bw-ssh-agent-filter: add more log output

Author: Moraxyc

pkgs/by-name/bw/bw-ssh-agent-filter/authorize_darwin.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log"
 	"time"
 
 	touchid "github.com/noamcohen97/touchid-go"
@@ -31,10 +32,9 @@ func (a *touchIDAuthorizer) Authorize(key ssh.PublicKey, comment string, flags a
 
 	reason := fmt.Sprintf("Allow SSH signature using %s\n%s", comment, ssh.FingerprintSHA256(key))
 
-	if err := touchid.CanAuthenticate(a.policy); err != nil {
-		return fmt.Errorf("local authentication unavailable: %w", err)
-	}
+	started := time.Now()
 	if err := touchid.Authenticate(ctx, a.policy, reason); err != nil {
+		log.Printf("auth failed after %s: %s", time.Since(started).Round(time.Millisecond), ssh.FingerprintSHA256(key))
 		if errors.Is(err, context.DeadlineExceeded) {
 			return errors.New("local authentication timed out")
 		}
@@ -46,6 +46,7 @@ func (a *touchIDAuthorizer) Authorize(key ssh.PublicKey, comment string, flags a
 		}
 		return fmt.Errorf("local authentication denied: %w", err)
 	}
+	log.Printf("auth ok after %s: %s", time.Since(started).Round(time.Millisecond), ssh.FingerprintSHA256(key))
 
 	return nil
 }

pkgs/by-name/bw/bw-ssh-agent-filter/go.mod

@@ -2,9 +2,9 @@ module bw-ssh-agent-filter
 
 go 1.26
 
-require golang.org/x/crypto v0.52.0
-
 require (
-	github.com/noamcohen97/touchid-go v0.3.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	github.com/noamcohen97/touchid-go v0.3.0
+	golang.org/x/crypto v0.52.0
 )
+
+require golang.org/x/sys v0.45.0 // indirect

pkgs/by-name/bw/bw-ssh-agent-filter/main.go

@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"strings"
 	"syscall"
+	"time"
 
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
@@ -223,22 +224,32 @@ func (a *filterAgent) Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, erro
 	if !a.isAllowed(key) {
 		return nil, errors.New("key not allowed")
 	}
+	started := time.Now()
 	if err := a.auth.Authorize(key, a.commentFor(key), 0); err != nil {
 		return nil, err
 	}
+	log.Printf("authorize finished after %s: %s", time.Since(started).Round(time.Millisecond), ssh.FingerprintSHA256(key))
 
-	return a.upstream.Sign(key, data)
+	started = time.Now()
+	sig, err := a.upstream.Sign(key, data)
+	log.Printf("upstream sign finished after %s: %s", time.Since(started).Round(time.Millisecond), ssh.FingerprintSHA256(key))
+	return sig, err
 }
 
 func (a *filterAgent) SignWithFlags(key ssh.PublicKey, data []byte, flags agent.SignatureFlags) (*ssh.Signature, error) {
 	if !a.isAllowed(key) {
 		return nil, errors.New("key not allowed")
 	}
+	started := time.Now()
 	if err := a.auth.Authorize(key, a.commentFor(key), flags); err != nil {
 		return nil, err
 	}
+	log.Printf("authorize finished after %s flags=%d: %s", time.Since(started).Round(time.Millisecond), flags, ssh.FingerprintSHA256(key))
 
-	return a.upstream.SignWithFlags(key, data, flags)
+	started = time.Now()
+	sig, err := a.upstream.SignWithFlags(key, data, flags)
+	log.Printf("upstream sign finished after %s flags=%d: %s", time.Since(started).Round(time.Millisecond), flags, ssh.FingerprintSHA256(key))
+	return sig, err
 }
 
 func (a *filterAgent) isAllowed(key ssh.PublicKey) bool {

pkgs/by-name/bw/bw-ssh-agent-filter/package.nix

@@ -8,7 +8,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bw-ssh-agent-filter";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = ./.;