From 485391620b99bd56d372fc1f70002d6df801b87b Mon Sep 17 00:00:00 2001
From: Sunil Mohan Adapa <sunil@medhas.org>
Date: Thu, 23 Jul 2026 14:32:30 -0700
Subject: [PATCH] ssh: Don't fail on page load when SSH host key can't be read

Closes: #2575.

Tests:

- 'touch /etc/ssh/ssh_host_dsa_key.pub'. Try to load the SSH app page. It fails.
With the patch, it succeeds. A warning message is printed about failing to read
the key with proper returncode, stdout, and stderr.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
---
 plinth/modules/ssh/__init__.py | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/plinth/modules/ssh/__init__.py b/plinth/modules/ssh/__init__.py
index bd0cfe8db..be0e7a52a 100644
--- a/plinth/modules/ssh/__init__.py
+++ b/plinth/modules/ssh/__init__.py
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 """FreedomBox app for OpenSSH server."""
 
+import logging
 import pathlib
 import re
 import subprocess
@@ -18,6 +19,8 @@ from plinth.package import Packages
 
 from . import manifest, privileged
 
+logger = logging.getLogger(__name__)
+
 _description = [
     _('A Secure Shell server uses the secure shell protocol to accept '
       'connections from remote computers. An authorized remote computer '
@@ -101,13 +104,21 @@ def get_host_keys():
                          r'.+ \((?P<algorithm>\w+)\)$')
 
     for public_key in etc_ssh.glob('*.pub'):
-        process = subprocess.run(['ssh-keygen', '-l', '-f',
-                                  str(public_key)], stdout=subprocess.PIPE,
-                                 check=True)
-        output = process.stdout.decode().strip()
-        if output:
-            match = re.match(pattern, output)
-            if match:
-                host_keys.append(match.groupdict())
+        try:
+            process = subprocess.run(
+                ['ssh-keygen', '-l', '-f',
+                 str(public_key)], stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE, check=True)
+            output = process.stdout.decode().strip()
+            if output:
+                match = re.match(pattern, output)
+                if match:
+                    host_keys.append(match.groupdict())
+        except subprocess.CalledProcessError as exception:
+            logger.warning(
+                'Unable to read SSH host public key file: %s, '
+                'returncode=%s, stdout=%s, stderr=%s', public_key,
+                exception.returncode, exception.stdout.decode(),
+                exception.stderr.decode())
 
     return host_keys