Re: [PATCH v6 5/9] ssh signing: parse ssh-keygen output and verify signatures

Fabian Stelzer [off-list ref] writes:

quoted

quoted

+		/* Search for the last "with" to get the full principal */
+		principal = line;
+		do {
+			search = strstr(line, " with ");
+			if (search)
+				line = search + 1;
+		} while (search != NULL);
+		sigc->signer = xmemdupz(principal, line - principal - 1);
+		sigc->fingerprint = xstrdup(strstr(line, "key") + 4);

OK.  This does not care the "RSA" part, which is future resistant.
It assumes the <algo>:<fingerprint> comes after literal " key ",
which I think is a reasonable thing to do.
However, we never checked if the line has "key" in it, so
strstr(line, "key") + 4 may not be pointing at where this code
expects.

Hmm. What would i do if i don't find "key"? Still mark the signature
as valid an just leave fingerprint & key empty?

We didn't get a satisfactory response from the ssh-keygen we expect
that tells us that the external tool successfully decided that the
signature is good or bad.  I would feel safer if we said we did not
see a good signature in such a case.