kenryu42/cc-safety-net v2.7.7

on GitHub

A fix for standard mode, which blocked ssh commands that authenticate with an identity file passed through -i.

Fixed

• Fixed standard mode treating the identity file of ssh -i as a sensitive-file read, so a command such as ssh -i ~/.ssh/deploy_key host.example uptime is no longer blocked by a built-in rule. ssh uses the key only to authenticate and never prints it. Clustered forms like -vi and an -i placed after options that take a value are both recognized. (#334)
  • -F, -o values such as IdentityFile= or ProxyCommand=, the remote command, an -i after the destination, and configured denyPaths entries all stay checked, and strict and paranoid modes still block the identity file.