Skip to content

Possible unwanted behavior in experimental command keys check-integrity

The keys check-integrity command is capable of recognizing any kind of invalid keystore entry, including unrecognized paths. For example, given the following keystore:

arti/
└── keystore
    ├── unrecognized-path-dir
    │   └── ks_hs_id.ed25519_expanded_private
    └── ks_hs_id.ed25519_expanded_private

The output is:

Found problems in keystore: arti.

Invalid keystore entries in keystore arti:

unrecognized-path-dir/ks_hs_id.ed25519_expanded_private
	Error: Unrecognized path: unrecognized-path-dir/ks_hs_id
ks_hs_id.ed25519_expanded_private
	Error: Unrecognized path: ks_hs_id

Let's say one of those entries presents an invalid OpenSSH key, for example:

cat arti/keystore/ks_hs_id.ed25519_expanded_private
-----BEGIN OPENSSH PRIVATE KEY-----
Invalid OPENSSH key
-----END OPENSSH PRIVATE KEY-----

In this case the output will be:

Found problems in keystore: arti.

Invalid keystore entries in keystore arti:

unrecognized-path-dir/ks_hs_id.ed25519_expanded_private
	Error: Unrecognized path: unrecognized-path-dir/ks_hs_id
ks_hs_id.ed25519_expanded_private
	Error: Failed to parse OpenSSH with type Ed25519ExpandedKeypair

Meaning that the command extracted and tried to parse an unrecognized path.

I think check-integrity should not do that, since unrecognized paths are already invalid entries and they will be removed with -s.

cc @gabi-250