Christian Couder [off-list ref] writes:
It seems to me that fingerprint_stdout should contain something like:
4096 SHA256:PelI2esT2xZlv20wJJyYOkQsli5RMK79oJ2VxqYb2PA
christian.couder@gmail.com (RSA)
and it looks like the 'key_size fingerprint_hash:fingerprint comment
(key_type)' format is the standard `ssh-keygen -l` output.
So I think it's safe to say that we should expect
`string_list_split(..., 2)` to return 3. That should work even if
there is no comment in the key file.
I do not know why you or anybody can think it is safe from what you
observed above, though. Who or which page of what manual told us
that the key owner's identity part cannot be missing?
But on the other hand, I think it's also acceptable to say that we
just want to keep the same behavior as the original code and check its
return value with `> 1` since we only need the second element
resulting from the split.
Yes, as a code clean-up topic, I think it is the *only* acceptable
thing to do. Finding the source to justify tightening of the rule
to validate data to insist we have to see 3 pieces can be left to a
separate topic once this series settles.
Thanks.