Issue when parsing known_hosts file with comments using libgit2

[remisauvat]

Hi,

I found an issue when the secret for a GitRepository contains a known_hosts file with comments. When using the libgit2 implementation I get the following error:

{"level":"error","ts":"2021-10-28T08:44:51.251Z","logger":"controller.gitrepository","msg":"Reconciler error","reconciler group":"source.toolkit.fluxcd.io","reconciler kind":"GitRepository","name":"gitops","namespace":"flux-system","error":"auth error: EOF"}

I had the same errors with image-automation-controller which uses the same code.

I was able to track down the issue to

source-controller/pkg/git/libgit2/transport.go

Lines 169 to 172 in 5ccb914

	_, hosts, pubKey, _, _, err := ssh.ParseKnownHosts(scanner.Bytes())
	if err != nil {
	return []knownKey{}, err
	}

Which tries for each line in the known_hosts file to parse the entry. But according to the official documentation, the function ParseKnownHosts can return io.EOF

If no entries were found in the input then err will be io.EOF

So I think those errors should be ignored or maybe lines should be scanned for # in them.

Here is an example secret that fails.

---
apiVersion: v1
kind: Secret
metadata:
  name: gitops
  namespace: flux-system
stringData:
  identity: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ....
    -----END OPENSSH PRIVATE KEY-----
  identity.pub: |
    ssh-rsa ...
  known_hosts: |
    # github
    192.30.253.112 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

[ppodevlabs]

This is happening to the image automation controller too. Just confirmed.

{"level":"error","ts":"2021-10-28T11:28:51.725Z","logger":"controller-runtime.manager.controller.imageupdateautomation","msg":"Reconciler error","reconciler group":"image.toolkit.fluxcd.io","reconciler kind":"ImageUpdateAutomation","name":"acceptance-ipa","namespace":"operator-cp-kang-qa","error":"auth error: EOF"}

Removing the # lines fixed the issue.

[hiddeco]

@darkowlzz is working on a fix, this will be included in the next release.