fix(ssh): present only the CA-signed host certificate

[minhtule]

Related Tickets & Documents

• Issue: Gateway SSH host identity changes on every restart #369

Changes

• Remove the raw host-key fallback; the gateway presents only its CA-signed host certificate.

Notes

Clients that accept only plain host-key algorithms (not *-cert-v01@openssh.com) can no longer negotiate a host key. This is intended: presenting the raw ephemeral key is what let host identity drift across restarts.

[Copilot]

Pull request overview

This PR updates the SSH gateway’s downstream host-key presentation to only advertise the CA-signed host certificate (removing the raw host-key fallback), and adds an integration test to enforce the expected negotiation failure for clients restricted to plain host-key algorithms.

Changes:

• Remove the downstream raw host-key fallback so only *-cert-v01@openssh.com host key algorithms are offered.
• Add an integration test that confirms connection failure when the client restricts HostKeyAlgorithms to plain ssh-ed25519.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/sshhandler/config.go	Removes adding the raw keySigner as a fallback host key, leaving only the cert signer advertised.
test/integration/ssh_test.go	Adds a regression test asserting that clients offering only plain host-key algorithms cannot negotiate a host key.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.09%. Comparing base (7a35cdd) to head (b2867ea).
⚠️ Report is 3 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #370      +/-   ##
==========================================
- Coverage   86.18%   86.09%   -0.09%     
==========================================
  Files          40       40              
  Lines        2830     2827       -3     
==========================================
- Hits         2439     2434       -5     
- Misses        265      267       +2     
  Partials      126      126              

Flag	Coverage Δ
integration	55.20% <ø> (+0.23%)	⬆️
unit	78.45% <ø> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/sshhandler/config.go	80.80% <ø> (-0.16%)	⬇️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[clement0010]

LGTM 👍🏻