[can2049]

What this fixes

Entry::from_str split each line with split_once(' '), so it only accepted a line whose fields are separated by exactly one ASCII space. The known_hosts format separates fields by any run of whitespace, so three shapes OpenSSH reads correctly were rejected outright:

line shape	OpenSSH 8.2p1 (ssh-keygen -F)	ssh-key 0.7.0-rc.12 (before)
host\tssh-ed25519\t<base64>	matches	Err(FormatEncoding)
host ssh-ed25519 <base64>	matches	Err(FormatEncoding)
host ssh-ed25519 <base64>	matches	Err(Encoding(Length))
@revoked\thost\t...	marker recognised	Err(FormatEncoding)

Because the error is per-line, KnownHosts::new(..) yields Err for such a line, and a caller that stops at the first error never reaches the rest of the file — so one hand-edited line can make an entire known_hosts unreadable.

This matters in practice because files in the wild are hand-edited and tabs/indentation are common; I hit it reading real known_hosts files with a port-forward manager that uses this crate.

The fix

Split on char::is_whitespace and treat the optional marker as a token, instead of assuming a single space follows it.

Two details are load-bearing:

• The remainder is re-joined with single spaces before being handed to PublicKey's parser. decode_segment in public/ssh_format.rs terminates only on b' ', so ssh-ed25519\t<base64> is not parseable by PublicKey even though it is valid known_hosts. Normalising the separators at this boundary keeps PublicKey's stricter contract intact.
• marker is rebuilt as format!("@{marker_str}") from the token after the @ has been stripped, so Marker::from_str still receives the spelling it expects.

Tests

Four unit tests added in known_hosts.rs (tab-separated, indented, runs of spaces, marker followed by a tab). Each fails before the change and passes after.

Verification

• cargo test -p ssh-key — all suites pass, 0 failures
• cargo clippy -p ssh-key --all-targets -- -D warnings — no errors
• cargo fmt -p ssh-key --check — clean
• cargo check -p ssh-key --no-default-features — clean (no alloc-only APIs used)

Note on scope

I have deliberately not changed the matching semantics in this crate — HostPatterns is still returned as raw patterns and matching remains the caller's job, as documented. This PR is limited to accepting the input shapes OpenSSH accepts.

---

AI usage

AI-assisted. The defect was found and reproduced by the author, the fix and tests were AI-drafted and then reviewed, compiled, and tested locally by the author. Reproductions were validated against a real OpenSSH 8.2p1 installation (ssh-keygen -F) rather than against assumptions about the format.

[tarcieri]

A couple suggestions:

• Preserve comment whitespace as-is
• OpenSSH appears to only treat and \t as whitespace. Perhaps we could match that behavior for compatibility

Otherwise looks good, thanks!