Feedback-ID: idd01497b:Fastmail
Content-Type: multipart/mixed;
 boundary=9e6c123686297078ee95638402068ec25549f640735bcb497aa45806d44b
Mime-Version: 1.0
Date: Mon, 17 Aug 2026 16:08:51 +0000
Message-Id: <DKRCKXI6J43G.3MQR3PFS7KB76@partin.io>
Subject: Re: Broken SSH Key Parsing
To: "pgsql-www" <pgsql-www@lists.postgresql.org>
From: "Tristan Partin" <tristan@partin.io>
References: <DKMDXC18PP0D.126KL701ABSLA@partin.io>
In-Reply-To: <DKMDXC18PP0D.126KL701ABSLA@partin.io>
Archived-At: 
 <https://www.postgresql.org/message-id/DKRCKXI6J43G.3MQR3PFS7KB76%40partin.io>
Precedence: bulk

--9e6c123686297078ee95638402068ec25549f640735bcb497aa45806d44b
Content-Type: multipart/alternative;
 boundary=017ffab37d9f4c04e0ea46ae1c40eca21d852144bed0e1082b5a9398c04e

--017ffab37d9f4c04e0ea46ae1c40eca21d852144bed0e1082b5a9398c04e
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Type: text/plain; charset=UTF-8

On Tue Aug 11, 2026 at 8:08 PM UTC, Tristan Partin wrote:
> Hey folks,
>
> I just got access to a Git repository on postgresql.org, so I started=20
> going through the motions of adding an SSH key to my profile. I was=20
> unable to add my key as-is, so I figured that I would flag the issue. My=
=20
> public SSH key looks something like this:
>
> 	ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABB=
BDPYnw8WWCrgL0sXijK7BY1Qz7KJlQZNe+ErNNwmfqazAd/CuTNNdENj21R6iR2CsjoEZ1prFcj=
/hPDV/j4nf7s=3D email@example.com (hostname)
>
> Accordingto to SSH key documentation[0], an SSH key is composed of=20
> 3 components:
>
> 	A B C
>
> A: The key type
> B: Base64-encoded public key
> C: An optional comment
>
> The problem with this key in particular is the comment. If I remove=20
> `(hostname)` from the key, postgresql.org will accept the key. I have=20
> a suspicion that we are probably incorrectly validating the key. Some=20
> pseudocode that would illustrate my hypothesis:
>
> 	keys =3D []
> 	for t in text.splitlines():
> 		sections =3D t.split(" ")
> 		if len(sections) < 2 or len(sections) > 3:
> 			raise ValueError("Invalid SSH key format")
>
> 		keys.append(OpenSSHKey(sections[0], sections[1], sections[2] if len(sec=
tions) =3D=3D 3 else None))
>
> I am happy to investigate this further if I can get read access to the=20
> postgresql.org site.
>
> I find my current comment format, including the hostname, to be useful=20
> when identifying the email and machine the key belongs to. I'll work=20
> around it for now.
>
> [0]: https://sshref.dev/#intro_legc_pub

Here is a patch to improve things a bit. We should probably add some=20
unit tests for this.

--=20
Tristan Partin
PostgreSQL Contributors Team
AWS (https://aws.amazon.com)

--017ffab37d9f4c04e0ea46ae1c40eca21d852144bed0e1082b5a9398c04e--

--9e6c123686297078ee95638402068ec25549f640735bcb497aa45806d44b
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=v1-0001-Improve-SSH-key-parsing.patch
Content-Type: text/x-patch; charset=utf-8;
 name=v1-0001-Improve-SSH-key-parsing.patch

RnJvbSA5NjY4MTdhMDYwY2JkYTZmZTJmZGM4MDJjMjZlYjE5NzQyNWU2YWU0IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBUcmlzdGFuIFBhcnRpbiA8dHJpc3RhbkBwYXJ0aW4uaW8+CkRh
dGU6IE1vbiwgMTcgQXVnIDIwMjYgMTU6NDY6NDAgKzAwMDAKU3ViamVjdDogW1BBVENIIHYxXSBJ
bXByb3ZlIFNTSCBrZXkgcGFyc2luZwoKV2UgcHJldmlvdXNseSByZWplY3RlZCBTU0gga2V5cyB3
aXRoIGNvbW1lbnRzIHRoYXQgaW5jbHVkZWQgc3BhY2VzLgpOb3RoaW5nIGluIHRoZSBTU0gga2V5
IHNwZWNpZmljYXRpb24gZm9yYmlkcyB0aGF0LgoKU2lnbmVkLW9mZi1ieTogVHJpc3RhbiBQYXJ0
aW4gPHRyaXN0YW5AcGFydGluLmlvPgotLS0KIHBnd2ViL2NvcmUvbW9kZWxzLnB5IHwgMTIgKysr
KysrKystLS0tCiAxIGZpbGUgY2hhbmdlZCwgOCBpbnNlcnRpb25zKCspLCA0IGRlbGV0aW9ucygt
KQoKZGlmZiAtLWdpdCBhL3Bnd2ViL2NvcmUvbW9kZWxzLnB5IGIvcGd3ZWIvY29yZS9tb2RlbHMu
cHkKaW5kZXggNjNlYjgyNzUuLjBkYTY2MWRhIDEwMDY0NAotLS0gYS9wZ3dlYi9jb3JlL21vZGVs
cy5weQorKysgYi9wZ3dlYi9jb3JlL21vZGVscy5weQpAQCAtMjU4LDE4ICsyNTgsMjIgQEAgZGVm
IGRhdGUoc2VsZik6CiAKIAogIyBPcHRpb25zLCBrZXl0eXBlLCBrZXksIGNvbW1lbnQuIEJ1dCB3
ZSBkb24ndCBzdXBwb3J0IG9wdGlvbnMuCi1kZWYgdmFsaWRhdGVfc3Noa2V5KGtleSk6CitkZWYg
dmFsaWRhdGVfc3Noa2V5KGtleTogc3RyKToKICAgICBsaW5lcyA9IGtleS5zcGxpdGxpbmVzKCkK
ICAgICBmb3IgayBpbiBsaW5lczoKLSAgICAgICAgcGllY2VzID0gay5zcGxpdCgpCisgICAgICAg
IHBpZWNlcyA9IGsuc3BsaXQobWF4c3BsaXQ9MikKICAgICAgICAgaWYgbGVuKHBpZWNlcykgPT0g
MDoKICAgICAgICAgICAgIHJhaXNlIFZhbGlkYXRpb25FcnJvcigiRW1wdHkga2V5cyBhcmUgbm90
IGFsbG93ZWQiKQotICAgICAgICBpZiBsZW4ocGllY2VzKSA+IDM6CisgICAgICAgIGlmIGxlbihw
aWVjZXMpIDwgMjoKICAgICAgICAgICAgIHJhaXNlIFZhbGlkYXRpb25FcnJvcignUGFzdGUgZWFj
aCBzc2gga2V5IHdpdGhvdXQgb3B0aW9ucywgZS5nLiAic3NoLXJzYSBBQUFBYmJiY2MgbXlrZXlA
bWFjaGluZSInKQogICAgICAgICBpZiBwaWVjZXNbMF0gPT0gJ3NzaC1kc3MnOgogICAgICAgICAg
ICAgcmFpc2UgVmFsaWRhdGlvbkVycm9yKCJGb3Igc2VjdXJpdHkgcmVhc29ucywgc3NoLWRzcyBr
ZXlzIGFyZSBub3Qgc3VwcG9ydGVkIikKICAgICAgICAgaWYgcGllY2VzWzBdIG5vdCBpbiBfdmFs
aWRfa2V5dHlwZXM6Ci0gICAgICAgICAgICByYWlzZSBWYWxpZGF0aW9uRXJyb3IoIk9ubHkga2V5
cyBvZiB0eXBlcyB7MH0gYXJlIHN1cHBvcnRlZCwgbm90IHsxfS4iLmZvcm1hdCgiLCAiLmpvaW4o
X3ZhbGlkX2tleXR5cGVzKSwgcGllY2VzWzBdKSkKKyAgICAgICAgICAgIHJhaXNlIFZhbGlkYXRp
b25FcnJvcigKKyAgICAgICAgICAgICAgICAnT25seSBrZXlzIG9mIHR5cGVzIHswfSBhcmUgc3Vw
cG9ydGVkLCBub3QgInsxfSIuICcKKyAgICAgICAgICAgICAgICAnSWYgeW91IHBhc3RlZCBhIGtl
eSB3aXRoIG9wdGlvbnMgKGUuZy4gZnJvbSBhbiBhdXRob3JpemVkX2tleXMgZmlsZSksICcKKyAg
ICAgICAgICAgICAgICAncmVtb3ZlIHRoZSBvcHRpb25zIGZpZWxkIGJlZm9yZSB0aGUga2V5IHR5
cGUuJy5mb3JtYXQoIiwgIi5qb2luKF92YWxpZF9rZXl0eXBlcyksIHBpZWNlc1swXSkKKyAgICAg
ICAgICAgICkKICAgICAgICAgdHJ5OgogICAgICAgICAgICAgYmFzZTY0LmI2NGRlY29kZShwaWVj
ZXNbMV0pCiAgICAgICAgIGV4Y2VwdCBFeGNlcHRpb24gYXMgZToKLS0gClRyaXN0YW4gUGFydGlu
Cmh0dHBzOi8vdHJpc3Rhbi5wYXJ0aW4uaW8KCg==
--9e6c123686297078ee95638402068ec25549f640735bcb497aa45806d44b--