Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

perf: reuse a deploy-key proof instead of asking the server twice

Browse Source 
A key rotation verified the candidate with `git ls-remote`, then immediately ran
preflightCandidate, which threw that result away and ran the same command over a
second SSH connection. Nothing happens between the two calls that could change
the answer, and the proof was already being passed in.

preflightCandidate now uses a proof that established a remote commit and falls
back to verifying when it is handed nothing usable, so it still works as a
standalone gate. Every ssh.exec opens its own connection, so this removes a full
TCP, key exchange and authentication round trip from a rotation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
NuklearRabbit
2026-08-23 14:53:53 +02:00
co-authored by Claude Opus 5
parent d77643c058
commit beeafdcba7
3 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/deploy-key-host.test.mjs
+22
View File
@@ -105,6 +105,28 @@ test("candidate verification only reports ready on a real remote commit", async
await assert.rejects(() => unproven.host.preflightCandidate(context), /did not prove the remote branch/);
});
test("a preflight reuses a proof it was handed instead of asking the server again", async () => {
const reused = keyHost("__FORGEFLOW_KEY_PROOF__\nremoteSha=\nfingerprint=\nhostFingerprint=\n");
const proof = { ready: true, remoteSha: "f".repeat(40), fingerprint: "SHA256:new", hostFingerprint: "SHA256:host" };
const context = {
repository: { ...REPOSITORY, sshUrl: "git@gitea.example:Jens/Portfolio.git" },
profile: { branch: "main" },
server: SERVER,
candidate: { paths: { privateKey: "/k/deploy-key", publicKey: "/k/deploy-key.pub", knownHosts: "/k/known_hosts" } },
proof,
};
assert.deepEqual(await reused.host.preflightCandidate(context), proof);
assert.equal(reused.scripts.length, 0, "no second connection is opened");
// A proof that never established a remote commit is not a shortcut.
await assert.rejects(
() => reused.host.preflightCandidate({ ...context, proof: { ready: false } }),
/did not prove the remote branch/,
);
assert.equal(reused.scripts.length, 1, "an unusable proof falls back to verifying");
});
test("verifying the active key uses the repository-scoped paths rather than a candidate", async () => {
const { host, scripts } = keyHost(`__FORGEFLOW_KEY_PROOF__\nremoteSha=${"e".repeat(40)}\nfingerprint=SHA256:active\nhostFingerprint=SHA256:host\n`);
const paths = host.paths(REPOSITORY, SERVER);