Add test for keymgr interop with external tools like ssh-keygen
tor-keymgr should have some ssh-keygen inerop tests. Currently, the keymgr tests use keys generated using maint/keygen-openssh-test/generate. Ideally we should have some tests that check the keymgr is able to handle keys generated by external tools (mainly ssh-keygen) as well.
This ticket will likely involve:
- moving the keys from
testdataintotestdata/arti(and updating the paths frommaint/keygen-openssh-test/generateaccordingly) - extending
maint/keygen-openssh-test/generateto generate a set of test keys usingssh-keygenintotestdata/ssh-keygen) - updating the keymgr tests to run against both sets of keys, not just
testdata/arti(tesdata/artiandtestdata/ssh-keygen)
Bonus: we should have a CI job that ensures running maint/keygen-openssh-test/generate doesn't change tesdata (i.e. that what's checked into the repo is exactly what the script would generate).
See also this thread from !2121 (merged):
-
@Diziet started a discussion: (+4 comments) I think one downside of this is that we no longer test actual interoperability between our tools and ssh-keygen? I don't think that's a blocker for this MR but it would probably be good to add some tests that did that.
I guess such tests would have to generate keys at runtime and check they appear to work after round trips.
If you agree with me on this point, how about filing a ticket for that?