eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

specify selective disclosure and anchor policy
Some checks failed
CI / fmt, clippy, docs (push) Failing after 5s
Details
CI / test (ubuntu-latest) (push) Failing after 5s
Details
CI / iroh integration smoke tests (push) Failing after 5s
Details
CodeQL / Analyze Rust (push) Failing after 4s
Details
Security / RustSec cargo-audit (push) Failing after 5s
Details
CI / test (macos-latest) (push) Has been cancelled
Details
CI / test (windows-latest) (push) Has been cancelled
Details

Browse source
This commit is contained in:
Eric Wendland 2026-07-18 22:05:57 +02:00
commit 76eb785ee2
11 changed files with 834 additions and 387 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -646,9 +646,12 @@ validated its own chain. There is no compatibility mode for that workflow.
The replacement is the small, transport-neutral
[`SSHSIGCHAIN v1`](docs/sshsigchain.md) specification. It starts from an
operator-pinned chain ID, OpenSSH root public key, profile, and namespace;
records are fixed-byte SSHSIG payloads linked by sequence and digest. Geth
already provides a verifier for independently produced JSONL transport files:
operator-pinned chain ID, OpenSSH root public key, and namespace. Parent hashes
define order without a redundant sequence counter. Every record carries a
public authority transition for devices, keys, causal revocation, scoped
permissions, and anchor policy, plus optional profile commitments whose payloads
can be selectively disclosed. Geth already provides a verifier for independently
produced JSONL transport files:
```sh
geth keychain verify-sigchain \
@ -657,10 +660,13 @@ geth keychain verify-sigchain \
--root-key ~/.ssh/geth-root.pub
```
SSHSIGCHAIN local record storage, signing, publication, import, and accepted-head
persistence remain follow-up work. Until they exist, do not substitute an
unpinned checkpoint or a local operation-log view for the SSHSIGCHAIN trust
tuple.
The verifier reports active authority devices/keys, disclosed and incomplete
profiles, the head digest, and current attester/backend anchor thresholds.
SSHSIGCHAIN local
record storage, signing, publication, import, accepted-head persistence, and
concrete anchor adapters remain follow-up work. Until they exist, do not
substitute an unpinned checkpoint or a local operation-log view for the
SSHSIGCHAIN trust tuple.
Signing is mediated by OpenSSH. `--signing-key` may point at a private key file,
a FIDO/YubiKey OpenSSH security-key stub, or a public key whose private half is