debitoor/ssh-private-key-buildpack

Add host keys to known_hosts file

jacobdr opened this issue · 0 comments

Right now, the current implementation uses StrictHostKeyChecking=no to prevent interactive warning messages about unknown keys / authenticity from preventing the build process. However, this is not ideal, as we should try to check the validity of the host's public key during SSH connection setup (e.g. during calls to npm install git+ssh:...).

We should close this issue with a PR that uses one of the approaches outlined here to facilitate better security.