fix: harden SSH trust and dependency security

internal/sshclient/sshclient.go

@@ -596,12 +596,7 @@ func (c *Client) connectViaJumpHosts(sc models.SSHConfig, finalConfig *ssh.Clien
 			jumpAuth = append(jumpAuth, ssh.PublicKeys(signer))
 		}
 
-		jumpConfig := &ssh.ClientConfig{
-			User:            jump.Username,
-			Auth:            jumpAuth,
-			HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-			Timeout:         finalConfig.Timeout,
-		}
+		jumpConfig := jumpHostClientConfig(jump, jumpAuth, finalConfig)
 
 		if currentClient == nil {
 			client, err := ssh.Dial("tcp", jumpAddr, jumpConfig)
@@ -648,6 +643,15 @@ func (c *Client) connectViaJumpHosts(sc models.SSHConfig, finalConfig *ssh.Clien
 	return ssh.NewClient(ncc, chans, reqs), nil
 }
 
+func jumpHostClientConfig(jump models.JumpHost, auth []ssh.AuthMethod, finalConfig *ssh.ClientConfig) *ssh.ClientConfig {
+	return &ssh.ClientConfig{
+		User:            jump.Username,
+		Auth:            auth,
+		HostKeyCallback: finalConfig.HostKeyCallback,
+		Timeout:         finalConfig.Timeout,
+	}
+}
+
 // parsePrivateKey loads and parses an SSH private key file. If the key is
 // encrypted and getPassphrase is provided, it will attempt decryption.
 func (c *Client) parsePrivateKey(path string, getPassphrase func() (string, error)) (ssh.Signer, error) {

internal/sshclient/sshclient_test.go

@@ -0,0 +1,49 @@
+package sshclient
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/andydixon/nexus/internal/models"
+	"golang.org/x/crypto/ssh"
+)
+
+func TestJumpHostClientConfigUsesFinalHostKeyCallback(t *testing.T) {
+	called := false
+	hostKeyCallback := func(hostname string, _ net.Addr, _ ssh.PublicKey) error {
+		called = true
+		if hostname != "jump.example:2222" {
+			t.Fatalf("hostname = %q, want jump.example:2222", hostname)
+		}
+		return nil
+	}
+
+	finalConfig := &ssh.ClientConfig{
+		HostKeyCallback: hostKeyCallback,
+		Timeout:         12 * time.Second,
+	}
+	jump := models.JumpHost{
+		Host:     "jump.example",
+		Port:     2222,
+		Username: "alice",
+	}
+
+	got := jumpHostClientConfig(jump, nil, finalConfig)
+	if got.User != jump.Username {
+		t.Fatalf("User = %q, want %q", got.User, jump.Username)
+	}
+	if got.Timeout != finalConfig.Timeout {
+		t.Fatalf("Timeout = %s, want %s", got.Timeout, finalConfig.Timeout)
+	}
+	if got.HostKeyCallback == nil {
+		t.Fatal("HostKeyCallback is nil")
+	}
+
+	if err := got.HostKeyCallback("jump.example:2222", nil, nil); err != nil {
+		t.Fatalf("HostKeyCallback() error = %v", err)
+	}
+	if !called {
+		t.Fatal("final host key callback was not used")
+	}
+}