lzap
September 9, 2026, 11:35am
1
Hello, we have removed the gem dependency called sshkey from Foreman Core. Foreman no longer use this Ruby library for SSH key generation and call ssh-keygen instead:
develop ← lzap:sshkey1
opened 02:38PM - 19 Aug 26 UTC
For FIPS/PQC, we want to remove all SSH related rubygems that do not provide all… required features. More generally, we would like to simplify security stack in Foreman and leverage OpenSSH library of the system.
This is a multi-commit PR that does the following:
* Refactors relevant code from model/validator into a service class SshKey (no changes)
* Covers it with unit tests with all supported modern ssh keys as fixtures (no changes)
* Rewrite the implementation to using `ssh-keygen` instead and add generate method
As you can see, there is one functional change that comes with the refactoring. The original rubygem returned key lengths in total number of bits, whereas `ssh-keygen` returns number of bits of elyptic curves (or something like that - not important). Therefore, length do change and now they reflect what OpenSSH returns which is for the good. Those lengths are not used for anything other than showing this in the UI/API.
Additionally, there was no generate method that would allow for safe and resilient SSH key generation and Foreman plugins do use this gem. This patch provides that method and tests so plugins can use the new `generate` method. It is also used in test factories where we generate about one dozen of keys each run. I double checked that this is safe on modern kernels and tests would not get stuck in case of low entropy.
Example use: https://github.com/theforeman/foreman_google/blob/3e6a3612056539bbb46c897354e1cdf0c835bace/app/models/foreman_google/gce.rb#L101
Foreman Packaging reviewers, here:
* https://github.com/theforeman/foreman-packaging/pull/14041
* https://github.com/theforeman/foreman-packaging/pull/14042
I am only aware of the following two plugins that use sshkey:
In case you know about any other plugin that uses this dependency, let me know please.
3 Likes
