From 6d16797c4f48c43a429a354f84bb309c2c47eaf6 Mon Sep 17 00:00:00 2001 From: Daniel Arroyo Date: Wed, 8 Jul 2026 00:44:01 -0400 Subject: [PATCH] Fix known_hosts format: use ssh.MarshalAuthorizedKey Bug: AddKnownHost wrote raw SSH wire-protocol bytes directly to known_hosts instead of the OpenSSH authorized-key one-line format. This produced garbage entries that would break SSH verification for newly added machines. Fix: ssh.ParsePublicKey(keyData) + ssh.MarshalAuthorizedKey() to produce canonical hostkey lines: hostname ssh-ed25519 AAAAB3...xn3c= --- internal/sshmanager/knownhosts.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/internal/sshmanager/knownhosts.go b/internal/sshmanager/knownhosts.go index 1dac65f..1ac438f 100644 --- a/internal/sshmanager/knownhosts.go +++ b/internal/sshmanager/knownhosts.go @@ -6,6 +6,8 @@ import ( "os" "path/filepath" "strings" + + "golang.org/x/crypto/ssh" ) type KnownHost struct { @@ -38,7 +40,11 @@ func AddKnownHost(sshDir, host string, port int, keyData []byte) error { addr = fmt.Sprintf("[%s]:%d", host, port) } - line := fmt.Sprintf("%s %s\n", addr, strings.TrimSpace(string(keyData))) + pubKey, err := ssh.ParsePublicKey(keyData) + if err != nil { + return fmt.Errorf("parsing host key: %w", err) + } + line := fmt.Sprintf("%s %s\n", addr, strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pubKey)))) if _, err := f.WriteString(line); err != nil { return err }