Unable to delete SSH keys

[Jimmy Merrild Krag]

I cannot delete my SSH keys.
I have marked this a security vulnerability because of the poential inability to delete a compromized SSH key.

Got no OOPS ID, but got a Sentry ID: 32a232dcb50c420cb17e2de793c7968e

[Daniel Manrique (roadmr)]

UnknownLaunchpadError: <UnknownLaunchpadError code: 400 message: 'key_text: ssh-dss AAAAB3NzaC1kc3MAAACBAJle69Pl5apCOWyy/IWxOXLC7aLPRTdziK56cPNeJJ8AKPcv3cncU1lqBVqub94URnWVuTobx00wlhBPzG+y4jEWe5Q/uFu0EgUV/uZ+csoNoaMxjZNGKS5HAeJBlkTJTtlRjwTviFNJzRsHQB8kK6EqKzlCVo5ppCAGQn2wOCS/AAAAFQDKTifx6yiHMEV0Bncrv57cgA11aQAAAIA1jl3JuRNEpKafZT2LBSMvebCTjAJiX06XzaGLN5azsNMSUQQhLszQW2pU+GQ9iJ5C7nqtNeUtJyUw2oWCDyWpp7gGKoYrO9+5WU+eFamTlfff2ilJ093sKqjTx8AiSKY/VJagKpqQd+qSLv8JN9NgYXiIz0uWUtIXlslHj8juNQAAAIBDnrlBOT1pUUr3dvdyjxAbw93spWEiAuHtQSA9kKpJEbuL1LxESjcGI1Tvo83mG5BHDE2Cmmm7oZLC+PedkqUD7m7iUG6PWZbAbTKFpTNt0yGQoZOQJnw6xRwtUFKerA+zx4q3YQaIHXVUP2JCD7v++alYvF87FlNrGG2fGSXlaQ== beruic@beruic-laptop
'>

This is what SSO said. I wonder why Launchpad 400d on us? could someone with access to Launchpad logs please have a look?

Here's the timestamp from the Sentry event.
Jul 6, 2018 9:52:55 AM UTC

[Colin Watson (cjwatson)]

Launchpad is just rejecting this because of parameter formatting: the key_text parameter is declared as a TextLine, so it isn't allowed to have a trailing newline.

[Colin Watson (cjwatson)]

16:16 <cjwatson> roadmr: easy to test - while you can't actually use that method for real without SSO's privileges, you can get far enough to see parameter validation happening. try 'lp-shell production devel' and then do lp.people.addSSHKeyFromSSO(openid_identifier='test', key_text='ssh-dss\n', dry_run=True) vs. same without the \n
16:20 <cjwatson> roadmr: so I think somebody needs to look into why ClaimSSHKeyForm.clean_ssh_key's .strip() and re.sub apparently isn't happening or not being saved into the form data or whatever (maybe something needs to call .clean() on the form and isn't?)
16:20 <cjwatson> roadmr: should be easy to exercise in the test suite anyway

[Maximiliano Bertacchini (maxiberta)]

Note that `ClaimSSHKeyForm` is used when adding keys, while this is an issue with deletion. That said, `DeleteSSHKeyForm` gets its choices directly from LP (`get_lp_ssh_keys()`). So, I believe LP itself might have "invalid" ssh keys in its storage. Is that possible?

OTOH, I've proposed a branch with an improved cleanup for *new* ssh keys.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r18743 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/18743>.

[Jimmy Merrild Krag (beruic)]

I have just tried to delete a key on https://login.launchpad.net/ssh-keys, but still get an error.

[Colin Watson (cjwatson)]

Jimmy, we haven't deployed the Launchpad side of this fix yet. You'll see the Launchpad bug task change to "Fix Released" once we have.

[Jimmy Merrild Krag (beruic)]

Sorry. Misread that one :)

[Colin Watson (cjwatson)]

This should work now. Please test and let us know either way; if it still doesn't work, we'll need to investigate further.

[Jimmy Merrild Krag (beruic)]

Sorry it took so long, but the result is that it worked! I could finally delete my old unsafe public key :)