proxyDirect waited for both copy goroutines via wg.Wait(). When the
server closes the connection mid-session, the stdin->conn goroutine
stays blocked reading a stdin that never reaches EOF (the ssh client
holds the proxycommand's stdin open until it exits), deadlocking until
an OS-level timeout reaps the process.
Return as soon as either direction finishes instead. Extracted a
testable proxyDirectWithIO and added a regression test.
Fixes#1641
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit adds the `--console` flag to the following commands:
* `step ssh certificate`
* `step ssh config`
* `step ssh hosts`
* `step ssh login`
* `step ssh proxycommand`
Machines doing ssh client connections might want to use a JWK
provisioner to create the SSH certificate, this change allows
to automatically create the token if --provisioner and
--provisioner-password-file are passed.
OIDC provisioners use an identity function to get the principals
for a given email, so there's no need to provide principals.
Moreover, if the email and principal does not match
`step ssh proxycommand` will fail if the username does not match
the email address.
For an unknown reason this feature was removed in an unrelated
commit: smallstep/cli@2c9b200Fixessmallstep/certificates#550
For user certificates, if an email is passed as a principal, include
in the principals list the email, and the local-part. This imitates
the behavior for OIDC provisioners on other provisioners like JWK.
On `step ssh certificate` we will only include them if no principals
are passed using the `--principal` flag.
Fixes#389
