-in-progress commit, which will be amended/rewritten ***

evanelias · 2024-07-15T20:37:08Z

Just opened #10 for the wildcard host matching fix, along with some additional documentation/README tweaks.

evanelias · 2024-07-16T21:31:48Z

I've just tagged v1.3.0 which includes this PR, as well as the wildcard matching fix in #10. Thanks again @Javier-varez and @abakum for all your assistance here!

skeema/knownhosts v1.3.0 introduced a HostKeyDB type that extends the HostKeyCallback functionality to support @cert-authority algorithms. `known_hosts` files may contain lines with @cert-authority markers to indicate that a line corresponds to a certificate instead of a key. If a git remote uses cert authorities as the preferred host identification mechanism, the functionality added in skeema/knownhosts v1.3.0 is needed so that go-git can interact with this remote. See skeema/knownhosts#9 for details.

| Package | Package file | Manager | Update | Change | |---|---|---|---|---| | [skeema](https://github.com/skeema/skeema) | misk/bin/hermit | hermit | patch | `1.12.0` -> `1.12.1` | --- ### Release Notes <details> <summary>skeema/skeema (skeema)</summary> ### [`v1.12.1`](https://github.com/skeema/skeema/releases/tag/v1.12.1) - **MySQL 9.0 and 9.1** support ([`7c94fcb`](skeema/skeema@7c94fcb), [`47bfc0a`](skeema/skeema@47bfc0a), [`a0a060a`](skeema/skeema@a0a060a)) - The new `VECTOR` column type is supported. In [`skeema diff`](https://www.skeema.io/docs/commands/diff/) and [`skeema push`](https://www.skeema.io/docs/commands/push/), altering a column type between `VECTOR` and any other sufficiently-large binary type is permitted as a [safe operation](https://www.skeema.io/docs/features/safety/#unsafe-change-detection) since the conversion is non-lossy. - MySQL 9 finally processes "inline" foreign key definitions (that is, `REFERENCES` clause in a column definition). These are supported as-is in Skeema. - **MariaDB 11.5 and 11.6** support ([`6165c90`](skeema/skeema@6165c90), [`f24ad30`](skeema/skeema@f24ad30)) - MariaDB 11.5 changes the default collation for Unicode charsets to use uca1400\_ai_ci collations, which are fully supported in Skeema. - MariaDB 11.5 solves the `TIMESTAMP` col type's previous Y2K38 limitation, and Skeema's [lint-has-time](https://www.skeema.io/docs/options/#lint-has-time) annotation message has been adjusted accordingly. - **`CHECK` constraint improvement**: When a diff only affects the *name* of a `CHECK` constraint without modifying its check expression, [`skeema diff`](https://www.skeema.io/docs/commands/diff/) and [`skeema push`](https://www.skeema.io/docs/commands/push/) now ignore this cosmetic change by default. This improves compatibility with external [OSC tools](https://www.skeema.io/docs/features/osc/), which inherently need to rename `CHECK` constraints as part of their operation. This new behavior can be overridden by enabling the [--exact-match](https://www.skeema.io/docs/options/#exact-match) option. ([`f000616`](skeema/skeema@f000616)) - **[Event](https://www.skeema.io/docs/features/events/) handling** improvements and fixes ([Skeema Premium](https://www.skeema.io/download/)) - When an event diff only included a change to the `DEFINER` clause, and no other differences, the `ALTER EVENT` emitted by Skeema was not valid SQL (despite conforming to syntax in the MySQL and MariaDB manuals). To fix this situation, the SQL will now also include an additional no-op clause, such as `ENABLE` for an event that is already enabled. - Several dump normalizations for `CREATE EVENT` statements were inadvertently omitted the first time an event was dumped by [`skeema init`](https://www.skeema.io/docs/commands/init/) or [`skeema pull`](https://www.skeema.io/docs/commands/pull/). - If any workspace query failed (e.g. query timeout), and any events were present in the \*.sql definitions, a panic would result instead of the intended workspace query failure error message. ([#229](skeema/skeema#229)) - **[SSH tunnel](https://www.skeema.io/docs/features/ssh/) enhancements** ([Skeema Premium](https://www.skeema.io/download/)) - CAs, which are indicated in the known_hosts file using `@cert-authority` lines, are now fully supported. ([skeema/knownhosts#8](skeema/knownhosts#8), [skeema/knownhosts#9](skeema/knownhosts#9)) - known_hosts lines using non-default ports are now matched properly. ([skeema/knownhosts#10](skeema/knownhosts#10)) - If any hand-written \*.sql files use the optional **`CREATE OR REPLACE` SQL syntax**, Skeema now parses and ignores the `OR REPLACE` clause. Previously, use of this syntax would prevent Skeema from parsing the statement. ([`6805737`](skeema/skeema@6805737)) - Enhancements for [Docker workspaces](https://www.skeema.io/docs/features/workspaces/#docker-workspaces) - Significant performance improvements for several common situations ([`d348249`](skeema/skeema@d348249), [`ca85df7`](skeema/skeema@ca85df7), [`7a40155`](skeema/skeema@7a40155)) - When using Percona Server 8.x, the Docker image / point release selection logic has been improved ([`e09350c`](skeema/skeema@e09350c), [`fe55d62`](skeema/skeema@fe55d62), [`af1b3b5`](skeema/skeema@af1b3b5)) - When a redundant non-unique index is flagged by [lint-dupe-index](https://www.skeema.io/docs/options/#lint-dupe-index), the annotation message is now clearer (since false positives may be possible) and suggests making the index be `INVISIBLE` / `IGNORED` before dropping ([#238](skeema/skeema#238), [#237](skeema/skeema#237)) - MariaDB's August 2024 point releases have changed the formatting of compressed columns in `SHOW CREATE TABLE`, which affected Skeema's [diff logic safeguards](https://www.skeema.io/docs/features/safety/#table-introspection-validation). This change is now handled and compressed columns are fully supported again. ([`49aed41`](skeema/skeema@49aed41)) - Minor wording changes in log messages and help text, for consistency. ([`4f8fa44`](skeema/skeema@4f8fa44), [`5f7598e`](skeema/skeema@5f7598e)) **Thank you** to all code contributors and issue reporters! An [installation guide](https://www.skeema.io/docs/install/) and [full documentation](https://www.skeema.io/docs/) are available on our website [skeema.io](https://www.skeema.io/). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 90a37c8a0c3c86b3fa245502cfeefd429129ebed

Javier-varez and others added 2 commits July 4, 2024 18:46

Support cert authorities

d314bf3

This was referenced Jul 8, 2024

Support cert authorities #8

Closed

Certificate in known_hosts #7

Closed

evanelias mentioned this pull request Jul 10, 2024

x/crypto/ssh/knownhosts: Should "*" match ports other than 22? golang/go#52056

Open

This comment was marked as outdated.

Sign in to view

evanelias merged commit 7c797a4 into main Jul 12, 2024
4 checks passed

evanelias deleted the certs-backwards-compat branch July 12, 2024 21:32

abakum referenced this pull request Jul 13, 2024

WIP: implement workaround for wildcards and non-standard port

175e28c

*** This is a work-in-progress commit, which will be amended/rewritten ***

evanelias mentioned this pull request Jul 15, 2024

host matching: handle wildcards with non-standard port #10

Merged

Javier-varez mentioned this pull request Jul 24, 2024

plumbing: transport/ssh, Add support for SSH @cert-authority. go-git/go-git#1157

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Backwards-compatible support for @cert-authority #9

Backwards-compatible support for @cert-authority #9

evanelias commented Jul 8, 2024 •

edited

Loading

coveralls-official bot commented Jul 8, 2024 •

edited

Loading

Javier-varez commented Jul 8, 2024

abakum commented Jul 9, 2024

evanelias commented Jul 9, 2024

evanelias commented Jul 9, 2024

abakum commented Jul 9, 2024

abakum commented Jul 10, 2024 •

edited

Loading

evanelias commented Jul 10, 2024

abakum commented Jul 10, 2024

evanelias commented Jul 10, 2024

This comment was marked as outdated.

Javier-varez commented Jul 11, 2024

abakum commented Jul 11, 2024

evanelias commented Jul 11, 2024

abakum commented Jul 11, 2024 •

edited

Loading

evanelias commented Jul 12, 2024

abakum commented Jul 13, 2024 •

edited

Loading

evanelias commented Jul 15, 2024

evanelias commented Jul 16, 2024

Backwards-compatible support for @cert-authority #9

Backwards-compatible support for @cert-authority #9

Conversation

evanelias commented Jul 8, 2024 • edited Loading

Implementation

Alternatives considered

Testing and feedback

coveralls-official bot commented Jul 8, 2024 • edited Loading

Javier-varez commented Jul 8, 2024

abakum commented Jul 9, 2024

evanelias commented Jul 9, 2024

evanelias commented Jul 9, 2024

abakum commented Jul 9, 2024

abakum commented Jul 10, 2024 • edited Loading

evanelias commented Jul 10, 2024

abakum commented Jul 10, 2024

evanelias commented Jul 10, 2024

This comment was marked as outdated.

Javier-varez commented Jul 11, 2024

abakum commented Jul 11, 2024

evanelias commented Jul 11, 2024

abakum commented Jul 11, 2024 • edited Loading

evanelias commented Jul 12, 2024

abakum commented Jul 13, 2024 • edited Loading

evanelias commented Jul 15, 2024

evanelias commented Jul 16, 2024

evanelias commented Jul 8, 2024 •

edited

Loading

coveralls-official bot commented Jul 8, 2024 •

edited

Loading

abakum commented Jul 10, 2024 •

edited

Loading

abakum commented Jul 11, 2024 •

edited

Loading

abakum commented Jul 13, 2024 •

edited

Loading