@mriekki/lean 0.1.0 → 0.2.0

package/assets/generated/deployment/src/lean_poc_deployment/ssh.py

@@ -1,118 +1,118 @@
-"""Strict SSH verification primitives for logical targets."""
-
-from __future__ import annotations
-
-import shutil
-import socket
-import subprocess
-from pathlib import Path
-from typing import Any
-
-from .errors import DeploymentKitError
-from .security import check_ssh_material_security, validate_target_trust_file
-
-
-def required_tool(name: str) -> str:
-    path = shutil.which(name)
-    if path is None:
-        raise DeploymentKitError(f"Required OpenSSH tool is unavailable: {name}")
-    return path
-
-
-def resolve_addresses(profile: dict[str, Any]) -> list[str]:
-    override = profile["addressOverride"]
-    if override:
-        return [override]
-    try:
-        answers = socket.getaddrinfo(
-            profile["hostName"],
-            profile["port"],
-            type=socket.SOCK_STREAM,
-        )
-    except OSError as error:
-        raise DeploymentKitError(
-            f"Cannot resolve target hostname {profile['hostName']}: {error}. "
-            "Use only a separately verified address override; do not scan the network."
-        ) from error
-    addresses = sorted({answer[4][0] for answer in answers})
-    if not addresses:
-        raise DeploymentKitError(f"Target hostname {profile['hostName']} returned no addresses.")
-    return addresses
-
-
-def ssh_args(profile: dict[str, Any], address: str, *, command: str = "true") -> list[str]:
-    return [
-        required_tool("ssh"),
-        "-F",
-        "none",
-        "-o",
-        "BatchMode=yes",
-        "-o",
-        "ConnectTimeout=8",
-        "-o",
-        "StrictHostKeyChecking=yes",
-        "-o",
-        "UpdateHostKeys=no",
-        "-o",
-        "CheckHostIP=no",
-        "-o",
-        "VerifyHostKeyDNS=no",
-        "-o",
-        "GlobalKnownHostsFile=none",
-        "-o",
-        f"UserKnownHostsFile={profile['knownHostsFile']}",
-        "-o",
-        f"HostKeyAlias={profile['sshAlias']}",
-        "-o",
-        f"IdentityFile={profile['identityFile']}",
-        "-o",
-        "IdentitiesOnly=yes",
-        "-o",
-        "PasswordAuthentication=no",
-        "-o",
-        "KbdInteractiveAuthentication=no",
-        "-o",
-        "PreferredAuthentications=publickey",
-        "-o",
-        "ForwardAgent=no",
-        "-o",
-        "ForwardX11=no",
-        "-o",
-        "ClearAllForwardings=yes",
-        "-p",
-        str(profile["port"]),
-        f"{profile['user']}@{address}",
-        command,
-    ]
-
-
-def verify_access(profile: dict[str, Any]) -> dict[str, str]:
-    identity = Path(profile["identityFile"])
-    known_hosts = Path(profile["knownHostsFile"])
-    if not identity.is_file():
-        raise DeploymentKitError(f"Dedicated private key is missing: {identity}")
-    if not known_hosts.is_file() or known_hosts.stat().st_size == 0:
-        raise DeploymentKitError(
-            f"Target-specific trust file is missing or empty: {known_hosts}. "
-            "Enroll trust only after independently verifying the host fingerprint."
-        )
-    check_ssh_material_security(identity, known_hosts)
-    validate_target_trust_file(profile)
-
-    failures: list[str] = []
-    for address in resolve_addresses(profile):
-        result = subprocess.run(
-            ssh_args(profile, address),
-            check=False,
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-        )
-        if result.returncode == 0:
-            return {"targetName": profile["targetName"], "address": address, "status": "verified"}
-        failures.append(f"{address}: exit {result.returncode}")
-
-    raise DeploymentKitError(
-        "Public-key SSH verification failed for all resolved addresses: " + "; ".join(failures)
-    )
+"""Strict SSH verification primitives for logical targets."""
+
+from __future__ import annotations
+
+import shutil
+import socket
+import subprocess
+from pathlib import Path
+from typing import Any
+
+from .errors import DeploymentKitError
+from .security import check_ssh_material_security, validate_target_trust_file
+
+
+def required_tool(name: str) -> str:
+    path = shutil.which(name)
+    if path is None:
+        raise DeploymentKitError(f"Required OpenSSH tool is unavailable: {name}")
+    return path
+
+
+def resolve_addresses(profile: dict[str, Any]) -> list[str]:
+    override = profile["addressOverride"]
+    if override:
+        return [override]
+    try:
+        answers = socket.getaddrinfo(
+            profile["hostName"],
+            profile["port"],
+            type=socket.SOCK_STREAM,
+        )
+    except OSError as error:
+        raise DeploymentKitError(
+            f"Cannot resolve target hostname {profile['hostName']}: {error}. "
+            "Use only a separately verified address override; do not scan the network."
+        ) from error
+    addresses = sorted({answer[4][0] for answer in answers})
+    if not addresses:
+        raise DeploymentKitError(f"Target hostname {profile['hostName']} returned no addresses.")
+    return addresses
+
+
+def ssh_args(profile: dict[str, Any], address: str, *, command: str = "true") -> list[str]:
+    return [
+        required_tool("ssh"),
+        "-F",
+        "none",
+        "-o",
+        "BatchMode=yes",
+        "-o",
+        "ConnectTimeout=8",
+        "-o",
+        "StrictHostKeyChecking=yes",
+        "-o",
+        "UpdateHostKeys=no",
+        "-o",
+        "CheckHostIP=no",
+        "-o",
+        "VerifyHostKeyDNS=no",
+        "-o",
+        "GlobalKnownHostsFile=none",
+        "-o",
+        f"UserKnownHostsFile={profile['knownHostsFile']}",
+        "-o",
+        f"HostKeyAlias={profile['sshAlias']}",
+        "-o",
+        f"IdentityFile={profile['identityFile']}",
+        "-o",
+        "IdentitiesOnly=yes",
+        "-o",
+        "PasswordAuthentication=no",
+        "-o",
+        "KbdInteractiveAuthentication=no",
+        "-o",
+        "PreferredAuthentications=publickey",
+        "-o",
+        "ForwardAgent=no",
+        "-o",
+        "ForwardX11=no",
+        "-o",
+        "ClearAllForwardings=yes",
+        "-p",
+        str(profile["port"]),
+        f"{profile['user']}@{address}",
+        command,
+    ]
+
+
+def verify_access(profile: dict[str, Any]) -> dict[str, str]:
+    identity = Path(profile["identityFile"])
+    known_hosts = Path(profile["knownHostsFile"])
+    if not identity.is_file():
+        raise DeploymentKitError(f"Dedicated private key is missing: {identity}")
+    if not known_hosts.is_file() or known_hosts.stat().st_size == 0:
+        raise DeploymentKitError(
+            f"Target-specific trust file is missing or empty: {known_hosts}. "
+            "Enroll trust only after independently verifying the host fingerprint."
+        )
+    check_ssh_material_security(identity, known_hosts)
+    validate_target_trust_file(profile)
+
+    failures: list[str] = []
+    for address in resolve_addresses(profile):
+        result = subprocess.run(
+            ssh_args(profile, address),
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        if result.returncode == 0:
+            return {"targetName": profile["targetName"], "address": address, "status": "verified"}
+        failures.append(f"{address}: exit {result.returncode}")
+
+    raise DeploymentKitError(
+        "Public-key SSH verification failed for all resolved addresses: " + "; ".join(failures)
+    )