Potential fix for code scanning alert no. 2: Use of insecure HostKeyCallback implementation

[aissat]

Potential fix for https://github.com/aissat/sysfig/security/code-scanning/2

In general, the fix is to replace gossh.InsecureIgnoreHostKey() with a HostKeyCallback that actually verifies the server’s host key against a trusted set (an allow-list). The most straightforward secure pattern with golang.org/x/crypto/ssh is to load one or more known host public keys and use ssh.FixedHostKey (for a single key) or a custom callback that checks the key against a map of allowed keys.

Within buildSSHClientConfig in internal/core/remote_deploy.go, we should introduce a small helper that loads a trusted host public key from a file path specified via an environment variable (or similar), parse it with gossh.ParsePublicKey, and then set HostKeyCallback to gossh.FixedHostKey(publicKey). This keeps the existing authentication behaviour intact (same authMethods) and only changes host verification from “accept all” to “accept only this trusted key”. Because we’re constrained to the shown snippet and should avoid large behavioural changes, using a single optional allow-listed key is the least invasive: if the env var is set and the key loads successfully, we use FixedHostKey; otherwise we can fail early with an error, rather than silently falling back to insecure behaviour.

Concretely:

• Add a new helper function in this file, above buildSSHClientConfig, e.g. func loadHostKeyCallback() (gossh.HostKeyCallback, error).
• In that helper, read a host public key file path from an environment variable like SYSFIG_SSH_HOST_KEY (name is arbitrary but descriptive; we can introduce it here), use os.ReadFile and gossh.ParsePublicKey, and return gossh.FixedHostKey(pubKey).
• Update buildSSHClientConfig to call loadHostKeyCallback; if it returns an error, propagate it; if it returns nil callback (e.g. env not set), return an error indicating that host verification is not configured.
• Replace the direct gossh.InsecureIgnoreHostKey() use on line 435 with the previously obtained hostKeyCallback.

This keeps imports unchanged (we already import gossh and os) and maintains the current authentication options while making host key verification secure and explicit.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.