authkeyline 0.2.0__tar.gz

authkeyline-0.2.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

authkeyline-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Third-party reference files, fetched locally by scripts/fetch_upstream.py; only the manifest is tracked.
+tests/upstream/*
+!tests/upstream/MANIFEST.json

authkeyline-0.2.0/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0]
+
+### Fixed
+
+- Option values are dequoted as sshd does it: only `\"` is an escape, other backslashes
+  are kept. 0.1.0 dropped them, so a parsed and rebuilt `command=` could change.
+- `build_line` could be steered into extra options, lines or keys through option names,
+  values ending in a backslash, line breaks in values or comments, or a key type with
+  spaces. It now refuses them and checks that the line reads back as the same record.
+- Key types are recognised by name from OpenSSH's table instead of by prefix, so
+  `rsa-sha2-256` lines parse and option fields such as `ssh-x` are not taken for keys.
+
+### Added
+
+- Options are checked like sshd: known names only (case-insensitive), quoted values,
+  single `command`, `principals` and `from`, `environment`, `permitopen`,
+  `permitlisten`, `tunnel` and `expiry-time` formats, and sshd's count limits.
+- The key blob is decoded and checked: embedded type and curve agree with the line,
+  Ed25519 and ML-DSA-44 key sizes, ECDSA points on the curve, security key application,
+  RSA moduli of at least 1024 bits, certificates (OpenSSH format, signature not verified).
+- `AuthorizedKey.public_key()`, `fingerprint()` (SHA256 and MD5 as `ssh-keygen -l` prints
+  them), `values()`, `has_flag()` and `environment()`; `PublicKey` and `Certificate`.
+- `check_file` lists every broken line; `AuthKeyError` carries `reason` and `line`.
+- `KEY_TYPES`, the key type names sshd accepts.
+- Lines are read as sshd reads them: a NUL ends the line, CR and other C whitespace are
+  ignored inside the blob and allowed in the comment, the base64 must be canonical (no
+  set spare bits), numbers in `tunnel` and ports may carry a sign or leading blanks, and
+  an `expiry-time` at the UTC epoch is refused.
+- Certificate signature types must fit the CA key; the signature itself is not verified.
+- The `authkeyline` command (and `python -m authkeyline`): an `ssh-keygen -l` style
+  listing that keeps comment bytes as they are, `--json`, `--check`, `-E md5`; exit
+  status 1 for broken lines and 2 for unreadable files.
+
+
+## [0.1.0]
+
+- Parse one `authorized_keys` line into an `AuthorizedKey` with `parse_line`.
+- Build a line back from a record with `build_line`.
+- Read a whole file, skipping blanks and comments, with `parse_file`.
+- Typed records: `AuthorizedKey`, `KeyOption`, and `key_bytes()` to decode the blob.
+- `AuthKeyError` for lines that are not valid entries.

authkeyline-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Thanks for taking the time. This project keeps a small, predictable shape.
+
+## Setup
+
+```
+pip install -r requirements-dev.txt
+```
+
+## Before you open a pull request
+
+- Keep public API in `src/authkeyline/__init__.py`; internals live in `_`-prefixed modules.
+- Add a test for the behaviour you change. Tests inject time, disk and network; they
+  never touch the real thing.
+- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
+- One logical change per commit, imperative subject line.
+
+Open an issue first if the change is large or shifts the public API.

authkeyline-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

authkeyline-0.2.0/PKG-INFO

@@ -0,0 +1,221 @@
+Metadata-Version: 2.5
+Name: authkeyline
+Version: 0.2.0
+Summary: Parse, check and safely build OpenSSH authorized_keys lines the way sshd reads them, with fingerprints, typed and zero-dependency
+Project-URL: Homepage, https://lianes8studio.com
+Project-URL: Repository, https://github.com/JaviLianes8/authkeyline
+Project-URL: Issues, https://github.com/JaviLianes8/authkeyline/issues
+Project-URL: Changelog, https://github.com/JaviLianes8/authkeyline/blob/main/CHANGELOG.md
+Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
+Project-URL: Funding, https://buymeacoffee.com/jlianesglrs
+Author-email: Javier Lianes <javier@lianes8studio.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: authorized_keys,certificate,ecdsa,ed25519,fingerprint,openssh,public-key,security-key,ssh,sshd
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# authkeyline
+
+Parse, check and safely build OpenSSH `authorized_keys` lines into typed records,
+the way sshd reads them. Zero dependencies.
+
+## Install
+
+```
+pip install authkeyline
+```
+
+## Usage
+
+The examples use a made-up Ed25519 key (its 32 bytes are 0 to 31); every block runs as
+part of the test suite and prints what its comments say.
+
+```python
+from authkeyline import parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+key = parse_line(
+    f'restrict,command="/usr/bin/backup --all",from="10.0.0.1,10.0.0.2" ssh-ed25519 {BLOB} alice@host'
+)
+
+print(key.key_type, key.comment)
+print(key.values("from"))
+print(key.has_flag("RESTRICT"))
+print(key.fingerprint())
+print(key.fingerprint("md5"))
+# ssh-ed25519 alice@host
+# ('10.0.0.1,10.0.0.2',)
+# True
+# SHA256:ZkAslGjFiUHdGf/WUL8rQvkib4PTvQatUV0OUQSncCA
+# MD5:0f:a2:0a:d7:38:3e:65:45:08:6b:63:84:1c:ff:dc:ba
+```
+
+Option values come back exactly as sshd sees them. Only `\"` is an escape inside the
+quotes; every other backslash is kept:
+
+```python
+from authkeyline import parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+key = parse_line(f'command="echo \\"hi\\" c:\\\\temp",environment="LANG=C" ssh-ed25519 {BLOB}')
+print(key.options[0].value)
+print(key.environment())
+# echo "hi" c:\\temp
+# {'LANG': 'C'}
+```
+
+`parse_line` refuses what sshd refuses, with the reason: unknown options, unquoted
+values, a repeated `command`, a malformed `permitopen`, `environment` or `expiry-time`,
+an unknown key type, a blob that is not base64, whose embedded type differs from the line,
+whose Ed25519 key is not 32 bytes, whose ECDSA point is off the curve, or whose RSA modulus
+is under 1024 bits:
+
+```python
+from authkeyline import AuthKeyError, parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+for line in [f"command=ls ssh-ed25519 {BLOB}", f"ssh-rsa {BLOB}", "no-pty ssh-ed25519 AAAA"]:
+    try:
+        parse_line(line)
+    except AuthKeyError as error:
+        print(error)
+# value of 'command' must be in double quotes
+# line says 'ssh-rsa' but the key blob holds 'ssh-ed25519'
+# key blob is truncated
+```
+
+### Building lines safely
+
+`build_line` writes a record back and refuses anything that would not read back as the
+same record: unknown option names, values with line breaks or a trailing backslash, a
+comment that breaks the line. Values cannot smuggle in other options or keys.
+
+```python
+from authkeyline import AuthKeyError, KeyOption, build_line, parse_line
+import dataclasses
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+public = parse_line(f"ssh-ed25519 {BLOB} deploy")
+restricted = dataclasses.replace(
+    public, options=(KeyOption("restrict"), KeyOption("command", 'rsync --server "a b"'))
+)
+print(build_line(restricted))
+try:
+    build_line(dataclasses.replace(public, comment="x\nssh-ed25519 AAAA intruder"))
+except AuthKeyError as error:
+    print(error)
+# restrict,command="rsync --server \"a b\"" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f deploy
+# comment holds a NUL or a line break
+```
+
+### Whole files
+
+```python
+from authkeyline import check_file, parse_file
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+text = f"# team keys\nssh-ed25519 {BLOB} one\n\nbogus ssh-ed25519 {BLOB} two\n"
+print(check_file(text))
+print(len(parse_file(text.replace("bogus ", ""))))
+# [LineProblem(line=4, message="unknown option 'bogus'")]
+# 2
+```
+
+`parse_file` raises on the first bad line with `error.line` set; `check_file` lists them
+all. Blank lines and `#` comments are skipped, as sshd does. To read a real file, pass
+its text: `parse_file(Path.home().joinpath(".ssh/authorized_keys").read_text())`.
+
+### Command line
+
+```
+authkeyline ~/.ssh/authorized_keys          # one line per key, like ssh-keygen -l
+authkeyline -E md5 authorized_keys           # MD5 fingerprints
+authkeyline --json authorized_keys           # options, sizes, certificate details
+authkeyline --check authorized_keys          # only report broken lines
+```
+
+Broken lines go to standard error as `FILE:LINE: reason` and the exit status is 1; a file
+that cannot be read gives status 2. The listing matches `ssh-keygen -l` byte for byte,
+comments in any encoding included (the test suite compares them).
+
+## API
+
+| Name | What it does |
+| --- | --- |
+| `parse_line(line)` | One line to an `AuthorizedKey`, checked like sshd; raises `AuthKeyError` |
+| `parse_file(text)` | Every key of a file; the first bad line raises with `.line` set |
+| `check_file(text)` | Every broken line as a `LineProblem(line, message)` |
+| `build_line(key)` | A record back to a line that reads back the same, or `AuthKeyError` |
+| `AuthorizedKey` | `options`, `key_type`, `key_base64`, `comment`; `public_key()`, `fingerprint()`, `values()`, `has_flag()`, `environment()`, `key_bytes()` |
+| `KeyOption` | `name` as written and `value` (`None` for a flag) |
+| `PublicKey` | `key_type`, `short_type`, `bits`, `application`, `certificate`, `fingerprint()` |
+| `Certificate` | `cert_type`, `serial`, `key_id`, `principals`, validity, critical options, extensions, `ca_key`, `signature_type` |
+| `LineProblem` | `line` number and `message` |
+| `KEY_TYPES` | The key type names sshd accepts, certificates included |
+| `AuthKeyError` | A `ValueError` with `reason` and `line` |
+
+## What it follows
+
+- The options grammar and rules of OpenSSH's `sshauthopt_parse` and the option list of
+  sshd(8): case-insensitive names, quoted values, `no-` forms, single `command`,
+  `principals` and `from`, `permitopen` and `permitlisten` targets, `tunnel`,
+  `expiry-time`, `environment` (first value of a name wins).
+- The key type table of OpenSSH (`ssh-ed25519`, `sk-ssh-ed25519@openssh.com`,
+  `ecdsa-sha2-nistp256/384/521`, `sk-ecdsa-sha2-nistp256@openssh.com`, `ssh-rsa`,
+  `ssh-mldsa44-ed25519`, their certificates, and the `rsa-sha2-256/512` names that sshd
+  reads as RSA keys), the blob layouts of RFC 4253, RFC 5656 and RFC 8709, and the
+  certificate format of draft-miller-ssh-cert.
+- Fingerprints are computed over the bare key, as `ssh-keygen -l` does, so a certificate
+  has the fingerprint of its key.
+
+Where it differs from sshd, on purpose:
+
+- Certificate signatures are not verified (that needs a crypto library), so a certificate
+  with a forged signature parses while sshd skips it. The signature type is checked
+  against the CA key. Certificates are rare in `authorized_keys`; CA keys marked
+  `cert-authority` are plain keys and fully checked.
+- `from=` patterns are kept as text, not matched against a client.
+- Port names such as `host:ssh` in `permitopen` are refused, since sshd resolves them
+  through the local services database, which differs per system.
+- `build_line` keeps comments and values to one line of text without NUL or CR. sshd
+  would cut a line at a NUL and ignore a CR in the comment, and `parse_line` reads such
+  lines the same way, but a written line never contains them.
+
+## Why
+
+An `authorized_keys` line packs an options field, a key type, a base64 blob and a comment
+into one string, and the options field has its own grammar. Splitting on whitespace or
+commas gets it wrong, and a builder that quotes values naively lets a value add options or
+whole keys. This library reads a line as sshd does (with the differences listed above),
+says why sshd would skip it, and writes lines that cannot be steered.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

authkeyline-0.2.0/README.md

@@ -0,0 +1,184 @@
+# authkeyline
+
+Parse, check and safely build OpenSSH `authorized_keys` lines into typed records,
+the way sshd reads them. Zero dependencies.
+
+## Install
+
+```
+pip install authkeyline
+```
+
+## Usage
+
+The examples use a made-up Ed25519 key (its 32 bytes are 0 to 31); every block runs as
+part of the test suite and prints what its comments say.
+
+```python
+from authkeyline import parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+key = parse_line(
+    f'restrict,command="/usr/bin/backup --all",from="10.0.0.1,10.0.0.2" ssh-ed25519 {BLOB} alice@host'
+)
+
+print(key.key_type, key.comment)
+print(key.values("from"))
+print(key.has_flag("RESTRICT"))
+print(key.fingerprint())
+print(key.fingerprint("md5"))
+# ssh-ed25519 alice@host
+# ('10.0.0.1,10.0.0.2',)
+# True
+# SHA256:ZkAslGjFiUHdGf/WUL8rQvkib4PTvQatUV0OUQSncCA
+# MD5:0f:a2:0a:d7:38:3e:65:45:08:6b:63:84:1c:ff:dc:ba
+```
+
+Option values come back exactly as sshd sees them. Only `\"` is an escape inside the
+quotes; every other backslash is kept:
+
+```python
+from authkeyline import parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+key = parse_line(f'command="echo \\"hi\\" c:\\\\temp",environment="LANG=C" ssh-ed25519 {BLOB}')
+print(key.options[0].value)
+print(key.environment())
+# echo "hi" c:\\temp
+# {'LANG': 'C'}
+```
+
+`parse_line` refuses what sshd refuses, with the reason: unknown options, unquoted
+values, a repeated `command`, a malformed `permitopen`, `environment` or `expiry-time`,
+an unknown key type, a blob that is not base64, whose embedded type differs from the line,
+whose Ed25519 key is not 32 bytes, whose ECDSA point is off the curve, or whose RSA modulus
+is under 1024 bits:
+
+```python
+from authkeyline import AuthKeyError, parse_line
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+for line in [f"command=ls ssh-ed25519 {BLOB}", f"ssh-rsa {BLOB}", "no-pty ssh-ed25519 AAAA"]:
+    try:
+        parse_line(line)
+    except AuthKeyError as error:
+        print(error)
+# value of 'command' must be in double quotes
+# line says 'ssh-rsa' but the key blob holds 'ssh-ed25519'
+# key blob is truncated
+```
+
+### Building lines safely
+
+`build_line` writes a record back and refuses anything that would not read back as the
+same record: unknown option names, values with line breaks or a trailing backslash, a
+comment that breaks the line. Values cannot smuggle in other options or keys.
+
+```python
+from authkeyline import AuthKeyError, KeyOption, build_line, parse_line
+import dataclasses
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+public = parse_line(f"ssh-ed25519 {BLOB} deploy")
+restricted = dataclasses.replace(
+    public, options=(KeyOption("restrict"), KeyOption("command", 'rsync --server "a b"'))
+)
+print(build_line(restricted))
+try:
+    build_line(dataclasses.replace(public, comment="x\nssh-ed25519 AAAA intruder"))
+except AuthKeyError as error:
+    print(error)
+# restrict,command="rsync --server \"a b\"" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f deploy
+# comment holds a NUL or a line break
+```
+
+### Whole files
+
+```python
+from authkeyline import check_file, parse_file
+
+BLOB = "AAAAC3NzaC1lZDI1NTE5AAAAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
+text = f"# team keys\nssh-ed25519 {BLOB} one\n\nbogus ssh-ed25519 {BLOB} two\n"
+print(check_file(text))
+print(len(parse_file(text.replace("bogus ", ""))))
+# [LineProblem(line=4, message="unknown option 'bogus'")]
+# 2
+```
+
+`parse_file` raises on the first bad line with `error.line` set; `check_file` lists them
+all. Blank lines and `#` comments are skipped, as sshd does. To read a real file, pass
+its text: `parse_file(Path.home().joinpath(".ssh/authorized_keys").read_text())`.
+
+### Command line
+
+```
+authkeyline ~/.ssh/authorized_keys          # one line per key, like ssh-keygen -l
+authkeyline -E md5 authorized_keys           # MD5 fingerprints
+authkeyline --json authorized_keys           # options, sizes, certificate details
+authkeyline --check authorized_keys          # only report broken lines
+```
+
+Broken lines go to standard error as `FILE:LINE: reason` and the exit status is 1; a file
+that cannot be read gives status 2. The listing matches `ssh-keygen -l` byte for byte,
+comments in any encoding included (the test suite compares them).
+
+## API
+
+| Name | What it does |
+| --- | --- |
+| `parse_line(line)` | One line to an `AuthorizedKey`, checked like sshd; raises `AuthKeyError` |
+| `parse_file(text)` | Every key of a file; the first bad line raises with `.line` set |
+| `check_file(text)` | Every broken line as a `LineProblem(line, message)` |
+| `build_line(key)` | A record back to a line that reads back the same, or `AuthKeyError` |
+| `AuthorizedKey` | `options`, `key_type`, `key_base64`, `comment`; `public_key()`, `fingerprint()`, `values()`, `has_flag()`, `environment()`, `key_bytes()` |
+| `KeyOption` | `name` as written and `value` (`None` for a flag) |
+| `PublicKey` | `key_type`, `short_type`, `bits`, `application`, `certificate`, `fingerprint()` |
+| `Certificate` | `cert_type`, `serial`, `key_id`, `principals`, validity, critical options, extensions, `ca_key`, `signature_type` |
+| `LineProblem` | `line` number and `message` |
+| `KEY_TYPES` | The key type names sshd accepts, certificates included |
+| `AuthKeyError` | A `ValueError` with `reason` and `line` |
+
+## What it follows
+
+- The options grammar and rules of OpenSSH's `sshauthopt_parse` and the option list of
+  sshd(8): case-insensitive names, quoted values, `no-` forms, single `command`,
+  `principals` and `from`, `permitopen` and `permitlisten` targets, `tunnel`,
+  `expiry-time`, `environment` (first value of a name wins).
+- The key type table of OpenSSH (`ssh-ed25519`, `sk-ssh-ed25519@openssh.com`,
+  `ecdsa-sha2-nistp256/384/521`, `sk-ecdsa-sha2-nistp256@openssh.com`, `ssh-rsa`,
+  `ssh-mldsa44-ed25519`, their certificates, and the `rsa-sha2-256/512` names that sshd
+  reads as RSA keys), the blob layouts of RFC 4253, RFC 5656 and RFC 8709, and the
+  certificate format of draft-miller-ssh-cert.
+- Fingerprints are computed over the bare key, as `ssh-keygen -l` does, so a certificate
+  has the fingerprint of its key.
+
+Where it differs from sshd, on purpose:
+
+- Certificate signatures are not verified (that needs a crypto library), so a certificate
+  with a forged signature parses while sshd skips it. The signature type is checked
+  against the CA key. Certificates are rare in `authorized_keys`; CA keys marked
+  `cert-authority` are plain keys and fully checked.
+- `from=` patterns are kept as text, not matched against a client.
+- Port names such as `host:ssh` in `permitopen` are refused, since sshd resolves them
+  through the local services database, which differs per system.
+- `build_line` keeps comments and values to one line of text without NUL or CR. sshd
+  would cut a line at a NUL and ignore a CR in the comment, and `parse_line` reads such
+  lines the same way, but a written line never contains them.
+
+## Why
+
+An `authorized_keys` line packs an options field, a key type, a base64 blob and a comment
+into one string, and the options field has its own grammar. Splitting on whitespace or
+commas gets it wrong, and a builder that quotes values naively lets a value add options or
+whole keys. This library reads a line as sshd does (with the differences listed above),
+says why sshd would skip it, and writes lines that cannot be steered.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

authkeyline-0.2.0/pyproject.toml

@@ -0,0 +1,76 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "authkeyline"
+version = "0.2.0"
+description = "Parse, check and safely build OpenSSH authorized_keys lines the way sshd reads them, with fingerprints, typed and zero-dependency"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Javier Lianes", email = "javier@lianes8studio.com" }]
+keywords = ["ssh", "openssh", "authorized_keys", "sshd", "public-key", "fingerprint", "certificate", "ed25519", "ecdsa", "security-key"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Operating System :: OS Independent",
+    "Environment :: Console",
+    "Topic :: Security",
+    "Topic :: System :: Systems Administration",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["ruff", "mypy", "pytest", "build", "twine"]
+
+[project.scripts]
+authkeyline = "authkeyline._cli:main"
+
+[project.urls]
+Homepage = "https://lianes8studio.com"
+Repository = "https://github.com/JaviLianes8/authkeyline"
+Issues = "https://github.com/JaviLianes8/authkeyline/issues"
+Changelog = "https://github.com/JaviLianes8/authkeyline/blob/main/CHANGELOG.md"
+LinkedIn = "https://www.linkedin.com/in/jlianes/"
+Funding = "https://buymeacoffee.com/jlianesglrs"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/authkeyline"]
+
+[tool.hatch.build.targets.sdist]
+# Third-party reference files are fetched locally and never shipped; only their manifest is.
+exclude = [
+    ".github",
+    "IMPROVEMENTS-round*.md",
+    "tests/upstream/*.c",
+    "tests/upstream/*.h",
+    "tests/upstream/*.8",
+    "tests/upstream/*.txt",
+    "tests/upstream/PROTOCOL.*",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"

authkeyline-0.2.0/requirements-dev.txt

@@ -0,0 +1,3 @@
+# Development dependencies: the package in editable mode plus its dev extras
+# (ruff, mypy, pytest, build, twine). Install with:  pip install -r requirements-dev.txt
+-e .[dev]

authkeyline-0.2.0/scripts/check.ps1

@@ -0,0 +1,16 @@
+# Local quality gate. Run before every commit. No CI runs in the cloud.
+# $ErrorActionPreference does NOT stop on a native command's non-zero exit, so each tool's
+# exit code is checked explicitly: a red gate must fail, never pass silently.
+$ErrorActionPreference = "Stop"
+
+function Invoke-Step($label, [scriptblock]$cmd) {
+    Write-Host "== $label =="
+    & $cmd
+    if ($LASTEXITCODE -ne 0) { Write-Host "FAILED: $label (exit $LASTEXITCODE)"; exit $LASTEXITCODE }
+}
+
+Invoke-Step "ruff format" { ruff format --check . }
+Invoke-Step "ruff lint"   { ruff check . }
+Invoke-Step "mypy"        { mypy --strict src tests }
+Invoke-Step "pytest"      { pytest }
+Write-Host "gate green"

authkeyline-0.2.0/scripts/fetch_upstream.py

@@ -0,0 +1,39 @@
+"""Fetch the third-party test files listed in tests/upstream/MANIFEST.json.
+
+The files are not part of the repository. Their tests skip until this script has fetched
+them; each download is checked against the size and sha256 in the manifest.
+
+    python scripts/fetch_upstream.py
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+FOLDER = Path(__file__).resolve().parents[1] / "tests" / "upstream"
+
+
+def main() -> int:
+    manifest = json.loads((FOLDER / "MANIFEST.json").read_text(encoding="utf-8"))
+    failed = 0
+    for name, entry in manifest.items():
+        with urllib.request.urlopen(entry["url"], timeout=60) as response:
+            body = response.read()
+        digest = hashlib.sha256(body).hexdigest()
+        if len(body) != entry["size"] or digest != entry["sha256"]:
+            print(f"{name}: got {len(body)} bytes, sha256 {digest}; manifest differs")
+            failed += 1
+            continue
+        target = FOLDER / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(body)
+        print(f"{name}: ok")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())