feat: make key authentication failures diagnosable #2
2026-09-09
feat: print the deploy key fingerprint
sshd names the offered key by fingerprint at LogLevel VERBOSE, so emitting it client-side makes a rejected key a direct comparison against the target's auth log rather than a guess. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
feat: verify the key up front and stop falling back to password auth
A rejected key produced two generic "Permission denied, please try again." prompts followed by a denial listing every auth method, which says nothing about why the key was refused, and looks identical whether the key input was malformed or simply not authorized on the server. The key is now checked with ssh-keygen before connecting, so an unusable input fails immediately and says so, and the derived public key is printed — that is the exact line that has to be present in authorized_keys. BatchMode stops the interactive password fallback, and IdentitiesOnly keeps ssh from offering anything other than the supplied key. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>