eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden signed node authorization flow

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 18:15:10 +02:00
commit 1336fa38e8
9 changed files with 382 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

11
AGENTS.md
View file

@ -119,11 +119,12 @@ Roadmap items should be actionable and checkable:
users, devices, nodes, agents, and endpoint bindings.
- The auth reducer builds a current permission view for resources, grants,
groups, and bearer access. The daemon persists local auth grant/revoke ops
and uses them for `auth explain`. Enrollment approval signs auth ops, and
`geth auth sync <node>` imports only auth ops signed by currently trusted
admin keys. `kv set --subject <principal>` enforces local KV write grants for
non-local test callers. Broader daemon-side module enforcement is still
roadmap work.
and uses them for `auth explain`. Enrollment approval, `geth node
grant/revoke-grant`, and `geth auth grant/revoke` sign auth ops through
OpenSSH when invoked through the CLI. `geth auth sync <node>` imports only
auth ops signed by currently trusted admin keys. `kv set --subject
<principal>` enforces local KV write grants for non-local test callers.
Broader daemon-side module enforcement is still roadmap work.
- The daemon persists local keychain ops and reduces them for `keychain status`.
`geth init --admin-key <pub> --signing-key <key> --node-name <name>` records
signed owner/user/device/node/agent binding operations. `keychain