From 35bd57f2035ff5a8f764e398ea4863c18d070eb0 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 7 May 2026 22:38:35 -0700 Subject: [PATCH 1/2] Redact private key material from SSH error messages Remove private key content, certificate content, and parsed key structs from error messages in signCertWithPrivateKey(). These values were formatted with %q into error strings that appear in terminal output and CI logs, exposing credential material. The underlying crypto library error (preserved via %s) already describes the failure cause (malformed PEM, unsupported algorithm, etc.), so no diagnostic information is lost. Signed-off-by: Sebastien Tardif --- internal/communicator/ssh/provisioner.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internal/communicator/ssh/provisioner.go b/internal/communicator/ssh/provisioner.go index aa014aa3f00c..e10e30fe0339 100644 --- a/internal/communicator/ssh/provisioner.go +++ b/internal/communicator/ssh/provisioner.go @@ -397,22 +397,22 @@ func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) { func signCertWithPrivateKey(pk string, certificate string) (ssh.AuthMethod, error) { rawPk, err := ssh.ParseRawPrivateKey([]byte(pk)) if err != nil { - return nil, fmt.Errorf("failed to parse private key %q: %s", pk, err) + return nil, fmt.Errorf("failed to parse private key: %s", err) } pcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certificate)) if err != nil { - return nil, fmt.Errorf("failed to parse certificate %q: %s", certificate, err) + return nil, fmt.Errorf("failed to parse certificate: %s", err) } usigner, err := ssh.NewSignerFromKey(rawPk) if err != nil { - return nil, fmt.Errorf("failed to create signer from raw private key %q: %s", rawPk, err) + return nil, fmt.Errorf("failed to create signer from private key: %s", err) } ucertSigner, err := ssh.NewCertSigner(pcert.(*ssh.Certificate), usigner) if err != nil { - return nil, fmt.Errorf("failed to create cert signer %q: %s", usigner, err) + return nil, fmt.Errorf("failed to create cert signer: %s", err) } return ssh.PublicKeys(ucertSigner), nil From 2fafebeb46e67bdf6d6eb179cde0ea406bfe0278 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Sun, 10 May 2026 23:43:14 -0700 Subject: [PATCH 2/2] Add changelog entry for SSH key redaction Signed-off-by: Sebastien Tardif --- .changes/v1.16/BUG FIXES-20260511-064314-2.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changes/v1.16/BUG FIXES-20260511-064314-2.yaml diff --git a/.changes/v1.16/BUG FIXES-20260511-064314-2.yaml b/.changes/v1.16/BUG FIXES-20260511-064314-2.yaml new file mode 100644 index 000000000000..854a4a839557 --- /dev/null +++ b/.changes/v1.16/BUG FIXES-20260511-064314-2.yaml @@ -0,0 +1,5 @@ +kind: BUG FIXES +body: 'communicator/ssh: Redact private key and certificate material from error messages to prevent credential exposure in logs' +time: 2026-05-11T06:26:00.000000Z +custom: + Issue: "38543"