make sure we check for the host key existence in the correct known_hosts file.

[monkeysphere.git] / src / share / m / ssh_proxycommand

diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index 322937b054a9ed448425da00fa65e2d44c4c075a..c90074b765f403d6157779fa83096a7d4d90e803 100644 (file)
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -102,8 +102,13 @@ EOF
     if [ -z "$sshKeyOffered" ] ; then
        log info <<EOF
 Could not retrieve RSA host key from $HOST.
+EOF
+       # check that there are any marginally valid keys
+       if echo "$gpgOut" | egrep -q '^(pub|sub):(m|f|u):' ; then
+           log info <<EOF
 The following keys were found with marginal validity:
 EOF
+       fi
     fi
 
     # find all 'pub' and 'sub' lines in the gpg output, which each
@@ -140,10 +145,9 @@ EOF
                else
 
                    # if the current key is marginal, show info
-                   if [ "$validity" = 'm' -o "$validity" = 'f' ] ; then
+                   if [ "$validity" = 'm' ] ; then
                        show_key_info "$keyid" | log info
                     fi
-
                fi
                ;;
        esac
@@ -163,10 +167,9 @@ None of the found keys matched the key offered by the host.
 EOF
        else
            log info <<EOF
-There may be other keys with less than marginal validity for this hostname.
+There may be keys for this hostname with less than marginal validity.
 EOF
        fi
-
        log info <<EOF
 Run the following command for more info about the found keys:
 gpg --check-sigs --list-options show-uid-validity =${userID}
@@ -228,8 +231,7 @@ if gpg_user --list-key ="${URI}" &>/dev/null ; then
 # if the host is NOT in the keyring...
 else
     # if the host key is found in the known_hosts file...
-    # FIXME: this only works for default known_hosts location
-    hostKey=$(ssh-keygen -F "$HOST" 2>/dev/null)
+    hostKey=$( [ ! -r "$KNOWN_HOSTS" ] || ssh-keygen -F "$HOST" -f "$KNOWN_HOSTS" 2>/dev/null)
 
     if [ "$hostKey" ] ; then
        # do not check the keyserver