runner: -identity ignores the user's ssh config !365

merged merged by cmc on 2026-09-10 03:47 UTC · krz/gitbay:runner-own-identity into main

2 files changed, +12 −6

Layout: unified · split

cmd/gitbay-runner/config.go +7 −3

 }
 // identityOpts is what makes ssh and git use the runner's own key and no
-// other: on a laptop the ambient key is the user's full-scope one, which
+// other. On a laptop the user's ~/.ssh/config names their full-scope key
-// the runner protocol refuses.
+// for the instance, and IdentitiesOnly keeps identities from the config,
+// so the runner would authenticate as that key and, on an admin's
+// machine, claim every repository's builds. -F /dev/null drops the
+// config; known_hosts is unaffected, and a host seen for the first time
+// is accepted, since a service cannot answer a prompt.
 func identityOpts(path string) []string {
 	if path == "" {
 		return nil
 	}
-	return []string{"-i", path, "-o", "IdentitiesOnly=yes"}
+	return []string{"-F", "/dev/null", "-i", path, "-o", "IdentitiesOnly=yes", "-o", "StrictHostKeyChecking=accept-new"}
 }

cmd/gitbay-runner/config_test.go +5 −3

 	"flag"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 	if got := identityOpts(""); got != nil {
 		t.Fatalf("empty identity produced %v", got)
 	}
-	got := identityOpts("/k")
+	got := strings.Join(identityOpts("/k"), " ")
-	if len(got) != 4 || got[0] != "-i" || got[1] != "/k" || got[3] != "IdentitiesOnly=yes" {
+	want := "-F /dev/null -i /k -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
-		t.Fatalf("got %v", got)
+	if got != want {
+		t.Fatalf("got %q, want %q", got, want)
 	}
 }