Method loadSSHKeys

internal/plugins/command-runner/ssh_client.go:210–265

loadSSHKeys returns SSH signers from all available sources in priority order: 1. SSH agent (if SSH_AUTH_SOCK is set) — supports encrypted and hardware keys 2. Explicit keyPath if provided 3. Standard key paths (~/.ssh/id_ed25519, id_rsa, id_ecdsa) as fallback

(keyPath string)

//  2. Explicit keyPath if provided
//  3. Standard key paths (~/.ssh/id_ed25519, id_rsa, id_ecdsa) as fallback
func (c *SSHClientImpl) loadSSHKeys(keyPath string) ([]ssh.Signer, error) {
	var signers []ssh.Signer

	// 1. SSH agent
	if sock := os.Getenv("SSH_AUTH_SOCK"); sock != "" {
		// nolint:gosec // G704: sock is sourced from SSH_AUTH_SOCK env var, not user input
		if conn, err := net.Dial("unix", sock); err == nil {
			agentSigners, err := agent.NewClient(conn).Signers()
			if err == nil && len(agentSigners) > 0 {
				crSSHLogger().Debug("SSH auth: loaded %d signer(s) from SSH agent", len(agentSigners))
				signers = append(signers, agentSigners...)
			}
		}
	}

	// 2. Explicit keyfile or standard paths
	homeDir, err := os.UserHomeDir()
	if err != nil {
		if len(signers) > 0 {
			return signers, nil
		}
		return nil, fmt.Errorf("failed to get home directory: %w", err)
	}

	var keyPaths []string
	if keyPath != "" {
		keyPaths = []string{keyPath}
	} else {
		keyPaths = []string{
			filepath.Join(homeDir, ".ssh", "id_ed25519"),
			filepath.Join(homeDir, ".ssh", "id_rsa"),
			filepath.Join(homeDir, ".ssh", "id_ecdsa"),
		}
	}

	for _, candidate := range keyPaths {
		// nolint:gosec // G304: Reading SSH keys from configured/standard paths is expected behavior
		keyBytes, err := os.ReadFile(candidate)
		if err != nil {
			continue // key doesn't exist at this path
		}
		signer, err := ssh.ParsePrivateKey(keyBytes)
		if err != nil {
			crSSHLogger().Debug("SSH auth: skipping key %s (encrypted or unsupported format)", candidate)
			continue // encrypted key — agent should cover this case
		}
		crSSHLogger().Debug("SSH auth: loaded key from %s", candidate)
		signers = append(signers, signer)
	}

	if len(signers) == 0 {
		return nil, fmt.Errorf("no SSH authentication available: SSH_AUTH_SOCK not set and no readable keys found in %v", keyPaths)
	}

	return signers, nil
}

// ExecuteContainerCommand executes a command in an LXC container via SSH to the host.