Passing `-i` options still creating temporary ssh and prompt the password

### Prerequisites - [x] I have updated to the latest version using `nix run --refresh github:nix-community/nixos-anywhere` - [x] I have reproduced the issue with the `--debug` flag - [x] I have searched existing issues to make sure this isn't a duplicate ### Bug Description I'd like to use `-i` in order to prevent from creating temporary SSH. However it still prompting the password to the temporary SSH. ### Steps to Reproduce 1. Deploy to Vultr 2. Run `nix run --refresh github:nix-community/nixos-anywhere -- --flake .#main -i /Users/myuser/.ssh/mykey --target-host root@<my-ip> --debug` ### Debug Logs ```shell warning: Ignoring the client-specified setting 'narinfo-cache-negative-ttl', because it is a restricted setting and you are not a trusted user warning: Ignoring the client-specified setting 'narinfo-cache-positive-ttl', because it is a restricted setting and you are not a trusted user warning: Ignoring the client-specified setting 'narinfo-cache-negative-ttl', because it is a restricted setting and you are not a trusted user warning: Ignoring the client-specified setting 'narinfo-cache-positive-ttl', because it is a restricted setting and you are not a trusted user + shift + [[ 0 -gt 0 ]] + [[ '' != '' ]] + diskoMode=disko + diskoAttr=diskoScript + [[ y == n ]] + [[ y == y ]] + nixOptions+=("-L") + [[ y == y ]] + nixCopyOptions+=("--substitute-on-destination") + [[ n == n ]] + [[ -z root@<my-ip> ]] + [[ auto == local ]] + [[ -n .#main ]] + [[ .#main =~ ^(.*)#([^#"]*)$ ]] + flake=. + flakeAttr=main + [[ -z main ]] + [[ main != nixosConfigurations.* ]] + flakeAttr='nixosConfigurations."main".config' + [[ n == y ]] + [[ auto == auto ]] + checkBuildLocally + local system extraPlatforms machineSystem ++ nix --extra-experimental-features 'nix-command flakes' config show system + system=aarch64-darwin ++ nix --extra-experimental-features 'nix-command flakes' config show extra-platforms + extraPlatforms=x86_64-darwin + [[ 0 -gt 0 ]] + [[ -n '' ]] ++ nix --extra-experimental-features 'nix-command flakes' eval --raw '.#nixosConfigurations."main".config.pkgs.system' ++ echo unknown + machineSystem=unknown + [[ unknown == unknown ]] + buildOn=auto + return + [[ -n . ]] + [[ auto == local ]] + [[ -n '' ]] ++ ssh -o IdentitiesOnly=yes -i /var/folders/2q/ylpwpzj560n0bjwcs0m409340000gq/T/tmp.dgQf6ZMyZ5/nixos-anywhere -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -G root@<my-ip> Warning: Identity file /var/folders/2q/ylpwpzj560n0bjwcs0m409340000gq/T/tmp.dgQf6ZMyZ5/nixos-anywhere not accessible: No such file or directory. + sshSettings=$'host <my-ip>\nuser root\nhostname <my-ip>\nport 22\naddressfamily any\nbatchmode no\ncanonicalizefallbacklocal yes\ncanonicalizehostname false\ncheckhostip no\ncompression no\ncontrolmaster false\nenablesshkeysign no\nclearallforwardings no\nexitonforwardfailure no\nfingerprinthash SHA256\nforwardx11 no\nforwardx11trusted no\ngatewayports no\ngssapiauthentication no\ngssapidelegatecredentials no\nhashknownhosts no\nhostbasedauthentication no\nidentitiesonly yes\nkbdinteractiveauthentication yes\nnohostauthenticationforlocalhost no\nnohostauthenticationforproxycommand no\npasswordauthentication yes\npermitlocalcommand no\nproxyusefdpass no\npubkeyauthentication true\nrequesttty auto\nsessiontype default\nstdinnull no\nforkafterauthentication no\nstreamlocalbindunlink no\nstricthostkeychecking false\ntcpkeepalive yes\ntunnel false\nverifyhostkeydns false\nvisualhostkey no\nupdatehostkeys false\nenableescapecommandline no\napplemultipath no\ncanonicalizemaxdots 1\nconnectionattempts 1\nforwardx11timeout 1200\nnumberofpasswordprompts 3\nserveralivecountmax 3\nserveraliveinterval 0\nrequiredrsasize 1024\nobscurekeystroketiming yes\nciphers chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\nhostkeyalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nhostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nkexalgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256\ncasignaturealgorithms ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nloglevel INFO\nmacs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1\nsecuritykeyprovider $SSH_SK_PROVIDER\npubkeyacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nxauthlocation /usr/X11R6/bin/xauth\nidentityfile ~/.ssh/id_rsa\nidentityfile ~/.ssh/id_ecdsa\nidentityfile ~/.ssh/id_ecdsa_sk\nidentityfile ~/.ssh/id_ed25519\nidentityfile ~/.ssh/id_ed25519_sk\nidentityfile ~/.ssh/id_xmss\ncanonicaldomains none\nglobalknownhostsfile /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2\nuserknownhostsfile /dev/null\nsendenv LANG\nsendenv LC_*\nlogverbose none\nchanneltimeout none\npermitremoteopen any\naddkeystoagent false\nforwardagent no\nconnecttimeout none\ntunneldevice any:any\ncanonicalizePermittedcnames none\ncontrolpersist no\nescapechar ~\nipqos af21 cs1\nrekeylimit 0 0\nstreamlocalbindmask 0177\nsyslogfacility USER' ++ echo $'host <my-ip>\nuser root\nhostname <my-ip>\nport 22\naddressfamily any\nbatchmode no\ncanonicalizefallbacklocal yes\ncanonicalizehostname false\ncheckhostip no\ncompression no\ncontrolmaster false\nenablesshkeysign no\nclearallforwardings no\nexitonforwardfailure no\nfingerprinthash SHA256\nforwardx11 no\nforwardx11trusted no\ngatewayports no\ngssapiauthentication no\ngssapidelegatecredentials no\nhashknownhosts no\nhostbasedauthentication no\nidentitiesonly yes\nkbdinteractiveauthentication yes\nnohostauthenticationforlocalhost no\nnohostauthenticationforproxycommand no\npasswordauthentication yes\npermitlocalcommand no\nproxyusefdpass no\npubkeyauthentication true\nrequesttty auto\nsessiontype default\nstdinnull no\nforkafterauthentication no\nstreamlocalbindunlink no\nstricthostkeychecking false\ntcpkeepalive yes\ntunnel false\nverifyhostkeydns false\nvisualhostkey no\nupdatehostkeys false\nenableescapecommandline no\napplemultipath no\ncanonicalizemaxdots 1\nconnectionattempts 1\nforwardx11timeout 1200\nnumberofpasswordprompts 3\nserveralivecountmax 3\nserveraliveinterval 0\nrequiredrsasize 1024\nobscurekeystroketiming yes\nciphers chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\nhostkeyalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nhostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nkexalgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256\ncasignaturealgorithms ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nloglevel INFO\nmacs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1\nsecuritykeyprovider $SSH_SK_PROVIDER\npubkeyacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256\nxauthlocation /usr/X11R6/bin/xauth\nidentityfile ~/.ssh/id_rsa\nidentityfile ~/.ssh/id_ecdsa\nidentityfile ~/.ssh/id_ecdsa_sk\nidentityfile ~/.ssh/id_ed25519\nidentityfile ~/.ssh/id_ed25519_sk\nidentityfile ~/.ssh/id_xmss\ncanonicaldomains none\nglobalknownhostsfile /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2\nuserknownhostsfile /dev/null\nsendenv LANG\nsendenv LC_*\nlogverbose none\nchanneltimeout none\npermitremoteopen any\naddkeystoagent false\nforwardagent no\nconnecttimeout none\ntunneldevice any:any\ncanonicalizePermittedcnames none\ncontrolpersist no\nescapechar ~\nipqos af21 cs1\nrekeylimit 0 0\nstreamlocalbindmask 0177\nsyslogfacility USER' ++ awk '/^user / { print $2 }' + sshUser=root + sshHost=<my-ip> + [[ 1 != 1 ]] + uploadSshKey + local sshCopyHome=/Users/myuser + mkdir -p /Users/myuser/.ssh/ + [[ -n /Users/myuser/.ssh/mykey ]] + cp /Users/myuser/.ssh/mykey /var/folders/2q/ylpwpzj560n0bjwcs0m409340000gq/T/tmp.dgQf6ZMyZ5/nixos-anywhere + ssh-keygen -y -f /var/folders/2q/ylpwpzj560n0bjwcs0m409340000gq/T/tmp.dgQf6ZMyZ5/nixos-anywhere Enter passphrase for "/var/folders/2q/ylpwpzj560n0bjwcs0m409340000gq/T/tmp.dgQf6ZMyZ5/nixos-anywhere": ``` ### Command Used nix run --refresh github:nix-community/nixos-anywhere -- --flake .#main -i /Users/myuser/.ssh/mykey --target-host root@1<my-ip> --debug ### Target System Cloud server (AWS, DigitalOcean, etc.) ### NixOS Version unstable ### Environment Information - Host OS: macOS Tahoe 26.2 - Nix version: nix (Lix, like Nix) 2.93.3 - Target architecture: x86 ### Configuration Files ```nix I don't think its touching NixOS configuration yet as it failed to connect to the machine. ``` ### Additional Context _No response_