Document lack of host Key validation

[DanielleMaywood]

I noticed you do not perform host key validation. Maybe this should be made more obvious to users without having to dig through the source?

sidekick/utils/utils.go

Lines 77 to 80 in b99b61b

	HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
	// use OpenSSH's known_hosts file if you care about host validation
	return nil
	},

[MightyMoud]

Yup fair point. I honestly didn't expect anyone to actually use this...
Thanks for pointing that out. I'll address this soon.

[lpil]

Forgive me, I'm not familiar with this library. What is one expected to do in this callback?

[DanielleMaywood]

Forgive me, I'm not familiar with this library. What is one expected to do in this callback?

So you're expected to check if the key matches what you expect by checking the .ssh/known_hosts file or some other source of truth.

You can use a library like https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts or https://pkg.go.dev/github.com/skeema/knownhosts for making that easier.

[MightyMoud]

You both are too kind! 🙂

I understand how critical this is now after some research.
I'll open a PR tonight. I would be glad if you guys can review it to make sure I get this right.

Let me know if you're keen, I'll assign you then...

[DanielleMaywood]

I'm more than happy to check it over if you want another set of eyes.

[MightyMoud]

Here we go - #9

[DanielleMaywood]

Will get round to this later!

[MightyMoud]

No rush!
Let's chat in the PR if you have any comments