07:56:53 .oO when user expectations and user behavior study do not meet:) 14:30:13 Doet gerrit not accept FIDO ssh keys? Or does it a take a while for new keys to sync? 14:40:06 Looks like it does not 14:40:11 I added by backup key and that works 14:40:32 Looks like our docs here https://illumos.org/docs/contributing/gerrit/ are not complete though, I can't scp the commit hook 14:40:56 https://gist.github.com/sjorge/b3936d86635e248dc8ae2fea2c0a00dd 14:45:34 Thanks to the internet, looks like I can fetch it from https://code.illumos.org/tools/hooks/commit-msg 14:45:43 Not sure why the scp is not working though 14:46:01 Other random using gerrit pages mention the exact same methode ¯\_(ツ)_/¯ 14:49:16 Oh nice the gerrit id gets auto added to tickets on our bugtracker 14:50:41 So aside from issues with FIDO ssh keys and the scp, all was done in ~ 2 minutes, not bad 14:56:12 Also a question about copyright header, IIRC one of the checks that ends up in mail_msg will complain about it because I didn't add one. I think for the pam stuff years ago it was OK to skip for tiny changes. And this one is even smaller. 15:26:02 sjorge - for copyright it's entirely up to you. You'll be the author in git anyway, which technically covers the CDDL requirement. There's also no problem with adding one even for a tiny change. Long way of saying that that part of pbchk output is not mandatory. 15:47:42 OK, given how tiny this one is I don't personally feel it warrants another line in the header 17:26:10 yeah, it's more of just a heads up in case you forgot 17:29:52 how does one change the status of an issue from new -> in progress? 17:30:36 hitting edit just allows me to add a new note 17:30:46 and ... just list copy link 18:34:45 sjorge: scp is because they (OpenSSH) broke scp 18:35:02 "scp -O ..." should work 18:35:21 I will just change it to use curl though 18:38:43 sjorge: By FIDO keys do you mean ecdsa-sk ? 18:40:02 Regular ecdsa keys will work, at least 19:01:54 yes, i was trying an ecdsa-sk 21:01:27 my one issue with ecdsa-sk is the lack of status notifications ("please touch your stick now") when used with ssh-agent 21:12:29 I have lost track of all the various bits and pieces of this 21:12:38 between arekinath's stuff and the other stuff, and then I think a 3rd other stuff 21:20:46 I just use pivy (arekinath's stuff) with yubikeys/smart cards 21:34:10 i used pivy for a while until the native support came 21:47:02 Interesting issue under openzfs: https://github.com/openzfs/zfs/issues/14260 23:04:26 I assume at some point the main use of pivy will become operations you can't perform via FIDO, like ECDH for deriving keys to encrypt data at rest 23:04:55 but there's still a very long tail of software that doesn't accept ecdsa-sk, like gerrit 23:05:22 arekinath: only if they implement their own ssh server? 23:05:35 primarily, yeah 23:06:03 but, like... libssh2 and putty and a bunch of the other SSH impls don't support it at all yet 23:06:46 it's the kind of change that takes a decade or more to get through the whole ecosystem, even though it gets through 50% of it very quickly 23:07:53 I am also pretty proud of -C in pivy-agent, which I would love openssh upstream to steal haha 23:09:04 (that's the agent forwarding connection confirm mode, where it detects connections forwarded from other machines and makes you consent to them using your keys, and the consent lasts for 15 sec but is renewed on further use, plus the consent prompt supports graphical desktop prompting) 23:09:39 -C is what you get for non-resident keys? 23:09:48 ah, ok 23:09:54 no auto-renewable for that 23:10:42 no, wait. not (non-resident) keys, but the no-touch option 23:10:54 (user presence) 23:11:20 it applies in addition to any touch requirement 23:11:24 extra step just for forwarded connections 23:11:47 but it's not per request, it's per connection, which is much less noisy and more pratical to use, especially with the renewal 23:12:55 yeah, different functionality (and wouldn't work out of the box for fido keys) 23:13:12 at least without duplicate work 23:13:19 it's kind of how hello works in that regard in windows 23:14:03 yeah, it was inspired a bit by that, and PIN caching rules for smartcards in windows in general 23:36:52 arekinath: https://code.illumos.org/c/illumos-gate/+/2566 23:36:53 → CODE REVIEW 2566: 15105 ilstr should be usable outside boot banner code (NEW) | https://www.illumos.org/issues/15105