clawbot
b9c8631788
All checks were successful
check / check (push) Successful in 2m30s
keyfunc ssh install appends the public line on a host through the system ssh, only when absent, feeding the line on standard input; keyfunc ssh to serves the derived key from an in-process agent on a private socket and runs the system ssh with it, the private key never on disk. Two review rounds; the second passed with no findings. Model: opus-5 (implementation and review); fable-5-1 (landing)
96 lines
2.3 KiB
Go
96 lines
2.3 KiB
Go
package ssh
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"slices"
|
|
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
// StatusError says the tool should end with the status ssh ended with.
|
|
// Only "ssh to" gives one back; every other error ends the tool with
|
|
// status 1.
|
|
type StatusError struct {
|
|
Status int
|
|
}
|
|
|
|
// Error says which status ssh ended with.
|
|
func (e StatusError) Error() string {
|
|
return fmt.Sprintf("ssh exited with status %d", e.Status)
|
|
}
|
|
|
|
// to returns the command that runs ssh with the derived key held by an
|
|
// agent of the tool's own.
|
|
func to() *cobra.Command {
|
|
cmd := &cobra.Command{
|
|
Use: "to <host> [ssh arguments...]",
|
|
Short: "run ssh with the derived key served from its own agent",
|
|
Long: "Serves the derived key from an SSH agent that runs " +
|
|
"inside the tool and points the system ssh at it. The host " +
|
|
"and everything after it are given to ssh unchanged, the " +
|
|
"tool ends with the status ssh ended with, and the key is " +
|
|
"never written to disk.",
|
|
Args: cobra.MinimumNArgs(1),
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
key, comment, err := derived(cmd)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
served, err := key.Serve(cmd.Context(), comment)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
defer served.Stop()
|
|
|
|
argv := slices.Concat([]string{
|
|
"-o", "IdentityAgent=" + served.Socket(),
|
|
}, args)
|
|
|
|
return connect(cmd.Context(), argv)
|
|
},
|
|
}
|
|
|
|
// Everything from the host onwards belongs to ssh, so flag
|
|
// reading stops at the first argument that is not a flag.
|
|
cmd.Flags().SetInterspersed(false)
|
|
|
|
addComment(cmd)
|
|
|
|
return cmd
|
|
}
|
|
|
|
// connect runs ssh on the terminal the tool was given and turns the
|
|
// status it ended with into the status the tool ends with.
|
|
func connect(ctx context.Context, argv []string) error {
|
|
//nolint:gosec // the arguments are the user's own, meant for ssh
|
|
command := exec.CommandContext(ctx, "ssh", argv...)
|
|
command.Stdin = os.Stdin
|
|
command.Stdout = os.Stdout
|
|
command.Stderr = os.Stderr
|
|
|
|
err := command.Run()
|
|
if err == nil {
|
|
return nil
|
|
}
|
|
|
|
var ended *exec.ExitError
|
|
if errors.As(err, &ended) {
|
|
status := ended.ExitCode()
|
|
if status < 0 {
|
|
// A signal ended ssh, and a signal has no status of its
|
|
// own to pass on.
|
|
status = 1
|
|
}
|
|
|
|
return StatusError{Status: status}
|
|
}
|
|
|
|
return fmt.Errorf("running ssh: %w", err)
|
|
}
|