{"record":{"id":"8a6796ec2afb294a","repo":"kubernetes/kops","slug":"error-decoding-ssh-public-key-q","errorCode":null,"errorMessage":"error decoding SSH public key: %q","messagePattern":"error decoding SSH public key: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"pkg/pki/sshkey.go","lineNumber":45,"sourceCode":"\t\"reflect\"\n\t\"strings\"\n\n\t\"golang.org/x/crypto/ssh\"\n)\n\n// parseSSHPublicKey parses the SSH public key string\nfunc parseSSHPublicKey(publicKey string) (ssh.PublicKey, error) {\n\ttokens := strings.Fields(publicKey)\n\tif len(tokens) < 2 {\n\t\treturn nil, fmt.Errorf(\"error parsing SSH public key: %q\", publicKey)\n\t}\n\n\tsshPublicKeyBytes, err := base64.StdEncoding.DecodeString(tokens[1])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error decoding SSH public key: %q err: %s\", publicKey, err)\n\t}\n\tif len(tokens) < 2 {\n\t\treturn nil, fmt.Errorf(\"error decoding SSH public key: %q\", publicKey)\n\t}\n\n\tsshPublicKey, err := ssh.ParsePublicKey(sshPublicKeyBytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing SSH public key: %v\", err)\n\t}\n\treturn sshPublicKey, nil\n}\n\n// colonSeparatedHex formats the byte slice SSH-fingerprint style: hex bytes separated by colons\nfunc colonSeparatedHex(data []byte) string {\n\tsshKeyFingerprint := fmt.Sprintf(\"%x\", data)\n\tvar colonSeparated bytes.Buffer\n\tfor i := 0; i < len(sshKeyFingerprint); i++ {\n\t\tif (i%2) == 0 && i != 0 {\n\t\t\tcolonSeparated.WriteByte(':')\n\t\t}\n\t\tcolonSeparated.WriteByte(sshKeyFingerprint[i])","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/sshkey.go#L27-L63","documentation":"This branch is a redundant defensive check: after a successful base64 decode of tokens[1] it re-checks len(tokens) < 2 and reports a decode error. Since tokens[1] was just accessed, len(tokens) >= 2 already holds, so in practice this exact message is unreachable dead code; the reachable decode failure is reported by errorIndex 1582.","triggerScenarios":"Not reachable at runtime: the preceding base64.DecodeString(tokens[1]) guarantees at least two tokens exist.","commonSituations":"Seen only while reading the source; it appears in audits of sshkey.go as an apparent copy-paste leftover of the earlier token-length check.","solutions":["No runtime action needed; treat occurrences of this message as the base64-decode failure path (see 'error decoding SSH public key: %q err: %s')","If maintaining the code, remove the redundant len(tokens) < 2 re-check"],"exampleFix":"// before\nif len(tokens) < 2 {\n\treturn nil, fmt.Errorf(\"error decoding SSH public key: %q\", publicKey)\n}\n// after\n// (remove the redundant check; tokens[1] was already accessed safely)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Unreachable defensive branch; treat any decode-shaped error via the reachable path:\nif _, err := pki.ComputeAWSKeyFingerprint(pubKey); err != nil {\n\tklog.V(2).Infof(\"SSH key rejected: %v\", err) // covers decode + parse paths\n}","preventionTips":["No runtime defense needed for this dead branch","Validate keys upstream with ssh-keygen -l to keep the whole parse path clean"],"tags":["ssh","dead-code","defensive-check"],"backgroundTag":"ssh-public-key-invalid","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}