eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

make sshsigchain the only portable sigchain format

Browse source
This commit is contained in:
Eric Wendland 2026-07-18 21:00:06 +02:00
commit 73500e1944
15 changed files with 812 additions and 1603 deletions
Download patch file Download diff file Expand all files Collapse all files

45
docs/architecture.md
View file

@ -451,23 +451,20 @@ admin-revoke` operations; `AdminKeyAdd` carries the public key material needed
to reconstruct an OpenSSH `allowed_signers` view. `geth keychain verify` replays
the log against the previously accepted admin-key view, mirroring the `git-skm`
pattern of verifying key-registry changes from a prior trusted state. The
transport-neutral replay rules, application-specific signature namespaces,
allowed-signers projection, and JSONL sigchain helpers live in `geth-keychain`
so other applications can reuse the same identity-log model without depending
on the daemon, SQLite, Iroh, or local control. The CLI can export the same
reduced key registry as OpenSSH `allowed_signers` or as appendable JSONL
sigchain data for website publication. It can also sign and verify arbitrary
snapshots, such as externally managed `authorized_keys`, with an active
keychain signer under an explicit OpenSSH namespace. `geth keychain
publish-bundle` writes a website-ready bundle for
`https://example.com/.well-known/sshsigchain/`, including `allowed_signers`,
`geth.sigchain.jsonl`, a signed checkpoint, and optional signed snapshots.
`geth keychain fetch --import` verifies the checkpoint and records the last
accepted checkpoint per retrieval source URL to reject older bundles. The
retrieval source may be a local mirror; the checkpoint still carries the signed
advertised publication base URL, and explicit checkpoint verification can pin it. `geth keychain
explain` and `explain-signer` provide basic auditability for why a keychain
operation or signer is trusted. `geth keychain sync <node>` pulls keychain
local replay rules, application-specific signature namespaces, and
allowed-signers projection live in `geth-keychain`. The CLI can export the
reduced key registry as OpenSSH `allowed_signers` and can sign and verify
arbitrary snapshots, such as externally managed `authorized_keys`, with an
active keychain signer under an explicit OpenSSH namespace. The prior static
JSONL export, publication, import, checkpoint, and fetch commands were removed:
their downloaded `allowed_signers` projection could bootstrap its own trust.
`geth keychain verify-sigchain --in <file> --chain-id <id> --root-key
<public-key>` is the inspection entry point for the standalone SSHSIGCHAIN
format, verified against a pin supplied by the operator. SSHSIGCHAIN signing,
persistent heads, publication, and import remain follow-up work rather than a
compatibility fallback. `geth keychain explain`
and `explain-signer` provide basic auditability for why a keychain operation or
signer is trusted. `geth keychain sync <node>` pulls keychain
operations and signatures from an imported peer over Iroh and imports only
operations with a valid OpenSSH signature from a currently trusted admin key
over the canonical payload. See `docs/sigchain-keychain.md` for the detailed
@ -479,16 +476,16 @@ identities are immutable in local storage. An attempted re-import with an
existing identity but different bytes is rejected before it can replace local
trust state; idempotent repeats leave the original bytes unchanged.
The replacement static-publication design is specified in
[`sshsigchain-v2.md`](sshsigchain-v2.md). Its reusable core has an explicit
The portable signed-chain design is specified in
[`sshsigchain.md`](sshsigchain.md). Its reusable core has an explicit
out-of-band `(chain ID, profile, SSHSIG namespace, root public key)` trust
tuple, a strict sequence plus hash link, bounded fields, and a profile reducer
that authorizes each record from only the causally preceding state. Geth's
`geth.keychain.v2` profile rejects timestamp validity windows as authorization
policy and treats key revocation as a causal record. The legacy static JSONL
commands have not yet been migrated to this core and are not a safe bootstrap
for new trust; Iroh keychain sync remains the supported replicated path while
the explicit v2 command workflow is completed.
`geth.keychain.sshsigchain.v1` profile rejects timestamp validity windows as authorization
policy and treats key revocation as a causal record. The prior test-only static
workflow was removed rather than migrated. Iroh keychain sync remains the
current replicated local operation-log path while explicit SSHSIGCHAIN
production and import workflows are completed.
New devices can use the node enrollment flow instead of hand-editing keychain
state. `geth node enroll join` explicitly imports an owner admin public key as