keyfunc ssh to and keyfunc ssh install started the system ssh and sftp with the tool's whole environment. When the mnemonic came from KEYFUNC_MNEMONIC, it stayed in the child's environment for as long as
the child ran: readable in /proc/<pid>/environ by the same user, and
forwardable to the host by a SendEnv line in the user's ssh config. ssh to exists so the private key never leaves the tool; the mnemonic
must not leave it either.
A small shared helper in the ssh cli package (childEnv) hands both
children the tool's environment with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed. It is set as the child's Env in connect (to) and session (install). The mnemonic command itself
still runs with the full environment, so nothing about resolving the
mnemonic changes.
What the diff does not show: the tests reuse the existing CLI stand-ins
for ssh and sftp, which now also write down their own environment
when a test asks. Two tests drive the real ssh install and ssh to
and check that neither variable reaches the child while a third variable
set alongside them does, so a scrubbed environment is not mistaken for
an empty one.
README gains one sentence under "Giving it the mnemonic".
Model: opus-4-8
Closes https://git.eeqj.de/sneak/keyfunc/issues/16
`keyfunc ssh to` and `keyfunc ssh install` started the system `ssh` and
`sftp` with the tool's whole environment. When the mnemonic came from
`KEYFUNC_MNEMONIC`, it stayed in the child's environment for as long as
the child ran: readable in `/proc/<pid>/environ` by the same user, and
forwardable to the host by a `SendEnv` line in the user's ssh config.
`ssh to` exists so the private key never leaves the tool; the mnemonic
must not leave it either.
A small shared helper in the ssh cli package (`childEnv`) hands both
children the tool's environment with `KEYFUNC_MNEMONIC` and
`KEYFUNC_MNEMONIC_COMMAND` removed. It is set as the child's `Env` in
`connect` (to) and `session` (install). The mnemonic command itself
still runs with the full environment, so nothing about resolving the
mnemonic changes.
What the diff does not show: the tests reuse the existing CLI stand-ins
for `ssh` and `sftp`, which now also write down their own environment
when a test asks. Two tests drive the real `ssh install` and `ssh to`
and check that neither variable reaches the child while a third variable
set alongside them does, so a scrubbed environment is not mistaken for
an empty one.
README gains one sentence under "Giving it the mnemonic".
Model: opus-4-8
ssh to and ssh install started the system ssh and sftp with the tool's
whole environment, so a mnemonic taken from KEYFUNC_MNEMONIC stayed in
the child's environment for as long as it ran, readable by the same user
and forwardable to the host through a SendEnv line. ssh to keeps the
private key inside the tool; the mnemonic must not leave it either.
A shared helper in the ssh cli package hands both children the tool's
environment with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed.
The mnemonic command itself still runs with the full environment. The
stand-in ssh and sftp in the tests now record their environment, and two
tests show neither variable reaches them while another one does.
Model: opus-4-8
Review passed: KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND are kept out of the ssh and sftp children on both code paths (the only two places besides the mnemonic command that start a process), the mnemonic command still runs with the full environment, the two new tests fail if the fix is removed, the README sentence is true of the code, and make check is green on the current next.
Model: opus-4-8
Review passed: `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` are kept out of the `ssh` and `sftp` children on both code paths (the only two places besides the mnemonic command that start a process), the mnemonic command still runs with the full environment, the two new tests fail if the fix is removed, the README sentence is true of the code, and `make check` is green on the current `next`.
Model: opus-4-8
clawbot
merged commit 64dcc7f42b into next2026-09-21 14:58:27 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #16
keyfunc ssh toandkeyfunc ssh installstarted the systemsshandsftpwith the tool's whole environment. When the mnemonic came fromKEYFUNC_MNEMONIC, it stayed in the child's environment for as long asthe child ran: readable in
/proc/<pid>/environby the same user, andforwardable to the host by a
SendEnvline in the user's ssh config.ssh toexists so the private key never leaves the tool; the mnemonicmust not leave it either.
A small shared helper in the ssh cli package (
childEnv) hands bothchildren the tool's environment with
KEYFUNC_MNEMONICandKEYFUNC_MNEMONIC_COMMANDremoved. It is set as the child'sEnvinconnect(to) andsession(install). The mnemonic command itselfstill runs with the full environment, so nothing about resolving the
mnemonic changes.
What the diff does not show: the tests reuse the existing CLI stand-ins
for
sshandsftp, which now also write down their own environmentwhen a test asks. Two tests drive the real
ssh installandssh toand check that neither variable reaches the child while a third variable
set alongside them does, so a scrubbed environment is not mistaken for
an empty one.
README gains one sentence under "Giving it the mnemonic".
Model: opus-4-8
Review passed:
KEYFUNC_MNEMONICandKEYFUNC_MNEMONIC_COMMANDare kept out of thesshandsftpchildren on both code paths (the only two places besides the mnemonic command that start a process), the mnemonic command still runs with the full environment, the two new tests fail if the fix is removed, the README sentence is true of the code, andmake checkis green on the currentnext.Model: opus-4-8