eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record SSH-signed keychain init ops

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 16:04:20 +02:00
commit 48a83c5a26
12 changed files with 283 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/architecture.md
View file

@ -235,8 +235,11 @@ identity. Keychain operations reduce into an active view containing current
admin keys, users, devices, node records, agent bindings, and endpoint-to-node
bindings. Revoked identity subtrees are excluded from that active view. The
daemon persists local keychain init/admin-key operations and `keychain status`
reports the reduced local view. OpenSSH signature capture and verification for
those operations is still future work.
reports the reduced local view. `keychain init --signing-key <path>` writes the
canonical keychain signing payloads, runs `ssh-keygen -Y sign` with the explicit
`geth.keychain.v1@geth.local` namespace, and stores the resulting OpenSSH
signatures in local SQLite. Verification and rejection of unsigned replicated
keychain operations are still future work.
The authorization plane is `geth-auth`: resource-local signed operation logs,
grants, revocations, groups, and `auth explain`. Auth operations reduce into a

13
docs/roadmap.md
View file

@ -169,10 +169,17 @@ resource-scoped capability decisions.
- `[x]` `geth keychain init --admin-key <path>` records an admin SSH public
key fingerprint.
- `[x]` `geth keychain status` reports the reduced local keychain view.
- `[ ]` Future completion records signed `KeychainInit` operations.
- `[ ]` OpenSSH signature namespaces are explicit in the signing flow.
- `[ ]` Missing `ssh-keygen` or unavailable hardware keys produce clear
- `[x]` `geth keychain init --signing-key <path>` signs recorded keychain ops
with `ssh-keygen -Y sign`.
- `[x]` OpenSSH keychain signatures use the explicit
`geth.keychain.v1@geth.local` namespace.
- `[x]` Keychain OpenSSH signatures are stored in local SQLite.
- `[x]` Missing `ssh-keygen` or unavailable hardware keys produce clear
errors during signing.
- `[x]` Tests cover signed keychain init with a generated local OpenSSH key
when `ssh-keygen` is available.
- `[ ]` Future completion verifies signatures before accepting replicated
keychain ops.
- `[x]` Keychain operation reducer.
Acceptance criteria: