Hey folks,
I just got access to a Git repository on postgresql.org, so I started
going through the motions of adding an SSH key to my profile. I was
unable to add my key as-is, so I figured that I would flag the issue. My
public SSH key looks something like this:
ecdsa-sha2-nistp256
AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDPYnw8WWCrgL0sXijK7BY1Qz7KJlQZNe+ErNNwmfqazAd/CuTNNdENj21R6iR2CsjoEZ1prFcj/hPDV/j4nf7s=
email@example.com(hostname)
Accordingto to SSH key documentation[0], an SSH key is composed of
3 components:
A B C
A: The key type
B: Base64-encoded public key
C: An optional comment
The problem with this key in particular is the comment. If I remove
`(hostname)` from the key, postgresql.org will accept the key. I have
a suspicion that we are probably incorrectly validating the key. Some
pseudocode that would illustrate my hypothesis:
keys = []
for t in text.splitlines():
sections = t.split(" ")
if len(sections) < 2 or len(sections) > 3:
raise ValueError("Invalid SSH key format")
keys.append(OpenSSHKey(sections[0], sections[1], sections[2] if len(sections) == 3 else None))
I am happy to investigate this further if I can get read access to the
postgresql.org site.
I find my current comment format, including the hostname, to be useful
when identifying the email and machine the key belongs to. I'll work
around it for now.
[0]: https://sshref.dev/#intro_legc_pub
--
Tristan Partin
PostgreSQL Contributors Team
AWS (https://aws.amazon.com)
