Method Sign

internal/agent/secure_agent.go:97–142

(pubkey ssh.PublicKey, data []byte)

}

func (a *secureAgent) Sign(pubkey ssh.PublicKey, data []byte) (*ssh.Signature, error) {
	fp := ssh.FingerprintSHA256(pubkey)

	// 动态加载最新的密钥列表
	metas, err := a.loadMetas()
	if err != nil {
		return nil, err
	}

	var alias string
	for _, m := range metas {
		if m.Fingerprint == fp {
			alias = m.Alias
			break
		}
	}
	if alias == "" {
		return nil, errors.New("key not found")
	}

	// 使用 AuthProvider 解锁 master key
	mk, err := a.authProvider.UnlockMasterKey()
	if err != nil {
		return nil, fmt.Errorf("认证失败: %w", err)
	}

	rec, err := store.LoadDecryptedRecord(alias, mk)
	if err != nil {
		return nil, err
	}
	priv, err := x509.ParsePKCS8PrivateKey(rec.PKCS8DER)
	if err != nil {
		return nil, err
	}
	signer, err := ssh.NewSignerFromKey(priv)
	if err != nil {
		return nil, err
	}

	log.Debug("SSH 签名", map[string]interface{}{
		"fingerprint": fp,
		"key_type":    signer.PublicKey().Type(),
	})

	return signer.Sign(nil, data)
}

// Support RSA-SHA2 algorithms when requested by the client.
func (a *secureAgent) SignWithFlags(pubkey ssh.PublicKey, data []byte, flags xagent.SignatureFlags) (*ssh.Signature, error) {