Push-mirror SSH host keys: persist accept-new trust + surface host-key status #625

New issue

Closed

opened 2026-09-16 15:47:34 +00:00 by crueber · 1 comment

crueber commented

2026-09-16 15:47:34 +00:00

Owner

Follow-up recommended by the #623 review (PR #624): SSH accept-new trust lands on ephemeral disk with no verification surface. Document the choice (done in 13_push_mirror.md), then: persist accepted host keys server-side (bucket sidecar, alongside the mirror config) and surface host-key status (fingerprint, first-accepted-at) in the push-mirror Settings section, so operators can verify/pin instead of trusting every sync. Prod guidance until then: pin known_hosts.

crueber added this to the v1 milestone

2026-09-16 15:47:34 +00:00

crueber added the

enhancement

issues

labels

2026-09-16 15:47:34 +00:00

crueber referenced this issue

2026-09-16 16:10:14 +00:00

Push mirroring: push repos to an upstream (password/token/SSH-key auth, keypair generation) with on-push + optional scheduled sync #623

crueber referenced this issue from a commit

2026-09-16 16:37:02 +00:00

Push-mirror SSH host-key trust: persist accept-new + surface status (Fix #625)

crueber referenced this issue from a pull request that will close it,

2026-09-16 16:37:07 +00:00

Push-mirror SSH host-key trust: persist accept-new + surface status (Fix #625) #626

crueber referenced this issue

2026-09-16 16:42:50 +00:00

Push-mirror SSH host-key trust: persist accept-new + surface status (Fix #625) #626

crueber closed this issue

2026-09-16 16:43:31 +00:00

crueber referenced this issue from a commit

2026-09-16 16:43:31 +00:00

Merge pull request 'Push-mirror SSH host-key trust: persist accept-new + surface status (Fix #625)' (#626) from fix/issue-625 into main

crueber commented

2026-09-16 16:43:40 +00:00

Author

Owner

Fixed by #626 (merged): accept-new trust harvested into the bucket secret sidecar (merge, operator pins win, steady-state skips writes, first-accepted-at stamped once) with fingerprint/accepted-at surfaced in the view + Settings (ETag-covered). Review fixed pre-merge: HashKnownHosts=no (salted hashes would defeat dedupe), harvest CAS re-merge loop (concurrent operator PUT no longer clobbered), stamp reset on clear. Verified: pushmirror 95.5%/api 95.4% cover, -race green, stub-git e2e + 1612 web unit green, independent review APPROVE.