uselagoon / uselagoon/lagoon-cli

Poor SSH key handling: overly coupled to `id_rsa` private keys

Open
#442 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
28
Forks
14
Avg merge
1d 2h
Merged PRs (30d)
1

Description

Describe the bug

The Lagoon CLI tool seems to make several assumptions about SSH keys. In several places, the existing code searches for exactly the string ~/.ssh/id_rsa, giving that type of private key special status. GitHub specifically recommends ed25519 keys and only suggests RSA on "legacy systems".

In PR https://github.com/uselagoon/lagoon-cli/pull/44, it was suggested by @smlx:

Honestly I think it would be fair to offload all key handling to the agent and not attempt to manually load SSH keyfiles at all. Best practice is to use an agent anyway, and that way any new SSH key formats are automatically handled going forward.

But I don't think this suggestion was implemented.

It would be much better if Lagoon CLI would read (and try) all available keys from ssh-add -L, rather than reading individual SSH keys.

To Reproduce
Steps to reproduce the behavior:

  1. Install lagoon CLI normally.
  2. On an environment where ~/.lagoon.yml has not been modified to add an sshkey value, create a key at ~/.ssh/id_ed25519 with chmod 600. There should also not be a ~/.ssh/id_rsa file.
  3. Attempt to execute a lagoon command such as lagoon whoami
  4. The command will return Error: open /home/runner/.ssh/id_rsa: no such file or directory.

Expected behavior
The command should succeed using the available ~/.ssh/id_ed25519 key.

Desktop (please complete the following information):

  • OS: Ubuntu 24.04

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the code path used by lagoon whoami and the existing handling of ~/.ssh/id_rsa; review the prior discussion in PR #44. Check how ssh-add -L relates to the available keys, then verify that an environment with only ~/.ssh/id_ed25519 allows the command to succeed without an id_rsa file.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.