From 14d0084b2262fa836a921b69a9c8f9ff14e35a40 Mon Sep 17 00:00:00 2001 From: Erik Nordmark Date: Fri, 31 Jul 2026 12:00:55 -0700 Subject: [PATCH] Potential fix for code scanning alert no. 2388: Use of insecure HostKeyCallback implementation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- evetest/ssh.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/evetest/ssh.go b/evetest/ssh.go index 8f22c7d09aa..4a90f89df03 100644 --- a/evetest/ssh.go +++ b/evetest/ssh.go @@ -17,6 +17,7 @@ import ( "github.com/lf-edge/eve/evetest/utils" "github.com/lf-edge/eve/pkg/pillar/utils/generics" "golang.org/x/crypto/ssh" + "golang.org/x/crypto/ssh/knownhosts" ) type watchdogWriter struct { @@ -61,8 +62,13 @@ func (th *TestHarness) runScriptOverSSH(ctx context.Context, addr string, auth AuthMethod, script string, stdout, stderr io.Writer, stdoutWatchdogTimeout time.Duration) error { + hostKeyCallback, err := knownhosts.New("/root/.ssh/known_hosts") + if err != nil { + return fmt.Errorf("failed to initialize SSH known_hosts callback: %w", err) + } + sshConfig := &ssh.ClientConfig{ - HostKeyCallback: ssh.InsecureIgnoreHostKey(), + HostKeyCallback: hostKeyCallback, Timeout: 5 * time.Second, }