Skip to content

feat(ssh): pre-seed known_hosts with git.amyl.org.uk host keys #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamamyl merged 1 commit into from
Jun 20, 2026
Merged

feat(ssh): pre-seed known_hosts with git.amyl.org.uk host keys #82

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions lib/installer_utils/ssh_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,16 @@

_SAFE_HOSTNAME_RE = re.compile(r"^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,253}[a-zA-Z0-9])?$")

# Pre-fetched host keys for hosts reachable only via Tailscale.
# Avoids interactive fingerprint prompts during first connection.
# Refresh with: ssh-keyscan <host>
_BAKED_KNOWN_HOSTS: dict[str, list[str]] = {
"git.amyl.org.uk": [
"git.amyl.org.uk ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5p+RFWilkcc9YR5gR2p23mguNrKrtwn3TAgxBOhRDq",
"git.amyl.org.uk ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHtSrK7VFPhy2ZsrWjRLcmmeBsTCXPB8IzWz+IE6vkpXuKY91lDdWZdciFZm/RQQilZMxnQwZDfkDK4kGQii7IU=",
],
}


def _validate_host(host: str) -> None:
if not _SAFE_HOSTNAME_RE.match(host):
Expand Down Expand Up @@ -77,6 +87,23 @@ def _append_to_known_hosts(ssh_user: str, known_hosts: str, host: str) -> None:
log.warning(f"ssh-keyscan failed: {e}")


def _seed_known_hosts(ssh_user: str, known_hosts: str, host: str, entries: list[str]) -> None:
"""Writes baked-in known_hosts entries for host if not already present."""
existing = ""
if os.path.exists(known_hosts):
with open(known_hosts) as f:
existing = f.read()
new_lines = [e for e in entries if e not in existing]
if not new_lines:
return
with open(known_hosts, "a") as f:
f.write("\n".join(new_lines) + "\n")
pw = pwd.getpwnam(ssh_user)
os.chown(known_hosts, pw.pw_uid, pw.pw_gid)
os.chmod(known_hosts, 0o600)
log.info(f"Seeded {len(new_lines)} baked-in host key(s) for {host} into known_hosts.")


def probe_and_fix_ssh(
exec_obj: Executor,
host: str,
Expand All @@ -99,6 +126,11 @@ def probe_and_fix_ssh(
home = _user_homedir(ssh_user)
known_hosts = os.path.join(home, ".ssh", "known_hosts")

# Pre-seed known_hosts with baked-in entries so Tailscale-only hosts don't
# trigger interactive fingerprint prompts on first connection.
if host in _BAKED_KNOWN_HOSTS:
_seed_known_hosts(ssh_user, known_hosts, host, _BAKED_KNOWN_HOSTS[host])

ok, stderr = _ssh_probe(exec_obj, host, ssh_user, key_path)
if ok:
log.success(f"SSH to {ssh_user}@{host}: OK")
Expand Down
Loading