eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden signed node authorization flow

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 18:15:10 +02:00
commit 1336fa38e8
9 changed files with 382 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/adr/0016-owner-node-enrollment.md
View file

@ -24,7 +24,11 @@ OpenSSH using the `geth.keychain.v1@geth.local` namespace.
The active device list is the reduced keychain view, surfaced through `geth node
list`. Renames and revocations are additional keychain operations. Resource
permissions remain resource-scoped auth operations and can be managed with
`geth node grant` and `geth node revoke-grant`.
`geth node grant` and `geth node revoke-grant`; the CLI requires an admin
`--signing-key` so these mutations replicate as signed auth operations.
Endpoint rotation is modeled with signed `NodeEndpointAdd` and
`NodeEndpointRevoke` operations exposed as `geth node endpoint-add` and
`geth node endpoint-revoke`.
New nodes can request enrollment with `geth node enroll request`. The request is
signed by the requesting agent key and includes the stable node ID, agent ID,
@ -52,6 +56,5 @@ add or revoke endpoint bindings without replacing the node identity.
The current sync model is a pull-based signed operation log. It is not yet a
Keyhive-style convergent authority and does not implement advanced group
cryptography. Manual grant/revoke commands still need the same signing
requirement as enrollment approval before this becomes a complete authorization
workflow.
cryptography. Conflict resolution for concurrent signed operations is still the
deterministic reducer, not a richer collaborative authority protocol.