keyfunc ssh to now runs ssh with -o IdentitiesOnly=no before the host, right after -o IdentityAgent=<socket>. When the user's ssh configuration sets IdentitiesOnly yes (often under Host *), ssh lists the agent's key but offers only keys named by IdentityFile. The derived key was never tried, and the login failed with Permission denied (publickey). An option on the command line wins over the configuration file. The tool's agent holds only the derived key, so turning the option off adds no other key.
TestIdentitiesOnlyIsTurnedOffBeforeTheHost in internal/cli/ssh_test.go requires the option between the agent option and the host in the arguments the stand-in ssh was given. TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn now expects the host as the fifth argument. The README's ssh to section names both options and says why the second one is there.
-o IdentityAgent stays the first option because the stand-in ssh scripts read the socket from their second argument.
Judgement call: ssh keeps the first value it is given for an option, so a user's own -o IdentitiesOnly=yes after the host is now overridden. With only the derived key in the agent, that setting could only stop the login.
Judgement call: keyfunc ssh to --help is unchanged. It names none of the options the tool passes, and the definition of done asks for help text only under the documentation-only option.
`keyfunc ssh to` now runs `ssh` with `-o IdentitiesOnly=no` before the host, right after `-o IdentityAgent=<socket>`. When the user's ssh configuration sets `IdentitiesOnly yes` (often under `Host *`), `ssh` lists the agent's key but offers only keys named by `IdentityFile`. The derived key was never tried, and the login failed with `Permission denied (publickey)`. An option on the command line wins over the configuration file. The tool's agent holds only the derived key, so turning the option off adds no other key.
`TestIdentitiesOnlyIsTurnedOffBeforeTheHost` in `internal/cli/ssh_test.go` requires the option between the agent option and the host in the arguments the stand-in `ssh` was given. `TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn` now expects the host as the fifth argument. The README's `ssh to` section names both options and says why the second one is there.
`-o IdentityAgent` stays the first option because the stand-in `ssh` scripts read the socket from their second argument.
Judgement call: `ssh` keeps the first value it is given for an option, so a user's own `-o IdentitiesOnly=yes` after the host is now overridden. With only the derived key in the agent, that setting could only stop the login.
Judgement call: `keyfunc ssh to --help` is unchanged. It names none of the options the tool passes, and the definition of done asks for help text only under the documentation-only option.
Fixes https://git.eeqj.de/sneak/keyfunc/issues/74
Model: opus-5-5
ssh to now gives ssh -o IdentitiesOnly=no before the host, next to
-o IdentityAgent. With IdentitiesOnly yes in the user's ssh
configuration, ssh listed the agent's key but never offered it, and
the login failed with Permission denied. An option on the command
line wins over the configuration, and the tool's agent holds only the
derived key, so turning the option off adds no other key. A test
against the stand-in ssh requires the option before the host, and the
README's ssh to section names both options.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
keyfunc ssh tonow runssshwith-o IdentitiesOnly=nobefore the host, right after-o IdentityAgent=<socket>. When the user's ssh configuration setsIdentitiesOnly yes(often underHost *),sshlists the agent's key but offers only keys named byIdentityFile. The derived key was never tried, and the login failed withPermission denied (publickey). An option on the command line wins over the configuration file. The tool's agent holds only the derived key, so turning the option off adds no other key.TestIdentitiesOnlyIsTurnedOffBeforeTheHostininternal/cli/ssh_test.gorequires the option between the agent option and the host in the arguments the stand-insshwas given.TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOnnow expects the host as the fifth argument. The README'sssh tosection names both options and says why the second one is there.-o IdentityAgentstays the first option because the stand-insshscripts read the socket from their second argument.Judgement call:
sshkeeps the first value it is given for an option, so a user's own-o IdentitiesOnly=yesafter the host is now overridden. With only the derived key in the agent, that setting could only stop the login.Judgement call:
keyfunc ssh to --helpis unchanged. It names none of the options the tool passes, and the definition of done asks for help text only under the documentation-only option.Fixes #74
Model: opus-5-5
Review passed; ready to merge into
next.Model: opus-5-5