Pin key fingerprints so a corrupted key cannot deploy - #1
Merged
Conversation
ssh-keygen -l validates structure, not authenticity. Flipping one bit in a key's material leaves a line that still parses, still reports 256-bit ED25519, and still passes every check we had -- only the fingerprint moves. Demonstrated: both the original and the tampered line exit 0 under ssh-keygen -lf. A key corrupted that way would have deployed, reached a new machine's authorized_keys and silently not worked, because no private key matches it. You would believe you had four ways into that box and have three. fingerprints.txt now pins the SHA256 of every key and validate.sh refuses to build while it and keys.txt disagree. Regenerate with scripts/fingerprints.sh and commit both together. The pin also buys reviewability, which may matter more: a reviewer skims past a 68-character base64 blob, but a changed SHA256 line is legible. Key material cannot change without the change appearing in a readable form in the same diff. Verified against the bit-flip, an added key, a removed key and a missing fingerprints.txt -- all blocked -- and that regenerating unblocks. An earlier attempt at the last case failed because the key I appended reused an existing blob and tripped the duplicate guard instead; the test was wrong, not the code.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
keys | 8a75baf | Aug 28 2026, 07:22 AM |
Aswinmcw
added a commit
that referenced
this pull request
Aug 28, 2026
'push:' with no branch filter fired alongside 'pull_request:', so every pull request commit ran the whole suite twice -- two identical Checks and two identical E2E runs, visible on PR #1. Restricting the push trigger to main leaves one run per PR commit plus one on main after a merge, which is what verifies the squashed result rather than the branch head. Tradeoff: a branch pushed with no PR open now gets no CI. That is the right way round, because main is protected by required status checks and nothing reaches it without a PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ssh-keygen -lvalidates structure, not authenticity. Flipping one bit in a key's material leaves a line that still parses, still reports256 ... (ED25519), and still passes every check we had — only the fingerprint moves:A key corrupted that way would deploy, land in a new machine's
authorized_keys, and silently not work — you'd believe you had four ways into that box and have three.fingerprints.txtnow pins the SHA256 of every key;validate.shrefuses to build while it andkeys.txtdisagree. Regenerate withsh scripts/fingerprints.shand commit both together.The pin also buys reviewability, which may matter more day to day: a reviewer skims past a 68-character base64 blob, but a changed
SHA256:line is legible.Verified — all blocked: the bit-flip, a key added without regenerating, a key removed, a missing
fingerprints.txt. And regenerating unblocks.