fix(ssh): enable macOS UseKeychain runtime support - #316
Open
inureyes wants to merge 1 commit into
Open
Conversation
Classify Apple's UseKeychain directive as a runtime-backed authentication option instead of emitting a false unsupported warning, and expose its resolved value in -G output. Match macOS behavior by falling back when a stored passphrase is stale and storing prompted passphrases only after successful key decryption. Document bssh's Keychain namespace and add parser, resolver, dump, and encrypted-key regression coverage. Tests: cargo fmt --all --check; cargo clippy -- -D warnings; cargo test --lib use_keychain; cargo test --test ssh_config_dump_test use_keychain_is_reported_as_runtime_supported
inureyes
added
type:bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
UseKeychaindirective as runtime-supported authentication instead of emitting a false unsupported-option warning, and expose the resolved value throughbssh -G.Testing
cargo fmt --all --checkcargo clippy -- -D warningscargo test --lib use_keychain(14 passed)cargo test --test ssh_config_dump_test(22 passed)target/debug/bssh -G usekeychain-probe.invalidwith the user's default SSH configuration (exit 0, empty stderr,usekeychain yes)Compatibility notes
Apple OpenSSH stores passphrases in the entitlement-protected
com.apple.ssh.passphrasesaccess group. bssh cannot reuse those records directly, so it stores passphrases under its ownbssh-ssh-key-passphraseservice and may prompt once on the first bssh connection.A broader
cargo test --librun completed with 1,714 passing tests and four failures in unrelated jump-authentication, control-socket permission, and known-hosts timeout tests. The Linux cross-check could not reach bssh code because the host lacksx86_64-linux-gnu-gccrequired byaws-lc-sys.