mantle: make kola use ecdsa SSH keys #1749
Conversation
|
This is needed for the switch to Fedora 33 so our tests can run. |
|
This looks good to me but to be more precise, it's RSA-SHA1 that is being deprecated not RSA 2048+ with SHA2+. I don't know why this is interpreted as RSA-SHA1 by the agent though so I would say let's go with this. |
There was a problem hiding this comment.
Looks like the unit test needs fixing.
Seems OK to me but I also personally prefer ed25519 keys. See https://www.google.com/search?client=firefox-b-1-d&q=ecdsa+vs+ed25519
dustymabe
force-pushed
the
dusty-kola-update-ssh-key
branch
from
59ba03f to
e0751e3
Compare
Thanks Walters, fixed! |
|
/lgtm |
|
I tried restarting the Jenkins job but clicking didn't do anything and clicking |
|
@dustymabe try a force push? |
dustymabe
force-pushed
the
dusty-kola-update-ssh-key
branch
from
e0751e3 to
dd642a3
Compare
done.. will need to re-add |
|
/lgtm Still investigating Jenkins weirdness. Can you leave this PR open and just open another one for now? It looks specific to this PR. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dustymabe, jlebon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Upstream SSH has been claiming [1] for a few releases now that: ``` It is now possible to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release. ``` In Fedora we switched recently [2] to disallow ssh-rsa so we need to switch our tools to a different type of key. [1] https://www.openssh.com/txt/release-8.3 [2] https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/b298a9e107b7e9699b36879eca031d1900ded1c4
dustymabe
force-pushed
the
dusty-kola-update-ssh-key
branch
from
dd642a3 to
8b170b3
Compare
|
New changes are detected. LGTM label has been removed. |
|
This breaks In particular, AWS only supports RSA keys (see docs):
|
… f33 For F33 let's re-enable RSA-SHA1 keys for now so our kola tests will work. The plan is to only re-enable this briefly while we wait for an upstream feature [1] to be implemented. We had moved to an ecdsa key [2] but AWS doesn't support non RSA keys [3] so we reverted it for now in [4]. [1] golang/go#37278 (comment) [2] coreos/coreos-assembler#1749 [3] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#how-to-generate-your-own-key-and-import-it-to-aws [4] coreos/coreos-assembler#1767
… f33 For F33 let's re-enable RSA-SHA1 keys for now so our kola tests will work. The plan is to only re-enable this briefly while we wait for an upstream feature [1] to be implemented. We had moved to an ecdsa key [2] but AWS doesn't support non RSA keys [3] so we reverted it for now in [4]. [1] golang/go#37278 (comment) [2] coreos/coreos-assembler#1749 [3] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#how-to-generate-your-own-key-and-import-it-to-aws [4] coreos/coreos-assembler#1767
… f33 For F33 let's re-enable RSA-SHA1 keys for now so our kola tests will work. The plan is to only re-enable this briefly while we wait for an upstream feature [1] to be implemented. We had moved to an ecdsa key [2] but AWS doesn't support non RSA keys [3] so we reverted it for now in [4]. [1] golang/go#37278 (comment) [2] coreos/coreos-assembler#1749 [3] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#how-to-generate-your-own-key-and-import-it-to-aws [4] coreos/coreos-assembler#1767
Upstream SSH has been claiming [1] for a few releases now that:
In Fedora we switched recently [2] to disallow ssh-rsa so we need to
switch our tools to a different type of key.
[1] https://www.openssh.com/txt/release-8.3
[2] https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/b298a9e107b7e9699b36879eca031d1900ded1c4