Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-5169GitHub issuePublicDecided· Out of scope

Pasting an RSA public key into sshd setup is rejected as invalid

Reported by z23 · filed Oct 6, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Pasting an RSA public key into sshd setup is rejected as invalidrevision 1 · captured 2026-10-06 05:14 UTC via poll

System details

AMD Ryzen 9 7940HS, AMD Radeon 780M (Phoenix1), Omarchy 4.0.4-1, gum 2.0.0, OpenSSH 10.5p1

What's wrong?

omarchy setup security sshd rejects a valid RSA public key when it is pasted into "Paste key manually", and prints Not a valid SSH public key.

The prompt is gum input, whose default --char-limit is 400. The script does not override that limit:

key=$(gum input --prompt "Public key> " --placeholder "ssh-ed25519 AAAA... user@host")

~/.ssh/id_rsa.pub on this machine is a 3072-bit RSA key, one line, 572 characters. ssh-keygen -lf accepts the file. The same key cut to the first 400 characters fails ssh-keygen -lf /dev/stdin with /dev/stdin is not a public key file., and valid_key reports that as an invalid key. An ed25519 key is about 100 characters, so the placeholder example works. A 4096-bit RSA key and an OpenSSH certificate are longer still (a local sk-ssh-ed25519 certificate here is 917 characters).

Steps to reproduce

  1. ssh-keygen -t rsa -b 3072 -f /tmp/id_rsa and confirm wc -c /tmp/id_rsa.pub is greater than 400.
  2. Run omarchy setup security sshd.
  3. Choose "Paste key manually".
  4. Paste the single line from id_rsa.pub.

The prompt prints Not a valid SSH public key: followed by a 400-character prefix of the key. Nothing is added to ~/.ssh/authorized_keys.

Passing the same line on the command line works, because that path never goes through gum input:

omarchy setup security sshd --key="$(cat /tmp/id_rsa.pub)"

What happened here

After the rejected paste, sshd.service was already enabled and active, ~/.ssh/authorized_keys did not exist, and /etc/ssh/sshd_config.d/10-omarchy-hardening.conf had not been written, so password authentication was still on. setup_sshd and open_firewall run before the key is accepted, and disable_password_auth runs only after authorize_key succeeds. That ordering is already tracked in #8363. This report is the reason a valid key fails the paste step.

Expected

Pasting a public key that ssh-keygen -lf accepts, including a 3072-bit or 4096-bit ssh-rsa key and an OpenSSH certificate, authorizes that entire line.

View raw text
### System details

AMD Ryzen 9 7940HS, AMD Radeon 780M (Phoenix1), Omarchy 4.0.4-1, gum 2.0.0, OpenSSH 10.5p1

### What's wrong?

`omarchy setup security sshd` rejects a valid RSA public key when it is pasted into "Paste key manually", and prints `Not a valid SSH public key`.

The prompt is `gum input`, whose default `--char-limit` is 400. The script does not override that limit:

```bash
key=$(gum input --prompt "Public key> " --placeholder "ssh-ed25519 AAAA... user@host")
```

`~/.ssh/id_rsa.pub` on this machine is a 3072-bit RSA key, one line, 572 characters. `ssh-keygen -lf` accepts the file. The same key cut to the first 400 characters fails `ssh-keygen -lf /dev/stdin` with `/dev/stdin is not a public key file.`, and `valid_key` reports that as an invalid key. An ed25519 key is about 100 characters, so the placeholder example works. A 4096-bit RSA key and an OpenSSH certificate are longer still (a local `sk-ssh-ed25519` certificate here is 917 characters).

### Steps to reproduce

1. `ssh-keygen -t rsa -b 3072 -f /tmp/id_rsa` and confirm `wc -c /tmp/id_rsa.pub` is greater than 400.
2. Run `omarchy setup security sshd`.
3. Choose "Paste key manually".
4. Paste the single line from `id_rsa.pub`.

The prompt prints `Not a valid SSH public key:` followed by a 400-character prefix of the key. Nothing is added to `~/.ssh/authorized_keys`.

Passing the same line on the command line works, because that path never goes through `gum input`:

```bash
omarchy setup security sshd --key="$(cat /tmp/id_rsa.pub)"
```

### What happened here

After the rejected paste, `sshd.service` was already enabled and active, `~/.ssh/authorized_keys` did not exist, and `/etc/ssh/sshd_config.d/10-omarchy-hardening.conf` had not been written, so password authentication was still on. `setup_sshd` and `open_firewall` run before the key is accepted, and `disable_password_auth` runs only after `authorize_key` succeeds. That ordering is already tracked in #8363. This report is the reason a valid key fails the paste step.

### Expected

Pasting a public key that `ssh-keygen -lf` accepts, including a 3072-bit or 4096-bit `ssh-rsa` key and an OpenSSH certificate, authorizes that entire line.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 21:44 UTC