Bug 274024

Summary: Enable ecdsa-sk and ed25519-sk SSH keys for git@gitrepo.freebsd.org
Product: Services Reporter: Christian Weisgerber <naddy>
Component: Core InfrastructureAssignee: Cluster Admin <clusteradm>
Status: Closed FIXED    
Severity: Affects Some People CC: emaste, grahamperrin, mat, philip
Priority: ---    
Version: unspecified   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
Proposed patch to devel/gitolite port
none
Proposed patch to devel/gitolite port philip: maintainer-approval? (mat)

Description Christian Weisgerber freebsd_committer freebsd_triage 2023-09-22 13:31:27 UTC 
Could we please enable SSH key types ecdsa-sk and ed25519-sk for committing to the FreeBSD repositories on gitrepo.freebsd.org?

Those are FIDO/U2F-backed keys available since OpenSSH 8.1. The public keys start like this:
sk-ecdsa-sha2-nistp256@openssh.com ...
sk-ssh-ed25519@openssh.com ...

gitrepo.freebsd.org accepts such keys in principle, but the git@gitrepo.freebsd.org account used for pushing Git commits does not.

Other infrastructure machines in the FreeBSD cluster (freefall, ref*, ...) accept such keys just fine.
Comment 1 Philip Paeps freebsd_committer freebsd_triage 2023-09-25 05:49:11 UTC 
Created attachment 245206 [details]
Proposed patch to devel/gitolite port
Comment 2 Philip Paeps freebsd_committer freebsd_triage 2023-09-25 05:51:41 UTC 
Cc:ing mat@FreeBSD.org since he maintains the devel/gitolite port.

The problem in the cluster is that "gitolite trigger SSH_AUTHKEYS" mangles sk-ssh-* keys by adding a comma behind them.  This is caused by the existing patch (by glebius) that tries to distinguish between bare keys and keys with options.

This patch updates the regex to additionally recognise sk-ssh-* keys.

It hasn't been tested in the cluster yet.  If this works -- and if mat@ approves -- I'd like to commit this patch to the devel/gitolite port.
Comment 3 Philip Paeps freebsd_committer freebsd_triage 2023-09-25 12:45:32 UTC 
Created attachment 245214 [details]
Proposed patch to devel/gitolite port

Address feedback from lwhsu.  The patch I proposed earlier did not (always?) apply cleanly.  Instead of adding it as an additional patch, regenerate the existing patch.

Removed the Git commentary from that patch.  It doesn't apply cleanly with git am anyway.

This patch should be submitted upstream and removed in due course.
Comment 4 Christian Weisgerber freebsd_committer freebsd_triage 2023-10-03 12:46:49 UTC 
Any progress?
Comment 5 Christian Weisgerber freebsd_committer freebsd_triage 2023-10-13 17:31:53 UTC 
lwhsu@ has deployed this and I have successfully used it to push ports commit 	fa0f0fcc333a4a5244e02a1933a3c1c0b5b6c0f9.

Thank you, everybody!