ssh

Documentation

Overview

Package ssh provides SSH authentication utilities for Git operations.

Index

• Constants
• func GetAuthMethod(privateKey, password, knownHosts string, allowMissingKnownHosts bool) ([]gitclient.Option, error)
• type KeyAuth
  • func NewPublicKeyAuth(privateKey, password, knownHosts string, allowMissingKnownHosts bool) (*KeyAuth, error)
  • func (a *KeyAuth) ClientConfig(ctx context.Context, req *transport.Request) (*gossh.ClientConfig, error)

Constants

const InsecureAllowMissingKnownHostsFlag = "--insecure-allow-missing-known-hosts"

InsecureAllowMissingKnownHostsFlag is the controller flag, surfaced in error text, that opts out of SSH host key verification when no host-key source produced any known_hosts at all.

Functions

func GetAuthMethod

func GetAuthMethod(privateKey, password, knownHosts string, allowMissingKnownHosts bool) ([]gitclient.Option, error)

GetAuthMethod returns SSH public key authentication as transport client options.

go-git v6 removed the single transport.AuthMethod interface: authentication is supplied as functional options on the transport client (gitclient.WithSSHAuth / gitclient.WithHTTPAuth), so a credential travels as a []gitclient.Option and a nil slice means anonymous.

The options are opaque closures, so callers cannot inspect what kind of credential they hold. NewPublicKeyAuth is the introspectable half, kept exported so the host-key policy can be asserted directly rather than through the option wrapper.

Types

type KeyAuth

type KeyAuth struct {
	*gogitssh.PublicKeys
	// contains filtered or unexported fields
}

KeyAuth is SSH public key authentication that always states which host key algorithms it will accept.

It exists to close a hole in go-git v6. Its SSH transport reads the process's default known_hosts files — `~/.ssh/known_hosts` and `/etc/ssh/ssh_known_hosts` — whenever ClientConfig comes back with an empty HostKeyAlgorithms, *even when a HostKeyCallback was supplied*, purely to derive the algorithm list (`plumbing/transport/ssh/ssh.go`, the `else if len(config.HostKeyAlgorithms) == 0` branch). If neither file exists it fails the connection with "unable to find any valid known_hosts file, set SSH_KNOWN_HOSTS env variable". The controller image is distroless with no home directory and no system known_hosts, so every SSH remote would fail there regardless of the credential — which is exactly what the e2e suite caught. v5 derived no algorithms and so never looked.

Populating the field ourselves keeps that fallback unreachable. The algorithms are derived from the pinned known_hosts when we have one, matching git's own behaviour: offering an algorithm the pin does not cover would make the server present a key our callback then rejects.

func NewPublicKeyAuth

func NewPublicKeyAuth(
	privateKey, password, knownHosts string,
	allowMissingKnownHosts bool,
) (*KeyAuth, error)

NewPublicKeyAuth builds go-git's SSH public key authentication from a private key, applying this project's host-key policy.

Host key verification fails closed: a known_hosts source is required. A known_hosts value that is present but cannot be parsed is always a hard error — if a host key is declared it must be valid. When no known_hosts is available at all, NewPublicKeyAuth returns an error unless allowMissingKnownHosts is set (the controller's --insecure-allow-missing-known-hosts flag), which disables host key verification and is intended for throwaway/dev clusters only.

func (*KeyAuth) ClientConfig

func (a *KeyAuth) ClientConfig(ctx context.Context, req *transport.Request) (*gossh.ClientConfig, error)

ClientConfig implements gitclient.SSHAuth. It delegates to go-git for the credential and host key callback, then guarantees HostKeyAlgorithms is set.