From 192293cdcae75f1f1bb4247c8f3b28ada48ad916 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Wed, 12 Aug 2026 18:42:58 +0000 Subject: [PATCH] offer to add an ssh key even when one already exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The zip option was already gone — it never came across in the port, since the file is key material that cannot live in the repository and the script no longer sits next to it. Pasting a public key was already the first option. What was missing is the case where the account HAS a key: the section went straight to hardening, so there was no way to authorise a second machine, a rebuilt laptop or anyone else, and the original had no way to do it at all. The same menu is now offered either way. What differs is whether it can be declined without consequence: with no key, declining means the hardening below refuses too, and the run says so rather than quietly moving on. confirm() takes an optional default so this one can be [y/N]. Most questions in this script are "do the thing you already asked for" and Enter should mean yes; a genuine extra defaulting to yes is how people end up agreeing to things by reflex. A pasted key is trimmed before validation. Copying from a terminal or a password manager routinely brings leading or trailing whitespace, and ssh-keygen will not parse a key with it attached — which would have read as "that is not a valid key" for a key that is perfectly fine. Also corrected the reason unzip is in core utils, which still said it was there to open ssh-keys.zip. Verified: the add-another prompt appears and defaults to no, a whitespace-wrapped key is trimmed and accepted, and the already-hardened path is unchanged. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/setup/machine-setup/lib/base.sh | 16 +++++++++---- scripts/setup/machine-setup/lib/packages.sh | 10 ++++---- scripts/setup/machine-setup/machine-setup.sh | 25 +++++++++++++++++--- 3 files changed, 39 insertions(+), 12 deletions(-) diff --git a/scripts/setup/machine-setup/lib/base.sh b/scripts/setup/machine-setup/lib/base.sh index eaaab9c5..7812575c 100644 --- a/scripts/setup/machine-setup/lib/base.sh +++ b/scripts/setup/machine-setup/lib/base.sh @@ -145,18 +145,26 @@ prompt_value() { # # ASSUME_YES=1 answers all of them, for an unattended run. confirm() { - local message="${1:-Proceed?}" answer - [[ "${ASSUME_YES:-}" == "1" ]] && return 0 + local message="${1:-Proceed?}" + # Second argument flips the default. Most questions here are "do the thing you + # already asked for" and Enter should mean yes; a few are genuine extras, where + # defaulting to yes would have people agreeing to them by reflex. + local default="${2:-y}" answer prompt + + [[ "${ASSUME_YES:-}" == "1" ]] && { [[ "$default" == "y" ]] && return 0 || return 1; } + + if [[ "$default" == "y" ]]; then prompt="[Y/n]"; else prompt="[y/N]"; fi while true; do # EOF is not a yes. Without this an unattended run without ASSUME_YES would # spin here forever. - if ! read -rp " ${message} [Y/n]: " answer; then + if ! read -rp " ${message} ${prompt}: " answer; then echo "" fail "No answer. Set ASSUME_YES=1 to run without prompts." fi + [[ -z "$answer" ]] && answer="$default" case "$answer" in - "" | y | Y | yes | Yes) return 0 ;; + y | Y | yes | Yes) return 0 ;; n | N | no | No) return 1 ;; *) warn "Answer y or n." ;; esac diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh index 4828a6f3..8ff1bf82 100644 --- a/scripts/setup/machine-setup/lib/packages.sh +++ b/scripts/setup/machine-setup/lib/packages.sh @@ -45,11 +45,11 @@ LAST_SKIPPED=() # that make a machine worth sitting at. # # The first six are load-bearing and each is used by a later step — curl fetches -# in nine of them, jq parses the lazygit release API, unzip opens ssh-keys.zip, -# gnupg dearmors the Docker keyring, git clones the Neovim config, and -# ca-certificates is what makes any of the fetching work. The rest are the -# environment: nothing calls them, they are here because a box you use should -# have them. +# in nine of them, jq parses the lazygit release API, gnupg dearmors the Docker +# keyring, git clones the Neovim config, unzip opens anything that arrives as an +# archive, and ca-certificates is what makes any of the fetching work. The rest +# are the environment: nothing calls them, they are here because a box you use +# should have them. # # build-essential is the one entry with any reach beyond itself: it is a # meta-package (gcc, g++, make, libc6-dev, dpkg-dev), so on a machine where a diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh index b43a29ca..d48fc35c 100755 --- a/scripts/setup/machine-setup/machine-setup.sh +++ b/scripts/setup/machine-setup/machine-setup.sh @@ -849,10 +849,26 @@ if ! skip; then echo " root login: $(sshd_effective permitrootlogin)" # ── a key first ── + # + # The same menu whether or not there is already one, because "add another" is a + # real need — a second laptop, a rebuilt machine — and the original had no way + # to do it at all. What changes is whether the question can be declined: with no + # key, declining means the hardening below will refuse too, and the run says so. + ADD_KEY=false if ((KEY_COUNT == 0)); then echo "" warn "${USERNAME} has no authorised key. Password login cannot be turned off until it has one." - echo " [1] paste a public key (the contents of your ~/.ssh/id_ed25519.pub)" + ADD_KEY=true + else + fix_ssh_permissions + echo "" + ADD_KEY=false + confirm "Add another authorised key for ${USERNAME}?" n && ADD_KEY=true + fi + + if $ADD_KEY; then + echo "" + echo " [1] paste a public key (one line, from your own ~/.ssh/id_ed25519.pub)" echo " [2] generate a new keypair on this machine" echo " [3] leave it for now" echo "" @@ -866,6 +882,11 @@ if ! skip; then case "${SSH_KEY_CHOICE:-1}" in 1) read -rp " Paste the public key: " SSH_PASTED || fail "No answer." + # Trimmed: pasting from a terminal or a password manager routinely + # brings leading or trailing whitespace, and ssh-keygen will not parse + # a key with it attached. + SSH_PASTED="${SSH_PASTED#"${SSH_PASTED%%[![:space:]]*}"}" + SSH_PASTED="${SSH_PASTED%"${SSH_PASTED##*[![:space:]]}"}" add_authorized_key "$SSH_PASTED" && SSH_KEY_DONE=true ;; 2) @@ -883,8 +904,6 @@ if ! skip; then esac done KEY_COUNT="$(authorized_key_count)" - else - fix_ssh_permissions fi # ── then hardening, and only then ──