NVIDIA / holodeck / 21871222693

48%

push

github

fix(ssh): use TOFU host key verification in all SSH connections (#630)

* fix(ssh): use TOFU host key verification in all SSH connections

Extract tofuHostKeyCallback from provisioner into shared pkg/sshutil
and wire it into cmd/cli/common/ConnectSSH() and dryrun connectOrDie().
All SSH connections now use Trust-On-First-Use verification instead of
InsecureIgnoreHostKey.

Addresses RISK 5 from PROJECT_360_EVALUATION.md.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(sshutil): address code review feedback on TOFU extraction

Restore detailed doc comment on exported TOFUHostKeyCallback(),
remove unnecessary host:=hostname alias, and normalize nolint
directive spacing to canonical //nolint:gosec format.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

---------

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

27 of 36 new or added lines in 2 files covered. (75.0%)

2308 of 5012 relevant lines covered (46.05%)

0.51 hits per line