An OpenSSH SHA256:<base64> public key fingerprint.
This is exactly what ssh-keygen -lf prints and what OpenSSH shows on an
unknown-host prompt: unpadded base64 of the sha256 of the wire encoding.
gunnar never computes “something like” a fingerprint. An operator has to be
able to compare what gunnar lists against what ssh-keygen says on their
laptop, so tests/fingerprint.rs pins it to known answers taken from the
real OpenSSH binary.
Every constructor routes through fingerprint_of_blob, so there is one
definition and it is a definition over bytes.
Convenience over fingerprint_of_blob for the crates that link thisssh-key. gunnar-ssh cannot use it (see fingerprint_of_blob) and
calls that function with russh’s key blob instead.
Accept a fingerprint that arrived as text: config file, gRPC request,
an operator’s terminal.
Validated rather than trusted: SHA256: plus 43 base64 characters. A
malformed fingerprint that gets stored anyway is a key that can never be
matched and never be revoked.