Module hostkey 

SSH host-key fingerprint pinning for well-known Git hosting services (FR-6, FR-7).

Gitway embeds the published SHA-256 fingerprints for GitHub, GitLab, and Codeberg. On every connection the server’s presented key is hashed and the resulting fingerprint is compared against the embedded list for that host. Any mismatch aborts the connection immediately.

Custom / self-hosted instances

Fingerprints for any host not listed below can be added via a known_hosts-style file at ~/.config/gitway/known_hosts (FR-7). Each non-comment line must follow the format:

hostname SHA256:<base64-encoded-fingerprint>

Fingerprint sources

• GitHub: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
• GitLab: https://docs.gitlab.com/ee/user/gitlab_com/index.html#ssh-host-keys-fingerprints
• Codeberg: https://docs.codeberg.org/security/ssh-fingerprint/

Last verified: 2026-04-11

Structs

HostKeyTrust

Combined view of every known_hosts entry that bears on the connection target.

Enums

HashMode

Per-file format detected by detect_hash_mode. Drives whether gitway hosts add should emit a hashed or plaintext entry by default.

Constants

CODEBERG_FINGERPRINTS

Codeberg.org’s published SSH host-key fingerprints (SHA-256).

DEFAULT_CODEBERG_HOST

Primary Codeberg SSH host.

DEFAULT_GITHUB_HOST

Primary GitHub SSH host (FR-1).

DEFAULT_GITLAB_HOST

Primary GitLab SSH host.

DEFAULT_PORT

Default SSH port used by all providers.

FALLBACK_HOSTDeprecated

Alias for GITHUB_FALLBACK_HOST; retained so existing callers that reference the old name continue to compile.

FALLBACK_PORT

HTTPS-port fallback for providers that support it (GitHub, GitLab).

GITHUB_FALLBACK_HOST

Fallback GitHub SSH host when port 22 is unavailable (FR-1).

GITHUB_FINGERPRINTS

GitHub’s published SSH host-key fingerprints (SHA-256, FR-6).

GITLAB_FALLBACK_HOST

Fallback GitLab SSH host when port 22 is unavailable.

GITLAB_FINGERPRINTS

GitLab.com’s published SSH host-key fingerprints (SHA-256).

Functions

all_embedded

Returns the embedded fingerprint catalogue as (host, fingerprint, algorithm) triples for surfacing in gitway hosts list.

append_known_host

Appends host SHA256:<fingerprint> as a new plaintext line to the known_hosts file at path, creating the file (and any missing parent directories) if needed.

append_known_host_hashed

Appends |1|<base64-salt>|<base64-hmac-sha1> SHA256:<fingerprint> to the known_hosts file at path, generating a fresh 20-byte random salt for this entry.

default_known_hosts_path

Returns the default known-hosts path: ~/.config/gitway/known_hosts (or the platform-equivalent dirs::config_dir() location).

detect_hash_mode

Inspects the existing known_hosts file at path and decides whether new entries should be hashed (matches OpenSSH’s HashKnownHosts yes behaviour) or plaintext.

fingerprints_for_host

Collects all expected fingerprints for host.

host_key_trust

Returns the HostKeyTrust for host, combining the embedded fingerprint set, any direct pins / @cert-authority / @revoked lines from the user-supplied or default known_hosts file, and pattern-matching for the cert-authority + revoked classes.

prepend_revoked

Prepends @revoked <host_pattern> <fingerprint> to the known_hosts file at path, atomically via a sibling tempfile + rename. Creates the file (and missing parents) if it does not yet exist.