Skip to content

Emit ssh UseKeychain option only on macOS - #38

Open
0xCardinal wants to merge 2 commits into
cyfinoid:mainfrom
0xCardinal:fix/usekeychain-macos-only
Open

Emit ssh UseKeychain option only on macOS#38
0xCardinal wants to merge 2 commits into
cyfinoid:mainfrom
0xCardinal:fix/usekeychain-macos-only

Conversation

@0xCardinal

@0xCardinal 0xCardinal commented Jul 13, 2026

Copy link
Copy Markdown

Problem

keychecker passes -o UseKeychain=no to the system ssh client (both in
_run_ssh_command and in the git ls-remote GIT_SSH_COMMAND). UseKeychain
is a macOS-only OpenSSH option. On Linux and other platforms the ssh client
rejects it before doing anything else:

command-line: line 0: Bad configuration option: usekeychain

The ssh process then exits non-zero before authenticating, so keychecker
reports ❌ Authentication failed for every server — even when the key and
account are perfectly valid. This makes the tool effectively unusable for server
validation on Linux (e.g. inside CI, containers, or a pentest jump box).

Reproduction (Linux)

$ keychecker id_rsa --validate huggingface
- huggingface: ❌ Authentication failed
    Server response: command-line: line 0: Bad configuration option: usekeychain

Meanwhile a raw handshake with the same key works fine:

$ ssh -T -i id_rsa -o IdentitiesOnly=yes git@hf.co
Hi <user>, welcome to Hugging Face.

Fix

Gate the UseKeychain option behind a sys.platform == "darwin" check so it is
only emitted on macOS (where IdentitiesOnly=yes is already set to isolate the
key regardless). No behavior change on macOS; Linux/other platforms now complete
the handshake normally.

Testing

Verified end-to-end: after the fix, --validate huggingface correctly resolves
the mapped username on Linux, and macOS behavior is unchanged. Existing test
suite passes and flake8 is clean.

`UseKeychain` is a macOS-only OpenSSH option. On Linux and other platforms
the ssh client rejects it with "command-line: line 0: Bad configuration
option: usekeychain" and exits before authenticating, so every server
validation fails with a misleading "authentication failed" even when the key
and account are valid.

Gate the option behind a `sys.platform == "darwin"` check in both
`_run_ssh_command` and the `git ls-remote` `GIT_SSH_COMMAND`, and add tests
covering the platform-conditional behavior for both call sites.
@anantshri anantshri mentioned this pull request Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant