Expose the configured IdentityAgent and IdentitiesOnly options - #15
Merged
alexey-milovidov merged 2 commits intoAug 23, 2026
Merged
Conversation
|
|
alexey-milovidov
added a commit
to ClickHouse/ClickHouse
that referenced
this pull request
Aug 20, 2026
…ests Addresses the review of #115072: - `IdentityFile` and `IdentityAgent` now expand the whole token set that `ssh` supports (`%C`, `%d`, `%h`, `%i`, `%L`, `%l`, `%n`, `%p`, `%r`, `%u`, `%%`), instead of leaving the unknown ones as is and silently probing a file that cannot exist. A token that is not supported is now an error. - `IdentitiesOnly yes` is honored: the ssh-agent is no longer asked for an arbitrary key when none of the configured identity files exists. Retrieval of the option is added to `libssh` (ClickHouse/libssh#15). - Reading the configuration, which used to happen up to three times per connection, happens once, in `getSSHClientConfiguration`. - Every failure to talk to the ssh-agent is reported as `SSH_AGENT_ERROR`. A socket name that is too long for a Unix socket used to escape as a `Poco::Exception` and abort the client instead of letting it use the key file. - `03780_failed_ssh` no longer expects the passphrase prompt, which is now asked only for a key that is really encrypted. - `04908_ssh_key_file_lookup`: the heading of the last case was printed before the previous one, and the new cases for `%r` and `IdentitiesOnly` are added.
alexey-milovidov
changed the title
IdentityAgent optionIdentityAgent and IdentitiesOnly options
alexey-milovidov
changed the base branch from
master
to
ClickHouse/libssh-0.12.0
August 23, 2026 01:47
alexey-milovidov
added a commit
to ClickHouse/ClickHouse
that referenced
this pull request
Aug 23, 2026
…2.0` The submodule was pinned to `2dc1be73`, the tip of the `continue-pr-115072-identity-agent-option` branch in `ClickHouse/libssh`. That branch is deleted once its pull request lands, so the pin would have become unreachable. ClickHouse/libssh#15 is now merged into `ClickHouse/libssh-0.12.0` - the branch this submodule tracks - so pin its tip instead. The tree is unchanged: `f3a90052` is the merge of the same two commits that add `SSH_OPTIONS_IDENTITY_AGENT` and `SSH_OPTIONS_IDENTITIES_ONLY` to `ssh_options_get`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expose
SSH_OPTIONS_IDENTITY_AGENTandSSH_OPTIONS_IDENTITIES_ONLYthroughssh_options_get, so that consumers can use the values resolved by libssh's full SSH configuration parser instead of parsingssh_configthemselves.IdentitiesOnlyis a boolean, and it is reported the same way it is spelled in the configuration file:yesorno.Used by ClickHouse/ClickHouse#115072, which looks up the SSH key of
clickhouse-clientthe same waysshdoes it.