Emit ssh UseKeychain option only on macOS - #38
Open
0xCardinal wants to merge 2 commits into
Open
Conversation
`UseKeychain` is a macOS-only OpenSSH option. On Linux and other platforms the ssh client rejects it with "command-line: line 0: Bad configuration option: usekeychain" and exits before authenticating, so every server validation fails with a misleading "authentication failed" even when the key and account are valid. Gate the option behind a `sys.platform == "darwin"` check in both `_run_ssh_command` and the `git ls-remote` `GIT_SSH_COMMAND`, and add tests covering the platform-conditional behavior for both call sites.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
keycheckerpasses-o UseKeychain=noto the systemsshclient (both in_run_ssh_commandand in thegit ls-remoteGIT_SSH_COMMAND).UseKeychainis a macOS-only OpenSSH option. On Linux and other platforms the ssh client
rejects it before doing anything else:
The ssh process then exits non-zero before authenticating, so
keycheckerreports
❌ Authentication failedfor every server — even when the key andaccount are perfectly valid. This makes the tool effectively unusable for server
validation on Linux (e.g. inside CI, containers, or a pentest jump box).
Reproduction (Linux)
Meanwhile a raw handshake with the same key works fine:
Fix
Gate the
UseKeychainoption behind asys.platform == "darwin"check so it isonly emitted on macOS (where
IdentitiesOnly=yesis already set to isolate thekey regardless). No behavior change on macOS; Linux/other platforms now complete
the handshake normally.
Testing
Verified end-to-end: after the fix,
--validate huggingfacecorrectly resolvesthe mapped username on Linux, and macOS behavior is unchanged. Existing test
suite passes and
flake8is clean.