From 7ed9d50ab63dd973c58ba072b914740e57651556 Mon Sep 17 00:00:00 2001
From: Lorenz Leutgeb <lorenz.leutgeb@radicle.dev>
Date: Wed, 20 May 2026 11:40:11 +0200
Subject: [PATCH] crypto: Update ssh-agent-lib from 0.5.2 to 0.6

This should fix issues handling SSH certificates.

See
<https://radicle.zulipchat.com/#narrow/channel/369873-Support/topic/1.2E9.2E0.3A.20rad.20auth.20fails.20with.20SSH.20certificate.20in.20agent/with/596358640>.
---
 Cargo.lock                             |  4 ++--
 crates/radicle-crypto/Cargo.toml       |  2 +-
 crates/radicle-crypto/src/ssh/agent.rs | 24 ++++++++++++++++--------
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b856a5cd..47233b63 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3957,9 +3957,9 @@ dependencies = [
 
 [[package]]
 name = "ssh-agent-lib"
-version = "0.5.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3d0582e6e5724c4a5d038472976e8fad64d824b3de37210aa60c35883e3e766"
+checksum = "b528981371b3bfdfe927a5ef37221446e0ba44551e673b569fd0fd38e5dcb292"
 dependencies = [
  "byteorder",
  "log",
diff --git a/crates/radicle-crypto/Cargo.toml b/crates/radicle-crypto/Cargo.toml
index 2cc67693..d9b2b0b9 100644
--- a/crates/radicle-crypto/Cargo.toml
+++ b/crates/radicle-crypto/Cargo.toml
@@ -28,7 +28,7 @@ schemars = { workspace = true, optional = true, features = ["derive", "std"] }
 serde = { workspace = true, features = ["derive", "std"] }
 signature = { workspace = true, features = ["std"] }
 sqlite = { workspace = true, features = ["bundled"], optional = true }
-ssh-agent-lib = { version = "0.5.2", optional = true, default-features = false, features = ["log"] }
+ssh-agent-lib = { version = "0.6", optional = true, default-features = false, features = ["log"] }
 ssh-key = { version = "0.6.3", default-features = false, features = ["std", "encryption", "getrandom"], optional = true }
 thiserror = { workspace = true, default-features = true }
 zeroize = { workspace = true }
diff --git a/crates/radicle-crypto/src/ssh/agent.rs b/crates/radicle-crypto/src/ssh/agent.rs
index d5323a11..39fec41e 100644
--- a/crates/radicle-crypto/src/ssh/agent.rs
+++ b/crates/radicle-crypto/src/ssh/agent.rs
@@ -3,7 +3,7 @@ use std::env::VarError;
 use std::path::Path;
 use std::path::PathBuf;
 
-use proto::Credential;
+use proto::{PrivateCredential, PublicCredential};
 use ssh_agent_lib::blocking::Client;
 pub use ssh_agent_lib::error::AgentError;
 use ssh_agent_lib::proto;
@@ -79,7 +79,7 @@ impl Agent {
     pub fn register(&mut self, key: &SecretKey) -> Result<(), AgentError> {
         use ssh_key::private::{Ed25519Keypair, KeypairData};
         self.client.add_identity(proto::AddIdentity {
-            credential: Credential::Key {
+            credential: PrivateCredential::Key {
                 privkey: KeypairData::Ed25519(Ed25519Keypair::from_bytes(key).unwrap()),
                 comment: "".into(),
             },
@@ -88,7 +88,7 @@ impl Agent {
 
     pub fn unregister(&mut self, key: &PublicKey) -> Result<(), AgentError> {
         self.client.remove_identity(proto::RemoveIdentity {
-            pubkey: Self::key_data(key),
+            credential: PublicCredential::Key(Self::key_data(key)),
         })
     }
 
@@ -98,7 +98,7 @@ impl Agent {
 
     pub fn sign(&mut self, key: &PublicKey, data: &[u8]) -> Result<[u8; 64], AgentError> {
         let sig = self.client.sign(proto::SignRequest {
-            pubkey: Self::key_data(key),
+            credential: PublicCredential::Key(Self::key_data(key)),
             data: data.to_vec(),
             flags: 0,
         })?;
@@ -120,7 +120,13 @@ impl Agent {
             .client
             .request_identities()?
             .into_iter()
-            .filter_map(|identity| identity.pubkey.ed25519().map(|key| PublicKey::from(key.0)))
+            .filter_map(|identity| {
+                identity
+                    .credential
+                    .key_data()
+                    .ed25519()
+                    .map(|key| PublicKey::from(key.0))
+            })
             .collect())
     }
 
@@ -189,7 +195,7 @@ impl AgentSigner {
 mod test {
     use crate::PublicKey;
     use ssh_agent_lib::blocking::Client;
-    use ssh_agent_lib::proto::SignRequest;
+    use ssh_agent_lib::proto::{PublicCredential, SignRequest};
     use ssh_agent_lib::ssh_key::public::{Ed25519PublicKey, KeyData};
 
     #[test]
@@ -215,7 +221,7 @@ mod test {
         // since we are not actually connected to SSH agent.
         assert!(
             matches!(client.remove_identity(ssh_agent_lib::proto::RemoveIdentity {
-                pubkey: KeyData::Ed25519(Ed25519PublicKey(pk.to_byte_array())),
+                credential: PublicCredential::Key(KeyData::Ed25519(Ed25519PublicKey(pk.to_byte_array()))),
             }),
                 Err(
                     super::AgentError::Proto(ssh_agent_lib::proto::ProtoError::IO(err)),
@@ -250,7 +256,9 @@ mod test {
 
         client
             .sign(SignRequest {
-                pubkey: KeyData::Ed25519(Ed25519PublicKey(pk.to_byte_array())),
+                credential: PublicCredential::Key(KeyData::Ed25519(Ed25519PublicKey(
+                    pk.to_byte_array(),
+                ))),
                 data,
                 flags: 0,
             })