.oO when user expectations and user behavior study do not meet:)

Doet gerrit not accept FIDO ssh keys? Or does it a take a while for new keys to sync?

Looks like it does not

I added by backup key and that works

Looks like our docs here illumos.org/docs/contributing/gerrit are not complete though, I can't scp the commit hook

Thanks to the internet, looks like I can fetch it from code.illumos.org/tools/hooks/commit-msg

Not sure why the scp is not working though

Other random using gerrit pages mention the exact same methode ¯\_(ツ)_/¯

Oh nice the gerrit id gets auto added to tickets on our bugtracker

So aside from issues with FIDO ssh keys and the scp, all was done in ~ 2 minutes, not bad

Also a question about copyright header, IIRC one of the checks that ends up in mail_msg will complain about it because I didn't add one. I think for the pam stuff years ago it was OK to skip for tiny changes. And this one is even smaller.

sjorge - for copyright it's entirely up to you. You'll be the author in git anyway, which technically covers the CDDL requirement. There's also no problem with adding one even for a tiny change. Long way of saying that that part of pbchk output is not mandatory.

OK, given how tiny this one is I don't personally feel it warrants another line in the header

yeah, it's more of just a heads up in case you forgot

how does one change the status of an issue from new -> in progress?

hitting edit just allows me to add a new note

and ... just list copy link

sjorge: scp is because they (OpenSSH) broke scp

"scp -O ..." should work

I will just change it to use curl though

sjorge: By FIDO keys do you mean ecdsa-sk ?

Regular ecdsa keys will work, at least

yes, i was trying an ecdsa-sk

my one issue with ecdsa-sk is the lack of status notifications ("please touch your stick now") when used with ssh-agent

I have lost track of all the various bits and pieces of this

between arekinath's stuff and the other stuff, and then I think a 3rd other stuff

I just use pivy (arekinath's stuff) with yubikeys/smart cards

i used pivy for a while until the native support came

Interesting issue under openzfs: openzfs/zfs #14260

I assume at some point the main use of pivy will become operations you can't perform via FIDO, like ECDH for deriving keys to encrypt data at rest

but there's still a very long tail of software that doesn't accept ecdsa-sk, like gerrit

arekinath: only if they implement their own ssh server?

primarily, yeah

but, like... libssh2 and putty and a bunch of the other SSH impls don't support it at all yet

it's the kind of change that takes a decade or more to get through the whole ecosystem, even though it gets through 50% of it very quickly

I am also pretty proud of -C in pivy-agent, which I would love openssh upstream to steal haha

(that's the agent forwarding connection confirm mode, where it detects connections forwarded from other machines and makes you consent to them using your keys, and the consent lasts for 15 sec but is renewed on further use, plus the consent prompt supports graphical desktop prompting)

-C is what you get for non-resident keys?

ah, ok

no auto-renewable for that

no, wait. not (non-resident) keys, but the no-touch option

(user presence)

it applies in addition to any touch requirement

extra step just for forwarded connections

but it's not per request, it's per connection, which is much less noisy and more pratical to use, especially with the renewal

yeah, different functionality (and wouldn't work out of the box for fido keys)

at least without duplicate work

it's kind of how hello works in that regard in windows

yeah, it was inspired a bit by that, and PIN caching rules for smartcards in windows in general

arekinath: code.illumos.org/c/illumos-gate/+/2566

→ CODE REVIEW 2566: 15105 ilstr should be usable outside boot banner code (NEW) | illumos.org/issues/15105