Repair and validate the AUR key before using it - #227
Conversation
The v0.1.1 AUR publish failed all three attempts with ssh's 'invalid format' / 'Permission denied (publickey)' — a secret that did not survive paste, not an AUR outage — and filed the outage issue for it. This has recurred across our CLIs (CRLF, dropped trailing newline, flattened lines). scripts/install-ssh-key.sh repairs those shapes, proves the key loads with ssh-keygen -y before anything authenticates, and on refusal diagnoses the shape without printing key material. Both the release job and the recovery dispatch install the key through it in a named step, and release.yml's outage issue is now scoped to the publish step like aur-publish.yml's already was.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Adds robust AUR SSH-key normalization and validation before publishing.
Changes:
- Repairs common secret formatting damage and validates keys.
- Adds Bats coverage for repair and rejection cases.
- Prevents invalid keys from triggering outage notifications.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
scripts/install-ssh-key.sh |
Normalizes, validates, and securely installs SSH keys. |
tests/e2e/install_ssh_key.bats |
Tests key repair, validation, and cleanup behavior. |
.github/workflows/release.yml |
Validates the AUR key before release publishing. |
.github/workflows/aur-publish.yml |
Validates the key in manual recovery publishing. |
RELEASING.md |
Documents safe AUR secret configuration. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| assert_installed() { | ||
| [[ "$status" -eq 0 ]] | ||
| [[ -f "$DEST" ]] | ||
| [[ "$(stat -c %a "$DEST")" == "600" ]] |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0973dad624
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| assert_installed() { | ||
| [[ "$status" -eq 0 ]] | ||
| [[ -f "$DEST" ]] | ||
| [[ "$(stat -c %a "$DEST")" == "600" ]] |
There was a problem hiding this comment.
On macOS, where the documented Bats runner explicitly supports brew install bats-core and contains macOS-specific sysctl/rush handling, BSD stat does not support GNU's -c option. Consequently, every new key-installation test fails inside assert_installed even when the script works correctly. Use a GNU/BSD fallback such as the one already present in scripts/check-size-budget.sh.
Useful? React with 👍 / 👎.
The v0.1.1 `Publish to AUR` leg failed all three attempts before touching the AUR: `Load key "/home/runner/.ssh/aur": invalid format` → `Permission denied (publickey)`. That's the secret not surviving paste, not an outage — and it filed the outage issue (#217) anyway. We've hit this repeatedly across the CLIs (CRLF, dropped trailing newline, key flattened onto one line with literal `\n`).
`scripts/install-ssh-key.sh` writes a key from `$SSH_KEY` to a path, repairing those shapes (CR removal, surrounding blank lines/trailing whitespace, exactly one trailing newline, `\n` expansion only when the key arrived on a single line), then proves it loads with `ssh-keygen -y`. On refusal it prints a shape diagnosis (`lines=N header=ok|missing|PUBLIC-KEY footer=ok|missing had-CR had-literal-backslash-n no-trailing-newline`) and never key material. `tests/e2e/install_ssh_key.bats` covers each repair and refusal.
Workflows: both `release.yml` and `aur-publish.yml` install the key through it in a named `Install AUR key` step, so a bad secret fails there with the diagnosis. `release.yml`'s outage issue is now scoped to the publish step's outcome, matching `aur-publish.yml`.
RELEASING.md: set the secret from the file (`gh secret set AUR_KEY --env release < keyfile`), never a paste.
After merge: dispatch `Publish to AUR` with `0.1.1` — either the repair makes the existing secret work, or the diagnosis names what's wrong with it.
Summary by cubic
Fail fast on malformed AUR SSH keys and avoid false “AUR outage” reports. Previously we wrote
AUR_KEYdirectly, got “invalid format” → “Permission denied (publickey)”, and filed an outage; now we normalize and verify the key before publish.Introduces
scripts/install-ssh-key.sh: reads$SSH_KEY, repairs common paste damage (CRLF, missing trailing newline, single-line with literal "\n", surrounding blanks/whitespace), enforces 0600, and verifies load withssh-keygen -y. On refusal, emits a shape diagnosis without printing key material.Updates
.github/workflows/aur-publish.ymlandrelease.ymlto add a named “Install AUR key” step that mapsAUR_KEY→$SSH_KEY, installs the key, and only then runs publish. Failure notification inrelease.ymlis now scoped to the publish step outcome.Adds
tests/e2e/install_ssh_key.batsto cover each repair path, refusal paths, permissions, and cleanup.Updates
RELEASING.mdto setAUR_KEYfrom the key file, not a paste:gh secret set AUR_KEY --env release < ~/.ssh/aur_hey_cli.Rollout
0.1.1. If the installer fails, re-saveAUR_KEYfrom the key file using the command above and retry.Written for commit 0973dad. Summary will update on new commits.