Author: Daniel F. Dickinson <cshored@thecshore.com>
Date:   Sun Jan 27 01:04:25 2019 -0500

gitolite: Eliminate the need for ssh-keygen dependency

  Previously gitolite used ssh-keygen to generate fingerprints
  from OpenSSH keys to ensure non-duplication of keys when
  processing them to create / manage user ssh access to the
  git repositories.  This ends up depending on openssl,
  which is large and unnecessary when we are running on an
  embedded distro such as OpenWrt.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
Index: gitolite-3.6.11/src/lib/Gitolite/Common.pm
===================================================================
--- gitolite-3.6.11.orig/src/lib/Gitolite/Common.pm
+++ gitolite-3.6.11/src/lib/Gitolite/Common.pm
@@ -26,6 +26,8 @@ package Gitolite::Common;
 use Exporter 'import';
 use File::Path qw(mkpath);
 use File::Temp qw(tempfile);
+use MIME::Base64 qw(decode_base64);
+use Digest::SHA qw(sha256_base64);
 use Carp qw(carp cluck croak confess);
 
 use strict;
@@ -352,43 +352,82 @@ sub logger_plus_stderr {
 }
 
 # ----------------------------------------------------------------------
+# Decode OpenSSH key
+# If the key cannot be parsed it will be undef
+# Returns (algorithm_name, algo_data1, algo_data2, ...)
+sub ssh_decode_key($) {
+    my $key = shift;
+    my $keydata = decode_base64($key);
+    my @keyparts = ();
+    my $partlen;
+    my $algorithm;
+    my $data;
+    my $pos = 0;
+    $partlen = unpack('N',  substr $keydata, $pos, 4) or return undef;
+    $algorithm = substr $keydata, $pos + 4, $partlen or return undef;
+    $pos = $pos + 4 + $partlen;
+    while ( $pos <= length($keydata) ) {
+        $partlen = unpack('N',  substr $keydata, $pos, 4) or last;
+        $data = unpack('s>*',  substr $keydata, $pos + 4, 4) or last;
+	$pos = $pos + 4 + $partlen;
+        push @keyparts, $data;
+    }
+    return ( $algorithm, @keyparts );
+}
+
+# ----------------------------------------------------------------------
+# Parse OpenSSH line
+# If the file cannot be parsed it will be undef
+# Returns (restrictions, algorithm, PEMkey, comment)
+sub ssh_parse_line($) {
+   my $ssh_line = shift;
+   my @ssh_parts = split / /, $ssh_line, 5;
+   if (scalar @ssh_parts < 4)  {
+      @ssh_parts = ('', @ssh_parts);
+   }
+   if (scalar @ssh_parts > 4) {
+      @ssh_parts = @ssh_parts[0,3]
+   }
+   if (scalar @ssh_parts < 4) {
+      @ssh_parts = undef;
+   }
+   return ( @ssh_parts );
+}
+
+# ----------------------------------------------------------------------
+# Get the SSH fingerprint of a line of text
+# If the fingerprint cannot be parsed, it will be undef
+# In a scalar context, returns the fingerprint
+# In a list context, returns (fingerprint, output) where output
+# is the parsed input line (less algorithm)
+sub ssh_fingerprint_line($) {
+    my $ssh_line = shift;
+    my @parsed_line = ssh_parse_line($ssh_line) or return undef;
+    my @ssh_parts = ssh_decode_key($parsed_line[2]) or return undef;
+    ( $parsed_line[1] eq $ssh_parts[0] ) or die "algorithm mismatch: $parsed_line[1] vs. $ssh_parts[0]";
+    my $fp = sha256_base64(join(' ', @ssh_parts[1,-1]));
+    return wantarray ? ($fp, join(' ', @ssh_parts[1,-1])) : $fp;
+}
+
+# ----------------------------------------------------------------------
 # Get the SSH fingerprint of a file
 # If the fingerprint cannot be parsed, it will be undef
 # In a scalar context, returns the fingerprint
 # In a list context, returns (fingerprint, output) where output
-# is the raw output of the ssh-keygen command
-sub ssh_fingerprint_file {
+# is the raw input line
+sub ssh_fingerprint_file($) {
     my $in = shift;
     -f $in or die "file not found: $in\n";
     my $fh;
-    open( $fh, "ssh-keygen -l -f $in |" ) or die "could not fork: $!\n";
+    open( $fh, $in ) or die "could not open $in: $!\n";
     my $output = <$fh>;
     chomp $output;
-    # dbg("fp = $fp");
     close $fh;
     # Return a valid fingerprint or undef
-    my $fp = undef;
-    if($output =~ /((?:MD5:)?(?:[0-9a-f]{2}:){15}[0-9a-f]{2})/i or
-       $output =~ m{((?:RIPEMD|SHA)\d+:[A-Za-z0-9+/=]+)}i) {
-        $fp = $1;
-    }
+    my $fp = ssh_fingerprint_line($output);
     return wantarray ? ($fp, $output) : $fp;
 }
 
-# Get the SSH fingerprint of a line of text
-# If the fingerprint cannot be parsed, it will be undef
-# In a scalar context, returns the fingerprint
-# In a list context, returns (fingerprint, output) where output
-# is the raw output of the ssh-keygen command
-sub ssh_fingerprint_line {
-    my ( $fh, $fn ) = tempfile();
-    print $fh shift() . "\n";
-    close $fh;
-    my ($fp,$output) = ssh_fingerprint_file($fn);
-    unlink $fn;
-    return wantarray ? ($fp,$output) : $fp;
-}
-
 # ----------------------------------------------------------------------
 
 # bare-minimum subset of 'Tsh' (see github.com/sitaramc/tsh)