Fix manhole auth logic: or → and in Twisted version check

[Copilot]

The condition gating password-based auth used or, causing it to bypass public key auth whenever the Twisted version was ≥ 16.1.0 — regardless of whether a public key was configured.

Change

• lib/carbon/manhole.py lines 37–38: Replace or with and so that in-memory password auth is only selected when both MANHOLE_PUBLIC_KEY is unset and the Twisted version supports it.

# Before
if (settings.MANHOLE_PUBLIC_KEY == 'None' or
        twisted.version >= versions.Version('twisted', 16, 1, 0)):

# After
if (settings.MANHOLE_PUBLIC_KEY == 'None' and
        twisted.version >= versions.Version('twisted', 16, 1, 0)):

With the old logic, a configured public key was silently ignored on Twisted ≥ 16.1.0, falling back to unauthenticated password login.

[Copilot]

Pull request overview

Fixes the manhole authentication gating logic so that password-based auth is only selected when both no public key is configured and the running Twisted version supports that auth path, preventing configured public keys from being ignored on Twisted ≥ 16.1.0.

Changes:

• Update the manhole auth selection condition from or to and to avoid bypassing public key auth on newer Twisted.

Comments suppressed due to low confidence (2)

lib/carbon/manhole.py:42

• MANHOLE_PUBLIC_KEY defaults to an empty string (see carbon.conf.defaults), but this condition only treats the literal string 'None' as “unset”. If ENABLE_MANHOLE is enabled without setting MANHOLE_PUBLIC_KEY, this falls into the public-key branch and attempts keys.Key.fromString(data=b''), which will raise and prevent startup. Consider treating empty/whitespace as unset (and/or normalizing 'None') and raising a CarbonConfigException with a clear message when no key is provided but public-key auth is required (e.g., on older Twisted).

  if (settings.MANHOLE_PUBLIC_KEY == 'None' and
          twisted.version >= versions.Version('twisted', 16, 1, 0)):
    credChecker = checkers.InMemoryUsernamePasswordDatabaseDontUse()
    credChecker.addUser(settings.MANHOLE_USER.encode('utf-8'),
                        ''.encode('utf-8'))
  else:

lib/carbon/manhole.py:41

• The password-auth branch registers an in-memory user with an empty password (addUser(..., b'')). Even with the corrected condition, this effectively enables passwordless SSH login for MANHOLE_USER whenever this branch is selected. Please require an explicit non-empty password (e.g., add a config setting) or enforce that the manhole only binds to loopback when password auth is enabled.

    credChecker = checkers.InMemoryUsernamePasswordDatabaseDontUse()
    credChecker.addUser(settings.MANHOLE_USER.encode('utf-8'),
                        ''.encode('utf-8'))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.