From f5b6ff72f22a6555316622148f2adf49fa886932 Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Tue, 28 Jul 2026 05:53:43 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E6=97=A0=E6=8D=9F=E4=BC=A0?=
 =?UTF-8?q?=E8=BE=93=E8=AF=81=E4=B9=A6=E5=90=8C=E6=AD=A5=20SSH=20=E5=85=AC?=
 =?UTF-8?q?=E9=92=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将包含空格与注释的 Ed25519 host key、公钥先 Base64 编码为单个 SSH 参数，远端解码后再次校验，并清理前次失败产生的无效 authorized_keys 单词行。

验证：Base64 完整往返、bash -n、ShellCheck，两次首次连接失败现场。
---
 scripts/cluster/install-certificate-sync.sh | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/scripts/cluster/install-certificate-sync.sh b/scripts/cluster/install-certificate-sync.sh
index 94616a9..1c7b041 100755
--- a/scripts/cluster/install-certificate-sync.sh
+++ b/scripts/cluster/install-certificate-sync.sh
@@ -12,6 +12,7 @@ hongkong_host_key=$(cluster_ssh "$CLUSTER_HONGKONG_HOST" \
   echo 'invalid Hong Kong SSH host key' >&2
   exit 1
 }
+hongkong_host_key_b64=$(printf '%s' "$hongkong_host_key" | base64 | tr -d '\n')
 
 public_key=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
 set -euo pipefail
@@ -26,18 +27,22 @@ REMOTE
   echo 'invalid certificate sync public key' >&2
   exit 1
 }
-cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- "$public_key" <<'REMOTE'
+public_key_b64=$(printf '%s' "$public_key" | base64 | tr -d '\n')
+cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- "$public_key_b64" <<'REMOTE'
 set -euo pipefail
-public_key=$1
+public_key=$(printf '%s' "$1" | base64 -d)
+[[ $public_key == ssh-ed25519\ * ]]
 install -d -m 0700 /root/.ssh
 touch /root/.ssh/authorized_keys
 chmod 0600 /root/.ssh/authorized_keys
+sed -i '/^ssh-ed25519$/d' /root/.ssh/authorized_keys
 grep -Fqx "$public_key" /root/.ssh/authorized_keys || printf '%s\n' "$public_key" >>/root/.ssh/authorized_keys
 REMOTE
 
-cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$hongkong_host_key" <<'REMOTE'
+cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$hongkong_host_key_b64" <<'REMOTE'
 set -euo pipefail
-hongkong_host_key=$1
+hongkong_host_key=$(printf '%s' "$1" | base64 -d)
+[[ $hongkong_host_key == ssh-ed25519\ * ]]
 install -d -m 0700 /root/.ssh
 known_hosts=/root/.ssh/known_hosts
 temporary=$(mktemp /root/.ssh/known_hosts.XXXXXX)