NVIDIA / holodeck / 21832033829

48%

push

github

fix: add SSH TOFU host key verification (#625)

- Replace ssh.InsecureIgnoreHostKey() with Trust-On-First-Use (TOFU)
  pattern that records host keys on first connection and verifies on
  subsequent ones, eliminating MITM vulnerability
- Host keys cached in ~/.cache/holodeck/known_hosts with 0600 permissions

Re-implemented against current upstream/main.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

28 of 37 new or added lines in 1 file covered. (75.68%)

2309 of 5014 relevant lines covered (46.05%)

0.51 hits per line