From d7205a911cf6aee68af63835dc96e22e0e2218f9 Mon Sep 17 00:00:00 2001 From: Mortdecai Date: Tue, 15 Sep 2026 19:39:33 -0400 Subject: [PATCH] fix: pass pubkey to tank-side.sh via env, not ssh command arg ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519 (the key body and comment became $2/$3). The loose validation passed and grep -qF matched any ed25519 key -> false '[skip] key present'; the key was never added. Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'. Co-Authored-By: Claude Opus 4.8 --- scripts/run.sh | 2 +- scripts/tank-side.sh | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/scripts/run.sh b/scripts/run.sh index 030c7c2..1c6c5f7 100755 --- a/scripts/run.sh +++ b/scripts/run.sh @@ -29,5 +29,5 @@ ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/ [[ ${1:-} == --no-tank ]] && exit 0 PUB=$(ssh mac cat .ssh/id_ed25519.pub) -ssh pve173 'bash -s' -- "$PUB" < scripts/tank-side.sh +ssh pve173 "PUB='$PUB' bash -s" < scripts/tank-side.sh echo "tank side done; test: ssh mac ~/mac/scripts/backup.sh" diff --git a/scripts/tank-side.sh b/scripts/tank-side.sh index bb6f669..0fd5532 100755 --- a/scripts/tank-side.sh +++ b/scripts/tank-side.sh @@ -1,8 +1,10 @@ #!/bin/bash -# Run on pve173: ssh pve173 'bash -s' -- "" < scripts/tank-side.sh +# Run on pve173: ssh pve173 "PUB='' bash -s" < scripts/tank-side.sh +# PUB comes via env (not a command arg) so ssh's remote-side re-splitting can't truncate the +# space-separated key line. $1 kept as a fallback for a local run. set -euo pipefail -PUB=${1:?pubkey line required} -[[ $PUB == ssh-ed25519* ]] || { echo "not a pubkey: $PUB"; exit 1; } +PUB=${PUB:-${1:-}} +[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "not a full pubkey line: '$PUB'"; exit 1; } DS=tank/backups/mac; TS=$(date +%s) if zfs list "$DS" >/dev/null 2>&1; then echo "[skip] dataset $DS"; else zfs create "$DS"; echo "[set] created $DS"; fi if grep -q "^\[$DS\]" /etc/sanoid/sanoid.conf; then echo "[skip] sanoid stanza"; else