SSH-key verification fails on CodeBerg

General
1

I get a strange failure on CodeBerg on my Aurora lap-top that I don’t get on my macbook.

After I upload the pubkey, I click the Verify button and then I get a screen with two code snippets I can use. The first is for verification using the private key file

echo -n '829c1f23a8e3c33b0ac6f75b8b4e262180f4b99ad75675f28506f59301e45b04' | ssh-keygen -Y sign -n gitea -f ~/.ssh/id_codeberg

the second is in case you’re using the agent:

bash -c "echo -n '829c1f23a8e3c33b0ac6f75b8b4e262180f4b99ad75675f28506f59301e45b04' | ssh-keygen -Y sign -n gitea -f <(echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL8111FOjJAQ7O6Pr3qgUd5YliCxQztYMUumn83kLkEc')"

After I paste the result into the Armored SSH signature field, I get the same error in both scenarios:

The provided SSH key, signature or token do not match or token is out-of-date.

I have not run into this problem before…. Is this familiar?

_General PSA_

Codeberg is awesome and they make security accessible to the masses. Please consider them if you are looking for a place to host your git repo and donating, even small amounts is a good contribution.

2

So quick question:

is the location of the private key the following ~/.ssh/id_codeberg and did you place into codeberg the public key ~/.ssh/id_codeberg.pub??

I just tried adding a new public key to my https://codeberg.org/ account and it was successfully added and I went through the verification part (using the echo command line option which then produced the '‘Signed Data’ output and copied it into the section needed to verify and completed without any issue.

I would run something like this to make sure the private and public keys match as well just in case(change the file names to what they are on your system):

ssh-keygen -lf ~/.ssh/id_rsa.pub
ssh-keygen -lf ~/.ssh/id_rsa

Another idea to try is to generate a new new SSH key and see if you can add it to codeberg.com and do the verify process as well just as a test:

ssh-keygen -t ed25519 -a 32 -f ~/.ssh/codeberg-test

I hope this helps and hope the solution is an easy one.

3

Thanks for the suggestion. I didn’t know about the -lf options for the fingerprint and the -f option saves me a lot of typing.

The current file names and keys all match, so I created a new key pair with your instructions and got the same error.

I’m copying the key text from the terminal window into the browser form.
I wonder if there is something in the clipboard or the character encoding that might be mangled?

4

It could possibly be a copy paste thing for this issue you are getting.

Some more possible tests to see what it might be:

  • Use command like xsel to copy the command line part to the clipboard
echo -n '<TOKEN>' | ssh-keygen -Y sign -n gitea -f ~/.ssh/codeberg-test | xsel -b
  • Download and use a different terminal (not the default one that comes with Aurora laptop, I use Ghostty)
  • Download and use a clipboard manager like Klipper for KDE to see if the data that’s being copied is wrong

Another thing to take note. I noticed when I did another test SSH key on codeberg.org that I messed up on my test SSH key verification and when I went to the verification again, I got a NEW token to use to do the verification. I didn’t notice that and failed again. I noticed it on the third attempt that I needed to do the following:

  • use the new token
  • change the name of the private key from the example commands they gave to make it work

I was able to do the second SSH key verification with success by doing the following changes above (I also used the xsel command with mine as well to copy/paste that key back into the verification process just fine)

Hope this helps!

1 Like
5

This is an awesome suggestion #TIL xsel is a thing, so I brew install xsel and your instructions worked like a charm….but the %$@* error happened again.

I didn’t find GhostTTY in the Bazaar flathub browser, so I install an emulator called Contour , refreshed the token, ran the echo… command again, pasted the text into the form…

and it worked like a charm!

So there may be something quite weird with the terminal emulator but it’s way past my bedtime…

thank you.

1 Like
6

… I didn’t see GhosTTY or Klipper in Bazaar, so I may not be using the same repos as the cool kids.

1 Like
7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.