diff --git a/kalshi/auth.py b/kalshi/auth.py index 9f09741d..f5923b85 100644 --- a/kalshi/auth.py +++ b/kalshi/auth.py @@ -119,6 +119,15 @@ def from_pem( """ if isinstance(pem_data, str): pem_data = pem_data.encode("utf-8") + if pem_data.lstrip().startswith(b"-----BEGIN OPENSSH PRIVATE KEY-----"): + raise KalshiAuthError( + "OpenSSH private-key format detected (-----BEGIN OPENSSH PRIVATE KEY-----); " + "Kalshi requires PKCS8 PEM. Convert in place with: " + "ssh-keygen -p -m PKCS8 -f " + "(you will be prompted for the current passphrase, if any, and a new one), " + "or generate a fresh PKCS8 key with: " + "openssl genpkey -algorithm RSA -out -pkeyopt rsa_keygen_bits:2048" + ) pw_bytes: bytes | None = None if password is not None: raw = password() if callable(password) else password diff --git a/tests/test_auth.py b/tests/test_auth.py index 520acf32..01902f4e 100644 --- a/tests/test_auth.py +++ b/tests/test_auth.py @@ -512,6 +512,20 @@ def test_rejects_non_rsa_key(self) -> None: with pytest.raises(KalshiAuthError, match="Expected RSA"): KalshiAuth.from_pem("key-4", ec_pem) + def test_issue_335_from_pem_openssh_format_error_message(self) -> None: + openssh_pem = ( + b"-----BEGIN OPENSSH PRIVATE KEY-----\n" + b"b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAB\n" + b"-----END OPENSSH PRIVATE KEY-----\n" + ) + with pytest.raises(KalshiAuthError, match="OpenSSH private-key format") as exc: + KalshiAuth.from_pem("key-ossh", openssh_pem) + msg = str(exc.value) + assert "ssh-keygen -p -m PKCS8 -f " in msg + # -N '' would silently strip the passphrase on encrypted OpenSSH keys — + # must not appear in the message + assert "-N ''" not in msg + class TestFromEnv: def test_missing_key_id(self, monkeypatch: pytest.MonkeyPatch) -> None: