Flux CLI does not read key file from path with tilde character

[whatnick]

Describe the bug

If you create a local key in ecdsa-sha2-nistp256 form and attempt to lodge it to the cluster secret using "--private-key-file=~/.ssh/id_ecdsa" format, flux CLI fails with failed to open private key file: open ~/.ssh/id_ecdsa: no such file or directory

Steps to reproduce

1. Create at an ecdsa key pair - ssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa
2. Attempt to lodge the secret key in cluster with : flux create secret git <secret_name> --url=ssh://git@github.com/<org>/<git_repo>.git --private-key-file=~/.ssh/id_ecdsa -n <namespace>
3. Flux cli errors out

Expected behavior

Flux CLI accepts the ecdsa-sha2-nist256p key stored in ~/.ssh/id_ecdsa

Screenshots and recordings

No response

OS / Distro

Ubuntu 22.04

Flux version

flux: v2.7.2

Flux check

► ghcr.io/fluxcd/notification-controller:v1.4.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v1.4.1
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta3
✔ buckets.source.toolkit.fluxcd.io/v1
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1
✔ helmreleases.helm.toolkit.fluxcd.io/v2
✔ helmrepositories.source.toolkit.fluxcd.io/v1
✔ imagepolicies.image.toolkit.fluxcd.io/v1beta2
✔ imagerepositories.image.toolkit.fluxcd.io/v1beta2
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1beta2
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta3
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed

Git provider

GitHub (Enterprise)

Container Registry provider

No response

Additional context

Leaving out the local key file triggers flux cli to generate a ecdsa-sha2-nistp384 key which can used as deploy key instead and works.

Code of Conduct

• I agree to follow this project's Code of Conduct

[stefanprodan]

Does it work with --private-key-file=$HOME/.ssh/id_ecdsa?

[whatnick]

$HOME works ~/ does not. Possibly shell expansion issue. We can error differently to suggest a better path : golang/go@ffbcd89

[makkes]

The ~ character is expanded by your shell (if it supports that), not by the Flux CLI. If you use --private-key-file ~/.ssh/id_ecdsa, it will work.

Curiously, --private-key-file=$HOME will be expanded by the shell while --private-key-file=~ will not. But there's not a lot we can do about that in the Flux CLI without jumping through a lot of hoops that may introduce further inconveniences (i.e. bugs) to users.

[makkes]

$HOME works ~/ does not. Possibly shell expansion issue. We can error differently to suggest a better path : golang/go@ffbcd89

I think the prefix check would be the best way to cope with this so users get a very early and clear signal what's going on.