Safer late.sh connection for evaluation

safer-late-eval.sh

(
  set -eu
  umask 077

  late_tmp="$(mktemp -d)"
  trap 'rm -rf -- "$late_tmp"' EXIT

  # Ephemeral key, blank comment, not added to an agent.
  ssh-keygen \
    -q \
    -t ed25519 \
    -N '' \
    -C '' \
    -f "$late_tmp/id_ed25519"

  # Replace visitor-name with a non-identifying pseudonym.
  TERM=xterm-256color ssh \
    -F /dev/null \
    -t \
    -i "$late_tmp/id_ed25519" \
    -o IdentityAgent=none \
    -o IdentitiesOnly=yes \
    -o AddKeysToAgent=no \
    -o PreferredAuthentications=publickey \
    -o PasswordAuthentication=no \
    -o KbdInteractiveAuthentication=no \
    -o HostbasedAuthentication=no \
    -o GSSAPIAuthentication=no \
    -o GSSAPIDelegateCredentials=no \
    -o ForwardAgent=no \
    -o ClearAllForwardings=yes \
    -o ForwardX11=no \
    -o Tunnel=no \
    -o ControlMaster=no \
    -o ControlPath=none \
    -o PermitLocalCommand=no \
    -o UserKnownHostsFile="$late_tmp/known_hosts" \
    -o GlobalKnownHostsFile=/dev/null \
    -o UpdateHostKeys=no \
    -o StrictHostKeyChecking=ask \
    visitor-name@late.sh
)