RE: [PATCH v6 5/9] ssh signing: parse ssh-keygen output and verify signatures
On July 29, 2021 5:13 PM, Fabian Stelzer wrote:
Show 30 quoted lines
>Subject: Re: [PATCH v6 5/9] ssh signing: parse ssh-keygen output and verify signatures
>
>On 29.07.21 23:01, Randall S. Becker wrote:
>> On July 29, 2021 4:46 PM, Junio wrote:
>>> Fabian Stelzer <fs@gigacodes.de> writes:
>>>
>>>> On 29.07.21 01:04, Jonathan Tan wrote:
>>>>
>>>>> Also, is this output documented to be stable even across locales?
>>>> Not really :/ (it currently is not locale specific)
>>>
>>> We probably want to defeat l10n of the message by spawning it in the C locale regardless.
>>>
>>>> The documentation states to only check the commands exit code. Do we
>>>> trust the exit code enough to rely on it for verification?
>>>
>>> Is the exit code sufficient to learn who signed it? Without knowing
>>> that, we cannot see if the principal is in or not in our
>> keychain, no?
>>
>> Have we not had issues in the past depending on exit code? I'm not sure this can be made entirely portable.
>>
>
>To find the principal (who signed it) we don't have to parse the output.
>Since verification is first a call to look up the principals matching the signatures public key from the allowedSignersFile and then trying
>verification with each one we already know which one matched (usually there is only one. I think multiples is only possible with an SSH
>CA).
>Of course this even more relies on the exit code of ssh-keygen.
>
>Not sure which is more portable and reliable. Parsing the textual output or the exit code. At the moment my patch does both.
What about a configurable exit code for this? See the comment below about that.
Show 13 quoted lines
>>>> If so then i can move the main result and only parse the text for
>>>> the signer/fingerprint info thats used in log formats. This way only
>>>> the logs would break in case the output changes.
>>>>
>>>> I added the output check since the gpg code did so as well:
>>>> ret |= !strstr(gpg_stdout.buf, "\n[GNUPG:] GOODSIG ");
>>>
>>> Does ssh-keygen have a mode similar to gpg's --status-fd feature
>>> where its output is geared more towards being stable and marchine parseable than being human friendly, by the way?
>>
>> I do not think this can be done in a platform independent way. Not
>> every platform that has ssh-keygen conforms to the OpenSSH UI or output - a particular annoyance I get daily.
>>
What about a configurable command, like GIT_SSH_COMMAND to allow someone to plug in a mechanism or write something that supplies a result you can handle? That's something I could probably work out on my own platforms.
Randall S. Becker <rsbecker@nexbridge.com>