Record SSH-signed keychain init ops

crates/geth/tests/bootstrap.rs

@@ -691,12 +691,14 @@ fn keychain_init_and_status_use_local_keychain_log() {
         &node,
         geth_control::ControlRequest::KeychainInit {
             admin_key_path: Some(admin_key_path),
+            signing_key_path: None,
         },
     )
     .expect("init keychain");
     match response {
-        geth_control::ControlResponse::KeychainInitialized { ops } => {
+        geth_control::ControlResponse::KeychainInitialized { ops, signatures } => {
             assert_eq!(ops.len(), 2);
+            assert!(signatures.is_empty());
         }
         other => panic!("unexpected response: {other:?}"),
     }
@@ -713,6 +715,55 @@ fn keychain_init_and_status_use_local_keychain_log() {
     }
 }
 
+#[test]
+fn keychain_init_can_record_openssh_signatures() {
+    if Command::new("ssh-keygen").arg("-?").output().is_err() {
+        return;
+    }
+
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let admin_key_path = home.path().join("admin_ed25519");
+    let status = Command::new("ssh-keygen")
+        .arg("-q")
+        .arg("-t")
+        .arg("ed25519")
+        .arg("-N")
+        .arg("")
+        .arg("-f")
+        .arg(&admin_key_path)
+        .status()
+        .expect("generate admin ssh key");
+    assert!(status.success());
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::KeychainInit {
+            admin_key_path: Some(admin_key_path.with_extension("pub")),
+            signing_key_path: Some(admin_key_path),
+        },
+    )
+    .expect("init signed keychain");
+    match response {
+        geth_control::ControlResponse::KeychainInitialized { ops, signatures } => {
+            assert_eq!(ops.len(), 2);
+            assert_eq!(signatures.len(), 2);
+            assert!(signatures.iter().all(|signature| {
+                signature.namespace == "geth.keychain.v1@geth.local"
+                    && !signature.signature.is_empty()
+            }));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let signatures = geth_store::Store::open(&paths.metadata_db())
+        .expect("open store")
+        .list_keychain_signatures()
+        .expect("list signatures");
+    assert_eq!(signatures.len(), 2);
+}
+
 #[test]
 fn db_add_and_status_register_local_db_metadata() {
     let home = tempfile::tempdir().expect("tempdir");