Seth/mac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: pass pubkey to tank-side.sh via env, not ssh command arg

Browse Source 
ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519
(the key body and comment became $2/$3). The loose validation passed and grep -qF
matched any ed25519 key -> false '[skip] key present'; the key was never added.
Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Mortdecai
2026-09-15 19:39:33 -04:00
parent af51e0cfa3
commit d7205a911c
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tank-side.sh
+5 -3
View File
@@ -1,8 +1,10 @@
#!/bin/bash
# Run on pve173: ssh pve173 'bash -s' -- "<pubkey>" < scripts/tank-side.sh
# Run on pve173: ssh pve173 "PUB='<pubkey line>' bash -s" < scripts/tank-side.sh
# PUB comes via env (not a command arg) so ssh's remote-side re-splitting can't truncate the
# space-separated key line. $1 kept as a fallback for a local run.
set -euo pipefail
PUB=${1:?pubkey line required}
[[ $PUB == ssh-ed25519* ]] || { echo "not a pubkey: $PUB"; exit 1; }
PUB=${PUB:-${1:-}}
[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "not a full pubkey line: '$PUB'"; exit 1; }
DS=tank/backups/mac; TS=$(date +%s)
if zfs list "$DS" >/dev/null 2>&1; then echo "[skip] dataset $DS"; else zfs create "$DS"; echo "[set] created $DS"; fi
if grep -q "^\[$DS\]" /etc/sanoid/sanoid.conf; then echo "[skip] sanoid stanza"; else