Merge pull request #94 from fosrl/dev

Remove cert validation check

Author: oschwartz10612

cmd/ssh/jit.go

@@ -1,14 +1,11 @@
 package ssh
 
 import (
-	"bytes"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/fosrl/cli/internal/api"
 	"github.com/fosrl/cli/internal/sshkeys"
-	"golang.org/x/crypto/ssh"
 )
 
 const (
@@ -17,34 +14,6 @@ const (
 	pollBackoffSteps  = 6
 )
 
-func validateSignedCert(pubKey, cert string) error {
-	cert = strings.TrimSpace(cert)
-	if cert == "" {
-		return fmt.Errorf("API returned an empty SSH certificate")
-	}
-
-	pubParsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubKey))
-	if err != nil {
-		return fmt.Errorf("parse generated public key: %w", err)
-	}
-
-	certParsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(cert))
-	if err != nil {
-		return fmt.Errorf("parse returned certificate: %w", err)
-	}
-
-	certKey, ok := certParsed.(*ssh.Certificate)
-	if !ok {
-		return fmt.Errorf("API returned %q instead of an SSH certificate", certParsed.Type())
-	}
-
-	if !bytes.Equal(certKey.Key.Marshal(), pubParsed.Marshal()) {
-		return fmt.Errorf("returned certificate does not match generated key")
-	}
-
-	return nil
-}
-
 // GenerateAndSignKey generates an Ed25519 key pair and signs the public key via the API.
 func GenerateAndSignKey(client *api.Client, orgID string, resourceID string, username string) (privPEM, pubKey, cert string, signData *api.SignSSHKeyData, err error) {
 	privPEM, pubKey, err = sshkeys.GenerateKeyPair()
@@ -68,11 +37,6 @@ func GenerateAndSignKey(client *api.Client, orgID string, resourceID string, use
 	} else if initResp.MessageID != 0 {
 		messageIDs = []int64{initResp.MessageID}
 	} else {
-		if initResp.AuthDaemonMode != "native" {
-			if err := validateSignedCert(pubKey, initResp.Certificate); err != nil {
-				return "", "", "", nil, fmt.Errorf("SSH error: invalid certificate: %w", err)
-			}
-		}
 		// return the data as this is okay
 		return privPEM, pubKey, initResp.Certificate, initResp, nil
 	}
@@ -90,11 +54,6 @@ func GenerateAndSignKey(client *api.Client, orgID string, resourceID string, use
 				if msg.Error != nil && *msg.Error != "" {
 					return "", "", "", nil, fmt.Errorf("SSH error: %s", *msg.Error)
 				}
-				if initResp.AuthDaemonMode != "native" {
-					if err := validateSignedCert(pubKey, initResp.Certificate); err != nil {
-						return "", "", "", nil, fmt.Errorf("SSH error: invalid certificate: %w", err)
-					}
-				}
 				return privPEM, pubKey, initResp.Certificate, initResp, nil
 			}
 		}