New SSH keys with comments including whitespace are truncated

[JeffMelton]

Steps to recreate:

• Create a new SSH key: ssh-keygen -t rsa -b 4096 -C "comment with whitespace"
• Copy new key to clipboard: xclip -sel clip < ~/.ssh/id_rsa.pub
• Add it to a user's authorized keys via GoGS web GUI
  • Account Settings -> SSH Keys -> Add Key
  • paste clipboard contents
  • name key
  • Add Key
• Attempt to authenticate: ssh -T git@example.com

Expected behavior:

• GoGS should not truncate comments on whitespace.
• From sshd(8) (emphasis mine):

Bits, exponent, and modulus are taken directly from the RSA host key; they can be obtained, for example, from /etc/ssh/ssh_host_key.pub. The optional comment field continues to the end of the line, and is not used.

---

I've looked at the git user's authorized_keys file on my server, and can confirm that the comment is truncated at the first whitespace. If one creates a new SSH key without comment, or without whitespace, i.e. ssh-keygen -t rsa -b 4096 -C "comment_without_whitespace", and follows the same steps as above for adding the key to the GoGS user, one is able to authenticate successfully.

(updates for clarity and more info)

[unknwon]

Thanks your feedback!

Simple question first:

Does truncated SSH key make you unable to git push/pull through SSH?

[JeffMelton]

That's correct. All repo access is denied.

[JeffMelton]

With apologies, I'd forgotten to check which version of GoGS I was running. I've updated now to 0.6.11, and can confirm that key comments are still being truncated but -- for reasons unclear to me -- I'm able to authenticate successfully.

I'd say there's still a bug, in that comments shouldn't be truncated, but that its severity is diminished somewhat.

Again, sorry for filing an issue against an older version.

---

Other info:
git version 1.7.10.4
Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u3 x86_64 GNU/Linux

[unknwon]

Hi @JeffMelton thanks for following up!

I've pushed a fix on master, please help test again!

[JeffMelton]

Yes, that seems to have done the trick. Thanks!

[unknwon]

@JeffMelton Awesome, thanks your confirmation!