eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require signed SSH metadata provenance

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:29:55 +02:00
commit 6e04e786c2
8 changed files with 414 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -34,6 +34,9 @@ payloads through `ssh-keygen -Y sign` using the
admin/YubiKey-rooted trust. `geth keychain status` reports the number of stored
keychain signatures plus how many currently verify with OpenSSH; rejecting
unsigned or invalid replicated keychain ops is still future work.
SSH certificate-flow and revocation records carry agent-key signed provenance
over canonical payloads, and sync import rejects new unsigned or invalidly
signed records.
The daemon can also install itself as a user service: