RouterOS/RouterOSAssistantTests/SSHHostKeyFingerprintTests.swift

import XCTest
import NIOSSH
@testable import RouterOSAssistant

final class SSHHostKeyFingerprintTests: XCTestCase {
    /// Cross-checked against `ssh-keygen -lf` on the same throwaway test key, which reported
    /// `SHA256:Hllxv6LLoHl2XTIXGGjUYJHbPFoH2F7iMrR74C5J95g` — confirms our hex fingerprint is
    /// SHA256 over the same bytes OpenSSH hashes (the key's SSH wire-format encoding).
    func testFingerprintMatchesOpenSSHsSHA256OverTheKeyBlob() throws {
        let openSSHLine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIINj+h+IeiBNELAG6CcYbMxrdsSn8hnccQrk/XDwUa6U test"
        let key = try NIOSSHPublicKey(openSSHPublicKey: openSSHLine)

        let hexFingerprint = SSHHostKeyFingerprint.sha256(of: key)
        let expectedBase64 = "Hllxv6LLoHl2XTIXGGjUYJHbPFoH2F7iMrR74C5J95g"

        let digestBytes = hexFingerprint
            .split(separator: ":")
            .map { UInt8($0, radix: 16)! }
        let actualBase64 = Data(digestBytes).base64EncodedString()
            .replacingOccurrences(of: "=", with: "")

        XCTAssertEqual(actualBase64, expectedBase64)
    }

    func testDifferentKeysProduceDifferentFingerprints() throws {
        let keyA = try NIOSSHPublicKey(
            openSSHPublicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIINj+h+IeiBNELAG6CcYbMxrdsSn8hnccQrk/XDwUa6U test"
        )
        let keyB = try NIOSSHPublicKey(
            openSSHPublicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFrnJfhSkd4VsrAhMBxc1MS6dm2LrDMMerNh3O4zl95 test2"
        )

        XCTAssertNotEqual(SSHHostKeyFingerprint.sha256(of: keyA), SSHHostKeyFingerprint.sha256(of: keyB))
    }
}