auth: improve from_pem error message for OpenSSH-format keys

kalshi/auth.py

@@ -119,6 +119,15 @@ def from_pem(
         """
         if isinstance(pem_data, str):
             pem_data = pem_data.encode("utf-8")
+        if pem_data.lstrip().startswith(b"-----BEGIN OPENSSH PRIVATE KEY-----"):
+            raise KalshiAuthError(
+                "OpenSSH private-key format detected (-----BEGIN OPENSSH PRIVATE KEY-----); "
+                "Kalshi requires PKCS8 PEM. Convert in place with: "
+                "ssh-keygen -p -m PKCS8 -f <path> "
+                "(you will be prompted for the current passphrase, if any, and a new one), "
+                "or generate a fresh PKCS8 key with: "
+                "openssl genpkey -algorithm RSA -out <path> -pkeyopt rsa_keygen_bits:2048"
+            )
         pw_bytes: bytes | None = None
         if password is not None:
             raw = password() if callable(password) else password

tests/test_auth.py

@@ -512,6 +512,20 @@ def test_rejects_non_rsa_key(self) -> None:
         with pytest.raises(KalshiAuthError, match="Expected RSA"):
             KalshiAuth.from_pem("key-4", ec_pem)
 
+    def test_issue_335_from_pem_openssh_format_error_message(self) -> None:
+        openssh_pem = (
+            b"-----BEGIN OPENSSH PRIVATE KEY-----\n"
+            b"b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAB\n"
+            b"-----END OPENSSH PRIVATE KEY-----\n"
+        )
+        with pytest.raises(KalshiAuthError, match="OpenSSH private-key format") as exc:
+            KalshiAuth.from_pem("key-ossh", openssh_pem)
+        msg = str(exc.value)
+        assert "ssh-keygen -p -m PKCS8 -f <path>" in msg
+        # -N '' would silently strip the passphrase on encrypted OpenSSH keys —
+        # must not appear in the message
+        assert "-N ''" not in msg
+
 
 class TestFromEnv:
     def test_missing_key_id(self, monkeypatch: pytest.MonkeyPatch) -> None: