Split public keys from auth'd_keys

michaelblyons · michaelblyons · commit a2fd67324c50 · 2025-12-21T17:09:09.000-05:00
diff --git a/README.md b/README.md
@@ -120,10 +120,6 @@ man 5 sshd_config
   (<kbd>Ctrl</kbd>+<kbd>R</kbd> or
    <kbd>Cmd</kbd>+<kbd>R</kbd>)
 
-Public keys are also associated with this syntax,
-since the *authorized_keys* format
-is basically a strict superset of them.
-
 For file format information,
 consult `man` pages on the web
 ([Linux][man-linux-authorized-keys],
diff --git a/syntax/Authorized Keys.sublime-syntax b/syntax/Authorized Keys.sublime-syntax
@@ -6,31 +6,24 @@
 name: Authorized Keys
 scope: source.authorized_keys
 version: 2
-extends: SSH Crypto.sublime-syntax
+extends: Public Key.sublime-syntax
 
 file_extensions:
   - authorized_keys
-  - pub
 
 hidden_file_extensions:
   - authorized_keys2
 
 contexts:
-  main:
-    - include: comments-number-sign
-    - match: ^
-      push:
-        - meta_scope: meta.line.authorized-key.authorized_keys
-        - include: pop-before-nl
-        - include: pop-nl
-        - include: ssh-key-types
-        - include: ssh-fingerprint-with-label
-        - include: flag-options
-        - include: value-options
-        - include: strings
-        - match: =
-          scope: keyword.operator.assignment.authorized_keys
-        - include: punctuation-comma-sequence
+
+  restrictions:
+    - meta_prepend: true
+    - include: flag-options
+    - include: value-options
+    - include: strings
+    - match: =
+      scope: keyword.operator.assignment.authorized_keys
+    - include: punctuation-comma-sequence
 
   flag-options:
     - match: (?:no-)?(?:pty|user-rc|(?:agent|port|X11)-forwarding)
diff --git a/syntax/Public Key.sublime-syntax b/syntax/Public Key.sublime-syntax
@@ -0,0 +1,26 @@
+%YAML 1.2
+---
+# https://www.sublimetext.com/docs/syntax.html
+name: Public Key
+scope: source.pubkey
+version: 2
+extends: SSH Crypto.sublime-syntax
+
+file_extensions:
+  - pub
+
+contexts:
+  main:
+    - include: comments-number-sign
+    - match: ^(?=\S)
+      push: [key, restrictions]
+
+  key:
+    - meta_scope: meta.line.key.pubkey
+    - include: pop-before-nl
+    - include: ssh-key-types
+    - include: ssh-fingerprint-with-label
+
+  restrictions:
+    - include: else-pop
+    - include: pop-before-nl
diff --git a/syntax/SSH Common.sublime-syntax b/syntax/SSH Common.sublime-syntax
@@ -259,6 +259,10 @@ contexts:
     - match: (?=\n)
       pop: 1
 
+  else-pop:
+    - match: (?=\S)
+      pop: 1
+
 ###############################################################################
 
 variables:
diff --git a/test/syntax_test_authorized_keys.authorized_keys b/test/syntax_test_authorized_keys.authorized_keys
@@ -5,23 +5,23 @@
 #^^^^^^^^ comment.line.number-sign.ssh.common
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeDxE1jPGCLo51RSF7CeJbp4raIc3xo6TBiqkz4WRWI you@example.com
-# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key
-#                                                                                               ^ - meta.line.authorized-key
+# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
+#                                                                                               ^ - meta.line.key.pubkey
 # ^^^^^^^^^ support.type.key-type
 #           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ variable.other.fingerprint
 #                                                                                ^^^^^^^^^^^^^^^ meta.annotation.identifier string.unquoted
 #                                                                                @@@@@@@@@@@@@@@ local-definition "Annotation: you@example.com"
 
 # Comments allowed at start of line
 ssh-rsa AAAAB3NzaLiPk== user@example.net   
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^ support.type.key-type
 #       ^^^^^^^^^^^^^^^ variable.other.fingerprint.ssh.common
 #                       ^^^^^^^^^^^^^^^^ meta.annotation.identifier.ssh.common string.unquoted.ssh.common
 #                                       ^^^ - meta.annotation - string
 #                       @@@@@@@@@@@@@@@@ local-definition "Annotation: user@example.net"
 from="*.sales.example.net,!pc.sales.example.net" ssh-rsa AAAAB3N9Q== john@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^ keyword.other.authorized_keys
 #   ^ keyword.operator.assignment.authorized_keys
 #    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ string.quoted.double.authorized_keys
@@ -35,7 +35,7 @@ from="*.sales.example.net,!pc.sales.example.net" ssh-rsa AAAAB3N9Q== john@exampl
 #                                                                    ^^^^^^^^^^^^^^^^ meta.annotation.identifier.ssh.common string.unquoted.ssh.common
 #                                                                    @@@@@@@@@@@@@@@@ local-definition "Annotation: john@example.net"
 command="dump /home",no-pty,no-port-forwarding ssh-rsa AAAAC3N51R== example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^ keyword.other.authorized_keys
 #      ^ keyword.operator.assignment.authorized_keys
 #       ^ string.quoted.double.authorized_keys punctuation.definition.string.begin.authorized_keys
@@ -54,7 +54,7 @@ command="dump /home",no-pty,no-port-forwarding ssh-rsa AAAAC3N51R== example.net
 #        @@@@ reference
 #                                                                   @@@@@@@@@@@ local-definition "Annotation: example.net"
 permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa AAAAB3N21S==
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^^^ keyword.other.authorized_keys
 #         ^ keyword.operator.assignment.authorized_keys
 #          ^^^^^^^^^^^^^^ string.quoted.double.authorized_keys
@@ -75,7 +75,7 @@ permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa AAAAB3N21S==
 #                                                   ^^^^^^^ support.type.key-type.ssh.crypto
 #                                                           ^^^^^^^^^^^^ variable.other.fingerprint.ssh.common
 permitlisten="localhost:8080",permitopen="localhost:22000",permitlisten="8081" ssh-rsa AAAAB3N21S==
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^^^^^ keyword.other.authorized_keys
 #           ^ keyword.operator.assignment.authorized_keys
 #            ^^^^^^^^^^^^^^^^ string.quoted.double.authorized_keys
@@ -103,7 +103,7 @@ permitlisten="localhost:8080",permitopen="localhost:22000",permitlisten="8081" s
 #                                                                              ^^^^^^^ support.type.key-type.ssh.crypto
 #                                                                                      ^^^^^^^^^^^^ variable.other.fingerprint.ssh.common
 tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAAB3N21S== jane@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^ keyword.other.authorized_keys
 #     ^ keyword.operator.assignment.authorized_keys
 #      ^^^ string.quoted.double.authorized_keys
@@ -126,7 +126,7 @@ tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAAB3N21S== jane@example.net
 #                   @@ reference
 #                                                               @@@@@@@@@@@@@@@@ local-definition "Annotation: jane@example.net"
 restrict,command="uptime" ssh-rsa AAAAB3N21S== user@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^ keyword.other.authorized_keys
 #       ^ punctuation.separator.sequence.ssh.common
 #        ^^^^^^^ keyword.other.authorized_keys
@@ -140,7 +140,7 @@ restrict,command="uptime" ssh-rsa AAAAB3N21S== user@example.net
 #                 @@@@@@ reference
 #                                              @@@@@@@@@@@@@@@@ local-definition "Annotation: user@example.net"
 restrict,pty,command="nethack" ssh-rsa AAAAB3N21S== user@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^ keyword.other.authorized_keys
 #       ^ punctuation.separator.sequence.ssh.common
 #        ^^^ keyword.other.authorized_keys
@@ -156,14 +156,14 @@ restrict,pty,command="nethack" ssh-rsa AAAAB3N21S== user@example.net
 #                     @@@@@@@ reference
 #                                                   @@@@@@@@@@@@@@@@ local-definition "Annotation: user@example.net"
 no-touch-required sk-ecdsa-sha2-nistp256@openssh.com AAAAB3N21S== user@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^^^^^^^^^^ keyword.other.authorized_keys
 #                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ support.type.key-type
 #                                                    ^^^^^^^^^^^^ variable.other.fingerprint.ssh.common
 #                                                                 ^^^^^^^^^^^^^^^^ meta.annotation.identifier.ssh.common string.unquoted.ssh.common
 #                                                                 @@@@@@@@@@@@@@@@ local-definition "Annotation: user@example.net"
 expiry-time="20190606" ssh-rsa AAAAB3N21S== user@example.net
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^^^^ keyword.other.authorized_keys
 #          ^ keyword.operator.assignment.authorized_keys
 #           ^^^^^^^^^^ string.quoted.double.authorized_keys
@@ -175,7 +175,7 @@ expiry-time="20190606" ssh-rsa AAAAB3N21S== user@example.net
 #                                           ^^^^^^^^^^^^^^^^ meta.annotation.identifier.ssh.common string.unquoted.ssh.common
 #                                           @@@@@@@@@@@@@@@@ local-definition "Annotation: user@example.net"
 environment="NAME=value",environment="NAME2=value2" ssh-rsa AAAAB3N21S==
-#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.authorized-key.authorized_keys
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
 #^^^^^^^^^^ keyword.other.authorized_keys
 #          ^ keyword.operator.assignment.authorized_keys
 #           ^^^^^^^^^^^^ string.quoted.double.authorized_keys
diff --git a/test/syntax_test_public_key.pub b/test/syntax_test_public_key.pub
@@ -0,0 +1,21 @@
+# SYNTAX TEST "Packages/SSH Config/syntax/Public Key.sublime-syntax"
+
+# Comment
+# <- comment.line.number-sign.ssh.common punctuation.definition.comment.ssh.common
+#^^^^^^^^ comment.line.number-sign.ssh.common
+
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeDxE1jPGCLo51RSF7CeJbp4raIc3xo6TBiqkz4WRWI you@example.com
+# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
+#                                                                                               ^ - meta.line.authorized-key
+# ^^^^^^^^^ support.type.key-type
+#           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ variable.other.fingerprint
+#                                                                                ^^^^^^^^^^^^^^^ meta.annotation.identifier string.unquoted
+
+# Comments allowed at start of line
+ssh-rsa AAAAB3NzaLiPk== user@example.net   
+#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ meta.line.key.pubkey
+#^^^^^^ support.type.key-type.ssh.crypto
+#       ^^^^^^^^^^^^^^^ variable.other.fingerprint.ssh.common
+#                       ^^^^^^^^^^^^^^^^ meta.annotation.identifier.ssh.common string.unquoted.ssh.common
+#                           ^ punctuation.separator.sequence.ssh.common
+#                                       ^^^ - meta.annotation - string
