Improve spire's use of ssh agent when multiple private keys are available.

[retrogradeorbit]

1. start with a clean ssh-agent.

2. use spire to initiate an ssh connection to a machine that has your ssh RSA key as an authorized key.

3. key decryption box appears. key cannot be decrypted with valid passphrase.

4. ctrl-c

5. use ssh to connect with same agent.

6. key decryption box appears. key can now be decrypted. ssh connects

7. logout the ssh shell

8. now try spire connection again. now it works.

9. use ssh-add -D to delete all decrypted keys

10. try again. fails.

[retrogradeorbit]

Problem predates new Jsch. Have never seen it until now because ssh agent is usually full of decrypted keys.

Appears to be a problem with the way spire's ssh-agent implementation calls the agent. It just issues a sign request straight away on the key. It does not offer the key first to see if the key would be accepted.

ssh does:

debug1: Offering public key: RSA SHA256:j3c87ySHbCUN5CETVky5nRNqABI5Mj8JuqSeBLd8kwk /home/crispin/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug2: input_userauth_pk_ok: fp SHA256:j3c87ySHbCUN5CETVky5nRNqABI5Mj8JuqSeBLd8kwk
debug3: sign_and_send_pubkey: RSA SHA256:j3c87ySHbCUN5CETVky5nRNqABI5Mj8JuqSeBLd8kwk

notice it sends message 50 first (SSH2_MSG_USERAUTH_REQUEST), then receives response 60 (SSH2_MSG_USERAUTH_PK_OK) and then issues the sign_and_send_pubkey call.

spire just takes the first identity and uses that for auth. I was getting confused because the order is different to ssh order.

In spire, when the first key tried fails, the whole auth fails. It does not then try the next key like ssh does.

[retrogradeorbit]

Spire needs more of the ssh-agent protocol implemented. It should offer ssh keys one after the other if you don't decrypt one, like ssh does.