Method SignWithFlags

internal/agent/secure_agent.go:145–207

Support RSA-SHA2 algorithms when requested by the client.

(pubkey ssh.PublicKey, data []byte, flags xagent.SignatureFlags)

// Support RSA-SHA2 algorithms when requested by the client.
func (a *secureAgent) SignWithFlags(pubkey ssh.PublicKey, data []byte, flags xagent.SignatureFlags) (*ssh.Signature, error) {
	fp := ssh.FingerprintSHA256(pubkey)

	// 动态加载最新的密钥列表
	metas, err := a.loadMetas()
	if err != nil {
		return nil, err
	}

	var alias string
	for _, m := range metas {
		if m.Fingerprint == fp {
			alias = m.Alias
			break
		}
	}
	if alias == "" {
		return nil, errors.New("key not found")
	}

	// 使用 AuthProvider 解锁 master key
	mk, err := a.authProvider.UnlockMasterKey()
	if err != nil {
		return nil, fmt.Errorf("认证失败: %w", err)
	}

	rec, err := store.LoadDecryptedRecord(alias, mk)
	if err != nil {
		return nil, err
	}
	priv, err := x509.ParsePKCS8PrivateKey(rec.PKCS8DER)
	if err != nil {
		return nil, err
	}
	signer, err := ssh.NewSignerFromKey(priv)
	if err != nil {
		return nil, err
	}

	if algSigner, ok := signer.(ssh.AlgorithmSigner); ok {
		algo := ""
		if (flags & xagent.SignatureFlagRsaSha512) != 0 {
			algo = "rsa-sha2-512"
		} else if (flags & xagent.SignatureFlagRsaSha256) != 0 {
			algo = "rsa-sha2-256"
		}
		if algo != "" {
			log.Debug("SSH 签名 (RSA-SHA2)", map[string]interface{}{
				"fingerprint": fp,
				"algorithm":   algo,
				"flags":       flags,
			})
			return algSigner.SignWithAlgorithm(rand.Reader, data, algo)
		}
	}

	log.Debug("SSH 签名 (fallback)", map[string]interface{}{
		"fingerprint": fp,