eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Represent SSH distribution sync as a resource log

Browse source
This commit is contained in:
Eric Wendland 2026-05-22 16:51:30 +02:00
commit 42d7301bdb
6 changed files with 247 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

34
docs/architecture.md
View file

@ -105,16 +105,20 @@ or pass `--sign` to execute that command immediately and import the resulting
certificate into local metadata for distribution. This relies on the local
OpenSSH ecosystem, so hardware-backed keys remain mediated by `ssh-keygen` and
the host's agent/security-key flow. Certificate and key revocations are stored
as signed-list-ready records. The bootstrap can pull
certificate-flow metadata over Iroh with `geth ssh cert sync <node-id>` when the
peer grants `ssh_cert.sync` on `resource:ssh:certs`, and revocation metadata with
as signed-list-ready records. Sync materializes those records as ordered SSH
distribution log entries: certificate requests, certificate imports, and
revocations each have stable log entry IDs and timestamps, and the receiver
reduces the entries into local state after provenance and conflict checks. The
bootstrap can pull certificate-flow log entries over Iroh with
`geth ssh cert sync <node-id>` when the peer grants `ssh_cert.sync` on
`resource:ssh:certs`, and revocation log entries with
`geth ssh revocation sync <node-id>` when the peer grants `ssh_revocation.sync`
on `resource:ssh:revocations`. The daemon also runs a configurable background
live-sync tick for known peers and records per-peer high-water cursors in
`module_state`, so repeated ticks request only records at or beyond the last
`module_state`, so repeated ticks request only entries at or beyond the last
remote cursor. The default interval is 30 seconds and can be changed under
`[sync]` in `config.toml`. Boundary duplicates are harmless because records are
keyed by stable IDs and inserted with replace semantics.
keyed by stable IDs.
Before issuing per-module pulls, the daemon can request an authorized sync
status summary over the same protected Iroh control ALPN. The serving peer
validates endpoint/card binding and returns only watermarks for streams where
@ -278,16 +282,16 @@ specification text. Certificate approval normally emits the exact
the resulting OpenSSH certificate, and mark the request signed. It can also
invoke `ssh-keygen -k` to produce a binary OpenSSH KRL; serial and key-ID KRL
entries require a CA public key via `--ca-public`, matching OpenSSH behavior.
It can import geth JSONL revocation
exports and OpenSSH KRL specification source files. Binary OpenSSH KRL files are
not enumerable through OpenSSH tooling, so geth treats binary import as
unsupported and asks for JSONL or the spec source. Revocation lists are not yet
full CRDT-replicated resources, but the daemon can already pull cert-flow and
revocation metadata from authorized peers over the protected Iroh control ALPN.
Manual sync commands and the background live-sync loop share the same capability
checks and cursor state. Sync import rejects conflicting records with ids that
already exist locally instead of replacing local metadata. Local SSH certificate
and revocation metadata commands also accept an optional subject principal for
It can import geth JSONL revocation exports and OpenSSH KRL specification source
files. Binary OpenSSH KRL files are not enumerable through OpenSSH tooling, so
geth treats binary import as unsupported and asks for JSONL or the spec source.
Revocation lists are not yet full CRDT-replicated resources, but the daemon now
syncs certificate-flow and revocation state as a small ordered resource log over
the protected Iroh control ALPN. Manual sync commands and the background
live-sync loop share the same capability checks and cursor state. Sync import
rejects conflicting records with ids that already exist locally instead of
replacing local metadata. Local SSH certificate and revocation metadata commands
also accept an optional subject principal for
authorization testing: non-owner subjects must hold `ssh_cert.*` capabilities on
`resource:ssh:certs` or `ssh_revocation.*` capabilities on
`resource:ssh:revocations` before requests, approval/import/read operations, or

7
docs/roadmap.md
View file

@ -593,7 +593,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
only after authorization.
- `[x]` Future completion adds a restricted built-in geth admin shell option.
- `[~]` SSH certificate and revocation distribution.
- `[x]` SSH certificate and revocation distribution.
Acceptance criteria:
- `[x]` Cert request and imported certificate records can be pulled from an
imported peer over Iroh.
@ -607,7 +607,10 @@ Goal: add authorized stream-oriented management workflows over Iroh.
offline after sync.
- `[x]` Background live-sync uses the same protected Iroh path and cursor
state as manual sync.
- `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
- `[x]` Replace pull-only metadata sync with a resource log or CRDT model.
- `[x]` Sync responses carry ordered SSH distribution log entries derived
from signed cert requests, signed certificate imports, and signed
revocation records.
- `[x]` Conflicting records with already-known ids are rejected during import
rather than replacing local metadata.
- `[x]` Unsigned records are rejected during sync import once signed