Skip to content

🐋🔧：write out the one key, not everything offered #911

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openinf-commit-queue merged 1 commit into from
Sep 7, 2026
Merged

🐋🔧：write out the one key, not everything offered #911

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .devcontainer/post-start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,25 @@ if [ "$(git config --global gpg.format 2>/dev/null || true)" = "ssh" ]; then
# Matched by key type. `^ssh-` misses ECDSA and security keys; counting
# non-blank lines instead would read "The agent has no identities." as an
# identity and write that sentence out as the key.
count="$(printf '%s\n' "${identities}" |
grep -cE '^(ssh-(rsa|dss|ed25519)|ecdsa-sha2-nistp[0-9]+|sk-(ssh-ed25519|ecdsa-sha2-nistp[0-9]+)@openssh\.com) ' ||
#
# Kept rather than counted, because the two are not the same list. An
# agent forwarding a certificate alongside the key it belongs to offers
# `ssh-ed25519-cert-v01@openssh.com`, which is deliberately not a type
# this accepts -- so the count is one while `ssh-add -L` printed two
# lines. Writing the unfiltered output would put two keys in a file
# `ssh-keygen -Y sign -f` reads one from, and give allowed_signers a
# second line where its grammar has room for none.
matched="$(printf '%s\n' "${identities}" |
grep -E '^(ssh-(rsa|dss|ed25519)|ecdsa-sha2-nistp[0-9]+|sk-(ssh-ed25519|ecdsa-sha2-nistp[0-9]+)@openssh\.com) ' ||
true)"
count="$(printf '%s\n' "${matched}" | grep -c . || true)"

if [ "${count}" -eq 1 ]; then
# Split because -m applies only to the deepest directory (SC2174), and
# unconditional because ssh refuses a world-writable ~/.ssh.
mkdir -p "$(dirname "${container_signingkey}")"
chmod 700 "$(dirname "${container_signingkey}")"
printf '%s\n' "${identities}" >"${container_signingkey}"
printf '%s\n' "${matched}" >"${container_signingkey}"
chmod 644 "${container_signingkey}"

if [ "${signingkey}" != "${container_signingkey}" ]; then
Expand Down
Loading