uselagoon / uselagoon/lagoon-cli
Poor SSH key handling: overly coupled to `id_rsa` private keys
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 28
- Forks
- 14
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Description
Describe the bug
The Lagoon CLI tool seems to make several assumptions about SSH keys. In several places, the existing code searches for exactly the string ~/.ssh/id_rsa, giving that type of private key special status. GitHub specifically recommends ed25519 keys and only suggests RSA on "legacy systems".
In PR https://github.com/uselagoon/lagoon-cli/pull/44, it was suggested by @smlx:
Honestly I think it would be fair to offload all key handling to the agent and not attempt to manually load SSH keyfiles at all. Best practice is to use an agent anyway, and that way any new SSH key formats are automatically handled going forward.
But I don't think this suggestion was implemented.
It would be much better if Lagoon CLI would read (and try) all available keys from ssh-add -L, rather than reading individual SSH keys.
To Reproduce
Steps to reproduce the behavior:
- Install
lagoonCLI normally. - On an environment where
~/.lagoon.ymlhas not been modified to add ansshkeyvalue, create a key at~/.ssh/id_ed25519withchmod 600. There should also not be a~/.ssh/id_rsafile. - Attempt to execute a lagoon command such as
lagoon whoami - The command will return
Error: open /home/runner/.ssh/id_rsa: no such file or directory.
Expected behavior
The command should succeed using the available ~/.ssh/id_ed25519 key.
Desktop (please complete the following information):
- OS: Ubuntu 24.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the code path used by lagoon whoami and the existing handling of ~/.ssh/id_rsa; review the prior discussion in PR #44. Check how ssh-add -L relates to the available keys, then verify that an environment with only ~/.ssh/id_ed25519 allows the command to succeed without an id_rsa file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100