vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 19:31:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(macos): require trusted SSH host keys (#68199)

Browse Source 
* fix(macos): require trusted SSH host keys

* chore(changelog): add macOS SSH strict host-key entry
This commit is contained in:
Devin Robison
2026-04-17 11:11:10 -06:00
committed by GitHub
parent dfca5bd0fe
commit 114b87caf2
6 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
apps/macos/Sources/OpenClaw/CommandResolver.swift
View File

@@ -3,6 +3,12 @@ import Foundation
enum CommandResolver {
private static let projectRootDefaultsKey = "openclaw.gatewayProjectRootPath"
private static let helperName = "openclaw"
static let strictHostKeyCheckingSSHOptions = [
"-o", "StrictHostKeyChecking=yes",
]
static let updateHostKeysSSHOptions = [
"-o", "UpdateHostKeys=yes",
]
static func gatewayEntrypoint(in root: URL) -> String? {
let distEntry = root.appendingPathComponent("dist/index.js").path
@@ -397,9 +403,7 @@ enum CommandResolver {
"""
let options: [String] = [
"-o", "BatchMode=yes",
"-o", "StrictHostKeyChecking=accept-new",
"-o", "UpdateHostKeys=yes",
]
] + self.strictHostKeyCheckingSSHOptions + self.updateHostKeysSSHOptions
let args = self.sshArguments(
target: parsed,
identity: settings.identity,

3
apps/macos/Sources/OpenClaw/NodePairingApprovalPrompter.swift
View File

@@ -483,8 +483,7 @@ final class NodePairingApprovalPrompter {
"-o", "ConnectTimeout=5",
"-o", "NumberOfPasswordPrompts=0",
"-o", "PreferredAuthentications=publickey",
"-o", "StrictHostKeyChecking=accept-new",
]
] + CommandResolver.strictHostKeyCheckingSSHOptions
guard let target = CommandResolver.makeSSHTarget(user: user, host: host, port: port) else {
return false
}

4
apps/macos/Sources/OpenClaw/RemoteGatewayProbe.swift
View File

@@ -200,9 +200,7 @@ enum RemoteGatewayProbe {
let options = [
"-o", "BatchMode=yes",
"-o", "ConnectTimeout=5",
"-o", "StrictHostKeyChecking=accept-new",
"-o", "UpdateHostKeys=yes",
]
] + CommandResolver.strictHostKeyCheckingSSHOptions + CommandResolver.updateHostKeysSSHOptions
let args = CommandResolver.sshArguments(
target: parsed,
identity: identity,

4
apps/macos/Sources/OpenClaw/RemotePortTunnel.swift
View File

@@ -73,14 +73,12 @@ final class RemotePortTunnel {
let options: [String] = [
"-o", "BatchMode=yes",
"-o", "ExitOnForwardFailure=yes",
"-o", "StrictHostKeyChecking=accept-new",
"-o", "UpdateHostKeys=yes",
"-o", "ServerAliveInterval=15",
"-o", "ServerAliveCountMax=3",
"-o", "TCPKeepAlive=yes",
"-N",
"-L", "\(localPort):127.0.0.1:\(resolvedRemotePort)",
]
] + CommandResolver.strictHostKeyCheckingSSHOptions + CommandResolver.updateHostKeysSSHOptions
let identity = settings.identity.trimmingCharacters(in: .whitespacesAndNewlines)
let args = CommandResolver.sshArguments(
target: parsed,

3
apps/macos/Tests/OpenClawIPCTests/CommandResolverTests.swift
View File

@@ -164,6 +164,9 @@ import Testing
} else {
#expect(Bool(false))
}
#expect(cmd.contains("StrictHostKeyChecking=yes"))
#expect(!cmd.contains("StrictHostKeyChecking=accept-new"))
#expect(cmd.contains("UpdateHostKeys=yes"))
#expect(cmd.contains("-i"))
#expect(cmd.contains("/tmp/id_ed25519"))
if let script = cmd.last {