add sample code and test SSH keys

Author: ddebin

.github/codecov.yml

@@ -1,4 +1,5 @@
-codecov:
-  parsers:
-    lcov:
-      partials_as_hits: true
+parsers:
+  lcov:
+    partials_as_hits: true
+  javascript:
+    enable_partials: true

.gitignore

@@ -6,5 +6,4 @@ mise.toml
 /*.tgz
 /.nyc_output
 /coverage
-id_*
 *.local.*

README.md

@@ -32,7 +32,7 @@ A seed is used to generate the secret, it's recommended you don't use the same s
 ## ⚠️ Limitations
 
 - Can't use ECDSA keys, they always give different signatures
-- [RFC8332](https://www.rfc-editor.org/info/rfc8332) compatible agent (e.g. OpenSSH 7.6+) mandatory to use SHA2-512 signature scheme. You can still use deprecated SHA1 signatures with `rsaSignatureFlag:0` option in `SSHAgentClient` constructor.
+- [RFC8332](https://www.rfc-editor.org/info/rfc8332) compatible agent (e.g. OpenSSH 7.6+) is mandatory to use SHA2-512 signature scheme. You can still use deprecated SHA1 signatures with `rsaSignatureFlag:0` option in `SSHAgentClient` constructor.
 
 ## 💻 CLI usage
 
@@ -67,7 +67,7 @@ Options:
 npm i ssh-agent-secrets
 ```
 
-### Sample
+### [Sample](/example/test.js)
 
 ```javascript
 import { SSHAgentClient } from 'ssh-agent-secrets'
@@ -77,7 +77,7 @@ const agent = new SSHAgentClient()
 const identities = await agent.getIdentities()
 console.log(identities)
 
-const identity = await agent.getIdentity('AWS')
+const identity = await agent.getIdentity('ED25519')
 
 const encrypted = await agent.encrypt(
   identity,
@@ -96,9 +96,10 @@ const decrypted = await agent.decrypt(
 console.log('Decrypted data:', decrypted.toString('utf8'))
 ```
 
-## Local test
+### Local test
 
 ```bash
 ssh-agent -D
-SSH_AUTH_SOCK= ssh-add id_ecdsa id_ed25519 id_rsa
+SSH_AUTH_SOCK="[...]" ssh-add test/ssh_keys/*
+SSH_AUTH_SOCK="[...]" npm run test
 ```

codecov.yml

@@ -0,0 +1,20 @@
+import { SSHAgentClient } from '../dist/src/lib/index.js'
+
+const agent = new SSHAgentClient()
+
+const identities = await agent.getIdentities()
+console.log(`${identities.length} identities found in the SSH agent`)
+
+// replace "AWS" with the actual comment of your SSH key
+const identity = await agent.getIdentity('ED25519')
+
+const encrypted = await agent.encrypt(
+  identity,
+  'not_a_secret_but_a_seed',
+  Buffer.from('Lorem ipsum dolor', 'utf8'),
+  'hex',
+)
+console.log('Encrypted data:', encrypted)
+
+const decrypted = await agent.decrypt(identity, 'not_a_secret_but_a_seed', encrypted, 'hex')
+console.log('Decrypted data:', decrypted.toString('utf8'))

example/test.js

@@ -2,13 +2,13 @@ import * as crypto from 'crypto'
 import { type SSHKey, type SSHSignature } from './ssh_agent_client.ts'
 
 /** Read a length-prefixed string (uint32 BE length + bytes) from a buffer. */
-const readString = function readString(buffer: Buffer, offset: number): Buffer {
+const readString = (buffer: Buffer, offset: number): Buffer => {
   const len = buffer.readUInt32BE(offset)
   return buffer.subarray(offset + 4, offset + 4 + len)
 }
 
 /** Write a length-prefixed string into `target` at `offset`, return next offset. */
-const writeString = function writeString(target: Buffer, src: Buffer, offset: number): number {
+const writeString = (target: Buffer, src: Buffer, offset: number): number => {
   target.writeUInt32BE(src.length, offset)
   src.copy(target, offset + 4)
   return offset + 4 + src.length
@@ -19,7 +19,7 @@ const writeString = function writeString(target: Buffer, src: Buffer, offset: nu
  * into `request` and return the next write offset (5).
  * The length field is the total buffer length minus the 4-byte length field itself.
  */
-const writeHeader = function writeHeader(request: Buffer, tag: number): number {
+const writeHeader = (request: Buffer, tag: number): number => {
   request.writeUInt32BE(request.length - 4, 0)
   request.writeUInt8(tag, 4)
   return 5

src/lib/parse_utils.ts

@@ -72,6 +72,7 @@ export class SSHAgentClient {
     this.cipherAlgo = options.cipherAlgo ?? 'aes-256-cbc'
     this.digestAlgo = options.digestAlgo ?? 'sha256'
 
+    /** Default to SHA2-512 signature when using RSA keys */
     this.rsaSignatureFlag = options.rsaSignatureFlag ?? RsaSignatureFlag.SSH_AGENT_RSA_SHA2_512
 
     const sockFile = options.sockFile ?? process.env.SSH_AUTH_SOCK

src/lib/ssh_agent_client.ts

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQREWz6lU6g0r40iDfQfSN5SyHN4V2e5
+LQ9PMbb7q7DjjlpntLj1YyiJ2kI1qk8S3HfaavQrlZ393ZQcgwCh6WWnAAAAqGEJ5shhCe
+bIAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBERbPqVTqDSvjSIN
+9B9I3lLIc3hXZ7ktD08xtvursOOOWme0uPVjKInaQjWqTxLcd9pq9CuVnf3dlByDAKHpZa
+cAAAAgX/s0aZuGMVwDFqed0dZP6sLPG1OGwmLfzr18cNHO8F4AAAANa2V5X2VjZHNhXzI1
+NgECAw==
+-----END OPENSSH PRIVATE KEY-----

test/ssh_keys/id_ecdsa_256

@@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAiAAAABNlY2RzYS
+1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQTyrUrtyMWCsVSZSxaMsHqxsApl2I6h
+umUukiarodoeR44S+da4Jn+uQ7vXHU3LErYokIBwa+pI0WESGKDmKv46DJQ2z1/duoYNCT
+vfz+veP/72yh5G3KrQjCYZLqAByfkAAADY/EEPT/xBD08AAAATZWNkc2Etc2hhMi1uaXN0
+cDM4NAAAAAhuaXN0cDM4NAAAAGEE8q1K7cjFgrFUmUsWjLB6sbAKZdiOobplLpImq6HaHk
+eOEvnWuCZ/rkO71x1NyxK2KJCAcGvqSNFhEhig5ir+OgyUNs9f3bqGDQk738/r3j/+9soe
+Rtyq0IwmGS6gAcn5AAAAMQC8tlMq4ZYm+TYf7be2DT2fUTtHgNkS3xPcpj9A2EFkVUX3Pq
+yaaFe4gyJYSbHGCLcAAAANa2V5X2VjZHNhXzM4NAEC
+-----END OPENSSH PRIVATE KEY-----

test/ssh_keys/id_ecdsa_384

@@ -0,0 +1,12 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAArAAAABNlY2RzYS
+1zaGEyLW5pc3RwNTIxAAAACG5pc3RwNTIxAAAAhQQAgsJlchCqyHPx2cYZOnNEOvoUx4K6
+RXFJQ7y/K/UH5YgD034nFFKsjBsycEiaM3Apf4ugcg4FVPqH4c6gF1h4LpoBafJFGSdi2+
+mjjM1EqtltG/30WQrI9/Vl+L+00CzQES6HWFp+phnSi6nsfhQQAp2gZ43/G/Pdd3xSSoKr
+lAVYfEgAAAEQn6hql5+oapcAAAATZWNkc2Etc2hhMi1uaXN0cDUyMQAAAAhuaXN0cDUyMQ
+AAAIUEAILCZXIQqshz8dnGGTpzRDr6FMeCukVxSUO8vyv1B+WIA9N+JxRSrIwbMnBImjNw
+KX+LoHIOBVT6h+HOoBdYeC6aAWnyRRknYtvpo4zNRKrZbRv99FkKyPf1Zfi/tNAs0BEuh1
+hafqYZ0oup7H4UEAKdoGeN/xvz3Xd8UkqCq5QFWHxIAAAAQXCDeTwGofULiUsEMK29UJ0L
+1xxTDBAkCK1zjPQWHDov8cf/DxB8nspWZVXNYLc+tnwDrzx0TFdF2sMR1uW7KJtvAAAADW
+tleV9lY2RzYV81MjEBAgMEBQY=
+-----END OPENSSH PRIVATE KEY-----